resolve conflicts

697 files changed, 44294 insertions, 15897 deletions

diff --git a/src/lib/libssl/LICENSE b/src/lib/libssl/LICENSE
index e6afecc724..a2c4adcbe6 100644
--- a/src/lib/libssl/LICENSE
+++ b/src/lib/libssl/LICENSE
@@ -12,7 +12,7 @@
   ---------------
 
 /* ====================================================================
- * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2008 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/src/lib/libssl/bio_ssl.c b/src/lib/libssl/bio_ssl.c
index d683ee43e1..420deb7fc9 100644
--- a/src/lib/libssl/bio_ssl.c
+++ b/src/lib/libssl/bio_ssl.c
@@ -456,7 +456,7 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
         case BIO_CTRL_SET_CALLBACK:
                 {
 #if 0 /* FIXME: Should this be used?  -- Richard Levitte */
-                BIOerr(SSL_F_SSL_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                SSLerr(SSL_F_SSL_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 ret = -1;
 #else
                 ret=0;
@@ -465,9 +465,9 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
                 break;
         case BIO_CTRL_GET_CALLBACK:
                 {
-                void (**fptr)();
+                void (**fptr)(const SSL *xssl,int type,int val);
 
-                fptr=(void (**)())ptr;
+                fptr=(void (**)(const SSL *xssl,int type,int val))ptr;
                 *fptr=SSL_get_info_callback(ssl);
                 }
                 break;
diff --git a/src/lib/libssl/doc/openssl.cnf b/src/lib/libssl/doc/openssl.cnf
index 4c1d595b0a..9e59020c17 100644
--- a/src/lib/libssl/doc/openssl.cnf
+++ b/src/lib/libssl/doc/openssl.cnf
@@ -44,8 +44,8 @@ new_certs_dir	= $dir/newcerts		# default place for new certs.
 
 certificate     = $dir/cacert.pem       # The CA certificate
 serial          = $dir/serial           # The current serial number
-#crlnumber      = $dir/crlnumber        # the current crl number must be
-                                        # commented out to leave a V1 CRL
+crlnumber       = $dir/crlnumber        # the current crl number
+                                        # must be commented out to leave a V1 CRL
 crl             = $dir/crl.pem          # The current CRL
 private_key     = $dir/private/cakey.pem# The private key
 RANDFILE        = $dir/private/.rand    # private random number file
@@ -67,7 +67,7 @@ cert_opt 	= ca_default		# Certificate field options
 
 default_days    = 365                   # how long to certify for
 default_crl_days= 30                    # how long before next CRL
-default_md      = md5                   # which md to use.
+default_md      = sha1                  # which md to use.
 preserve        = no                    # keep passed DN ordering
 
 # A few difference way of specifying how similar the request should look
@@ -188,7 +188,7 @@ nsComment			= "OpenSSL Generated Certificate"
 
 # PKIX recommendations harmless if included in all certificates.
 subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer:always
+authorityKeyIdentifier=keyid,issuer
 
 # This stuff is for subjectAltName and issuerAltname.
 # Import the email address.
diff --git a/src/lib/libssl/doc/openssl.txt b/src/lib/libssl/doc/openssl.txt
index 432a17b66c..f8817b0a71 100644
--- a/src/lib/libssl/doc/openssl.txt
+++ b/src/lib/libssl/doc/openssl.txt
@@ -154,8 +154,22 @@ for example contain data in multiple sections. The correct syntax to
 use is defined by the extension code itself: check out the certificate
 policies extension for an example.
 
-In addition it is also possible to use the word DER to include arbitrary
-data in any extension.
+There are two ways to encode arbitrary extensions.
+
+The first way is to use the word ASN1 followed by the extension content
+using the same syntax as ASN1_generate_nconf(). For example:
+
+1.2.3.4=critical,ASN1:UTF8String:Some random data
+
+1.2.3.4=ASN1:SEQUENCE:seq_sect
+
+[seq_sect]
+
+field1 = UTF8:field1
+field2 = UTF8:field2
+
+It is also possible to use the word DER to include arbitrary data in any
+extension.
 
 1.2.3.4=critical,DER:01:02:03:04
 1.2.3.4=DER:01020304
@@ -336,16 +350,21 @@ Subject Alternative Name.
 The subject alternative name extension allows various literal values to be
 included in the configuration file. These include "email" (an email address)
 "URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a
-registered ID: OBJECT IDENTIFIER) and IP (and IP address).
+registered ID: OBJECT IDENTIFIER), IP (and IP address) and otherName.
 
 Also the email option include a special 'copy' value. This will automatically
 include and email addresses contained in the certificate subject name in
 the extension.
 
+otherName can include arbitrary data associated with an OID: the value
+should be the OID followed by a semicolon and the content in standard
+ASN1_generate_nconf() format.
+
 Examples:
 
 subjectAltName=email:copy,email:my@other.address,URI:http://my.url.here/
 subjectAltName=email:my@other.address,RID:1.2.3.4
+subjectAltName=otherName:1.2.3.4;UTF8:some other identifier
 
 Issuer Alternative Name.
 
@@ -759,7 +778,7 @@ called.
 
 The X509V3_EXT_METHOD structure is described below.
 
-strut {
+struct {
 int ext_nid;
 int ext_flags;
 X509V3_EXT_NEW ext_new;
diff --git a/src/lib/libssl/doc/standards.txt b/src/lib/libssl/doc/standards.txt
index f6675b574b..a5ce778f8e 100644
--- a/src/lib/libssl/doc/standards.txt
+++ b/src/lib/libssl/doc/standards.txt
@@ -88,10 +88,26 @@ PKCS#12: Personal Information Exchange Syntax Standard, version 1.0.
      (Format: TXT=143173 bytes) (Obsoletes RFC2437) (Status:           
      INFORMATIONAL)                                         
 
+3713 A Description of the Camellia Encryption Algorithm. M. Matsui,
+     J. Nakajima, S. Moriai. April 2004. (Format: TXT=25031 bytes)
+     (Status: INFORMATIONAL)
+
 3820 Internet X.509 Public Key Infrastructure (PKI) Proxy Certificate
      Profile. S. Tuecke, V. Welch, D. Engert, L. Pearlman, M. Thompson.
      June 2004. (Format: TXT=86374 bytes) (Status: PROPOSED STANDARD)
 
+4132 Addition of Camellia Cipher Suites to Transport Layer Security
+     (TLS). S. Moriai, A. Kato, M. Kanda. July 2005. (Format: TXT=13590
+     bytes) (Status: PROPOSED STANDARD)
+
+4162 Addition of SEED Cipher Suites to Transport Layer Security (TLS).
+     H.J. Lee, J.H. Yoon, J.I. Lee. August 2005. (Format: TXT=10578 bytes)
+     (Status: PROPOSED STANDARD)
+
+4269 The SEED Encryption Algorithm. H.J. Lee, S.J. Lee, J.H. Yoon,
+     D.H. Cheon, J.I. Lee. December 2005. (Format: TXT=34390 bytes)
+     (Obsoletes RFC4009) (Status: INFORMATIONAL)
+
 
 Related:
 --------
@@ -250,7 +266,11 @@ STARTTLS documents.
      Protocol. A. Jungmaier, E. Rescorla, M. Tuexen. December 2002.
      (Format: TXT=16333 bytes) (Status: PROPOSED STANDARD)
 
-  "Securing FTP with TLS", 01/27/2000, <draft-murray-auth-ftp-ssl-05.txt>  
+3657 Use of the Camellia Encryption Algorithm in Cryptographic 
+     Message Syntax (CMS). S. Moriai, A. Kato. January 2004.
+     (Format: TXT=26282 bytes) (Status: PROPOSED STANDARD)
+
+"Securing FTP with TLS", 01/27/2000, <draft-murray-auth-ftp-ssl-05.txt>  
  
 
 To be implemented:
diff --git a/src/lib/libssl/s23_clnt.c b/src/lib/libssl/s23_clnt.c
index 86356731ea..c45a8e0a04 100644
--- a/src/lib/libssl/s23_clnt.c
+++ b/src/lib/libssl/s23_clnt.c
@@ -80,28 +80,10 @@ static SSL_METHOD *ssl23_get_client_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *SSLv23_client_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv23_client_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&SSLv23_client_data,
-                                (char *)sslv23_base_method(),sizeof(SSL_METHOD));
-                        SSLv23_client_data.ssl_connect=ssl23_connect;
-                        SSLv23_client_data.get_ssl_method=ssl23_get_client_method;
-                        init=0;
-                        }
-
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv23_client_data);
-        }
+IMPLEMENT_ssl23_meth_func(SSLv23_client_method,
+                        ssl_undefined_function,
+                        ssl23_connect,
+                        ssl23_get_client_method)
 
 int ssl23_connect(SSL *s)
         {
@@ -241,6 +223,17 @@ static int ssl23_client_hello(SSL *s)
                 {
                 version = SSL2_VERSION;
                 }
+#ifndef OPENSSL_NO_TLSEXT 
+        if (version != SSL2_VERSION)
+                {
+                /* have to disable SSL 2.0 compatibility if we need TLS extensions */
+
+                if (s->tlsext_hostname != NULL)
+                        ssl2_compat = 0;
+                if (s->tlsext_status_type != -1)
+                        ssl2_compat = 0;
+                }
+#endif
 
         buf=(unsigned char *)s->init_buf->data;
         if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
@@ -254,7 +247,7 @@ static int ssl23_client_hello(SSL *s)
 #endif
 
                 p=s->s3->client_random;
-                Time=(unsigned long)time(NULL);                 /* Time */
+                Time=(unsigned long)time(NULL);         /* Time */
                 l2n(Time,p);
                 if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
                         return -1;
@@ -264,14 +257,6 @@ static int ssl23_client_hello(SSL *s)
                         version_major = TLS1_VERSION_MAJOR;
                         version_minor = TLS1_VERSION_MINOR;
                         }
-#ifdef OPENSSL_FIPS
-                else if(FIPS_mode())
-                        {
-                        SSLerr(SSL_F_SSL23_CLIENT_HELLO,
-                                        SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
-                        return -1;
-                        }
-#endif
                 else if (version == SSL3_VERSION)
                         {
                         version_major = SSL3_VERSION_MAJOR;
@@ -386,6 +371,13 @@ static int ssl23_client_hello(SSL *s)
                                 *(p++)=comp->id;
                                 }
                         *(p++)=0; /* Add the NULL method */
+#ifndef OPENSSL_NO_TLSEXT
+                        if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
+                                {
+                                SSLerr(SSL_F_SSL23_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);
+                                return -1;
+                                }
+#endif
                         
                         l = p-d;
                         *p = 42;
@@ -544,14 +536,6 @@ static int ssl23_get_server_hello(SSL *s)
                 if ((p[2] == SSL3_VERSION_MINOR) &&
                         !(s->options & SSL_OP_NO_SSLv3))
                         {
-#ifdef OPENSSL_FIPS
-                        if(FIPS_mode())
-                                {
-                                SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,
-                                        SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
-                                goto err;
-                                }
-#endif
                         s->version=SSL3_VERSION;
                         s->method=SSLv3_client_method();
                         }
@@ -608,7 +592,6 @@ static int ssl23_get_server_hello(SSL *s)
         if (!ssl_get_new_session(s,0))
                 goto err;
 
-        s->first_packet=1;
         return(SSL_connect(s));
 err:
         return(-1);
diff --git a/src/lib/libssl/s23_lib.c b/src/lib/libssl/s23_lib.c
index 8d7dbcf569..fc2981308d 100644
--- a/src/lib/libssl/s23_lib.c
+++ b/src/lib/libssl/s23_lib.c
@@ -60,55 +60,17 @@
 #include <openssl/objects.h>
 #include "ssl_locl.h"
 
-static int ssl23_num_ciphers(void );
-static SSL_CIPHER *ssl23_get_cipher(unsigned int u);
-static int ssl23_read(SSL *s, void *buf, int len);
-static int ssl23_peek(SSL *s, void *buf, int len);
-static int ssl23_write(SSL *s, const void *buf, int len);
-static long ssl23_default_timeout(void );
-static int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p);
-static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p);
-const char *SSL23_version_str="SSLv2/3 compatibility" OPENSSL_VERSION_PTEXT;
-
-static SSL_METHOD SSLv23_data= {
-        TLS1_VERSION,
-        tls1_new,
-        tls1_clear,
-        tls1_free,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl23_read,
-        ssl23_peek,
-        ssl23_write,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl_ok,
-        ssl3_ctrl,
-        ssl3_ctx_ctrl,
-        ssl23_get_cipher_by_char,
-        ssl23_put_cipher_by_char,
-        ssl_undefined_const_function,
-        ssl23_num_ciphers,
-        ssl23_get_cipher,
-        ssl_bad_method,
-        ssl23_default_timeout,
-        &ssl3_undef_enc_method,
-        ssl_undefined_function,
-        ssl3_callback_ctrl,
-        ssl3_ctx_callback_ctrl,
-        };
-
-static long ssl23_default_timeout(void)
+long ssl23_default_timeout(void)
         {
         return(300);
         }
 
-SSL_METHOD *sslv23_base_method(void)
-        {
-        return(&SSLv23_data);
-        }
+IMPLEMENT_ssl23_meth_func(sslv23_base_method,
+                        ssl_undefined_function,
+                        ssl_undefined_function,
+                        ssl_bad_method)
 
-static int ssl23_num_ciphers(void)
+int ssl23_num_ciphers(void)
         {
         return(ssl3_num_ciphers()
 #ifndef OPENSSL_NO_SSL2
@@ -117,7 +79,7 @@ static int ssl23_num_ciphers(void)
             );
         }
 
-static SSL_CIPHER *ssl23_get_cipher(unsigned int u)
+SSL_CIPHER *ssl23_get_cipher(unsigned int u)
         {
         unsigned int uu=ssl3_num_ciphers();
 
@@ -133,7 +95,7 @@ static SSL_CIPHER *ssl23_get_cipher(unsigned int u)
 
 /* This function needs to check if the ciphers required are actually
  * available */
-static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p)
+SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p)
         {
         SSL_CIPHER c,*cp;
         unsigned long id;
@@ -151,7 +113,7 @@ static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p)
         return(cp);
         }
 
-static int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
+int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
         {
         long l;
 
@@ -166,7 +128,7 @@ static int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
         return(3);
         }
 
-static int ssl23_read(SSL *s, void *buf, int len)
+int ssl23_read(SSL *s, void *buf, int len)
         {
         int n;
 
@@ -189,7 +151,7 @@ static int ssl23_read(SSL *s, void *buf, int len)
                 }
         }
 
-static int ssl23_peek(SSL *s, void *buf, int len)
+int ssl23_peek(SSL *s, void *buf, int len)
         {
         int n;
 
@@ -212,7 +174,7 @@ static int ssl23_peek(SSL *s, void *buf, int len)
                 }
         }
 
-static int ssl23_write(SSL *s, const void *buf, int len)
+int ssl23_write(SSL *s, const void *buf, int len)
         {
         int n;
 
diff --git a/src/lib/libssl/s23_srvr.c b/src/lib/libssl/s23_srvr.c
index b73abc448f..6637bb9549 100644
--- a/src/lib/libssl/s23_srvr.c
+++ b/src/lib/libssl/s23_srvr.c
@@ -132,28 +132,10 @@ static SSL_METHOD *ssl23_get_server_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *SSLv23_server_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv23_server_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&SSLv23_server_data,
-                                (char *)sslv23_base_method(),sizeof(SSL_METHOD));
-                        SSLv23_server_data.ssl_accept=ssl23_accept;
-                        SSLv23_server_data.get_ssl_method=ssl23_get_server_method;
-                        init=0;
-                        }
-
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv23_server_data);
-        }
+IMPLEMENT_ssl23_meth_func(SSLv23_server_method,
+                        ssl23_accept,
+                        ssl_undefined_function,
+                        ssl23_get_server_method)
 
 int ssl23_accept(SSL *s)
         {
@@ -404,15 +386,6 @@ int ssl23_get_client_hello(SSL *s)
                         }
                 }
 
-#ifdef OPENSSL_FIPS
-        if (FIPS_mode() && (s->version < TLS1_VERSION))
-                {
-                SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
-                                        SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
-                goto err;
-                }
-#endif
-
         if (s->state == SSL23_ST_SR_CLNT_HELLO_B)
                 {
                 /* we have SSLv3/TLSv1 in an SSLv2 header
@@ -592,7 +565,6 @@ int ssl23_get_client_hello(SSL *s)
         s->init_num=0;
 
         if (buf != buf_space) OPENSSL_free(buf);
-        s->first_packet=1;
         return(SSL_accept(s));
 err:
         if (buf != buf_space) OPENSSL_free(buf);
diff --git a/src/lib/libssl/s3_both.c b/src/lib/libssl/s3_both.c
index 64d317b7ac..2ecfbb77cb 100644
--- a/src/lib/libssl/s3_both.c
+++ b/src/lib/libssl/s3_both.c
@@ -108,6 +108,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #include <limits.h>
 #include <string.h>
@@ -192,7 +197,7 @@ int ssl3_get_finished(SSL *s, int a, int b)
          * change cipher spec message and is in s->s3->tmp.peer_finish_md
          */ 
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 a,
                 b,
                 SSL3_MT_FINISHED,
@@ -386,8 +391,8 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
                         {
                         while (s->init_num < 4)
                                 {
-                                i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],
-                                        4 - s->init_num, 0);
+                                i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
+                                        &p[s->init_num],4 - s->init_num, 0);
                                 if (i <= 0)
                                         {
                                         s->rwstate=SSL_READING;
@@ -467,7 +472,7 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
         n = s->s3->tmp.message_size - s->init_num;
         while (n > 0)
                 {
-                i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n,0);
+                i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n,0);
                 if (i <= 0)
                         {
                         s->rwstate=SSL_READING;
@@ -492,7 +497,7 @@ err:
 int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
         {
         EVP_PKEY *pk;
-        int ret= -1,i,j;
+        int ret= -1,i;
 
         if (pkey == NULL)
                 pk=X509_get_pubkey(x);
@@ -504,35 +509,17 @@ int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
         if (i == EVP_PKEY_RSA)
                 {
                 ret=SSL_PKEY_RSA_ENC;
-                if (x != NULL)
-                        {
-                        j=X509_get_ext_count(x);
-                        /* check to see if this is a signing only certificate */
-                        /* EAY EAY EAY EAY */
-                        }
                 }
         else if (i == EVP_PKEY_DSA)
                 {
                 ret=SSL_PKEY_DSA_SIGN;
                 }
-        else if (i == EVP_PKEY_DH)
+#ifndef OPENSSL_NO_EC
+        else if (i == EVP_PKEY_EC)
                 {
-                /* if we just have a key, we needs to be guess */
-
-                if (x == NULL)
-                        ret=SSL_PKEY_DH_DSA;
-                else
-                        {
-                        j=X509_get_signature_type(x);
-                        if (j == EVP_PKEY_RSA)
-                                ret=SSL_PKEY_DH_RSA;
-                        else if (j== EVP_PKEY_DSA)
-                                ret=SSL_PKEY_DH_DSA;
-                        else ret= -1;
-                        }
+                ret = SSL_PKEY_ECC;
                 }
-        else
-                ret= -1;
+#endif
 
 err:
         if(!pkey) EVP_PKEY_free(pk);
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
index 4163d97944..9a87c1cfb3 100644
--- a/src/lib/libssl/s3_clnt.c
+++ b/src/lib/libssl/s3_clnt.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -108,6 +108,19 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * ECC cipher suite support in OpenSSL originally written by
+ * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
+ *
+ */
 
 #include <stdio.h>
 #include "ssl_locl.h"
@@ -117,20 +130,22 @@
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include <openssl/md5.h>
-#include <openssl/fips.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
 
 static SSL_METHOD *ssl3_get_client_method(int ver);
-static int ssl3_client_hello(SSL *s);
-static int ssl3_get_server_hello(SSL *s);
-static int ssl3_get_certificate_request(SSL *s);
 static int ca_dn_cmp(const X509_NAME * const *a,const X509_NAME * const *b);
-static int ssl3_get_server_done(SSL *s);
-static int ssl3_send_client_verify(SSL *s);
-static int ssl3_send_client_certificate(SSL *s);
-static int ssl3_send_client_key_exchange(SSL *s);
-static int ssl3_get_key_exchange(SSL *s);
-static int ssl3_get_server_certificate(SSL *s);
-static int ssl3_check_cert_and_algorithm(SSL *s);
+#ifndef OPENSSL_NO_TLSEXT
+static int ssl3_check_finished(SSL *s);
+#endif
+
+#ifndef OPENSSL_NO_ECDH
+static int curve_id2nid(int curve_id);
+int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs);
+#endif
+
 static SSL_METHOD *ssl3_get_client_method(int ver)
         {
         if (ver == SSL3_VERSION)
@@ -139,28 +154,10 @@ static SSL_METHOD *ssl3_get_client_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *SSLv3_client_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv3_client_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&SSLv3_client_data,(char *)sslv3_base_method(),
-                                sizeof(SSL_METHOD));
-                        SSLv3_client_data.ssl_connect=ssl3_connect;
-                        SSLv3_client_data.get_ssl_method=ssl3_get_client_method;
-                        init=0;
-                        }
-
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv3_client_data);
-        }
+IMPLEMENT_ssl3_meth_func(SSLv3_client_method,
+                        ssl_undefined_function,
+                        ssl3_connect,
+                        ssl3_get_client_method)
 
 int ssl3_connect(SSL *s)
         {
@@ -270,15 +267,43 @@ int ssl3_connect(SSL *s)
 
                 case SSL3_ST_CR_CERT_A:
                 case SSL3_ST_CR_CERT_B:
-                        /* Check if it is anon DH */
+#ifndef OPENSSL_NO_TLSEXT
+                        ret=ssl3_check_finished(s);
+                        if (ret <= 0) goto end;
+                        if (ret == 2)
+                                {
+                                s->hit = 1;
+                                if (s->tlsext_ticket_expected)
+                                        s->state=SSL3_ST_CR_SESSION_TICKET_A;
+                                else
+                                        s->state=SSL3_ST_CR_FINISHED_A;
+                                s->init_num=0;
+                                break;
+                                }
+#endif
+                        /* Check if it is anon DH/ECDH */
                         if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
                                 {
                                 ret=ssl3_get_server_certificate(s);
                                 if (ret <= 0) goto end;
+#ifndef OPENSSL_NO_TLSEXT
+                                if (s->tlsext_status_expected)
+                                        s->state=SSL3_ST_CR_CERT_STATUS_A;
+                                else
+                                        s->state=SSL3_ST_CR_KEY_EXCH_A;
+                                }
+                        else
+                                {
+                                skip = 1;
+                                s->state=SSL3_ST_CR_KEY_EXCH_A;
+                                }
+#else
                                 }
                         else
                                 skip=1;
+
                         s->state=SSL3_ST_CR_KEY_EXCH_A;
+#endif
                         s->init_num=0;
                         break;
 
@@ -337,6 +362,13 @@ int ssl3_connect(SSL *s)
                          * sent back */
                         /* For TLS, cert_req is set to 2, so a cert chain
                          * of nothing is sent, but no verify packet is sent */
+                        /* XXX: For now, we do not support client 
+                         * authentication in ECDH cipher suites with
+                         * ECDH (rather than ECDSA) certificates.
+                         * We need to skip the certificate verify 
+                         * message when client's ECDH public key is sent 
+                         * inside the client certificate.
+                         */
                         if (s->s3->tmp.cert_req == 1)
                                 {
                                 s->state=SSL3_ST_CW_CERT_VRFY_A;
@@ -368,11 +400,15 @@ int ssl3_connect(SSL *s)
                         s->init_num=0;
 
                         s->session->cipher=s->s3->tmp.new_cipher;
+#ifdef OPENSSL_NO_COMP
+                        s->session->compress_meth=0;
+#else
                         if (s->s3->tmp.new_compression == NULL)
                                 s->session->compress_meth=0;
                         else
                                 s->session->compress_meth=
                                         s->s3->tmp.new_compression->id;
+#endif
                         if (!s->method->ssl3_enc->setup_key_block(s))
                                 {
                                 ret= -1;
@@ -411,11 +447,36 @@ int ssl3_connect(SSL *s)
                                 }
                         else
                                 {
+#ifndef OPENSSL_NO_TLSEXT
+                                /* Allow NewSessionTicket if ticket expected */
+                                if (s->tlsext_ticket_expected)
+                                        s->s3->tmp.next_state=SSL3_ST_CR_SESSION_TICKET_A;
+                                else
+#endif
+                                
                                 s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A;
                                 }
                         s->init_num=0;
                         break;
 
+#ifndef OPENSSL_NO_TLSEXT
+                case SSL3_ST_CR_SESSION_TICKET_A:
+                case SSL3_ST_CR_SESSION_TICKET_B:
+                        ret=ssl3_get_new_session_ticket(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_CR_FINISHED_A;
+                        s->init_num=0;
+                break;
+
+                case SSL3_ST_CR_CERT_STATUS_A:
+                case SSL3_ST_CR_CERT_STATUS_B:
+                        ret=ssl3_get_cert_status(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_CR_KEY_EXCH_A;
+                        s->init_num=0;
+                break;
+#endif
+
                 case SSL3_ST_CR_FINISHED_A:
                 case SSL3_ST_CR_FINISHED_B:
 
@@ -512,13 +573,16 @@ end:
         }
 
 
-static int ssl3_client_hello(SSL *s)
+int ssl3_client_hello(SSL *s)
         {
         unsigned char *buf;
         unsigned char *p,*d;
-        int i,j;
+        int i;
         unsigned long Time,l;
+#ifndef OPENSSL_NO_COMP
+        int j;
         SSL_COMP *comp;
+#endif
 
         buf=(unsigned char *)s->init_buf->data;
         if (s->state == SSL3_ST_CW_CLNT_HELLO_A)
@@ -535,8 +599,8 @@ static int ssl3_client_hello(SSL *s)
                 p=s->s3->client_random;
                 Time=(unsigned long)time(NULL);                 /* Time */
                 l2n(Time,p);
-                if(RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
-                    goto err;
+                if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
+                        goto err;
 
                 /* Do the message type and length last */
                 d=p= &(buf[4]);
@@ -557,7 +621,7 @@ static int ssl3_client_hello(SSL *s)
                 *(p++)=i;
                 if (i != 0)
                         {
-                        if (i > sizeof s->session->session_id)
+                        if (i > (int)sizeof(s->session->session_id))
                                 {
                                 SSLerr(SSL_F_SSL3_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
                                 goto err;
@@ -577,6 +641,9 @@ static int ssl3_client_hello(SSL *s)
                 p+=i;
 
                 /* COMPRESSION */
+#ifdef OPENSSL_NO_COMP
+                *(p++)=1;
+#else
                 if (s->ctx->comp_methods == NULL)
                         j=0;
                 else
@@ -587,8 +654,15 @@ static int ssl3_client_hello(SSL *s)
                         comp=sk_SSL_COMP_value(s->ctx->comp_methods,i);
                         *(p++)=comp->id;
                         }
+#endif
                 *(p++)=0; /* Add the NULL method */
-                
+#ifndef OPENSSL_NO_TLSEXT
+                if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);
+                        goto err;
+                        }
+#endif          
                 l=(p-d);
                 d=buf;
                 *(d++)=SSL3_MT_CLIENT_HELLO;
@@ -606,7 +680,7 @@ err:
         return(-1);
         }
 
-static int ssl3_get_server_hello(SSL *s)
+int ssl3_get_server_hello(SSL *s)
         {
         STACK_OF(SSL_CIPHER) *sk;
         SSL_CIPHER *c;
@@ -614,16 +688,44 @@ static int ssl3_get_server_hello(SSL *s)
         int i,al,ok;
         unsigned int j;
         long n;
+#ifndef OPENSSL_NO_COMP
         SSL_COMP *comp;
+#endif
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_CR_SRVR_HELLO_A,
                 SSL3_ST_CR_SRVR_HELLO_B,
-                SSL3_MT_SERVER_HELLO,
-                300, /* ?? */
+                -1,
+                20000, /* ?? */
                 &ok);
 
         if (!ok) return((int)n);
+
+        if ( SSL_version(s) == DTLS1_VERSION)
+                {
+                if ( s->s3->tmp.message_type == DTLS1_MT_HELLO_VERIFY_REQUEST)
+                        {
+                        if ( s->d1->send_cookie == 0)
+                                {
+                                s->s3->tmp.reuse_message = 1;
+                                return 1;
+                                }
+                        else /* already sent a cookie */
+                                {
+                                al=SSL_AD_UNEXPECTED_MESSAGE;
+                                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_MESSAGE_TYPE);
+                                goto f_err;
+                                }
+                        }
+                }
+        
+        if ( s->s3->tmp.message_type != SSL3_MT_SERVER_HELLO)
+                {
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_MESSAGE_TYPE);
+                goto f_err;
+                }
+
         d=p=(unsigned char *)s->init_msg;
 
         if ((p[0] != (s->version>>8)) || (p[1] != (s->version&0xff)))
@@ -719,6 +821,14 @@ static int ssl3_get_server_hello(SSL *s)
 
         /* lets get the compression algorithm */
         /* COMPRESSION */
+#ifdef OPENSSL_NO_COMP
+        if (*(p++) != 0)
+                {
+                al=SSL_AD_ILLEGAL_PARAMETER;
+                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
+                goto f_err;
+                }
+#else
         j= *(p++);
         if (j == 0)
                 comp=NULL;
@@ -735,6 +845,25 @@ static int ssl3_get_server_hello(SSL *s)
                 {
                 s->s3->tmp.new_compression=comp;
                 }
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+        /* TLS extensions*/
+        if (s->version > SSL3_VERSION)
+                {
+                if (!ssl_parse_serverhello_tlsext(s,&p,d,n, &al))
+                        {
+                        /* 'al' set by ssl_parse_serverhello_tlsext */
+                        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_PARSE_TLSEXT);
+                        goto f_err; 
+                        }
+                if (ssl_check_serverhello_tlsext(s) <= 0)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SERVERHELLO_TLSEXT);
+                                goto err;
+                        }
+                }
+#endif
+
 
         if (p != (d+n))
                 {
@@ -751,18 +880,19 @@ err:
         return(-1);
         }
 
-static int ssl3_get_server_certificate(SSL *s)
+int ssl3_get_server_certificate(SSL *s)
         {
         int al,i,ok,ret= -1;
         unsigned long n,nc,llen,l;
         X509 *x=NULL;
-        unsigned char *p,*d,*q;
+        const unsigned char *q,*p;
+        unsigned char *d;
         STACK_OF(X509) *sk=NULL;
         SESS_CERT *sc;
         EVP_PKEY *pkey=NULL;
-        int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
+        int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_CR_CERT_A,
                 SSL3_ST_CR_CERT_B,
                 -1,
@@ -771,7 +901,9 @@ static int ssl3_get_server_certificate(SSL *s)
 
         if (!ok) return((int)n);
 
-        if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)
+        if ((s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE) ||
+                ((s->s3->tmp.new_cipher->algorithms & SSL_aKRB5) && 
+                (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE)))
                 {
                 s->s3->tmp.reuse_message=1;
                 return(1);
@@ -783,7 +915,7 @@ static int ssl3_get_server_certificate(SSL *s)
                 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE);
                 goto f_err;
                 }
-        d=p=(unsigned char *)s->init_msg;
+        p=d=(unsigned char *)s->init_msg;
 
         if ((sk=sk_X509_new_null()) == NULL)
                 {
@@ -835,10 +967,10 @@ static int ssl3_get_server_certificate(SSL *s)
         i=ssl_verify_cert_chain(s,sk);
         if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)
 #ifndef OPENSSL_NO_KRB5
-                && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
-                != (SSL_aKRB5|SSL_kKRB5)
+                && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
+                != (SSL_aKRB5|SSL_kKRB5)
 #endif /* OPENSSL_NO_KRB5 */
-                )
+                )
                 {
                 al=ssl_verify_alarm_type(s->verify_result);
                 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
@@ -861,16 +993,16 @@ static int ssl3_get_server_certificate(SSL *s)
 
         pkey=X509_get_pubkey(x);
 
-        /* VRS: allow null cert if auth == KRB5 */
-        need_cert =     ((s->s3->tmp.new_cipher->algorithms
-                        & (SSL_MKEY_MASK|SSL_AUTH_MASK))
-                        == (SSL_aKRB5|SSL_kKRB5))? 0: 1;
+        /* VRS: allow null cert if auth == KRB5 */
+        need_cert =     ((s->s3->tmp.new_cipher->algorithms
+                         & (SSL_MKEY_MASK|SSL_AUTH_MASK))
+                         == (SSL_aKRB5|SSL_kKRB5))? 0: 1;
 
 #ifdef KSSL_DEBUG
         printf("pkey,x = %p, %p\n", pkey,x);
         printf("ssl_cert_type(x,pkey) = %d\n", ssl_cert_type(x,pkey));
         printf("cipher, alg, nc = %s, %lx, %d\n", s->s3->tmp.new_cipher->name,
-                s->s3->tmp.new_cipher->algorithms, need_cert);
+                s->s3->tmp.new_cipher->algorithms, need_cert);
 #endif    /* KSSL_DEBUG */
 
         if (need_cert && ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey)))
@@ -892,31 +1024,31 @@ static int ssl3_get_server_certificate(SSL *s)
                 goto f_err;
                 }
 
-        if (need_cert)
-                {
-                sc->peer_cert_type=i;
-                CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
-                /* Why would the following ever happen?
-                 * We just created sc a couple of lines ago. */
-                if (sc->peer_pkeys[i].x509 != NULL)
-                        X509_free(sc->peer_pkeys[i].x509);
-                sc->peer_pkeys[i].x509=x;
-                sc->peer_key= &(sc->peer_pkeys[i]);
-
-                if (s->session->peer != NULL)
-                        X509_free(s->session->peer);
-                CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
-                s->session->peer=x;
-                }
-        else
-                {
-                sc->peer_cert_type=i;
-                sc->peer_key= NULL;
-
-                if (s->session->peer != NULL)
-                        X509_free(s->session->peer);
-                s->session->peer=NULL;
-                }
+        if (need_cert)
+                {
+                sc->peer_cert_type=i;
+                CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
+                /* Why would the following ever happen?
+                 * We just created sc a couple of lines ago. */
+                if (sc->peer_pkeys[i].x509 != NULL)
+                        X509_free(sc->peer_pkeys[i].x509);
+                sc->peer_pkeys[i].x509=x;
+                sc->peer_key= &(sc->peer_pkeys[i]);
+
+                if (s->session->peer != NULL)
+                        X509_free(s->session->peer);
+                CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
+                s->session->peer=x;
+                }
+        else
+                {
+                sc->peer_cert_type=i;
+                sc->peer_key= NULL;
+
+                if (s->session->peer != NULL)
+                        X509_free(s->session->peer);
+                s->session->peer=NULL;
+                }
         s->session->verify_result = s->verify_result;
 
         x=NULL;
@@ -934,7 +1066,7 @@ err:
         return(ret);
         }
 
-static int ssl3_get_key_exchange(SSL *s)
+int ssl3_get_key_exchange(SSL *s)
         {
 #ifndef OPENSSL_NO_RSA
         unsigned char *q,md_buf[EVP_MAX_MD_SIZE*2];
@@ -950,10 +1082,17 @@ static int ssl3_get_key_exchange(SSL *s)
 #ifndef OPENSSL_NO_DH
         DH *dh=NULL;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *ecdh = NULL;
+        BN_CTX *bn_ctx = NULL;
+        EC_POINT *srvr_ecpoint = NULL;
+        int curve_nid = 0;
+        int encoded_pt_len = 0;
+#endif
 
         /* use same message size as in ssl3_get_certificate_request()
          * as ServerKeyExchange message may be skipped */
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_CR_KEY_EXCH_A,
                 SSL3_ST_CR_KEY_EXCH_B,
                 -1,
@@ -986,6 +1125,13 @@ static int ssl3_get_key_exchange(SSL *s)
                         s->session->sess_cert->peer_dh_tmp=NULL;
                         }
 #endif
+#ifndef OPENSSL_NO_ECDH
+                if (s->session->sess_cert->peer_ecdh_tmp)
+                        {
+                        EC_KEY_free(s->session->sess_cert->peer_ecdh_tmp);
+                        s->session->sess_cert->peer_ecdh_tmp=NULL;
+                        }
+#endif
                 }
         else
                 {
@@ -1127,6 +1273,114 @@ static int ssl3_get_key_exchange(SSL *s)
                 goto f_err;
                 }
 #endif /* !OPENSSL_NO_DH */
+
+#ifndef OPENSSL_NO_ECDH
+        else if (alg & SSL_kECDHE)
+                {
+                EC_GROUP *ngroup;
+                const EC_GROUP *group;
+
+                if ((ecdh=EC_KEY_new()) == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+
+                /* Extract elliptic curve parameters and the
+                 * server's ephemeral ECDH public key.
+                 * Keep accumulating lengths of various components in
+                 * param_len and make sure it never exceeds n.
+                 */
+
+                /* XXX: For now we only support named (not generic) curves
+                 * and the ECParameters in this case is just three bytes.
+                 */
+                param_len=3;
+                if ((param_len > n) ||
+                    (*p != NAMED_CURVE_TYPE) || 
+                    ((curve_nid = curve_id2nid(*(p + 2))) == 0)) 
+                        {
+                        al=SSL_AD_INTERNAL_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
+                        goto f_err;
+                        }
+
+                ngroup = EC_GROUP_new_by_curve_name(curve_nid);
+                if (ngroup == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_EC_LIB);
+                        goto err;
+                        }
+                if (EC_KEY_set_group(ecdh, ngroup) == 0)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_EC_LIB);
+                        goto err;
+                        }
+                EC_GROUP_free(ngroup);
+
+                group = EC_KEY_get0_group(ecdh);
+
+                if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&
+                    (EC_GROUP_get_degree(group) > 163))
+                        {
+                        al=SSL_AD_EXPORT_RESTRICTION;
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER);
+                        goto f_err;
+                        }
+
+                p+=3;
+
+                /* Next, get the encoded ECPoint */
+                if (((srvr_ecpoint = EC_POINT_new(group)) == NULL) ||
+                    ((bn_ctx = BN_CTX_new()) == NULL))
+                        {
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+
+                encoded_pt_len = *p;  /* length of encoded point */
+                p+=1;
+                param_len += (1 + encoded_pt_len);
+                if ((param_len > n) ||
+                    (EC_POINT_oct2point(group, srvr_ecpoint, 
+                        p, encoded_pt_len, bn_ctx) == 0))
+                        {
+                        al=SSL_AD_DECODE_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_ECPOINT);
+                        goto f_err;
+                        }
+
+                n-=param_len;
+                p+=encoded_pt_len;
+
+                /* The ECC/TLS specification does not mention
+                 * the use of DSA to sign ECParameters in the server
+                 * key exchange message. We do support RSA and ECDSA.
+                 */
+                if (0) ;
+#ifndef OPENSSL_NO_RSA
+                else if (alg & SSL_aRSA)
+                        pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
+#endif
+#ifndef OPENSSL_NO_ECDSA
+                else if (alg & SSL_aECDSA)
+                        pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
+#endif
+                /* else anonymous ECDH, so no certificate or pkey. */
+                EC_KEY_set_public_key(ecdh, srvr_ecpoint);
+                s->session->sess_cert->peer_ecdh_tmp=ecdh;
+                ecdh=NULL;
+                BN_CTX_free(bn_ctx);
+                EC_POINT_free(srvr_ecpoint);
+                srvr_ecpoint = NULL;
+                }
+        else if (alg & SSL_kECDH)
+                {
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
+                goto f_err;
+                }
+#endif /* !OPENSSL_NO_ECDH */
         if (alg & SSL_aFZA)
                 {
                 al=SSL_AD_HANDSHAKE_FAILURE;
@@ -1137,7 +1391,6 @@ static int ssl3_get_key_exchange(SSL *s)
 
         /* p points to the next byte, there are 'n' bytes left */
 
-
         /* if it was signed, check the signature */
         if (pkey != NULL)
                 {
@@ -1162,14 +1415,11 @@ static int ssl3_get_key_exchange(SSL *s)
                         q=md_buf;
                         for (num=2; num > 0; num--)
                                 {
-                                EVP_MD_CTX_set_flags(&md_ctx,
-                                        EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
                                 EVP_DigestInit_ex(&md_ctx,(num == 2)
                                         ?s->ctx->md5:s->ctx->sha1, NULL);
                                 EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
                                 EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
                                 EVP_DigestUpdate(&md_ctx,param,param_len);
-                                
                                 EVP_DigestFinal_ex(&md_ctx,q,(unsigned int *)&i);
                                 q+=i;
                                 j+=i;
@@ -1210,6 +1460,24 @@ static int ssl3_get_key_exchange(SSL *s)
                         }
                 else
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                        if (pkey->type == EVP_PKEY_EC)
+                        {
+                        /* let's do ECDSA */
+                        EVP_VerifyInit_ex(&md_ctx,EVP_ecdsa(), NULL);
+                        EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
+                        EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
+                        EVP_VerifyUpdate(&md_ctx,param,param_len);
+                        if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
+                                {
+                                /* bad signature */
+                                al=SSL_AD_DECRYPT_ERROR;
+                                SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
+                                goto f_err;
+                                }
+                        }
+                else
+#endif
                         {
                         SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
                         goto err;
@@ -1245,20 +1513,27 @@ err:
         if (dh != NULL)
                 DH_free(dh);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        BN_CTX_free(bn_ctx);
+        EC_POINT_free(srvr_ecpoint);
+        if (ecdh != NULL)
+                EC_KEY_free(ecdh);
+#endif
         EVP_MD_CTX_cleanup(&md_ctx);
         return(-1);
         }
 
-static int ssl3_get_certificate_request(SSL *s)
+int ssl3_get_certificate_request(SSL *s)
         {
         int ok,ret=0;
         unsigned long n,nc,l;
         unsigned int llen,ctype_num,i;
         X509_NAME *xn=NULL;
-        unsigned char *p,*d,*q;
+        const unsigned char *p,*q;
+        unsigned char *d;
         STACK_OF(X509_NAME) *ca_sk=NULL;
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_CR_CERT_REQ_A,
                 SSL3_ST_CR_CERT_REQ_B,
                 -1,
@@ -1294,7 +1569,7 @@ static int ssl3_get_certificate_request(SSL *s)
                         }
                 }
 
-        d=p=(unsigned char *)s->init_msg;
+        p=d=(unsigned char *)s->init_msg;
 
         if ((ca_sk=sk_X509_NAME_new(ca_dn_cmp)) == NULL)
                 {
@@ -1395,13 +1670,150 @@ static int ca_dn_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
         {
         return(X509_NAME_cmp(*a,*b));
         }
+#ifndef OPENSSL_NO_TLSEXT
+int ssl3_get_new_session_ticket(SSL *s)
+        {
+        int ok,al,ret=0, ticklen;
+        long n;
+        const unsigned char *p;
+        unsigned char *d;
 
-static int ssl3_get_server_done(SSL *s)
+        n=s->method->ssl_get_message(s,
+                SSL3_ST_CR_SESSION_TICKET_A,
+                SSL3_ST_CR_SESSION_TICKET_B,
+                -1,
+                16384,
+                &ok);
+
+        if (!ok)
+                return((int)n);
+
+        if (s->s3->tmp.message_type == SSL3_MT_FINISHED)
+                {
+                s->s3->tmp.reuse_message=1;
+                return(1);
+                }
+        if (s->s3->tmp.message_type != SSL3_MT_NEWSESSION_TICKET)
+                {
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_BAD_MESSAGE_TYPE);
+                goto f_err;
+                }
+        if (n < 6)
+                {
+                /* need at least ticket_lifetime_hint + ticket length */
+                al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
+                SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
+                goto f_err;
+                }
+        p=d=(unsigned char *)s->init_msg;
+        n2l(p, s->session->tlsext_tick_lifetime_hint);
+        n2s(p, ticklen);
+        /* ticket_lifetime_hint + ticket_length + ticket */
+        if (ticklen + 6 != n)
+                {
+                al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
+                SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
+                goto f_err;
+                }
+        if (s->session->tlsext_tick)
+                {
+                OPENSSL_free(s->session->tlsext_tick);
+                s->session->tlsext_ticklen = 0;
+                }
+        s->session->tlsext_tick = OPENSSL_malloc(ticklen);
+        if (!s->session->tlsext_tick)
+                {
+                SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+        memcpy(s->session->tlsext_tick, p, ticklen);
+        s->session->tlsext_ticklen = ticklen;
+        
+        ret=1;
+        return(ret);
+f_err:
+        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+err:
+        return(-1);
+        }
+
+int ssl3_get_cert_status(SSL *s)
+        {
+        int ok, al;
+        unsigned long resplen;
+        long n;
+        const unsigned char *p;
+
+        n=s->method->ssl_get_message(s,
+                SSL3_ST_CR_CERT_STATUS_A,
+                SSL3_ST_CR_CERT_STATUS_B,
+                SSL3_MT_CERTIFICATE_STATUS,
+                16384,
+                &ok);
+
+        if (!ok) return((int)n);
+        if (n < 4)
+                {
+                /* need at least status type + length */
+                al = SSL_AD_DECODE_ERROR;
+                SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_LENGTH_MISMATCH);
+                goto f_err;
+                }
+        p = (unsigned char *)s->init_msg;
+        if (*p++ != TLSEXT_STATUSTYPE_ocsp)
+                {
+                al = SSL_AD_DECODE_ERROR;
+                SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_UNSUPPORTED_STATUS_TYPE);
+                goto f_err;
+                }
+        n2l3(p, resplen);
+        if (resplen + 4 != n)
+                {
+                al = SSL_AD_DECODE_ERROR;
+                SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_LENGTH_MISMATCH);
+                goto f_err;
+                }
+        if (s->tlsext_ocsp_resp)
+                OPENSSL_free(s->tlsext_ocsp_resp);
+        s->tlsext_ocsp_resp = BUF_memdup(p, resplen);
+        if (!s->tlsext_ocsp_resp)
+                {
+                al = SSL_AD_INTERNAL_ERROR;
+                SSLerr(SSL_F_SSL3_GET_CERT_STATUS,ERR_R_MALLOC_FAILURE);
+                goto f_err;
+                }
+        s->tlsext_ocsp_resplen = resplen;
+        if (s->ctx->tlsext_status_cb)
+                {
+                int ret;
+                ret = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
+                if (ret == 0)
+                        {
+                        al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
+                        SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_INVALID_STATUS_RESPONSE);
+                        goto f_err;
+                        }
+                if (ret < 0)
+                        {
+                        al = SSL_AD_INTERNAL_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_CERT_STATUS,ERR_R_MALLOC_FAILURE);
+                        goto f_err;
+                        }
+                }
+        return 1;
+f_err:
+        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+        return(-1);
+        }
+#endif
+
+int ssl3_get_server_done(SSL *s)
         {
         int ok,ret=0;
         long n;
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_CR_SRVR_DONE_A,
                 SSL3_ST_CR_SRVR_DONE_B,
                 SSL3_MT_SERVER_DONE,
@@ -1420,7 +1832,8 @@ static int ssl3_get_server_done(SSL *s)
         return(ret);
         }
 
-static int ssl3_send_client_key_exchange(SSL *s)
+
+int ssl3_send_client_key_exchange(SSL *s)
         {
         unsigned char *p,*d;
         int n;
@@ -1430,8 +1843,16 @@ static int ssl3_send_client_key_exchange(SSL *s)
         EVP_PKEY *pkey=NULL;
 #endif
 #ifndef OPENSSL_NO_KRB5
-        KSSL_ERR kssl_err;
+        KSSL_ERR kssl_err;
 #endif /* OPENSSL_NO_KRB5 */
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *clnt_ecdh = NULL;
+        const EC_POINT *srvr_ecpoint = NULL;
+        EVP_PKEY *srvr_pub_pkey = NULL;
+        unsigned char *encodedPoint = NULL;
+        int encoded_pt_len = 0;
+        BN_CTX * bn_ctx = NULL;
+#endif
 
         if (s->state == SSL3_ST_CW_KEY_EXCH_A)
                 {
@@ -1440,8 +1861,8 @@ static int ssl3_send_client_key_exchange(SSL *s)
 
                 l=s->s3->tmp.new_cipher->algorithms;
 
-                /* Fool emacs indentation */
-                if (0) {}
+                /* Fool emacs indentation */
+                if (0) {}
 #ifndef OPENSSL_NO_RSA
                 else if (l & SSL_kRSA)
                         {
@@ -1503,12 +1924,12 @@ static int ssl3_send_client_key_exchange(SSL *s)
 #endif
 #ifndef OPENSSL_NO_KRB5
                 else if (l & SSL_kKRB5)
-                        {
-                        krb5_error_code krb5rc;
-                        KSSL_CTX        *kssl_ctx = s->kssl_ctx;
-                        /*  krb5_data   krb5_ap_req;  */
-                        krb5_data       *enc_ticket;
-                        krb5_data       authenticator, *authp = NULL;
+                        {
+                        krb5_error_code krb5rc;
+                        KSSL_CTX        *kssl_ctx = s->kssl_ctx;
+                        /*  krb5_data   krb5_ap_req;  */
+                        krb5_data       *enc_ticket;
+                        krb5_data       authenticator, *authp = NULL;
                         EVP_CIPHER_CTX  ciph_ctx;
                         EVP_CIPHER      *enc = NULL;
                         unsigned char   iv[EVP_MAX_IV_LENGTH];
@@ -1520,8 +1941,8 @@ static int ssl3_send_client_key_exchange(SSL *s)
                         EVP_CIPHER_CTX_init(&ciph_ctx);
 
 #ifdef KSSL_DEBUG
-                        printf("ssl3_send_client_key_exchange(%lx & %lx)\n",
-                                l, SSL_kKRB5);
+                        printf("ssl3_send_client_key_exchange(%lx & %lx)\n",
+                                l, SSL_kKRB5);
 #endif  /* KSSL_DEBUG */
 
                         authp = NULL;
@@ -1529,37 +1950,37 @@ static int ssl3_send_client_key_exchange(SSL *s)
                         if (KRB5SENDAUTH)  authp = &authenticator;
 #endif  /* KRB5SENDAUTH */
 
-                        krb5rc = kssl_cget_tkt(kssl_ctx, &enc_ticket, authp,
+                        krb5rc = kssl_cget_tkt(kssl_ctx, &enc_ticket, authp,
                                 &kssl_err);
                         enc = kssl_map_enc(kssl_ctx->enctype);
-                        if (enc == NULL)
-                            goto err;
+                        if (enc == NULL)
+                            goto err;
 #ifdef KSSL_DEBUG
-                        {
-                        printf("kssl_cget_tkt rtn %d\n", krb5rc);
-                        if (krb5rc && kssl_err.text)
+                        {
+                        printf("kssl_cget_tkt rtn %d\n", krb5rc);
+                        if (krb5rc && kssl_err.text)
                           printf("kssl_cget_tkt kssl_err=%s\n", kssl_err.text);
-                        }
+                        }
 #endif  /* KSSL_DEBUG */
 
-                        if (krb5rc)
-                                {
-                                ssl3_send_alert(s,SSL3_AL_FATAL,
+                        if (krb5rc)
+                                {
+                                ssl3_send_alert(s,SSL3_AL_FATAL,
                                                 SSL_AD_HANDSHAKE_FAILURE);
-                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
                                                 kssl_err.reason);
-                                goto err;
-                                }
+                                goto err;
+                                }
 
                         /*  20010406 VRS - Earlier versions used KRB5 AP_REQ
                         **  in place of RFC 2712 KerberosWrapper, as in:
                         **
-                        **  Send ticket (copy to *p, set n = length)
-                        **  n = krb5_ap_req.length;
-                        **  memcpy(p, krb5_ap_req.data, krb5_ap_req.length);
-                        **  if (krb5_ap_req.data)  
-                        **    kssl_krb5_free_data_contents(NULL,&krb5_ap_req);
-                        **
+                        **  Send ticket (copy to *p, set n = length)
+                        **  n = krb5_ap_req.length;
+                        **  memcpy(p, krb5_ap_req.data, krb5_ap_req.length);
+                        **  if (krb5_ap_req.data)  
+                        **    kssl_krb5_free_data_contents(NULL,&krb5_ap_req);
+                        **
                         **  Now using real RFC 2712 KerberosWrapper
                         **  (Thanks to Simon Wilkinson <sxw@sxw.org.uk>)
                         **  Note: 2712 "opaque" types are here replaced
@@ -1594,8 +2015,10 @@ static int ssl3_send_client_key_exchange(SSL *s)
                                 n+=2;
                                 }
  
-                        if (RAND_bytes(tmp_buf,sizeof tmp_buf) <= 0)
-                            goto err;
+                            tmp_buf[0]=s->client_version>>8;
+                            tmp_buf[1]=s->client_version&0xff;
+                            if (RAND_bytes(&(tmp_buf[2]),sizeof tmp_buf-2) <= 0)
+                                goto err;
 
                         /*  20010420 VRS.  Tried it this way; failed.
                         **      EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,NULL);
@@ -1624,20 +2047,27 @@ static int ssl3_send_client_key_exchange(SSL *s)
                         p+=outl;
                         n+=outl + 2;
 
-                        s->session->master_key_length=
-                                s->method->ssl3_enc->generate_master_secret(s,
+                        s->session->master_key_length=
+                                s->method->ssl3_enc->generate_master_secret(s,
                                         s->session->master_key,
                                         tmp_buf, sizeof tmp_buf);
 
                         OPENSSL_cleanse(tmp_buf, sizeof tmp_buf);
                         OPENSSL_cleanse(epms, outl);
-                        }
+                        }
 #endif
 #ifndef OPENSSL_NO_DH
                 else if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
                         {
                         DH *dh_srvr,*dh_clnt;
 
+                        if (s->session->sess_cert == NULL) 
+                                {
+                                ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
+                                goto err;
+                                }
+
                         if (s->session->sess_cert->peer_dh_tmp != NULL)
                                 dh_srvr=s->session->sess_cert->peer_dh_tmp;
                         else
@@ -1689,10 +2119,198 @@ static int ssl3_send_client_key_exchange(SSL *s)
                         /* perhaps clean things up a bit EAY EAY EAY EAY*/
                         }
 #endif
+
+#ifndef OPENSSL_NO_ECDH 
+                else if ((l & SSL_kECDH) || (l & SSL_kECDHE))
+                        {
+                        const EC_GROUP *srvr_group = NULL;
+                        EC_KEY *tkey;
+                        int ecdh_clnt_cert = 0;
+                        int field_size = 0;
+
+                        /* Did we send out the client's
+                         * ECDH share for use in premaster
+                         * computation as part of client certificate?
+                         * If so, set ecdh_clnt_cert to 1.
+                         */
+                        if ((l & SSL_kECDH) && (s->cert != NULL)) 
+                                {
+                                /* XXX: For now, we do not support client
+                                 * authentication using ECDH certificates.
+                                 * To add such support, one needs to add
+                                 * code that checks for appropriate 
+                                 * conditions and sets ecdh_clnt_cert to 1.
+                                 * For example, the cert have an ECC
+                                 * key on the same curve as the server's
+                                 * and the key should be authorized for
+                                 * key agreement.
+                                 *
+                                 * One also needs to add code in ssl3_connect
+                                 * to skip sending the certificate verify
+                                 * message.
+                                 *
+                                 * if ((s->cert->key->privatekey != NULL) &&
+                                 *     (s->cert->key->privatekey->type ==
+                                 *      EVP_PKEY_EC) && ...)
+                                 * ecdh_clnt_cert = 1;
+                                 */
+                                }
+
+                        if (s->session->sess_cert->peer_ecdh_tmp != NULL)
+                                {
+                                tkey = s->session->sess_cert->peer_ecdh_tmp;
+                                }
+                        else
+                                {
+                                /* Get the Server Public Key from Cert */
+                                srvr_pub_pkey = X509_get_pubkey(s->session-> \
+                                    sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
+                                if ((srvr_pub_pkey == NULL) ||
+                                    (srvr_pub_pkey->type != EVP_PKEY_EC) ||
+                                    (srvr_pub_pkey->pkey.ec == NULL))
+                                        {
+                                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_INTERNAL_ERROR);
+                                        goto err;
+                                        }
+
+                                tkey = srvr_pub_pkey->pkey.ec;
+                                }
+
+                        srvr_group   = EC_KEY_get0_group(tkey);
+                        srvr_ecpoint = EC_KEY_get0_public_key(tkey);
+
+                        if ((srvr_group == NULL) || (srvr_ecpoint == NULL))
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+
+                        if ((clnt_ecdh=EC_KEY_new()) == NULL) 
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+
+                        if (!EC_KEY_set_group(clnt_ecdh, srvr_group))
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_EC_LIB);
+                                goto err;
+                                }
+                        if (ecdh_clnt_cert) 
+                                { 
+                                /* Reuse key info from our certificate
+                                 * We only need our private key to perform
+                                 * the ECDH computation.
+                                 */
+                                const BIGNUM *priv_key;
+                                tkey = s->cert->key->privatekey->pkey.ec;
+                                priv_key = EC_KEY_get0_private_key(tkey);
+                                if (priv_key == NULL)
+                                        {
+                                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                                        goto err;
+                                        }
+                                if (!EC_KEY_set_private_key(clnt_ecdh, priv_key))
+                                        {
+                                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_EC_LIB);
+                                        goto err;
+                                        }
+                                }
+                        else 
+                                {
+                                /* Generate a new ECDH key pair */
+                                if (!(EC_KEY_generate_key(clnt_ecdh)))
+                                        {
+                                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB);
+                                        goto err;
+                                        }
+                                }
+
+                        /* use the 'p' output buffer for the ECDH key, but
+                         * make sure to clear it out afterwards
+                         */
+
+                        field_size = EC_GROUP_get_degree(srvr_group);
+                        if (field_size <= 0)
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 
+                                       ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+                        n=ECDH_compute_key(p, (field_size+7)/8, srvr_ecpoint, clnt_ecdh, NULL);
+                        if (n <= 0)
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 
+                                       ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+
+                        /* generate master key from the result */
+                        s->session->master_key_length = s->method->ssl3_enc \
+                            -> generate_master_secret(s, 
+                                s->session->master_key,
+                                p, n);
+
+                        memset(p, 0, n); /* clean up */
+
+                        if (ecdh_clnt_cert) 
+                                {
+                                /* Send empty client key exch message */
+                                n = 0;
+                                }
+                        else 
+                                {
+                                /* First check the size of encoding and
+                                 * allocate memory accordingly.
+                                 */
+                                encoded_pt_len = 
+                                    EC_POINT_point2oct(srvr_group, 
+                                        EC_KEY_get0_public_key(clnt_ecdh), 
+                                        POINT_CONVERSION_UNCOMPRESSED, 
+                                        NULL, 0, NULL);
+
+                                encodedPoint = (unsigned char *) 
+                                    OPENSSL_malloc(encoded_pt_len * 
+                                        sizeof(unsigned char)); 
+                                bn_ctx = BN_CTX_new();
+                                if ((encodedPoint == NULL) || 
+                                    (bn_ctx == NULL)) 
+                                        {
+                                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                                        goto err;
+                                        }
+
+                                /* Encode the public key */
+                                n = EC_POINT_point2oct(srvr_group, 
+                                    EC_KEY_get0_public_key(clnt_ecdh), 
+                                    POINT_CONVERSION_UNCOMPRESSED, 
+                                    encodedPoint, encoded_pt_len, bn_ctx);
+
+                                *p = n; /* length of encoded point */
+                                /* Encoded point will be copied here */
+                                p += 1; 
+                                /* copy the point */
+                                memcpy((unsigned char *)p, encodedPoint, n);
+                                /* increment n to account for length field */
+                                n += 1; 
+                                }
+
+                        /* Free allocated memory */
+                        BN_CTX_free(bn_ctx);
+                        if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
+                        if (clnt_ecdh != NULL) 
+                                 EC_KEY_free(clnt_ecdh);
+                        EVP_PKEY_free(srvr_pub_pkey);
+                        }
+#endif /* !OPENSSL_NO_ECDH */
                 else
                         {
-                        ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
-                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
+                        ssl3_send_alert(s, SSL3_AL_FATAL,
+                            SSL_AD_HANDSHAKE_FAILURE);
+                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                            ERR_R_INTERNAL_ERROR);
                         goto err;
                         }
                 
@@ -1708,10 +2326,17 @@ static int ssl3_send_client_key_exchange(SSL *s)
         /* SSL3_ST_CW_KEY_EXCH_B */
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
 err:
+#ifndef OPENSSL_NO_ECDH
+        BN_CTX_free(bn_ctx);
+        if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
+        if (clnt_ecdh != NULL) 
+                EC_KEY_free(clnt_ecdh);
+        EVP_PKEY_free(srvr_pub_pkey);
+#endif
         return(-1);
         }
 
-static int ssl3_send_client_verify(SSL *s)
+int ssl3_send_client_verify(SSL *s)
         {
         unsigned char *p,*d;
         unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
@@ -1720,7 +2345,7 @@ static int ssl3_send_client_verify(SSL *s)
         unsigned u=0;
 #endif
         unsigned long n;
-#ifndef OPENSSL_NO_DSA
+#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
         int j;
 #endif
 
@@ -1766,6 +2391,23 @@ static int ssl3_send_client_verify(SSL *s)
                         }
                 else
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                        if (pkey->type == EVP_PKEY_EC)
+                        {
+                        if (!ECDSA_sign(pkey->save_type,
+                                &(data[MD5_DIGEST_LENGTH]),
+                                SHA_DIGEST_LENGTH,&(p[2]),
+                                (unsigned int *)&j,pkey->pkey.ec))
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,
+                                    ERR_R_ECDSA_LIB);
+                                goto err;
+                                }
+                        s2n(j,p);
+                        n=j+2;
+                        }
+                else
+#endif
                         {
                         SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_INTERNAL_ERROR);
                         goto err;
@@ -1782,7 +2424,7 @@ err:
         return(-1);
         }
 
-static int ssl3_send_client_certificate(SSL *s)
+int ssl3_send_client_certificate(SSL *s)
         {
         X509 *x509=NULL;
         EVP_PKEY *pkey=NULL;
@@ -1861,7 +2503,7 @@ static int ssl3_send_client_certificate(SSL *s)
 
 #define has_bits(i,m)   (((i)&(m)) == (m))
 
-static int ssl3_check_cert_and_algorithm(SSL *s)
+int ssl3_check_cert_and_algorithm(SSL *s)
         {
         int i,idx;
         long algs;
@@ -1876,18 +2518,18 @@ static int ssl3_check_cert_and_algorithm(SSL *s)
 
         sc=s->session->sess_cert;
 
-        if (sc == NULL)
-                {
-                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,ERR_R_INTERNAL_ERROR);
-                goto err;
-                }
-
         algs=s->s3->tmp.new_cipher->algorithms;
 
         /* we don't have a certificate */
         if (algs & (SSL_aDH|SSL_aNULL|SSL_aKRB5))
                 return(1);
 
+        if (sc == NULL)
+                {
+                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,ERR_R_INTERNAL_ERROR);
+                goto err;
+                }
+
 #ifndef OPENSSL_NO_RSA
         rsa=s->session->sess_cert->peer_rsa_tmp;
 #endif
@@ -1898,6 +2540,21 @@ static int ssl3_check_cert_and_algorithm(SSL *s)
         /* This is the passed certificate */
 
         idx=sc->peer_cert_type;
+#ifndef OPENSSL_NO_ECDH
+        if (idx == SSL_PKEY_ECC)
+                {
+                if (check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509,
+                    s->s3->tmp.new_cipher) == 0) 
+                        { /* check failed */
+                        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_BAD_ECC_CERT);
+                        goto f_err;                     
+                        }
+                else 
+                        {
+                        return 1;
+                        }
+                }
+#endif
         pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
         i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
         EVP_PKEY_free(pkey);
@@ -1983,3 +2640,79 @@ err:
         return(0);
         }
 
+
+#ifndef OPENSSL_NO_ECDH
+/* This is the complement of nid2curve_id in s3_srvr.c. */
+static int curve_id2nid(int curve_id)
+{
+        /* ECC curves from draft-ietf-tls-ecc-01.txt (Mar 15, 2001)
+         * (no changes in draft-ietf-tls-ecc-03.txt [June 2003]) */
+        static int nid_list[26] =
+        {
+                0,
+                NID_sect163k1, /* sect163k1 (1) */
+                NID_sect163r1, /* sect163r1 (2) */
+                NID_sect163r2, /* sect163r2 (3) */
+                NID_sect193r1, /* sect193r1 (4) */ 
+                NID_sect193r2, /* sect193r2 (5) */ 
+                NID_sect233k1, /* sect233k1 (6) */
+                NID_sect233r1, /* sect233r1 (7) */ 
+                NID_sect239k1, /* sect239k1 (8) */ 
+                NID_sect283k1, /* sect283k1 (9) */
+                NID_sect283r1, /* sect283r1 (10) */ 
+                NID_sect409k1, /* sect409k1 (11) */ 
+                NID_sect409r1, /* sect409r1 (12) */
+                NID_sect571k1, /* sect571k1 (13) */ 
+                NID_sect571r1, /* sect571r1 (14) */ 
+                NID_secp160k1, /* secp160k1 (15) */
+                NID_secp160r1, /* secp160r1 (16) */ 
+                NID_secp160r2, /* secp160r2 (17) */ 
+                NID_secp192k1, /* secp192k1 (18) */
+                NID_X9_62_prime192v1, /* secp192r1 (19) */ 
+                NID_secp224k1, /* secp224k1 (20) */ 
+                NID_secp224r1, /* secp224r1 (21) */
+                NID_secp256k1, /* secp256k1 (22) */ 
+                NID_X9_62_prime256v1, /* secp256r1 (23) */ 
+                NID_secp384r1, /* secp384r1 (24) */
+                NID_secp521r1  /* secp521r1 (25) */     
+        };
+        
+        if ((curve_id < 1) || (curve_id > 25)) return 0;
+
+        return nid_list[curve_id];
+}
+#endif
+
+/* Check to see if handshake is full or resumed. Usually this is just a
+ * case of checking to see if a cache hit has occurred. In the case of
+ * session tickets we have to check the next message to be sure.
+ */
+
+#ifndef OPENSSL_NO_TLSEXT
+static int ssl3_check_finished(SSL *s)
+        {
+        int ok;
+        long n;
+        /* If we have no ticket or session ID is non-zero length (a match of
+         * a non-zero session length would never reach here) it cannot be a
+         * resumed session.
+         */
+        if (!s->session->tlsext_tick || s->session->session_id_length)
+                return 1;
+        /* this function is called when we really expect a Certificate
+         * message, so permit appropriate message length */
+        n=s->method->ssl_get_message(s,
+                SSL3_ST_CR_CERT_A,
+                SSL3_ST_CR_CERT_B,
+                -1,
+                s->max_cert_list,
+                &ok);
+        if (!ok) return((int)n);
+        s->s3->tmp.reuse_message = 1;
+        if ((s->s3->tmp.message_type == SSL3_MT_FINISHED)
+                || (s->s3->tmp.message_type == SSL3_MT_NEWSESSION_TICKET))
+                return 2;
+
+        return 1;
+        }
+#endif
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index a77588e725..bdbcd44f27 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -108,19 +108,35 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * ECC cipher suite support in OpenSSL originally written by
+ * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
+ *
+ */
 
 #include <stdio.h>
 #include <openssl/objects.h>
 #include "ssl_locl.h"
 #include "kssl_lcl.h"
 #include <openssl/md5.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/pq_compat.h>
 
-const char *ssl3_version_str="SSLv3" OPENSSL_VERSION_PTEXT;
+const char ssl3_version_str[]="SSLv3" OPENSSL_VERSION_PTEXT;
 
 #define SSL3_NUM_CIPHERS        (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
 
-static long ssl3_default_timeout(void );
-
+/* list of available SSLv3 ciphers (sorted by id) */
 OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 /* The RSA ciphers */
 /* Cipher 01 */
@@ -142,82 +158,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_RSA_NULL_SHA,
         SSL3_CK_RSA_NULL_SHA,
         SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        0,
-        0,
-        0,
-        SSL_ALL_CIPHERS,
-        SSL_ALL_STRENGTHS,
-        },
-
-/* anon DH */
-/* Cipher 17 */
-        {
-        1,
-        SSL3_TXT_ADH_RC4_40_MD5,
-        SSL3_CK_ADH_RC4_40_MD5,
-        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        0,
-        40,
-        128,
-        SSL_ALL_CIPHERS,
-        SSL_ALL_STRENGTHS,
-        },
-/* Cipher 18 */
-        {
-        1,
-        SSL3_TXT_ADH_RC4_128_MD5,
-        SSL3_CK_ADH_RC4_128_MD5,
-        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        0,
-        128,
-        128,
-        SSL_ALL_CIPHERS,
-        SSL_ALL_STRENGTHS,
-        },
-/* Cipher 19 */
-        {
-        1,
-        SSL3_TXT_ADH_DES_40_CBC_SHA,
-        SSL3_CK_ADH_DES_40_CBC_SHA,
-        SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_NOT_EXP|SSL_STRONG_NONE,
         0,
-        40,
-        128,
-        SSL_ALL_CIPHERS,
-        SSL_ALL_STRENGTHS,
-        },
-/* Cipher 1A */
-        {
-        1,
-        SSL3_TXT_ADH_DES_64_CBC_SHA,
-        SSL3_CK_ADH_DES_64_CBC_SHA,
-        SSL_kEDH |SSL_aNULL|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
         0,
-        56,
-        56,
-        SSL_ALL_CIPHERS,
-        SSL_ALL_STRENGTHS,
-        },
-/* Cipher 1B */
-        {
-        1,
-        SSL3_TXT_ADH_DES_192_CBC_SHA,
-        SSL3_CK_ADH_DES_192_CBC_SHA,
-        SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
         0,
-        168,
-        168,
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
-
-/* RSA again */
 /* Cipher 03 */
         {
         1,
@@ -291,7 +238,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_RSA_DES_40_CBC_SHA,
         SSL3_CK_RSA_DES_40_CBC_SHA,
         SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_EXPORT|SSL_EXP40,
         0,
         40,
         56,
@@ -304,7 +251,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_RSA_DES_64_CBC_SHA,
         SSL3_CK_RSA_DES_64_CBC_SHA,
         SSL_kRSA|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
+        SSL_NOT_EXP|SSL_LOW,
         0,
         56,
         56,
@@ -317,22 +264,21 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_RSA_DES_192_CBC3_SHA,
         SSL3_CK_RSA_DES_192_CBC3_SHA,
         SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
         168,
         168,
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
-
-/*  The DH ciphers */
+/* The DH ciphers */
 /* Cipher 0B */
         {
         0,
         SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
         SSL3_CK_DH_DSS_DES_40_CBC_SHA,
         SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_EXPORT|SSL_EXP40,
         0,
         40,
         56,
@@ -345,7 +291,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
         SSL3_CK_DH_DSS_DES_64_CBC_SHA,
         SSL_kDHd |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
+        SSL_NOT_EXP|SSL_LOW,
         0,
         56,
         56,
@@ -358,7 +304,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
         SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
         SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
         168,
         168,
@@ -371,7 +317,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
         SSL3_CK_DH_RSA_DES_40_CBC_SHA,
         SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_EXPORT|SSL_EXP40,
         0,
         40,
         56,
@@ -384,7 +330,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
         SSL3_CK_DH_RSA_DES_64_CBC_SHA,
         SSL_kDHr |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
+        SSL_NOT_EXP|SSL_LOW,
         0,
         56,
         56,
@@ -397,7 +343,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
         SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
         SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
         168,
         168,
@@ -412,7 +358,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
         SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
         SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_EXPORT|SSL_EXP40,
         0,
         40,
         56,
@@ -425,7 +371,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
         SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
         SSL_kEDH|SSL_aDSS|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
+        SSL_NOT_EXP|SSL_LOW,
         0,
         56,
         56,
@@ -438,7 +384,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
         SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
         SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
         168,
         168,
@@ -451,7 +397,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
         SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
         SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_EXPORT|SSL_EXP40,
         0,
         40,
         56,
@@ -464,7 +410,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
         SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
         SSL_kEDH|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
+        SSL_NOT_EXP|SSL_LOW,
         0,
         56,
         56,
@@ -477,7 +423,72 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
         SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
         SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        168,
+        168,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 17 */
+        {
+        1,
+        SSL3_TXT_ADH_RC4_40_MD5,
+        SSL3_CK_ADH_RC4_40_MD5,
+        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
+        0,
+        40,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 18 */
+        {
+        1,
+        SSL3_TXT_ADH_RC4_128_MD5,
+        SSL3_CK_ADH_RC4_128_MD5,
+        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 19 */
+        {
+        1,
+        SSL3_TXT_ADH_DES_40_CBC_SHA,
+        SSL3_CK_ADH_DES_40_CBC_SHA,
+        SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
+        0,
+        40,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 1A */
+        {
+        1,
+        SSL3_TXT_ADH_DES_64_CBC_SHA,
+        SSL3_CK_ADH_DES_64_CBC_SHA,
+        SSL_kEDH |SSL_aNULL|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_LOW,
+        0,
+        56,
+        56,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 1B */
+        {
+        1,
+        SSL3_TXT_ADH_DES_192_CBC_SHA,
+        SSL3_CK_ADH_DES_192_CBC_SHA,
+        SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
         168,
         168,
@@ -531,17 +542,14 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 #endif
 
 #ifndef OPENSSL_NO_KRB5
-/* The Kerberos ciphers
-** 20000107 VRS: And the first shall be last,
-** in hopes of avoiding the lynx ssl renegotiation problem.
-*/
-/* Cipher 1E VRS */
+/* The Kerberos ciphers */
+/* Cipher 1E */
         {
         1,
         SSL3_TXT_KRB5_DES_64_CBC_SHA,
         SSL3_CK_KRB5_DES_64_CBC_SHA,
         SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_SHA1   |SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
+        SSL_NOT_EXP|SSL_LOW,
         0,
         56,
         56,
@@ -549,21 +557,21 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 1F VRS */
+/* Cipher 1F */
         {
         1,
         SSL3_TXT_KRB5_DES_192_CBC3_SHA,
         SSL3_CK_KRB5_DES_192_CBC3_SHA,
         SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_SHA1  |SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
-        112,
+        168,
         168,
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 20 VRS */
+/* Cipher 20 */
         {
         1,
         SSL3_TXT_KRB5_RC4_128_SHA,
@@ -577,7 +585,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 21 VRS */
+/* Cipher 21 */
         {
         1,
         SSL3_TXT_KRB5_IDEA_128_CBC_SHA,
@@ -591,7 +599,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 22 VRS */
+/* Cipher 22 */
         {
         1,
         SSL3_TXT_KRB5_DES_64_CBC_MD5,
@@ -605,7 +613,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 23 VRS */
+/* Cipher 23 */
         {
         1,
         SSL3_TXT_KRB5_DES_192_CBC3_MD5,
@@ -613,13 +621,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_MD5   |SSL_SSLV3,
         SSL_NOT_EXP|SSL_HIGH,
         0,
-        112,
+        168,
         168,
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 24 VRS */
+/* Cipher 24 */
         {
         1,
         SSL3_TXT_KRB5_RC4_128_MD5,
@@ -633,7 +641,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 25 VRS */
+/* Cipher 25 */
         {
         1,
         SSL3_TXT_KRB5_IDEA_128_CBC_MD5,
@@ -647,13 +655,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 26 VRS */
+/* Cipher 26 */
         {
         1,
         SSL3_TXT_KRB5_DES_40_CBC_SHA,
         SSL3_CK_KRB5_DES_40_CBC_SHA,
         SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_SHA1   |SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_EXPORT|SSL_EXP40,
         0,
         40,
         56,
@@ -661,7 +669,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 27 VRS */
+/* Cipher 27 */
         {
         1,
         SSL3_TXT_KRB5_RC2_40_CBC_SHA,
@@ -675,7 +683,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 28 VRS */
+/* Cipher 28 */
         {
         1,
         SSL3_TXT_KRB5_RC4_40_SHA,
@@ -683,13 +691,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_kKRB5|SSL_aKRB5|  SSL_RC4|SSL_SHA1   |SSL_SSLV3,
         SSL_EXPORT|SSL_EXP40,
         0,
-        128,
+        40,
         128,
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 29 VRS */
+/* Cipher 29 */
         {
         1,
         SSL3_TXT_KRB5_DES_40_CBC_MD5,
@@ -703,7 +711,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 2A VRS */
+/* Cipher 2A */
         {
         1,
         SSL3_TXT_KRB5_RC2_40_CBC_MD5,
@@ -717,7 +725,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 2B VRS */
+/* Cipher 2B */
         {
         1,
         SSL3_TXT_KRB5_RC4_40_MD5,
@@ -725,16 +733,258 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_kKRB5|SSL_aKRB5|  SSL_RC4|SSL_MD5    |SSL_SSLV3,
         SSL_EXPORT|SSL_EXP40,
         0,
-        128,
+        40,
         128,
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
 #endif  /* OPENSSL_NO_KRB5 */
 
+/* New AES ciphersuites */
+/* Cipher 2F */
+        {
+        1,
+        TLS1_TXT_RSA_WITH_AES_128_SHA,
+        TLS1_CK_RSA_WITH_AES_128_SHA,
+        SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 30 */
+        {
+        0,
+        TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
+        TLS1_CK_DH_DSS_WITH_AES_128_SHA,
+        SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 31 */
+        {
+        0,
+        TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
+        TLS1_CK_DH_RSA_WITH_AES_128_SHA,
+        SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 32 */
+        {
+        1,
+        TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
+        TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
+        SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 33 */
+        {
+        1,
+        TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
+        TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
+        SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 34 */
+        {
+        1,
+        TLS1_TXT_ADH_WITH_AES_128_SHA,
+        TLS1_CK_ADH_WITH_AES_128_SHA,
+        SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+/* Cipher 35 */
+        {
+        1,
+        TLS1_TXT_RSA_WITH_AES_256_SHA,
+        TLS1_CK_RSA_WITH_AES_256_SHA,
+        SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 36 */
+        {
+        0,
+        TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
+        TLS1_CK_DH_DSS_WITH_AES_256_SHA,
+        SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 37 */
+        {
+        0,
+        TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
+        TLS1_CK_DH_RSA_WITH_AES_256_SHA,
+        SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 38 */
+        {
+        1,
+        TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
+        TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
+        SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 39 */
+        {
+        1,
+        TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
+        TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
+        SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+        /* Cipher 3A */
+        {
+        1,
+        TLS1_TXT_ADH_WITH_AES_256_SHA,
+        TLS1_CK_ADH_WITH_AES_256_SHA,
+        SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+#ifndef OPENSSL_NO_CAMELLIA
+        /* Camellia ciphersuites from RFC4132 (128-bit portion) */
+
+        /* Cipher 41 */
+        {
+        1,
+        TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA,
+        TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA,
+        SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 42 */
+        {
+        0, /* not implemented (non-ephemeral DH) */
+        TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
+        TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
+        SSL_kDHd|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 43 */
+        {
+        0, /* not implemented (non-ephemeral DH) */
+        TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
+        TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
+        SSL_kDHr|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 44 */
+        {
+        1,
+        TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
+        TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
+        SSL_kEDH|SSL_aDSS|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 45 */
+        {
+        1,
+        TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
+        TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
+        SSL_kEDH|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 46 */
+        {
+        1,
+        TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA,
+        TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA,
+        SSL_kEDH|SSL_aNULL|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+#endif /* OPENSSL_NO_CAMELLIA */
 
 #if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES
-        /* New TLS Export CipherSuites */
+        /* New TLS Export CipherSuites from expired ID */
+#if 0
         /* Cipher 60 */
             {
             1,
@@ -761,13 +1011,14 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
             SSL_ALL_CIPHERS,
             SSL_ALL_STRENGTHS,
             },
+#endif
         /* Cipher 62 */
             {
             1,
             TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
             TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
             SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1,
-            SSL_EXPORT|SSL_EXP56|SSL_FIPS,
+            SSL_EXPORT|SSL_EXP56,
             0,
             56,
             56,
@@ -780,7 +1031,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
             TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
             TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
             SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1,
-            SSL_EXPORT|SSL_EXP56|SSL_FIPS,
+            SSL_EXPORT|SSL_EXP56,
             0,
             56,
             56,
@@ -827,170 +1078,536 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
             SSL_ALL_STRENGTHS
             },
 #endif
-        /* New AES ciphersuites */
 
-        /* Cipher 2F */
+#ifndef OPENSSL_NO_CAMELLIA
+        /* Camellia ciphersuites from RFC4132 (256-bit portion) */
+
+        /* Cipher 84 */
+        {
+        1,
+        TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA,
+        TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA,
+        SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 85 */
+        {
+        0, /* not implemented (non-ephemeral DH) */
+        TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
+        TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
+        SSL_kDHd|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 86 */
+        {
+        0, /* not implemented (non-ephemeral DH) */
+        TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
+        TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
+        SSL_kDHr|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 87 */
+        {
+        1,
+        TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
+        TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
+        SSL_kEDH|SSL_aDSS|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 88 */
+        {
+        1,
+        TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
+        TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
+        SSL_kEDH|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 89 */
+        {
+        1,
+        TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA,
+        TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA,
+        SSL_kEDH|SSL_aNULL|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+#endif /* OPENSSL_NO_CAMELLIA */
+
+#ifndef OPENSSL_NO_SEED
+        /* SEED ciphersuites from RFC4162 */
+
+        /* Cipher 96 */
+        {
+        1,
+        TLS1_TXT_RSA_WITH_SEED_SHA,
+        TLS1_CK_RSA_WITH_SEED_SHA,
+        SSL_kRSA|SSL_aRSA|SSL_SEED|SSL_SHA1|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+        /* Cipher 97 */
+        {
+        0, /* not implemented (non-ephemeral DH) */
+        TLS1_TXT_DH_DSS_WITH_SEED_SHA,
+        TLS1_CK_DH_DSS_WITH_SEED_SHA,
+        SSL_kDHd|SSL_aDH|SSL_SEED|SSL_SHA1|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+        /* Cipher 98 */
+        {
+        0, /* not implemented (non-ephemeral DH) */
+        TLS1_TXT_DH_RSA_WITH_SEED_SHA,
+        TLS1_CK_DH_RSA_WITH_SEED_SHA,
+        SSL_kDHr|SSL_aDH|SSL_SEED|SSL_SHA1|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+        /* Cipher 99 */
+        {
+        1,
+        TLS1_TXT_DHE_DSS_WITH_SEED_SHA,
+        TLS1_CK_DHE_DSS_WITH_SEED_SHA,
+        SSL_kEDH|SSL_aDSS|SSL_SEED|SSL_SHA1|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+        /* Cipher 9A */
+        {
+        1,
+        TLS1_TXT_DHE_RSA_WITH_SEED_SHA,
+        TLS1_CK_DHE_RSA_WITH_SEED_SHA,
+        SSL_kEDH|SSL_aRSA|SSL_SEED|SSL_SHA1|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+        /* Cipher 9B */
+        {
+        1,
+        TLS1_TXT_ADH_WITH_SEED_SHA,
+        TLS1_CK_ADH_WITH_SEED_SHA,
+        SSL_kEDH|SSL_aNULL|SSL_SEED|SSL_SHA1|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+#endif /* OPENSSL_NO_SEED */
+
+#ifndef OPENSSL_NO_ECDH
+        /* Cipher C001 */
             {
-            1,
-            TLS1_TXT_RSA_WITH_AES_128_SHA,
-            TLS1_CK_RSA_WITH_AES_128_SHA,
-            SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            128,
-            128,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 30 */
+            1,
+            TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA,
+            TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA,
+            SSL_kECDH|SSL_aECDSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            0,
+            0,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C002 */
             {
-            0,
-            TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
-            TLS1_CK_DH_DSS_WITH_AES_128_SHA,
-            SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            128,
-            128,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 31 */
+            1,
+            TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA,
+            TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA,
+            SSL_kECDH|SSL_aECDSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C003 */
             {
-            0,
-            TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
-            TLS1_CK_DH_RSA_WITH_AES_128_SHA,
-            SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            128,
-            128,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 32 */
+            1,
+            TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
+            TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
+            SSL_kECDH|SSL_aECDSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            168,
+            168,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C004 */
             {
-            1,
-            TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
-            TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
-            SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            128,
-            128,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 33 */
+            1,
+            TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+            TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+            SSL_kECDH|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C005 */
             {
-            1,
-            TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
-            TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
-            SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            128,
-            128,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 34 */
+            1,
+            TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+            TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+            SSL_kECDH|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            256,
+            256,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C006 */
             {
-            1,
-            TLS1_TXT_ADH_WITH_AES_128_SHA,
-            TLS1_CK_ADH_WITH_AES_128_SHA,
-            SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            128,
-            128,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-
-        /* Cipher 35 */
+            1,
+            TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
+            TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
+            SSL_kECDHE|SSL_aECDSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            0,
+            0,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C007 */
             {
-            1,
-            TLS1_TXT_RSA_WITH_AES_256_SHA,
-            TLS1_CK_RSA_WITH_AES_256_SHA,
-            SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            256,
-            256,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 36 */
+            1,
+            TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
+            TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
+            SSL_kECDHE|SSL_aECDSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C008 */
             {
-            0,
-            TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
-            TLS1_CK_DH_DSS_WITH_AES_256_SHA,
-            SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            256,
-            256,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 37 */
+            1,
+            TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
+            TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
+            SSL_kECDHE|SSL_aECDSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            168,
+            168,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C009 */
             {
-            0,
-            TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
-            TLS1_CK_DH_RSA_WITH_AES_256_SHA,
-            SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            256,
-            256,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 38 */
+            1,
+            TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+            TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+            SSL_kECDHE|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C00A */
             {
-            1,
-            TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
-            TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
-            SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            256,
-            256,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 39 */
+            1,
+            TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+            TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+            SSL_kECDHE|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            256,
+            256,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C00B */
             {
-            1,
-            TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
-            TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
-            SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            256,
-            256,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 3A */
+            1,
+            TLS1_TXT_ECDH_RSA_WITH_NULL_SHA,
+            TLS1_CK_ECDH_RSA_WITH_NULL_SHA,
+            SSL_kECDH|SSL_aRSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            0,
+            0,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C00C */
             {
-            1,
-            TLS1_TXT_ADH_WITH_AES_256_SHA,
-            TLS1_CK_ADH_WITH_AES_256_SHA,
-            SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            256,
-            256,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
+            1,
+            TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA,
+            TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA,
+            SSL_kECDH|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C00D */
+            {
+            1,
+            TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA,
+            TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA,
+            SSL_kECDH|SSL_aRSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            168,
+            168,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C00E */
+            {
+            1,
+            TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA,
+            TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA,
+            SSL_kECDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C00F */
+            {
+            1,
+            TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA,
+            TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA,
+            SSL_kECDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            256,
+            256,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C010 */
+            {
+            1,
+            TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
+            TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
+            SSL_kECDHE|SSL_aRSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            0,
+            0,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C011 */
+            {
+            1,
+            TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
+            TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
+            SSL_kECDHE|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C012 */
+            {
+            1,
+            TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
+            TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
+            SSL_kECDHE|SSL_aRSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            168,
+            168,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C013 */
+            {
+            1,
+            TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+            TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+            SSL_kECDHE|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C014 */
+            {
+            1,
+            TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+            TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+            SSL_kECDHE|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            256,
+            256,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C015 */
+            {
+            1,
+            TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
+            TLS1_CK_ECDH_anon_WITH_NULL_SHA,
+            SSL_kECDHE|SSL_aNULL|SSL_eNULL|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            0,
+            0,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
 
+        /* Cipher C016 */
+            {
+            1,
+            TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
+            TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
+            SSL_kECDHE|SSL_aNULL|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C017 */
+            {
+            1,
+            TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
+            TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
+            SSL_kECDHE|SSL_aNULL|SSL_3DES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            168,
+            168,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C018 */
+            {
+            1,
+            TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
+            TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
+            SSL_kECDHE|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C019 */
+            {
+            1,
+            TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
+            TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
+            SSL_kECDHE|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            256,
+            256,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+#endif  /* OPENSSL_NO_ECDH */
+
+
 /* end of list */
         };
 
-static SSL3_ENC_METHOD SSLv3_enc_data={
+SSL3_ENC_METHOD SSLv3_enc_data={
         ssl3_enc,
         ssl3_mac,
         ssl3_setup_key_block,
@@ -1004,45 +1621,17 @@ static SSL3_ENC_METHOD SSLv3_enc_data={
         ssl3_alert_code,
         };
 
-static SSL_METHOD SSLv3_data= {
-        SSL3_VERSION,
-        ssl3_new,
-        ssl3_clear,
-        ssl3_free,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl3_read,
-        ssl3_peek,
-        ssl3_write,
-        ssl3_shutdown,
-        ssl3_renegotiate,
-        ssl3_renegotiate_check,
-        ssl3_ctrl,
-        ssl3_ctx_ctrl,
-        ssl3_get_cipher_by_char,
-        ssl3_put_cipher_by_char,
-        ssl3_pending,
-        ssl3_num_ciphers,
-        ssl3_get_cipher,
-        ssl_bad_method,
-        ssl3_default_timeout,
-        &SSLv3_enc_data,
-        ssl_undefined_function,
-        ssl3_callback_ctrl,
-        ssl3_ctx_callback_ctrl,
-        };
-
-static long ssl3_default_timeout(void)
+long ssl3_default_timeout(void)
         {
         /* 2 hours, the 24 hours mentioned in the SSLv3 spec
          * is way too long for http, the cache would over fill */
         return(60*60*2);
         }
 
-SSL_METHOD *sslv3_base_method(void)
-        {
-        return(&SSLv3_data);
-        }
+IMPLEMENT_ssl3_meth_func(sslv3_base_method,
+                        ssl_undefined_function,
+                        ssl_undefined_function,
+                        ssl_bad_method)
 
 int ssl3_num_ciphers(void)
         {
@@ -1073,6 +1662,8 @@ int ssl3_new(SSL *s)
         memset(s3,0,sizeof *s3);
         EVP_MD_CTX_init(&s3->finish_dgst1);
         EVP_MD_CTX_init(&s3->finish_dgst2);
+        pq_64bit_init(&(s3->rrec.seq_num));
+        pq_64bit_init(&(s3->wrec.seq_num));
 
         s->s3=s3;
 
@@ -1098,10 +1689,18 @@ void ssl3_free(SSL *s)
         if (s->s3->tmp.dh != NULL)
                 DH_free(s->s3->tmp.dh);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        if (s->s3->tmp.ecdh != NULL)
+                EC_KEY_free(s->s3->tmp.ecdh);
+#endif
+
         if (s->s3->tmp.ca_names != NULL)
                 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
         EVP_MD_CTX_cleanup(&s->s3->finish_dgst1);
         EVP_MD_CTX_cleanup(&s->s3->finish_dgst2);
+        pq_64bit_free(&(s->s3->rrec.seq_num));
+        pq_64bit_free(&(s->s3->wrec.seq_num));
+
         OPENSSL_cleanse(s->s3,sizeof *s->s3);
         OPENSSL_free(s->s3);
         s->s3=NULL;
@@ -1125,6 +1724,10 @@ void ssl3_clear(SSL *s)
         if (s->s3->tmp.dh != NULL)
                 DH_free(s->s3->tmp.dh);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        if (s->s3->tmp.ecdh != NULL)
+                EC_KEY_free(s->s3->tmp.ecdh);
+#endif
 
         rp = s->s3->rbuf.buf;
         wp = s->s3->wbuf.buf;
@@ -1263,13 +1866,122 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                 }
                 break;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        case SSL_CTRL_SET_TMP_ECDH:
+                {
+                EC_KEY *ecdh = NULL;
+                        
+                if (parg == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
+                        return(ret);
+                        }
+                if (!EC_KEY_up_ref((EC_KEY *)parg))
+                        {
+                        SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB);
+                        return(ret);
+                        }
+                ecdh = (EC_KEY *)parg;
+                if (!(s->options & SSL_OP_SINGLE_ECDH_USE))
+                        {
+                        if (!EC_KEY_generate_key(ecdh))
+                                {
+                                EC_KEY_free(ecdh);
+                                SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB);
+                                return(ret);
+                                }
+                        }
+                if (s->cert->ecdh_tmp != NULL)
+                        EC_KEY_free(s->cert->ecdh_tmp);
+                s->cert->ecdh_tmp = ecdh;
+                ret = 1;
+                }
+                break;
+        case SSL_CTRL_SET_TMP_ECDH_CB:
+                {
+                SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return(ret);
+                }
+                break;
+#endif /* !OPENSSL_NO_ECDH */
+#ifndef OPENSSL_NO_TLSEXT
+        case SSL_CTRL_SET_TLSEXT_HOSTNAME:
+                if (larg == TLSEXT_NAMETYPE_host_name)
+                        {
+                        if (s->tlsext_hostname != NULL) 
+                                OPENSSL_free(s->tlsext_hostname);
+                        s->tlsext_hostname = NULL;
+
+                        ret = 1;
+                        if (parg == NULL) 
+                                break;
+                        if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name)
+                                {
+                                SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
+                                return 0;
+                                }
+                        if ((s->tlsext_hostname = BUF_strdup((char *)parg)) == NULL)
+                                {
+                                SSLerr(SSL_F_SSL3_CTRL, ERR_R_INTERNAL_ERROR);
+                                return 0;
+                                }
+                        }
+                else
+                        {
+                        SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
+                        return 0;
+                        }
+                break;
+        case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
+                s->tlsext_debug_arg=parg;
+                ret = 1;
+                break;
+  
+        case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
+                s->tlsext_status_type=larg;
+                ret = 1;
+                break;
+
+        case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS:
+                *(STACK_OF(X509_EXTENSION) **)parg = s->tlsext_ocsp_exts;
+                ret = 1;
+                break;
+
+        case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS:
+                s->tlsext_ocsp_exts = parg;
+                ret = 1;
+                break;
+
+        case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS:
+                *(STACK_OF(OCSP_RESPID) **)parg = s->tlsext_ocsp_ids;
+                ret = 1;
+                break;
+
+        case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS:
+                s->tlsext_ocsp_ids = parg;
+                ret = 1;
+                break;
+
+        case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:
+                *(unsigned char **)parg = s->tlsext_ocsp_resp;
+                return s->tlsext_ocsp_resplen;
+                
+        case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:
+                if (s->tlsext_ocsp_resp)
+                        OPENSSL_free(s->tlsext_ocsp_resp);
+                s->tlsext_ocsp_resp = parg;
+                s->tlsext_ocsp_resplen = larg;
+                ret = 1;
+                break;
+
+#endif /* !OPENSSL_NO_TLSEXT */
         default:
                 break;
                 }
         return(ret);
         }
 
-long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)())
+long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
         {
         int ret=0;
 
@@ -1307,6 +2019,19 @@ long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)())
                 }
                 break;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        case SSL_CTRL_SET_TMP_ECDH_CB:
+                {
+                s->cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
+                }
+                break;
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+        case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
+                s->tlsext_debug_cb=(void (*)(SSL *,int ,int,
+                                        unsigned char *, int, void *))fp;
+                break;
+#endif
         default:
                 break;
                 }
@@ -1399,6 +2124,83 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
                 }
                 break;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        case SSL_CTRL_SET_TMP_ECDH:
+                {
+                EC_KEY *ecdh = NULL;
+                        
+                if (parg == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB);
+                        return 0;
+                        }
+                ecdh = EC_KEY_dup((EC_KEY *)parg);
+                if (ecdh == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_EC_LIB);
+                        return 0;
+                        }
+                if (!(ctx->options & SSL_OP_SINGLE_ECDH_USE))
+                        {
+                        if (!EC_KEY_generate_key(ecdh))
+                                {
+                                EC_KEY_free(ecdh);
+                                SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB);
+                                return 0;
+                                }
+                        }
+
+                if (cert->ecdh_tmp != NULL)
+                        {
+                        EC_KEY_free(cert->ecdh_tmp);
+                        }
+                cert->ecdh_tmp = ecdh;
+                return 1;
+                }
+                /* break; */
+        case SSL_CTRL_SET_TMP_ECDH_CB:
+                {
+                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return(0);
+                }
+                break;
+#endif /* !OPENSSL_NO_ECDH */
+#ifndef OPENSSL_NO_TLSEXT
+        case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
+                ctx->tlsext_servername_arg=parg;
+                break;
+        case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
+        case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
+                {
+                unsigned char *keys = parg;
+                if (!keys)
+                        return 48;
+                if (larg != 48)
+                        {
+                        SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
+                        return 0;
+                        }
+                if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS)
+                        {
+                        memcpy(ctx->tlsext_tick_key_name, keys, 16);
+                        memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
+                        memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
+                        }
+                else
+                        {
+                        memcpy(keys, ctx->tlsext_tick_key_name, 16);
+                        memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16);
+                        memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16);
+                        }
+                return 1;
+                }
+  
+        case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
+                ctx->tlsext_status_arg=parg;
+                return 1;
+                break;
+
+#endif /* !OPENSSL_NO_TLSEXT */
         /* A Thawte special :-) */
         case SSL_CTRL_EXTRA_CHAIN_CERT:
                 if (ctx->extra_certs == NULL)
@@ -1415,7 +2217,7 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
         return(1);
         }
 
-long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
+long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
         {
         CERT *cert;
 
@@ -1437,6 +2239,30 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
                 }
                 break;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        case SSL_CTRL_SET_TMP_ECDH_CB:
+                {
+                cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
+                }
+                break;
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+        case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
+                ctx->tlsext_servername_callback=(int (*)(SSL *,int *,void *))fp;
+                break;
+  
+        case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
+                ctx->tlsext_status_cb=(int (*)(SSL *,void *))fp;
+                break;
+
+        case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
+                ctx->tlsext_ticket_key_cb=(int (*)(SSL *,unsigned char  *,
+                                                unsigned char *,
+                                                EVP_CIPHER_CTX *,
+                                                HMAC_CTX *, int))fp;
+                break;
+
+#endif
         default:
                 return(0);
                 }
@@ -1447,41 +2273,19 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
  * available */
 SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
         {
-        static int init=1;
-        static SSL_CIPHER *sorted[SSL3_NUM_CIPHERS];
-        SSL_CIPHER c,*cp= &c,**cpp;
+        SSL_CIPHER c,*cp;
         unsigned long id;
-        int i;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL);
-
-                if (init)
-                        {
-                        for (i=0; i<SSL3_NUM_CIPHERS; i++)
-                                sorted[i]= &(ssl3_ciphers[i]);
-
-                        qsort(sorted,
-                                SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER *),
-                                FP_ICC ssl_cipher_ptr_id_cmp);
-
-                        init=0;
-                        }
-                
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
-                }
 
         id=0x03000000L|((unsigned long)p[0]<<8L)|(unsigned long)p[1];
         c.id=id;
-        cpp=(SSL_CIPHER **)OBJ_bsearch((char *)&cp,
-                (char *)sorted,
-                SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER *),
-                FP_ICC ssl_cipher_ptr_id_cmp);
-        if ((cpp == NULL) || !(*cpp)->valid)
-                return(NULL);
+        cp = (SSL_CIPHER *)OBJ_bsearch((char *)&c,
+                (char *)ssl3_ciphers,
+                SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER),
+                FP_ICC ssl_cipher_id_cmp);
+        if (cp == NULL || cp->valid == 0)
+                return NULL;
         else
-                return(*cpp);
+                return cp;
         }
 
 int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
@@ -1504,6 +2308,7 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
         SSL_CIPHER *c,*ret=NULL;
         STACK_OF(SSL_CIPHER) *prio, *allow;
         int i,j,ok;
+
         CERT *cert;
         unsigned long alg,mask,emask;
 
@@ -1584,7 +2389,6 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                         }
 
                 if (!ok) continue;
-        
                 j=sk_SSL_CIPHER_find(allow,c);
                 if (j >= 0)
                         {
@@ -1629,6 +2433,26 @@ int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
 #ifndef OPENSSL_NO_DSA
         p[ret++]=SSL3_CT_DSS_SIGN;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        /* We should ask for fixed ECDH certificates only
+         * for SSL_kECDH (and not SSL_kECDHE)
+         */
+        if ((alg & SSL_kECDH) && (s->version >= TLS1_VERSION))
+                {
+                p[ret++]=TLS_CT_RSA_FIXED_ECDH;
+                p[ret++]=TLS_CT_ECDSA_FIXED_ECDH;
+                }
+#endif
+
+#ifndef OPENSSL_NO_ECDSA
+        /* ECDSA certs can be used with RSA cipher suites as well 
+         * so we don't need to check for SSL_kECDH or SSL_kECDHE
+         */
+        if (s->version >= TLS1_VERSION)
+                {
+                p[ret++]=TLS_CT_ECDSA_SIGN;
+                }
+#endif  
         return(ret);
         }
 
@@ -1656,13 +2480,13 @@ int ssl3_shutdown(SSL *s)
                 {
                 /* resend it if not sent */
 #if 1
-                ssl3_dispatch_alert(s);
+                s->method->ssl_dispatch_alert(s);
 #endif
                 }
         else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
                 {
                 /* If we are waiting for a close from our peer, we are closed */
-                ssl3_read_bytes(s,0,NULL,0,0);
+                s->method->ssl_read_bytes(s,0,NULL,0,0);
                 }
 
         if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&
@@ -1717,8 +2541,8 @@ int ssl3_write(SSL *s, const void *buf, int len)
                 }
         else
                 {
-                ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA,
-                                     buf,len);
+                ret=s->method->ssl_write_bytes(s,SSL3_RT_APPLICATION_DATA,
+                        buf,len);
                 if (ret <= 0) return(ret);
                 }
 
@@ -1732,7 +2556,7 @@ static int ssl3_read_internal(SSL *s, void *buf, int len, int peek)
         clear_sys_error();
         if (s->s3->renegotiate) ssl3_renegotiate_check(s);
         s->s3->in_read_app_data=1;
-        ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
+        ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
         if ((ret == -1) && (s->s3->in_read_app_data == 2))
                 {
                 /* ssl3_read_bytes decided to call s->handshake_func, which
@@ -1741,7 +2565,7 @@ static int ssl3_read_internal(SSL *s, void *buf, int len, int peek)
                  * and thinks that application data makes sense here; so disable
                  * handshake processing and try to read application data again. */
                 s->in_handshake++;
-                ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
+                ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
                 s->in_handshake--;
                 }
         else
diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c
index cb0b12b400..44c7c143fe 100644
--- a/src/lib/libssl/s3_pkt.c
+++ b/src/lib/libssl/s3_pkt.c
@@ -118,15 +118,9 @@
 
 static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
                          unsigned int len, int create_empty_fragment);
-static int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
-                              unsigned int len);
 static int ssl3_get_record(SSL *s);
-static int do_compress(SSL *ssl);
-static int do_uncompress(SSL *ssl);
-static int do_change_cipher_spec(SSL *ssl);
 
-/* used only by ssl3_get_record */
-static int ssl3_read_n(SSL *s, int n, int max, int extend)
+int ssl3_read_n(SSL *s, int n, int max, int extend)
         {
         /* If extend == 0, obtain new n-byte packet; if extend == 1, increase
          * packet by another n bytes.
@@ -147,6 +141,14 @@ static int ssl3_read_n(SSL *s, int n, int max, int extend)
                 /* ... now we can act as if 'extend' was set */
                 }
 
+        /* extend reads should not span multiple packets for DTLS */
+        if ( SSL_version(s) == DTLS1_VERSION &&
+                extend)
+                {
+                if ( s->s3->rbuf.left > 0 && n > s->s3->rbuf.left)
+                        n = s->s3->rbuf.left;
+                }
+
         /* if there is enough in the buffer from a previous read, take some */
         if (s->s3->rbuf.left >= (int)n)
                 {
@@ -275,11 +277,7 @@ again:
                 n2s(p,rr->length);
 
                 /* Lets check version */
-                if (s->first_packet)
-                        {
-                        s->first_packet=0;
-                        }
-                else
+                if (!s->first_packet)
                         {
                         if (version != s->version)
                                 {
@@ -434,7 +432,7 @@ printf("\n");
                         SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_COMPRESSED_LENGTH_TOO_LONG);
                         goto f_err;
                         }
-                if (!do_uncompress(s))
+                if (!ssl3_do_uncompress(s))
                         {
                         al=SSL_AD_DECOMPRESSION_FAILURE;
                         SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BAD_DECOMPRESSION);
@@ -472,8 +470,9 @@ err:
         return(ret);
         }
 
-static int do_uncompress(SSL *ssl)
+int ssl3_do_uncompress(SSL *ssl)
         {
+#ifndef OPENSSL_NO_COMP
         int i;
         SSL3_RECORD *rr;
 
@@ -485,12 +484,13 @@ static int do_uncompress(SSL *ssl)
         else
                 rr->length=i;
         rr->data=rr->comp;
-
+#endif
         return(1);
         }
 
-static int do_compress(SSL *ssl)
+int ssl3_do_compress(SSL *ssl)
         {
+#ifndef OPENSSL_NO_COMP
         int i;
         SSL3_RECORD *wr;
 
@@ -504,6 +504,7 @@ static int do_compress(SSL *ssl)
                 wr->length=i;
 
         wr->input=wr->data;
+#endif
         return(1);
         }
 
@@ -580,7 +581,7 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
         /* If we have an alert to send, lets send it */
         if (s->s3->alert_dispatch)
                 {
-                i=ssl3_dispatch_alert(s);
+                i=s->method->ssl_dispatch_alert(s);
                 if (i <= 0)
                         return(i);
                 /* if it went, fall through and send more stuff */
@@ -655,7 +656,7 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
         /* first we compress */
         if (s->compress != NULL)
                 {
-                if (!do_compress(s))
+                if (!ssl3_do_compress(s))
                         {
                         SSLerr(SSL_F_DO_SSL3_WRITE,SSL_R_COMPRESSION_FAILURE);
                         goto err;
@@ -716,8 +717,8 @@ err:
         }
 
 /* if s->s3->wbuf.left != 0, we need to call this */
-static int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
-                              unsigned int len)
+int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
+        unsigned int len)
         {
         int i;
 
@@ -1089,7 +1090,7 @@ start:
                 if (s->s3->tmp.new_cipher == NULL)
                         {
                         al=SSL_AD_UNEXPECTED_MESSAGE;
-                        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
+                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_CCS_RECEIVED_EARLY);
                         goto f_err;
                         }
 
@@ -1099,7 +1100,7 @@ start:
                         s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC, rr->data, 1, s, s->msg_callback_arg);
 
                 s->s3->change_cipher_spec=1;
-                if (!do_change_cipher_spec(s))
+                if (!ssl3_do_change_cipher_spec(s))
                         goto err;
                 else
                         goto start;
@@ -1211,7 +1212,7 @@ err:
         return(-1);
         }
 
-static int do_change_cipher_spec(SSL *s)
+int ssl3_do_change_cipher_spec(SSL *s)
         {
         int i;
         const char *sender;
@@ -1268,7 +1269,7 @@ void ssl3_send_alert(SSL *s, int level, int desc)
         s->s3->send_alert[0]=level;
         s->s3->send_alert[1]=desc;
         if (s->s3->wbuf.left == 0) /* data still being written out? */
-                ssl3_dispatch_alert(s);
+                s->method->ssl_dispatch_alert(s);
         /* else data is still being written out, we will get written
          * some time in the future */
         }
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 36fc39d7f8..903522ab59 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -108,11 +108,23 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * ECC cipher suite support in OpenSSL originally written by
+ * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
+ *
+ */
 
 #define REUSE_CIPHER_BUG
 #define NETSCAPE_HANG_BUG
 
-
 #include <stdio.h>
 #include "ssl_locl.h"
 #include "kssl_lcl.h"
@@ -120,24 +132,21 @@
 #include <openssl/rand.h>
 #include <openssl/objects.h>
 #include <openssl/evp.h>
+#include <openssl/hmac.h>
 #include <openssl/x509.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
 #ifndef OPENSSL_NO_KRB5
 #include <openssl/krb5_asn.h>
 #endif
 #include <openssl/md5.h>
-#include <openssl/fips.h>
 
 static SSL_METHOD *ssl3_get_server_method(int ver);
-static int ssl3_get_client_hello(SSL *s);
-static int ssl3_check_client_hello(SSL *s);
-static int ssl3_send_server_hello(SSL *s);
-static int ssl3_send_server_key_exchange(SSL *s);
-static int ssl3_send_certificate_request(SSL *s);
-static int ssl3_send_server_done(SSL *s);
-static int ssl3_get_client_key_exchange(SSL *s);
-static int ssl3_get_client_certificate(SSL *s);
-static int ssl3_get_cert_verify(SSL *s);
-static int ssl3_send_hello_request(SSL *s);
+#ifndef OPENSSL_NO_ECDH
+static int nid2curve_id(int nid);
+#endif
 
 static SSL_METHOD *ssl3_get_server_method(int ver)
         {
@@ -147,28 +156,10 @@ static SSL_METHOD *ssl3_get_server_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *SSLv3_server_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv3_server_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&SSLv3_server_data,(char *)sslv3_base_method(),
-                                sizeof(SSL_METHOD));
-                        SSLv3_server_data.ssl_accept=ssl3_accept;
-                        SSLv3_server_data.get_ssl_method=ssl3_get_server_method;
-                        init=0;
-                        }
-                        
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv3_server_data);
-        }
+IMPLEMENT_ssl3_meth_func(SSLv3_server_method,
+                        ssl3_accept,
+                        ssl_undefined_function,
+                        ssl3_get_server_method)
 
 int ssl3_accept(SSL *s)
         {
@@ -299,9 +290,18 @@ int ssl3_accept(SSL *s)
                 case SSL3_ST_SW_SRVR_HELLO_B:
                         ret=ssl3_send_server_hello(s);
                         if (ret <= 0) goto end;
-
+#ifndef OPENSSL_NO_TLSEXT
                         if (s->hit)
-                                s->state=SSL3_ST_SW_CHANGE_A;
+                                {
+                                if (s->tlsext_ticket_expected)
+                                        s->state=SSL3_ST_SW_SESSION_TICKET_A;
+                                else
+                                        s->state=SSL3_ST_SW_CHANGE_A;
+                                }
+#else
+                        if (s->hit)
+                                        s->state=SSL3_ST_SW_CHANGE_A;
+#endif
                         else
                                 s->state=SSL3_ST_SW_CERT_A;
                         s->init_num=0;
@@ -309,15 +309,30 @@ int ssl3_accept(SSL *s)
 
                 case SSL3_ST_SW_CERT_A:
                 case SSL3_ST_SW_CERT_B:
-                        /* Check if it is anon DH */
-                        if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
+                        /* Check if it is anon DH or anon ECDH or KRB5 */
+                        if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL)
+                                && !(s->s3->tmp.new_cipher->algorithms & SSL_aKRB5))
                                 {
                                 ret=ssl3_send_server_certificate(s);
                                 if (ret <= 0) goto end;
+#ifndef OPENSSL_NO_TLSEXT
+                                if (s->tlsext_status_expected)
+                                        s->state=SSL3_ST_SW_CERT_STATUS_A;
+                                else
+                                        s->state=SSL3_ST_SW_KEY_EXCH_A;
+                                }
+                        else
+                                {
+                                skip = 1;
+                                s->state=SSL3_ST_SW_KEY_EXCH_A;
+                                }
+#else
                                 }
                         else
                                 skip=1;
+
                         s->state=SSL3_ST_SW_KEY_EXCH_A;
+#endif
                         s->init_num=0;
                         break;
 
@@ -340,9 +355,18 @@ int ssl3_accept(SSL *s)
                         else
                                 s->s3->tmp.use_rsa_tmp=0;
 
+
                         /* only send if a DH key exchange, fortezza or
-                         * RSA but we have a sign only certificate */
+                         * RSA but we have a sign only certificate
+                         *
+                         * For ECC ciphersuites, we send a serverKeyExchange
+                         * message only if the cipher suite is either
+                         * ECDH-anon or ECDHE. In other cases, the
+                         * server certificate contains the server's 
+                         * public key for key exchange.
+                         */
                         if (s->s3->tmp.use_rsa_tmp
+                            || (l & SSL_kECDHE)
                             || (l & (SSL_DH|SSL_kFZA))
                             || ((l & SSL_kRSA)
                                 && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL
@@ -446,19 +470,33 @@ int ssl3_accept(SSL *s)
                 case SSL3_ST_SR_KEY_EXCH_A:
                 case SSL3_ST_SR_KEY_EXCH_B:
                         ret=ssl3_get_client_key_exchange(s);
-                        if (ret <= 0) goto end;
-                        s->state=SSL3_ST_SR_CERT_VRFY_A;
-                        s->init_num=0;
-
-                        /* We need to get hashes here so if there is
-                         * a client cert, it can be verified */ 
-                        s->method->ssl3_enc->cert_verify_mac(s,
-                                &(s->s3->finish_dgst1),
-                                &(s->s3->tmp.cert_verify_md[0]));
-                        s->method->ssl3_enc->cert_verify_mac(s,
-                                &(s->s3->finish_dgst2),
-                                &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]));
+                        if (ret <= 0) 
+                                goto end;
+                        if (ret == 2)
+                                {
+                                /* For the ECDH ciphersuites when
+                                 * the client sends its ECDH pub key in
+                                 * a certificate, the CertificateVerify
+                                 * message is not sent.
+                                 */
+                                s->state=SSL3_ST_SR_FINISHED_A;
+                                s->init_num = 0;
+                                }
+                        else   
+                                {
+                                s->state=SSL3_ST_SR_CERT_VRFY_A;
+                                s->init_num=0;
 
+                                /* We need to get hashes here so if there is
+                                 * a client cert, it can be verified
+                                 */ 
+                                s->method->ssl3_enc->cert_verify_mac(s,
+                                    &(s->s3->finish_dgst1),
+                                    &(s->s3->tmp.cert_verify_md[0]));
+                                s->method->ssl3_enc->cert_verify_mac(s,
+                                    &(s->s3->finish_dgst2),
+                                    &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]));
+                                }
                         break;
 
                 case SSL3_ST_SR_CERT_VRFY_A:
@@ -479,11 +517,34 @@ int ssl3_accept(SSL *s)
                         if (ret <= 0) goto end;
                         if (s->hit)
                                 s->state=SSL_ST_OK;
+#ifndef OPENSSL_NO_TLSEXT
+                        else if (s->tlsext_ticket_expected)
+                                s->state=SSL3_ST_SW_SESSION_TICKET_A;
+#endif
                         else
                                 s->state=SSL3_ST_SW_CHANGE_A;
                         s->init_num=0;
                         break;
 
+#ifndef OPENSSL_NO_TLSEXT
+                case SSL3_ST_SW_SESSION_TICKET_A:
+                case SSL3_ST_SW_SESSION_TICKET_B:
+                        ret=ssl3_send_newsession_ticket(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_SW_CHANGE_A;
+                        s->init_num=0;
+                        break;
+
+                case SSL3_ST_SW_CERT_STATUS_A:
+                case SSL3_ST_SW_CERT_STATUS_B:
+                        ret=ssl3_send_cert_status(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_SW_KEY_EXCH_A;
+                        s->init_num=0;
+                        break;
+
+#endif
+
                 case SSL3_ST_SW_CHANGE_A:
                 case SSL3_ST_SW_CHANGE_B:
 
@@ -589,7 +650,7 @@ end:
         return(ret);
         }
 
-static int ssl3_send_hello_request(SSL *s)
+int ssl3_send_hello_request(SSL *s)
         {
         unsigned char *p;
 
@@ -611,14 +672,14 @@ static int ssl3_send_hello_request(SSL *s)
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
         }
 
-static int ssl3_check_client_hello(SSL *s)
+int ssl3_check_client_hello(SSL *s)
         {
         int ok;
         long n;
 
         /* this function is called when we really expect a Certificate message,
          * so permit appropriate message length */
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_SR_CERT_A,
                 SSL3_ST_SR_CERT_B,
                 -1,
@@ -644,14 +705,17 @@ static int ssl3_check_client_hello(SSL *s)
         return 1;
 }
 
-static int ssl3_get_client_hello(SSL *s)
+int ssl3_get_client_hello(SSL *s)
         {
         int i,j,ok,al,ret= -1;
+        unsigned int cookie_len;
         long n;
         unsigned long id;
         unsigned char *p,*d,*q;
         SSL_CIPHER *c;
+#ifndef OPENSSL_NO_COMP
         SSL_COMP *comp=NULL;
+#endif
         STACK_OF(SSL_CIPHER) *ciphers=NULL;
 
         /* We do this so that we will respond with our native type.
@@ -662,10 +726,10 @@ static int ssl3_get_client_hello(SSL *s)
          */
         if (s->state == SSL3_ST_SR_CLNT_HELLO_A)
                 {
-                s->first_packet=1;
                 s->state=SSL3_ST_SR_CLNT_HELLO_B;
                 }
-        n=ssl3_get_message(s,
+        s->first_packet=1;
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_SR_CLNT_HELLO_B,
                 SSL3_ST_SR_CLNT_HELLO_C,
                 SSL3_MT_CLIENT_HELLO,
@@ -673,6 +737,7 @@ static int ssl3_get_client_hello(SSL *s)
                 &ok);
 
         if (!ok) return((int)n);
+        s->first_packet=0;
         d=p=(unsigned char *)s->init_msg;
 
         /* use version from inside client hello, not from record header
@@ -680,7 +745,8 @@ static int ssl3_get_client_hello(SSL *s)
         s->client_version=(((int)p[0])<<8)|(int)p[1];
         p+=2;
 
-        if (s->client_version < s->version)
+        if ((s->version == DTLS1_VERSION && s->client_version > s->version) ||
+            (s->version != DTLS1_VERSION && s->client_version < s->version))
                 {
                 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_WRONG_VERSION_NUMBER);
                 if ((s->client_version>>8) == SSL3_VERSION_MAJOR) 
@@ -708,14 +774,14 @@ static int ssl3_get_client_hello(SSL *s)
          * might be written that become totally unsecure when compiled with
          * an earlier library version)
          */
-        if (j == 0 || (s->new_session && (s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION)))
+        if ((s->new_session && (s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION)))
                 {
                 if (!ssl_get_new_session(s,1))
                         goto err;
                 }
         else
                 {
-                i=ssl_get_prev_session(s,p,j);
+                i=ssl_get_prev_session(s, p, j, d + n);
                 if (i == 1)
                         { /* previous session */
                         s->hit=1;
@@ -730,6 +796,68 @@ static int ssl3_get_client_hello(SSL *s)
                 }
 
         p+=j;
+
+        if (s->version == DTLS1_VERSION)
+                {
+                /* cookie stuff */
+                cookie_len = *(p++);
+
+                if ( (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) &&
+                        s->d1->send_cookie == 0)
+                        {
+                        /* HelloVerifyMessage has already been sent */
+                        if ( cookie_len != s->d1->cookie_len)
+                                {
+                                al = SSL_AD_HANDSHAKE_FAILURE;
+                                SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_COOKIE_MISMATCH);
+                                goto f_err;
+                                }
+                        }
+
+                /* 
+                 * The ClientHello may contain a cookie even if the
+                 * HelloVerify message has not been sent--make sure that it
+                 * does not cause an overflow.
+                 */
+                if ( cookie_len > sizeof(s->d1->rcvd_cookie))
+                        {
+                        /* too much data */
+                        al = SSL_AD_DECODE_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_COOKIE_MISMATCH);
+                        goto f_err;
+                        }
+
+                /* verify the cookie if appropriate option is set. */
+                if ( (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) &&
+                        cookie_len > 0)
+                        {
+                        memcpy(s->d1->rcvd_cookie, p, cookie_len);
+
+                        if ( s->ctx->app_verify_cookie_cb != NULL)
+                                {
+                                if ( s->ctx->app_verify_cookie_cb(s, s->d1->rcvd_cookie,
+                                        cookie_len) == 0)
+                                        {
+                                        al=SSL_AD_HANDSHAKE_FAILURE;
+                                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 
+                                                SSL_R_COOKIE_MISMATCH);
+                                        goto f_err;
+                                        }
+                                /* else cookie verification succeeded */
+                                }
+                        else if ( memcmp(s->d1->rcvd_cookie, s->d1->cookie, 
+                                                  s->d1->cookie_len) != 0) /* default verification */
+                                {
+                                        al=SSL_AD_HANDSHAKE_FAILURE;
+                                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 
+                                                SSL_R_COOKIE_MISMATCH);
+                                        goto f_err;
+                                }
+                        }
+
+                p += cookie_len;
+                }
+
         n2s(p,i);
         if ((i == 0) && (j != 0))
                 {
@@ -779,8 +907,7 @@ static int ssl3_get_client_hello(SSL *s)
                         if ((s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
                                 {
                                 /* Very bad for multi-threading.... */
-                                s->session->cipher=sk_SSL_CIPHER_value(ciphers,
-                                                                       0);
+                                s->session->cipher=sk_SSL_CIPHER_value(ciphers, 0);
                                 }
                         else
                                 {
@@ -817,10 +944,27 @@ static int ssl3_get_client_hello(SSL *s)
                 goto f_err;
                 }
 
+#ifndef OPENSSL_NO_TLSEXT
+        /* TLS extensions*/
+        if (s->version > SSL3_VERSION)
+                {
+                if (!ssl_parse_clienthello_tlsext(s,&p,d,n, &al))
+                        {
+                        /* 'al' set by ssl_parse_clienthello_tlsext */
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_PARSE_TLSEXT);
+                        goto f_err;
+                        }
+                }
+                if (ssl_check_clienthello_tlsext(s) <= 0) {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT);
+                        goto err;
+                }
+#endif
         /* Worst case, we will use the NULL compression, but if we have other
          * options, we will now look for them.  We have i-1 compression
          * algorithms from the client, starting at q. */
         s->s3->tmp.new_compression=NULL;
+#ifndef OPENSSL_NO_COMP
         if (s->ctx->comp_methods != NULL)
                 { /* See if we have a match */
                 int m,nn,o,v,done=0;
@@ -845,6 +989,7 @@ static int ssl3_get_client_hello(SSL *s)
                 else
                         comp=NULL;
                 }
+#endif
 
         /* TLS does not mind if there is extra stuff */
 #if 0   /* SSL 3.0 does not mind either, so we should disable this test
@@ -868,7 +1013,11 @@ static int ssl3_get_client_hello(SSL *s)
 
         if (!s->hit)
                 {
+#ifdef OPENSSL_NO_COMP
+                s->session->compress_meth=0;
+#else
                 s->session->compress_meth=(comp == NULL)?0:comp->id;
+#endif
                 if (s->session->ciphers != NULL)
                         sk_SSL_CIPHER_free(s->session->ciphers);
                 s->session->ciphers=ciphers;
@@ -943,7 +1092,7 @@ err:
         return(ret);
         }
 
-static int ssl3_send_server_hello(SSL *s)
+int ssl3_send_server_hello(SSL *s)
         {
         unsigned char *buf;
         unsigned char *p,*d;
@@ -956,7 +1105,7 @@ static int ssl3_send_server_hello(SSL *s)
                 p=s->s3->server_random;
                 Time=(unsigned long)time(NULL);                 /* Time */
                 l2n(Time,p);
-                if(RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
+                if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
                         return -1;
                 /* Do the message type and length last */
                 d=p= &(buf[4]);
@@ -975,12 +1124,20 @@ static int ssl3_send_server_hello(SSL *s)
                  * session-id if we want it to be single use.
                  * Currently I will not implement the '0' length session-id
                  * 12-Jan-98 - I'll now support the '0' length stuff.
+                 *
+                 * We also have an additional case where stateless session
+                 * resumption is successful: we always send back the old
+                 * session id. In this case s->hit is non zero: this can
+                 * only happen if stateless session resumption is succesful
+                 * if session caching is disabled so existing functionality
+                 * is unaffected.
                  */
-                if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER))
+                if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)
+                        && !s->hit)
                         s->session->session_id_length=0;
 
                 sl=s->session->session_id_length;
-                if (sl > sizeof s->session->session_id)
+                if (sl > (int)sizeof(s->session->session_id))
                         {
                         SSLerr(SSL_F_SSL3_SEND_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
                         return -1;
@@ -994,11 +1151,21 @@ static int ssl3_send_server_hello(SSL *s)
                 p+=i;
 
                 /* put the compression method */
+#ifdef OPENSSL_NO_COMP
+                        *(p++)=0;
+#else
                 if (s->s3->tmp.new_compression == NULL)
                         *(p++)=0;
                 else
                         *(p++)=s->s3->tmp.new_compression->id;
-
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+                if ((p = ssl_add_serverhello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_SEND_SERVER_HELLO,ERR_R_INTERNAL_ERROR);
+                        return -1;
+                        }
+#endif
                 /* do the header */
                 l=(p-d);
                 d=buf;
@@ -1015,7 +1182,7 @@ static int ssl3_send_server_hello(SSL *s)
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
         }
 
-static int ssl3_send_server_done(SSL *s)
+int ssl3_send_server_done(SSL *s)
         {
         unsigned char *p;
 
@@ -1039,7 +1206,7 @@ static int ssl3_send_server_done(SSL *s)
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
         }
 
-static int ssl3_send_server_key_exchange(SSL *s)
+int ssl3_send_server_key_exchange(SSL *s)
         {
 #ifndef OPENSSL_NO_RSA
         unsigned char *q;
@@ -1051,6 +1218,13 @@ static int ssl3_send_server_key_exchange(SSL *s)
 #ifndef OPENSSL_NO_DH
         DH *dh=NULL,*dhp;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *ecdh=NULL, *ecdhp;
+        unsigned char *encodedPoint = NULL;
+        int encodedlen = 0;
+        int curve_id = 0;
+        BN_CTX *bn_ctx = NULL; 
+#endif
         EVP_PKEY *pkey;
         unsigned char *p,*d;
         int al,i;
@@ -1159,6 +1333,134 @@ static int ssl3_send_server_key_exchange(SSL *s)
                         }
                 else 
 #endif
+#ifndef OPENSSL_NO_ECDH
+                        if (type & SSL_kECDHE)
+                        {
+                        const EC_GROUP *group;
+
+                        ecdhp=cert->ecdh_tmp;
+                        if ((ecdhp == NULL) && (s->cert->ecdh_tmp_cb != NULL))
+                                {
+                                ecdhp=s->cert->ecdh_tmp_cb(s,
+                                      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
+                                      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
+                                }
+                        if (ecdhp == NULL)
+                                {
+                                al=SSL_AD_HANDSHAKE_FAILURE;
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_ECDH_KEY);
+                                goto f_err;
+                                }
+
+                        if (s->s3->tmp.ecdh != NULL)
+                                {
+                                EC_KEY_free(s->s3->tmp.ecdh); 
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+
+                        /* Duplicate the ECDH structure. */
+                        if (ecdhp == NULL)
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+                        if (!EC_KEY_up_ref(ecdhp))
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+                        ecdh = ecdhp;
+
+                        s->s3->tmp.ecdh=ecdh;
+                        if ((EC_KEY_get0_public_key(ecdh) == NULL) ||
+                            (EC_KEY_get0_private_key(ecdh) == NULL) ||
+                            (s->options & SSL_OP_SINGLE_ECDH_USE))
+                                {
+                                if(!EC_KEY_generate_key(ecdh))
+                                    {
+                                    SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
+                                    goto err;
+                                    }
+                                }
+
+                        if (((group = EC_KEY_get0_group(ecdh)) == NULL) ||
+                            (EC_KEY_get0_public_key(ecdh)  == NULL) ||
+                            (EC_KEY_get0_private_key(ecdh) == NULL))
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+
+                        if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&
+                            (EC_GROUP_get_degree(group) > 163)) 
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER);
+                                goto err;
+                                }
+
+                        /* XXX: For now, we only support ephemeral ECDH
+                         * keys over named (not generic) curves. For 
+                         * supported named curves, curve_id is non-zero.
+                         */
+                        if ((curve_id = 
+                            nid2curve_id(EC_GROUP_get_curve_name(group)))
+                            == 0)
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNSUPPORTED_ELLIPTIC_CURVE);
+                                goto err;
+                                }
+
+                        /* Encode the public key.
+                         * First check the size of encoding and
+                         * allocate memory accordingly.
+                         */
+                        encodedlen = EC_POINT_point2oct(group, 
+                            EC_KEY_get0_public_key(ecdh),
+                            POINT_CONVERSION_UNCOMPRESSED, 
+                            NULL, 0, NULL);
+
+                        encodedPoint = (unsigned char *) 
+                            OPENSSL_malloc(encodedlen*sizeof(unsigned char)); 
+                        bn_ctx = BN_CTX_new();
+                        if ((encodedPoint == NULL) || (bn_ctx == NULL))
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+
+
+                        encodedlen = EC_POINT_point2oct(group, 
+                            EC_KEY_get0_public_key(ecdh), 
+                            POINT_CONVERSION_UNCOMPRESSED, 
+                            encodedPoint, encodedlen, bn_ctx);
+
+                        if (encodedlen == 0) 
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+
+                        BN_CTX_free(bn_ctx);  bn_ctx=NULL;
+
+                        /* XXX: For now, we only support named (not 
+                         * generic) curves in ECDH ephemeral key exchanges.
+                         * In this situation, we need four additional bytes
+                         * to encode the entire ServerECDHParams
+                         * structure. 
+                         */
+                        n = 4 + encodedlen;
+
+                        /* We'll generate the serverKeyExchange message
+                         * explicitly so we can set these to NULLs
+                         */
+                        r[0]=NULL;
+                        r[1]=NULL;
+                        r[2]=NULL;
+                        r[3]=NULL;
+                        }
+                else 
+#endif /* !OPENSSL_NO_ECDH */
                         {
                         al=SSL_AD_HANDSHAKE_FAILURE;
                         SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
@@ -1201,6 +1503,31 @@ static int ssl3_send_server_key_exchange(SSL *s)
                         p+=nr[i];
                         }
 
+#ifndef OPENSSL_NO_ECDH
+                if (type & SSL_kECDHE) 
+                        {
+                        /* XXX: For now, we only support named (not generic) curves.
+                         * In this situation, the serverKeyExchange message has:
+                         * [1 byte CurveType], [2 byte CurveName]
+                         * [1 byte length of encoded point], followed by
+                         * the actual encoded point itself
+                         */
+                        *p = NAMED_CURVE_TYPE;
+                        p += 1;
+                        *p = 0;
+                        p += 1;
+                        *p = curve_id;
+                        p += 1;
+                        *p = encodedlen;
+                        p += 1;
+                        memcpy((unsigned char*)p, 
+                            (unsigned char *)encodedPoint, 
+                            encodedlen);
+                        OPENSSL_free(encodedPoint);
+                        p += encodedlen;
+                        }
+#endif
+
                 /* not anonymous */
                 if (pkey != NULL)
                         {
@@ -1213,8 +1540,6 @@ static int ssl3_send_server_key_exchange(SSL *s)
                                 j=0;
                                 for (num=2; num > 0; num--)
                                         {
-                                        EVP_MD_CTX_set_flags(&md_ctx,
-                                                EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
                                         EVP_DigestInit_ex(&md_ctx,(num == 2)
                                                 ?s->ctx->md5:s->ctx->sha1, NULL);
                                         EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
@@ -1255,6 +1580,25 @@ static int ssl3_send_server_key_exchange(SSL *s)
                                 }
                         else
 #endif
+#if !defined(OPENSSL_NO_ECDSA)
+                                if (pkey->type == EVP_PKEY_EC)
+                                {
+                                /* let's do ECDSA */
+                                EVP_SignInit_ex(&md_ctx,EVP_ecdsa(), NULL);
+                                EVP_SignUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
+                                EVP_SignUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
+                                EVP_SignUpdate(&md_ctx,&(d[4]),n);
+                                if (!EVP_SignFinal(&md_ctx,&(p[2]),
+                                        (unsigned int *)&i,pkey))
+                                        {
+                                        SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_ECDSA);
+                                        goto err;
+                                        }
+                                s2n(i,p);
+                                n+=i+2;
+                                }
+                        else
+#endif
                                 {
                                 /* Is this error check actually needed? */
                                 al=SSL_AD_HANDSHAKE_FAILURE;
@@ -1278,11 +1622,15 @@ static int ssl3_send_server_key_exchange(SSL *s)
 f_err:
         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 err:
+#ifndef OPENSSL_NO_ECDH
+        if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
+        BN_CTX_free(bn_ctx);
+#endif
         EVP_MD_CTX_cleanup(&md_ctx);
         return(-1);
         }
 
-static int ssl3_send_certificate_request(SSL *s)
+int ssl3_send_certificate_request(SSL *s)
         {
         unsigned char *p,*d;
         int i,j,nl,off,n;
@@ -1371,7 +1719,7 @@ err:
         return(-1);
         }
 
-static int ssl3_get_client_key_exchange(SSL *s)
+int ssl3_get_client_key_exchange(SSL *s)
         {
         int i,al,ok;
         long n;
@@ -1389,7 +1737,14 @@ static int ssl3_get_client_key_exchange(SSL *s)
         KSSL_ERR kssl_err;
 #endif /* OPENSSL_NO_KRB5 */
 
-        n=ssl3_get_message(s,
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *srvr_ecdh = NULL;
+        EVP_PKEY *clnt_pub_pkey = NULL;
+        EC_POINT *clnt_ecpoint = NULL;
+        BN_CTX *bn_ctx = NULL; 
+#endif
+
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_SR_KEY_EXCH_A,
                 SSL3_ST_SR_KEY_EXCH_B,
                 SSL3_MT_CLIENT_KEY_EXCHANGE,
@@ -1433,8 +1788,9 @@ static int ssl3_get_client_key_exchange(SSL *s)
                         rsa=pkey->pkey.rsa;
                         }
 
-                /* TLS */
-                if (s->version > SSL3_VERSION)
+                /* TLS and [incidentally] DTLS, including pre-0.9.8f */
+                if (s->version > SSL3_VERSION &&
+                    s->client_version != DTLS1_BAD_VER)
                         {
                         n2s(p,i);
                         if (n != i+2)
@@ -1495,7 +1851,7 @@ static int ssl3_get_client_key_exchange(SSL *s)
                         i = SSL_MAX_MASTER_KEY_LENGTH;
                         p[0] = s->client_version >> 8;
                         p[1] = s->client_version & 0xff;
-                        if(RAND_pseudo_bytes(p+2, i-2) <= 0)  /* should be RAND_bytes, but we cannot work around a failure */
+                        if (RAND_pseudo_bytes(p+2, i-2) <= 0) /* should be RAND_bytes, but we cannot work around a failure */
                                 goto err;
                         }
         
@@ -1594,7 +1950,7 @@ static int ssl3_get_client_key_exchange(SSL *s)
                 n2s(p,i);
                 enc_ticket.length = i;
 
-                if (n < (long)enc_ticket.length + 6)
+                if (n < (int)enc_ticket.length + 6)
                         {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                                 SSL_R_DATA_LENGTH_TOO_LONG);
@@ -1607,7 +1963,7 @@ static int ssl3_get_client_key_exchange(SSL *s)
                 n2s(p,i);
                 authenticator.length = i;
 
-                if (n < (long)(enc_ticket.length + authenticator.length + 6))
+                if (n < (int)(enc_ticket.length + authenticator.length) + 6)
                         {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                                 SSL_R_DATA_LENGTH_TOO_LONG);
@@ -1649,7 +2005,7 @@ static int ssl3_get_client_key_exchange(SSL *s)
                         if (kssl_err.text)
                                 printf("kssl_err text= %s\n", kssl_err.text);
 #endif  /* KSSL_DEBUG */
-                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                                 kssl_err.reason);
                         goto err;
                         }
@@ -1666,14 +2022,14 @@ static int ssl3_get_client_key_exchange(SSL *s)
                         if (kssl_err.text)
                                 printf("kssl_err text= %s\n", kssl_err.text);
 #endif  /* KSSL_DEBUG */
-                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                                 kssl_err.reason);
                         goto err;
                         }
 
                 if ((krb5rc = kssl_validate_times(authtime, &ttimes)) != 0)
                         {
-                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, krb5rc);
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, krb5rc);
                         goto err;
                         }
 
@@ -1719,6 +2075,24 @@ static int ssl3_get_client_key_exchange(SSL *s)
                                 SSL_R_DATA_LENGTH_TOO_LONG);
                         goto err;
                         }
+                if (!((pms[0] == (s->client_version>>8)) && (pms[1] == (s->client_version & 0xff))))
+                    {
+                    /* The premaster secret must contain the same version number as the
+                     * ClientHello to detect version rollback attacks (strangely, the
+                     * protocol does not offer such protection for DH ciphersuites).
+                     * However, buggy clients exist that send random bytes instead of
+                     * the protocol version.
+                     * If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. 
+                     * (Perhaps we should have a separate BUG value for the Kerberos cipher)
+                     */
+                    if (!(s->options & SSL_OP_TLS_ROLLBACK_BUG))
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                               SSL_AD_DECODE_ERROR);
+                        goto err;
+                        }
+                    }
+
                 EVP_CIPHER_CTX_cleanup(&ciph_ctx);
 
                 s->session->master_key_length=
@@ -1727,7 +2101,7 @@ static int ssl3_get_client_key_exchange(SSL *s)
 
                 if (kssl_ctx->client_princ)
                         {
-                        int len = strlen(kssl_ctx->client_princ);
+                        size_t len = strlen(kssl_ctx->client_princ);
                         if ( len < SSL_MAX_KRB5_PRINCIPAL_LENGTH ) 
                                 {
                                 s->session->krb5_client_princ_len = len;
@@ -1744,6 +2118,156 @@ static int ssl3_get_client_key_exchange(SSL *s)
                 }
         else
 #endif  /* OPENSSL_NO_KRB5 */
+
+#ifndef OPENSSL_NO_ECDH
+                if ((l & SSL_kECDH) || (l & SSL_kECDHE))
+                {
+                int ret = 1;
+                int field_size = 0;
+                const EC_KEY   *tkey;
+                const EC_GROUP *group;
+                const BIGNUM *priv_key;
+
+                /* initialize structures for server's ECDH key pair */
+                if ((srvr_ecdh = EC_KEY_new()) == NULL) 
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                            ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+
+                /* Let's get server private key and group information */
+                if (l & SSL_kECDH) 
+                        { 
+                        /* use the certificate */
+                        tkey = s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec;
+                        }
+                else
+                        {
+                        /* use the ephermeral values we saved when
+                         * generating the ServerKeyExchange msg.
+                         */
+                        tkey = s->s3->tmp.ecdh;
+                        }
+
+                group    = EC_KEY_get0_group(tkey);
+                priv_key = EC_KEY_get0_private_key(tkey);
+
+                if (!EC_KEY_set_group(srvr_ecdh, group) ||
+                    !EC_KEY_set_private_key(srvr_ecdh, priv_key))
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                               ERR_R_EC_LIB);
+                        goto err;
+                        }
+
+                /* Let's get client's public key */
+                if ((clnt_ecpoint = EC_POINT_new(group)) == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                            ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+
+                if (n == 0L) 
+                        {
+                        /* Client Publickey was in Client Certificate */
+
+                         if (l & SSL_kECDHE) 
+                                 {
+                                 al=SSL_AD_HANDSHAKE_FAILURE;
+                                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_ECDH_KEY);
+                                 goto f_err;
+                                 }
+                        if (((clnt_pub_pkey=X509_get_pubkey(s->session->peer))
+                            == NULL) || 
+                            (clnt_pub_pkey->type != EVP_PKEY_EC))
+                                {
+                                /* XXX: For now, we do not support client
+                                 * authentication using ECDH certificates
+                                 * so this branch (n == 0L) of the code is
+                                 * never executed. When that support is
+                                 * added, we ought to ensure the key 
+                                 * received in the certificate is 
+                                 * authorized for key agreement.
+                                 * ECDH_compute_key implicitly checks that
+                                 * the two ECDH shares are for the same
+                                 * group.
+                                 */
+                                al=SSL_AD_HANDSHAKE_FAILURE;
+                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                    SSL_R_UNABLE_TO_DECODE_ECDH_CERTS);
+                                goto f_err;
+                                }
+
+                        if (EC_POINT_copy(clnt_ecpoint,
+                            EC_KEY_get0_public_key(clnt_pub_pkey->pkey.ec)) == 0)
+                                {
+                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                        ERR_R_EC_LIB);
+                                goto err;
+                                }
+                        ret = 2; /* Skip certificate verify processing */
+                        }
+                else
+                        {
+                        /* Get client's public key from encoded point
+                         * in the ClientKeyExchange message.
+                         */
+                        if ((bn_ctx = BN_CTX_new()) == NULL)
+                                {
+                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+
+                        /* Get encoded point length */
+                        i = *p; 
+                        p += 1;
+                        if (EC_POINT_oct2point(group, 
+                            clnt_ecpoint, p, i, bn_ctx) == 0)
+                                {
+                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_EC_LIB);
+                                goto err;
+                                }
+                        /* p is pointing to somewhere in the buffer
+                         * currently, so set it to the start 
+                         */ 
+                        p=(unsigned char *)s->init_buf->data;
+                        }
+
+                /* Compute the shared pre-master secret */
+                field_size = EC_GROUP_get_degree(group);
+                if (field_size <= 0)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 
+                               ERR_R_ECDH_LIB);
+                        goto err;
+                        }
+                i = ECDH_compute_key(p, (field_size+7)/8, clnt_ecpoint, srvr_ecdh, NULL);
+                if (i <= 0)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                            ERR_R_ECDH_LIB);
+                        goto err;
+                        }
+
+                EVP_PKEY_free(clnt_pub_pkey);
+                EC_POINT_free(clnt_ecpoint);
+                if (srvr_ecdh != NULL) 
+                        EC_KEY_free(srvr_ecdh);
+                BN_CTX_free(bn_ctx);
+
+                /* Compute the master secret */
+                s->session->master_key_length = s->method->ssl3_enc-> \
+                    generate_master_secret(s, s->session->master_key, p, i);
+                
+                OPENSSL_cleanse(p, i);
+                return (ret);
+                }
+        else
+#endif
                 {
                 al=SSL_AD_HANDSHAKE_FAILURE;
                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
@@ -1754,13 +2278,20 @@ static int ssl3_get_client_key_exchange(SSL *s)
         return(1);
 f_err:
         ssl3_send_alert(s,SSL3_AL_FATAL,al);
-#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA)
+#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_ECDH)
 err:
 #endif
+#ifndef OPENSSL_NO_ECDH
+        EVP_PKEY_free(clnt_pub_pkey);
+        EC_POINT_free(clnt_ecpoint);
+        if (srvr_ecdh != NULL) 
+                EC_KEY_free(srvr_ecdh);
+        BN_CTX_free(bn_ctx);
+#endif
         return(-1);
         }
 
-static int ssl3_get_cert_verify(SSL *s)
+int ssl3_get_cert_verify(SSL *s)
         {
         EVP_PKEY *pkey=NULL;
         unsigned char *p;
@@ -1769,7 +2300,7 @@ static int ssl3_get_cert_verify(SSL *s)
         int type=0,i,j;
         X509 *peer;
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_SR_CERT_VRFY_A,
                 SSL3_ST_SR_CERT_VRFY_B,
                 -1,
@@ -1880,6 +2411,23 @@ static int ssl3_get_cert_verify(SSL *s)
                 }
         else
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                if (pkey->type == EVP_PKEY_EC)
+                {
+                j=ECDSA_verify(pkey->save_type,
+                        &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),
+                        SHA_DIGEST_LENGTH,p,i,pkey->pkey.ec);
+                if (j <= 0)
+                        {
+                        /* bad signature */
+                        al=SSL_AD_DECRYPT_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,
+                            SSL_R_BAD_ECDSA_SIGNATURE);
+                        goto f_err;
+                        }
+                }
+        else
+#endif
                 {
                 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,ERR_R_INTERNAL_ERROR);
                 al=SSL_AD_UNSUPPORTED_CERTIFICATE;
@@ -1898,15 +2446,16 @@ end:
         return(ret);
         }
 
-static int ssl3_get_client_certificate(SSL *s)
+int ssl3_get_client_certificate(SSL *s)
         {
         int i,ok,al,ret= -1;
         X509 *x=NULL;
         unsigned long l,nc,llen,n;
-        unsigned char *p,*d,*q;
+        const unsigned char *p,*q;
+        unsigned char *d;
         STACK_OF(X509) *sk=NULL;
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_SR_CERT_A,
                 SSL3_ST_SR_CERT_B,
                 -1,
@@ -1941,7 +2490,7 @@ static int ssl3_get_client_certificate(SSL *s)
                 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_WRONG_MESSAGE_TYPE);
                 goto f_err;
                 }
-        d=p=(unsigned char *)s->init_msg;
+        p=d=(unsigned char *)s->init_msg;
 
         if ((sk=sk_X509_new_null()) == NULL)
                 {
@@ -2080,3 +2629,209 @@ int ssl3_send_server_certificate(SSL *s)
         /* SSL3_ST_SW_CERT_B */
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
         }
+
+
+#ifndef OPENSSL_NO_ECDH
+/* This is the complement of curve_id2nid in s3_clnt.c. */
+static int nid2curve_id(int nid)
+{
+        /* ECC curves from draft-ietf-tls-ecc-01.txt (Mar 15, 2001)
+         * (no changes in draft-ietf-tls-ecc-03.txt [June 2003]) */
+        switch (nid) {
+        case NID_sect163k1: /* sect163k1 (1) */
+                return 1;
+        case NID_sect163r1: /* sect163r1 (2) */
+                return 2;
+        case NID_sect163r2: /* sect163r2 (3) */
+                return 3;
+        case NID_sect193r1: /* sect193r1 (4) */ 
+                return 4;
+        case NID_sect193r2: /* sect193r2 (5) */ 
+                return 5;
+        case NID_sect233k1: /* sect233k1 (6) */
+                return 6;
+        case NID_sect233r1: /* sect233r1 (7) */ 
+                return 7;
+        case NID_sect239k1: /* sect239k1 (8) */ 
+                return 8;
+        case NID_sect283k1: /* sect283k1 (9) */
+                return 9;
+        case NID_sect283r1: /* sect283r1 (10) */ 
+                return 10;
+        case NID_sect409k1: /* sect409k1 (11) */ 
+                return 11;
+        case NID_sect409r1: /* sect409r1 (12) */
+                return 12;
+        case NID_sect571k1: /* sect571k1 (13) */ 
+                return 13;
+        case NID_sect571r1: /* sect571r1 (14) */ 
+                return 14;
+        case NID_secp160k1: /* secp160k1 (15) */
+                return 15;
+        case NID_secp160r1: /* secp160r1 (16) */ 
+                return 16;
+        case NID_secp160r2: /* secp160r2 (17) */ 
+                return 17;
+        case NID_secp192k1: /* secp192k1 (18) */
+                return 18;
+        case NID_X9_62_prime192v1: /* secp192r1 (19) */ 
+                return 19;
+        case NID_secp224k1: /* secp224k1 (20) */ 
+                return 20;
+        case NID_secp224r1: /* secp224r1 (21) */
+                return 21;
+        case NID_secp256k1: /* secp256k1 (22) */ 
+                return 22;
+        case NID_X9_62_prime256v1: /* secp256r1 (23) */ 
+                return 23;
+        case NID_secp384r1: /* secp384r1 (24) */
+                return 24;
+        case NID_secp521r1:  /* secp521r1 (25) */       
+                return 25;
+        default:
+                return 0;
+        }
+}
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+int ssl3_send_newsession_ticket(SSL *s)
+        {
+        if (s->state == SSL3_ST_SW_SESSION_TICKET_A)
+                {
+                unsigned char *p, *senc, *macstart;
+                int len, slen;
+                unsigned int hlen;
+                EVP_CIPHER_CTX ctx;
+                HMAC_CTX hctx;
+                unsigned char iv[EVP_MAX_IV_LENGTH];
+                unsigned char key_name[16];
+
+                /* get session encoding length */
+                slen = i2d_SSL_SESSION(s->session, NULL);
+                /* Some length values are 16 bits, so forget it if session is
+                 * too long
+                 */
+                if (slen > 0xFF00)
+                        return -1;
+                /* Grow buffer if need be: the length calculation is as
+                 * follows 1 (size of message name) + 3 (message length
+                 * bytes) + 4 (ticket lifetime hint) + 2 (ticket length) +
+                 * 16 (key name) + max_iv_len (iv length) +
+                 * session_length + max_enc_block_size (max encrypted session
+                 * length) + max_md_size (HMAC).
+                 */
+                if (!BUF_MEM_grow(s->init_buf,
+                        26 + EVP_MAX_IV_LENGTH + EVP_MAX_BLOCK_LENGTH +
+                        EVP_MAX_MD_SIZE + slen))
+                        return -1;
+                senc = OPENSSL_malloc(slen);
+                if (!senc)
+                        return -1;
+                p = senc;
+                i2d_SSL_SESSION(s->session, &p);
+
+                p=(unsigned char *)s->init_buf->data;
+                /* do the header */
+                *(p++)=SSL3_MT_NEWSESSION_TICKET;
+                /* Skip message length for now */
+                p += 3;
+                EVP_CIPHER_CTX_init(&ctx);
+                HMAC_CTX_init(&hctx);
+                /* Initialize HMAC and cipher contexts. If callback present
+                 * it does all the work otherwise use generated values
+                 * from parent ctx.
+                 */
+                if (s->ctx->tlsext_ticket_key_cb)
+                        {
+                        if (s->ctx->tlsext_ticket_key_cb(s, key_name, iv, &ctx,
+                                                         &hctx, 1) < 0)
+                                {
+                                OPENSSL_free(senc);
+                                return -1;
+                                }
+                        }
+                else
+                        {
+                        RAND_pseudo_bytes(iv, 16);
+                        EVP_EncryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
+                                        s->ctx->tlsext_tick_aes_key, iv);
+                        HMAC_Init_ex(&hctx, s->ctx->tlsext_tick_hmac_key, 16,
+                                        tlsext_tick_md(), NULL);
+                        memcpy(key_name, s->ctx->tlsext_tick_key_name, 16);
+                        }
+                l2n(s->session->tlsext_tick_lifetime_hint, p);
+                /* Skip ticket length for now */
+                p += 2;
+                /* Output key name */
+                macstart = p;
+                memcpy(p, key_name, 16);
+                p += 16;
+                /* output IV */
+                memcpy(p, iv, EVP_CIPHER_CTX_iv_length(&ctx));
+                p += EVP_CIPHER_CTX_iv_length(&ctx);
+                /* Encrypt session data */
+                EVP_EncryptUpdate(&ctx, p, &len, senc, slen);
+                p += len;
+                EVP_EncryptFinal(&ctx, p, &len);
+                p += len;
+                EVP_CIPHER_CTX_cleanup(&ctx);
+
+                HMAC_Update(&hctx, macstart, p - macstart);
+                HMAC_Final(&hctx, p, &hlen);
+                HMAC_CTX_cleanup(&hctx);
+
+                p += hlen;
+                /* Now write out lengths: p points to end of data written */
+                /* Total length */
+                len = p - (unsigned char *)s->init_buf->data;
+                p=(unsigned char *)s->init_buf->data + 1;
+                l2n3(len - 4, p); /* Message length */
+                p += 4;
+                s2n(len - 10, p);  /* Ticket length */
+
+                /* number of bytes to write */
+                s->init_num= len;
+                s->state=SSL3_ST_SW_SESSION_TICKET_B;
+                s->init_off=0;
+                OPENSSL_free(senc);
+                }
+
+        /* SSL3_ST_SW_SESSION_TICKET_B */
+        return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
+        }
+
+int ssl3_send_cert_status(SSL *s)
+        {
+        if (s->state == SSL3_ST_SW_CERT_STATUS_A)
+                {
+                unsigned char *p;
+                /* Grow buffer if need be: the length calculation is as
+                 * follows 1 (message type) + 3 (message length) +
+                 * 1 (ocsp response type) + 3 (ocsp response length)
+                 * + (ocsp response)
+                 */
+                if (!BUF_MEM_grow(s->init_buf, 8 + s->tlsext_ocsp_resplen))
+                        return -1;
+
+                p=(unsigned char *)s->init_buf->data;
+
+                /* do the header */
+                *(p++)=SSL3_MT_CERTIFICATE_STATUS;
+                /* message length */
+                l2n3(s->tlsext_ocsp_resplen + 4, p);
+                /* status type */
+                *(p++)= s->tlsext_status_type;
+                /* length of OCSP response */
+                l2n3(s->tlsext_ocsp_resplen, p);
+                /* actual response */
+                memcpy(p, s->tlsext_ocsp_resp, s->tlsext_ocsp_resplen);
+                /* number of bytes to write */
+                s->init_num = 8 + s->tlsext_ocsp_resplen;
+                s->state=SSL3_ST_SW_CERT_STATUS_B;
+                s->init_off = 0;
+                }
+
+        /* SSL3_ST_SW_CERT_STATUS_B */
+        return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
+        }
+#endif
diff --git a/src/lib/libssl/src/CHANGES b/src/lib/libssl/src/CHANGES
index 2840a36a6d..217aa70dcb 100644
--- a/src/lib/libssl/src/CHANGES
+++ b/src/lib/libssl/src/CHANGES
@@ -2,6 +2,1459 @@
  OpenSSL CHANGES
  _______________
 
+ Changes between 0.9.8g and 0.9.8h  [28 May 2008]
+
+  *) Fix flaw if 'Server Key exchange message' is omitted from a TLS
+     handshake which could lead to a cilent crash as found using the
+     Codenomicon TLS test suite (CVE-2008-1672) 
+     [Steve Henson, Mark Cox]
+
+  *) Fix double free in TLS server name extensions which could lead to
+     a remote crash found by Codenomicon TLS test suite (CVE-2008-0891) 
+     [Joe Orton]
+
+  *) Clear error queue in SSL_CTX_use_certificate_chain_file()
+
+     Clear the error queue to ensure that error entries left from
+     older function calls do not interfere with the correct operation.
+     [Lutz Jaenicke, Erik de Castro Lopo]
+
+  *) Remove root CA certificates of commercial CAs:
+
+     The OpenSSL project does not recommend any specific CA and does not
+     have any policy with respect to including or excluding any CA.
+     Therefore it does not make any sense to ship an arbitrary selection
+     of root CA certificates with the OpenSSL software.
+     [Lutz Jaenicke]
+
+  *) RSA OAEP patches to fix two separate invalid memory reads.
+     The first one involves inputs when 'lzero' is greater than
+     'SHA_DIGEST_LENGTH' (it would read about SHA_DIGEST_LENGTH bytes
+     before the beginning of from). The second one involves inputs where
+     the 'db' section contains nothing but zeroes (there is a one-byte
+     invalid read after the end of 'db').
+     [Ivan Nestlerode <inestlerode@us.ibm.com>]
+
+  *) Partial backport from 0.9.9-dev:
+
+     Introduce bn_mul_mont (dedicated Montgomery multiplication
+     procedure) as a candidate for BIGNUM assembler implementation.
+     While 0.9.9-dev uses assembler for various architectures, only
+     x86_64 is available by default here in the 0.9.8 branch, and
+     32-bit x86 is available through a compile-time setting.
+
+     To try the 32-bit x86 assembler implementation, use Configure
+     option "enable-montasm" (which exists only for this backport).
+
+     As "enable-montasm" for 32-bit x86 disclaims code stability
+     anyway, in this constellation we activate additional code
+     backported from 0.9.9-dev for further performance improvements,
+     namely BN_from_montgomery_word.  (To enable this otherwise,
+     e.g. x86_64, try "-DMONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD".)
+
+     [Andy Polyakov (backport partially by Bodo Moeller)]
+
+  *) Add TLS session ticket callback. This allows an application to set
+     TLS ticket cipher and HMAC keys rather than relying on hardcoded fixed
+     values. This is useful for key rollover for example where several key
+     sets may exist with different names.
+     [Steve Henson]
+
+  *) Reverse ENGINE-internal logic for caching default ENGINE handles.
+     This was broken until now in 0.9.8 releases, such that the only way
+     a registered ENGINE could be used (assuming it initialises
+     successfully on the host) was to explicitly set it as the default
+     for the relevant algorithms. This is in contradiction with 0.9.7
+     behaviour and the documentation. With this fix, when an ENGINE is
+     registered into a given algorithm's table of implementations, the
+     'uptodate' flag is reset so that auto-discovery will be used next
+     time a new context for that algorithm attempts to select an
+     implementation.
+     [Ian Lister (tweaked by Geoff Thorpe)]
+
+  *) Backport of CMS code to OpenSSL 0.9.8. This differs from the 0.9.9
+     implemention in the following ways:
+
+     Lack of EVP_PKEY_ASN1_METHOD means algorithm parameters have to be
+     hard coded.
+
+     Lack of BER streaming support means one pass streaming processing is
+     only supported if data is detached: setting the streaming flag is
+     ignored for embedded content.
+
+     CMS support is disabled by default and must be explicitly enabled
+     with the enable-cms configuration option.
+     [Steve Henson]
+
+  *) Update the GMP engine glue to do direct copies between BIGNUM and
+     mpz_t when openssl and GMP use the same limb size. Otherwise the
+     existing "conversion via a text string export" trick is still used.
+     [Paul Sheer <paulsheer@gmail.com>]
+
+  *) Zlib compression BIO. This is a filter BIO which compressed and
+     uncompresses any data passed through it.
+     [Steve Henson]
+
+  *) Add AES_wrap_key() and AES_unwrap_key() functions to implement
+     RFC3394 compatible AES key wrapping.
+     [Steve Henson]
+
+  *) Add utility functions to handle ASN1 structures. ASN1_STRING_set0():
+     sets string data without copying. X509_ALGOR_set0() and
+     X509_ALGOR_get0(): set and retrieve X509_ALGOR (AlgorithmIdentifier)
+     data. Attribute function X509at_get0_data_by_OBJ(): retrieves data
+     from an X509_ATTRIBUTE structure optionally checking it occurs only
+     once. ASN1_TYPE_set1(): set and ASN1_TYPE structure copying supplied
+     data.
+     [Steve Henson]
+
+  *) Fix BN flag handling in RSA_eay_mod_exp() and BN_MONT_CTX_set()
+     to get the expected BN_FLG_CONSTTIME behavior.
+     [Bodo Moeller (Google)]
+  
+  *) Netware support:
+
+     - fixed wrong usage of ioctlsocket() when build for LIBC BSD sockets
+     - fixed do_tests.pl to run the test suite with CLIB builds too (CLIB_OPT)
+     - added some more tests to do_tests.pl
+     - fixed RunningProcess usage so that it works with newer LIBC NDKs too
+     - removed usage of BN_LLONG for CLIB builds to avoid runtime dependency
+     - added new Configure targets netware-clib-bsdsock, netware-clib-gcc,
+       netware-clib-bsdsock-gcc, netware-libc-bsdsock-gcc
+     - various changes to netware.pl to enable gcc-cross builds on Win32
+       platform
+     - changed crypto/bio/b_sock.c to work with macro functions (CLIB BSD)
+     - various changes to fix missing prototype warnings
+     - fixed x86nasm.pl to create correct asm files for NASM COFF output
+     - added AES, WHIRLPOOL and CPUID assembler code to build files
+     - added missing AES assembler make rules to mk1mf.pl
+     - fixed order of includes in apps/ocsp.c so that e_os.h settings apply
+     [Guenter Knauf <eflash@gmx.net>]
+
+  *) Implement certificate status request TLS extension defined in RFC3546.
+     A client can set the appropriate parameters and receive the encoded
+     OCSP response via a callback. A server can query the supplied parameters
+     and set the encoded OCSP response in the callback. Add simplified examples
+     to s_client and s_server.
+     [Steve Henson]
+
+ Changes between 0.9.8f and 0.9.8g  [19 Oct 2007]
+
+  *) Fix various bugs:
+     + Binary incompatibility of ssl_ctx_st structure
+     + DTLS interoperation with non-compliant servers
+     + Don't call get_session_cb() without proposed session
+     + Fix ia64 assembler code
+     [Andy Polyakov, Steve Henson]
+
+ Changes between 0.9.8e and 0.9.8f  [11 Oct 2007]
+
+  *) DTLS Handshake overhaul. There were longstanding issues with
+     OpenSSL DTLS implementation, which were making it impossible for
+     RFC 4347 compliant client to communicate with OpenSSL server.
+     Unfortunately just fixing these incompatibilities would "cut off"
+     pre-0.9.8f clients. To allow for hassle free upgrade post-0.9.8e
+     server keeps tolerating non RFC compliant syntax. The opposite is
+     not true, 0.9.8f client can not communicate with earlier server.
+     This update even addresses CVE-2007-4995.
+     [Andy Polyakov]
+
+  *) Changes to avoid need for function casts in OpenSSL: some compilers
+     (gcc 4.2 and later) reject their use.
+     [Kurt Roeckx <kurt@roeckx.be>, Peter Hartley <pdh@utter.chaos.org.uk>,
+      Steve Henson]
+  
+  *) Add RFC4507 support to OpenSSL. This includes the corrections in
+     RFC4507bis. The encrypted ticket format is an encrypted encoded
+     SSL_SESSION structure, that way new session features are automatically
+     supported.
+
+     If a client application caches session in an SSL_SESSION structure
+     support is transparent because tickets are now stored in the encoded
+     SSL_SESSION.
+     
+     The SSL_CTX structure automatically generates keys for ticket
+     protection in servers so again support should be possible
+     with no application modification.
+
+     If a client or server wishes to disable RFC4507 support then the option
+     SSL_OP_NO_TICKET can be set.
+
+     Add a TLS extension debugging callback to allow the contents of any client
+     or server extensions to be examined.
+
+     This work was sponsored by Google.
+     [Steve Henson]
+
+  *) Add initial support for TLS extensions, specifically for the server_name
+     extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
+     have new members for a host name.  The SSL data structure has an
+     additional member SSL_CTX *initial_ctx so that new sessions can be
+     stored in that context to allow for session resumption, even after the
+     SSL has been switched to a new SSL_CTX in reaction to a client's
+     server_name extension.
+
+     New functions (subject to change):
+
+         SSL_get_servername()
+         SSL_get_servername_type()
+         SSL_set_SSL_CTX()
+
+     New CTRL codes and macros (subject to change):
+
+         SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
+                                 - SSL_CTX_set_tlsext_servername_callback()
+         SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
+                                      - SSL_CTX_set_tlsext_servername_arg()
+         SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
+
+     openssl s_client has a new '-servername ...' option.
+
+     openssl s_server has new options '-servername_host ...', '-cert2 ...',
+     '-key2 ...', '-servername_fatal' (subject to change).  This allows
+     testing the HostName extension for a specific single host name ('-cert'
+     and '-key' remain fallbacks for handshakes without HostName
+     negotiation).  If the unrecogninzed_name alert has to be sent, this by
+     default is a warning; it becomes fatal with the '-servername_fatal'
+     option.
+
+     [Peter Sylvester,  Remy Allais, Christophe Renou, Steve Henson]
+
+  *) Add AES and SSE2 assembly language support to VC++ build.
+     [Steve Henson]
+
+  *) Mitigate attack on final subtraction in Montgomery reduction.
+     [Andy Polyakov]
+
+  *) Fix crypto/ec/ec_mult.c to work properly with scalars of value 0
+     (which previously caused an internal error).
+     [Bodo Moeller]
+
+  *) Squeeze another 10% out of IGE mode when in != out.
+     [Ben Laurie]
+
+  *) AES IGE mode speedup.
+     [Dean Gaudet (Google)]
+
+  *) Add the Korean symmetric 128-bit cipher SEED (see
+     http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp) and
+     add SEED ciphersuites from RFC 4162:
+
+        TLS_RSA_WITH_SEED_CBC_SHA      =  "SEED-SHA"
+        TLS_DHE_DSS_WITH_SEED_CBC_SHA  =  "DHE-DSS-SEED-SHA"
+        TLS_DHE_RSA_WITH_SEED_CBC_SHA  =  "DHE-RSA-SEED-SHA"
+        TLS_DH_anon_WITH_SEED_CBC_SHA  =  "ADH-SEED-SHA"
+
+     To minimize changes between patchlevels in the OpenSSL 0.9.8
+     series, SEED remains excluded from compilation unless OpenSSL
+     is configured with 'enable-seed'.
+     [KISA, Bodo Moeller]
+
+  *) Mitigate branch prediction attacks, which can be practical if a
+     single processor is shared, allowing a spy process to extract
+     information.  For detailed background information, see
+     http://eprint.iacr.org/2007/039 (O. Aciicmez, S. Gueron,
+     J.-P. Seifert, "New Branch Prediction Vulnerabilities in OpenSSL
+     and Necessary Software Countermeasures").  The core of the change
+     are new versions BN_div_no_branch() and
+     BN_mod_inverse_no_branch() of BN_div() and BN_mod_inverse(),
+     respectively, which are slower, but avoid the security-relevant
+     conditional branches.  These are automatically called by BN_div()
+     and BN_mod_inverse() if the flag BN_FLG_CONSTTIME is set for one
+     of the input BIGNUMs.  Also, BN_is_bit_set() has been changed to
+     remove a conditional branch.
+
+     BN_FLG_CONSTTIME is the new name for the previous
+     BN_FLG_EXP_CONSTTIME flag, since it now affects more than just
+     modular exponentiation.  (Since OpenSSL 0.9.7h, setting this flag
+     in the exponent causes BN_mod_exp_mont() to use the alternative
+     implementation in BN_mod_exp_mont_consttime().)  The old name
+     remains as a deprecated alias.
+
+     Similary, RSA_FLAG_NO_EXP_CONSTTIME is replaced by a more general
+     RSA_FLAG_NO_CONSTTIME flag since the RSA implementation now uses
+     constant-time implementations for more than just exponentiation.
+     Here too the old name is kept as a deprecated alias.
+
+     BN_BLINDING_new() will now use BN_dup() for the modulus so that
+     the BN_BLINDING structure gets an independent copy of the
+     modulus.  This means that the previous "BIGNUM *m" argument to
+     BN_BLINDING_new() and to BN_BLINDING_create_param() now
+     essentially becomes "const BIGNUM *m", although we can't actually
+     change this in the header file before 0.9.9.  It allows
+     RSA_setup_blinding() to use BN_with_flags() on the modulus to
+     enable BN_FLG_CONSTTIME.
+
+     [Matthew D Wood (Intel Corp)]
+
+  *) In the SSL/TLS server implementation, be strict about session ID
+     context matching (which matters if an application uses a single
+     external cache for different purposes).  Previously,
+     out-of-context reuse was forbidden only if SSL_VERIFY_PEER was
+     set.  This did ensure strict client verification, but meant that,
+     with applications using a single external cache for quite
+     different requirements, clients could circumvent ciphersuite
+     restrictions for a given session ID context by starting a session
+     in a different context.
+     [Bodo Moeller]
+
+  *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
+     a ciphersuite string such as "DEFAULT:RSA" cannot enable
+     authentication-only ciphersuites.
+     [Bodo Moeller]
+
+  *) Update the SSL_get_shared_ciphers() fix CVE-2006-3738 which was
+     not complete and could lead to a possible single byte overflow
+     (CVE-2007-5135) [Ben Laurie]
+
+ Changes between 0.9.8d and 0.9.8e  [23 Feb 2007]
+
+  *) Since AES128 and AES256 (and similarly Camellia128 and
+     Camellia256) share a single mask bit in the logic of
+     ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
+     kludge to work properly if AES128 is available and AES256 isn't
+     (or if Camellia128 is available and Camellia256 isn't).
+     [Victor Duchovni]
+
+  *) Fix the BIT STRING encoding generated by crypto/ec/ec_asn1.c
+     (within i2d_ECPrivateKey, i2d_ECPKParameters, i2d_ECParameters):
+     When a point or a seed is encoded in a BIT STRING, we need to
+     prevent the removal of trailing zero bits to get the proper DER
+     encoding.  (By default, crypto/asn1/a_bitstr.c assumes the case
+     of a NamedBitList, for which trailing 0 bits need to be removed.)
+     [Bodo Moeller]
+
+  *) Have SSL/TLS server implementation tolerate "mismatched" record
+     protocol version while receiving ClientHello even if the
+     ClientHello is fragmented.  (The server can't insist on the
+     particular protocol version it has chosen before the ServerHello
+     message has informed the client about his choice.)
+     [Bodo Moeller]
+
+  *) Add RFC 3779 support.
+     [Rob Austein for ARIN, Ben Laurie]
+
+  *) Load error codes if they are not already present instead of using a
+     static variable. This allows them to be cleanly unloaded and reloaded.
+     Improve header file function name parsing.
+     [Steve Henson]
+
+  *) extend SMTP and IMAP protocol emulation in s_client to use EHLO
+     or CAPABILITY handshake as required by RFCs.
+     [Goetz Babin-Ebell]
+
+ Changes between 0.9.8c and 0.9.8d  [28 Sep 2006]
+
+  *) Introduce limits to prevent malicious keys being able to
+     cause a denial of service.  (CVE-2006-2940)
+     [Steve Henson, Bodo Moeller]
+
+  *) Fix ASN.1 parsing of certain invalid structures that can result
+     in a denial of service.  (CVE-2006-2937)  [Steve Henson]
+
+  *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
+     (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
+
+  *) Fix SSL client code which could crash if connecting to a
+     malicious SSLv2 server.  (CVE-2006-4343)
+     [Tavis Ormandy and Will Drewry, Google Security Team]
+
+  *) Since 0.9.8b, ciphersuite strings naming explicit ciphersuites
+     match only those.  Before that, "AES256-SHA" would be interpreted
+     as a pattern and match "AES128-SHA" too (since AES128-SHA got
+     the same strength classification in 0.9.7h) as we currently only
+     have a single AES bit in the ciphersuite description bitmap.
+     That change, however, also applied to ciphersuite strings such as
+     "RC4-MD5" that intentionally matched multiple ciphersuites --
+     namely, SSL 2.0 ciphersuites in addition to the more common ones
+     from SSL 3.0/TLS 1.0.
+
+     So we change the selection algorithm again: Naming an explicit
+     ciphersuite selects this one ciphersuite, and any other similar
+     ciphersuite (same bitmap) from *other* protocol versions.
+     Thus, "RC4-MD5" again will properly select both the SSL 2.0
+     ciphersuite and the SSL 3.0/TLS 1.0 ciphersuite.
+
+     Since SSL 2.0 does not have any ciphersuites for which the
+     128/256 bit distinction would be relevant, this works for now.
+     The proper fix will be to use different bits for AES128 and
+     AES256, which would have avoided the problems from the beginning;
+     however, bits are scarce, so we can only do this in a new release
+     (not just a patchlevel) when we can change the SSL_CIPHER
+     definition to split the single 'unsigned long mask' bitmap into
+     multiple values to extend the available space.
+
+     [Bodo Moeller]
+
+ Changes between 0.9.8b and 0.9.8c  [05 Sep 2006]
+
+  *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
+     (CVE-2006-4339)  [Ben Laurie and Google Security Team]
+
+  *) Add AES IGE and biIGE modes.
+     [Ben Laurie]
+
+  *) Change the Unix randomness entropy gathering to use poll() when
+     possible instead of select(), since the latter has some
+     undesirable limitations.
+     [Darryl Miles via Richard Levitte and Bodo Moeller]
+
+  *) Disable "ECCdraft" ciphersuites more thoroughly.  Now special
+     treatment in ssl/ssl_ciph.s makes sure that these ciphersuites
+     cannot be implicitly activated as part of, e.g., the "AES" alias.
+     However, please upgrade to OpenSSL 0.9.9[-dev] for
+     non-experimental use of the ECC ciphersuites to get TLS extension
+     support, which is required for curve and point format negotiation
+     to avoid potential handshake problems.
+     [Bodo Moeller]
+
+  *) Disable rogue ciphersuites:
+
+      - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
+      - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
+      - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
+
+     The latter two were purportedly from
+     draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
+     appear there.
+
+     Also deactivate the remaining ciphersuites from
+     draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
+     unofficial, and the ID has long expired.
+     [Bodo Moeller]
+
+  *) Fix RSA blinding Heisenbug (problems sometimes occured on
+     dual-core machines) and other potential thread-safety issues.
+     [Bodo Moeller]
+
+  *) Add the symmetric cipher Camellia (128-bit, 192-bit, 256-bit key
+     versions), which is now available for royalty-free use
+     (see http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html).
+     Also, add Camellia TLS ciphersuites from RFC 4132.
+
+     To minimize changes between patchlevels in the OpenSSL 0.9.8
+     series, Camellia remains excluded from compilation unless OpenSSL
+     is configured with 'enable-camellia'.
+     [NTT]
+
+  *) Disable the padding bug check when compression is in use. The padding
+     bug check assumes the first packet is of even length, this is not
+     necessarily true if compresssion is enabled and can result in false
+     positives causing handshake failure. The actual bug test is ancient
+     code so it is hoped that implementations will either have fixed it by
+     now or any which still have the bug do not support compression.
+     [Steve Henson]
+
+ Changes between 0.9.8a and 0.9.8b  [04 May 2006]
+
+  *) When applying a cipher rule check to see if string match is an explicit
+     cipher suite and only match that one cipher suite if it is.
+     [Steve Henson]
+
+  *) Link in manifests for VC++ if needed.
+     [Austin Ziegler <halostatue@gmail.com>]
+
+  *) Update support for ECC-based TLS ciphersuites according to
+     draft-ietf-tls-ecc-12.txt with proposed changes (but without
+     TLS extensions, which are supported starting with the 0.9.9
+     branch, not in the OpenSSL 0.9.8 branch).
+     [Douglas Stebila]
+
+  *) New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free() to support
+     opaque EVP_CIPHER_CTX handling.
+     [Steve Henson]
+
+  *) Fixes and enhancements to zlib compression code. We now only use
+     "zlib1.dll" and use the default __cdecl calling convention on Win32
+     to conform with the standards mentioned here:
+           http://www.zlib.net/DLL_FAQ.txt
+     Static zlib linking now works on Windows and the new --with-zlib-include
+     --with-zlib-lib options to Configure can be used to supply the location
+     of the headers and library. Gracefully handle case where zlib library
+     can't be loaded.
+     [Steve Henson]
+
+  *) Several fixes and enhancements to the OID generation code. The old code
+     sometimes allowed invalid OIDs (1.X for X >= 40 for example), couldn't
+     handle numbers larger than ULONG_MAX, truncated printing and had a
+     non standard OBJ_obj2txt() behaviour.
+     [Steve Henson]
+
+  *) Add support for building of engines under engine/ as shared libraries
+     under VC++ build system.
+     [Steve Henson]
+
+  *) Corrected the numerous bugs in the Win32 path splitter in DSO.
+     Hopefully, we will not see any false combination of paths any more.
+     [Richard Levitte]
+
+ Changes between 0.9.8 and 0.9.8a  [11 Oct 2005]
+
+  *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
+     (part of SSL_OP_ALL).  This option used to disable the
+     countermeasure against man-in-the-middle protocol-version
+     rollback in the SSL 2.0 server implementation, which is a bad
+     idea.  (CVE-2005-2969)
+
+     [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
+     for Information Security, National Institute of Advanced Industrial
+     Science and Technology [AIST], Japan)]
+
+  *) Add two function to clear and return the verify parameter flags.
+     [Steve Henson]
+
+  *) Keep cipherlists sorted in the source instead of sorting them at
+     runtime, thus removing the need for a lock.
+     [Nils Larsch]
+
+  *) Avoid some small subgroup attacks in Diffie-Hellman.
+     [Nick Mathewson and Ben Laurie]
+
+  *) Add functions for well-known primes.
+     [Nick Mathewson]
+
+  *) Extended Windows CE support.
+     [Satoshi Nakamura and Andy Polyakov]
+
+  *) Initialize SSL_METHOD structures at compile time instead of during
+     runtime, thus removing the need for a lock.
+     [Steve Henson]
+
+  *) Make PKCS7_decrypt() work even if no certificate is supplied by
+     attempting to decrypt each encrypted key in turn. Add support to
+     smime utility.
+     [Steve Henson]
+
+ Changes between 0.9.7h and 0.9.8  [05 Jul 2005]
+
+  [NB: OpenSSL 0.9.7i and later 0.9.7 patch levels were released after
+  OpenSSL 0.9.8.]
+
+  *) Add libcrypto.pc and libssl.pc for those who feel they need them.
+     [Richard Levitte]
+
+  *) Change CA.sh and CA.pl so they don't bundle the CSR and the private
+     key into the same file any more.
+     [Richard Levitte]
+
+  *) Add initial support for Win64, both IA64 and AMD64/x64 flavors.
+     [Andy Polyakov]
+
+  *) Add -utf8 command line and config file option to 'ca'.
+     [Stefan <stf@udoma.org]
+
+  *) Removed the macro des_crypt(), as it seems to conflict with some
+     libraries.  Use DES_crypt().
+     [Richard Levitte]
+
+  *) Correct naming of the 'chil' and '4758cca' ENGINEs. This
+     involves renaming the source and generated shared-libs for
+     both. The engines will accept the corrected or legacy ids
+     ('ncipher' and '4758_cca' respectively) when binding. NB,
+     this only applies when building 'shared'.
+     [Corinna Vinschen <vinschen@redhat.com> and Geoff Thorpe]
+
+  *) Add attribute functions to EVP_PKEY structure. Modify
+     PKCS12_create() to recognize a CSP name attribute and
+     use it. Make -CSP option work again in pkcs12 utility.
+     [Steve Henson]
+
+  *) Add new functionality to the bn blinding code:
+     - automatic re-creation of the BN_BLINDING parameters after
+       a fixed number of uses (currently 32)
+     - add new function for parameter creation
+     - introduce flags to control the update behaviour of the
+       BN_BLINDING parameters
+     - hide BN_BLINDING structure
+     Add a second BN_BLINDING slot to the RSA structure to improve
+     performance when a single RSA object is shared among several
+     threads.
+     [Nils Larsch]
+
+  *) Add support for DTLS.
+     [Nagendra Modadugu <nagendra@cs.stanford.edu> and Ben Laurie]
+
+  *) Add support for DER encoded private keys (SSL_FILETYPE_ASN1)
+     to SSL_CTX_use_PrivateKey_file() and SSL_use_PrivateKey_file()
+     [Walter Goulet]
+
+  *) Remove buggy and incompletet DH cert support from
+     ssl/ssl_rsa.c and ssl/s3_both.c
+     [Nils Larsch]
+
+  *) Use SHA-1 instead of MD5 as the default digest algorithm for
+     the apps/openssl applications.
+     [Nils Larsch]
+
+  *) Compile clean with "-Wall -Wmissing-prototypes
+     -Wstrict-prototypes -Wmissing-declarations -Werror". Currently
+     DEBUG_SAFESTACK must also be set.
+     [Ben Laurie]
+
+  *) Change ./Configure so that certain algorithms can be disabled by default.
+     The new counterpiece to "no-xxx" is "enable-xxx".
+
+     The patented RC5 and MDC2 algorithms will now be disabled unless
+     "enable-rc5" and "enable-mdc2", respectively, are specified.
+
+     (IDEA remains enabled despite being patented.  This is because IDEA
+     is frequently required for interoperability, and there is no license
+     fee for non-commercial use.  As before, "no-idea" can be used to
+     avoid this algorithm.)
+
+     [Bodo Moeller]
+
+  *) Add processing of proxy certificates (see RFC 3820).  This work was
+     sponsored by KTH (The Royal Institute of Technology in Stockholm) and
+     EGEE (Enabling Grids for E-science in Europe).
+     [Richard Levitte]
+
+  *) RC4 performance overhaul on modern architectures/implementations, such
+     as Intel P4, IA-64 and AMD64.
+     [Andy Polyakov]
+
+  *) New utility extract-section.pl. This can be used specify an alternative
+     section number in a pod file instead of having to treat each file as
+     a separate case in Makefile. This can be done by adding two lines to the
+     pod file:
+
+     =for comment openssl_section:XXX
+
+     The blank line is mandatory.
+
+     [Steve Henson]
+
+  *) New arguments -certform, -keyform and -pass for s_client and s_server
+     to allow alternative format key and certificate files and passphrase
+     sources.
+     [Steve Henson]
+
+  *) New structure X509_VERIFY_PARAM which combines current verify parameters,
+     update associated structures and add various utility functions.
+
+     Add new policy related verify parameters, include policy checking in 
+     standard verify code. Enhance 'smime' application with extra parameters
+     to support policy checking and print out.
+     [Steve Henson]
+
+  *) Add a new engine to support VIA PadLock ACE extensions in the VIA C3
+     Nehemiah processors. These extensions support AES encryption in hardware
+     as well as RNG (though RNG support is currently disabled).
+     [Michal Ludvig <michal@logix.cz>, with help from Andy Polyakov]
+
+  *) Deprecate BN_[get|set]_params() functions (they were ignored internally).
+     [Geoff Thorpe]
+
+  *) New FIPS 180-2 algorithms, SHA-224/-256/-384/-512 are implemented.
+     [Andy Polyakov and a number of other people]
+
+  *) Improved PowerPC platform support. Most notably BIGNUM assembler
+     implementation contributed by IBM.
+     [Suresh Chari, Peter Waltenberg, Andy Polyakov]
+
+  *) The new 'RSA_generate_key_ex' function now takes a BIGNUM for the public
+     exponent rather than 'unsigned long'. There is a corresponding change to
+     the new 'rsa_keygen' element of the RSA_METHOD structure.
+     [Jelte Jansen, Geoff Thorpe]
+
+  *) Functionality for creating the initial serial number file is now
+     moved from CA.pl to the 'ca' utility with a new option -create_serial.
+
+     (Before OpenSSL 0.9.7e, CA.pl used to initialize the serial
+     number file to 1, which is bound to cause problems.  To avoid
+     the problems while respecting compatibility between different 0.9.7
+     patchlevels, 0.9.7e  employed 'openssl x509 -next_serial' in
+     CA.pl for serial number initialization.  With the new release 0.9.8,
+     we can fix the problem directly in the 'ca' utility.)
+     [Steve Henson]
+
+  *) Reduced header interdepencies by declaring more opaque objects in
+     ossl_typ.h. As a consequence, including some headers (eg. engine.h) will
+     give fewer recursive includes, which could break lazy source code - so
+     this change is covered by the OPENSSL_NO_DEPRECATED symbol. As always,
+     developers should define this symbol when building and using openssl to
+     ensure they track the recommended behaviour, interfaces, [etc], but
+     backwards-compatible behaviour prevails when this isn't defined.
+     [Geoff Thorpe]
+
+  *) New function X509_POLICY_NODE_print() which prints out policy nodes.
+     [Steve Henson]
+
+  *) Add new EVP function EVP_CIPHER_CTX_rand_key and associated functionality.
+     This will generate a random key of the appropriate length based on the 
+     cipher context. The EVP_CIPHER can provide its own random key generation
+     routine to support keys of a specific form. This is used in the des and 
+     3des routines to generate a key of the correct parity. Update S/MIME
+     code to use new functions and hence generate correct parity DES keys.
+     Add EVP_CHECK_DES_KEY #define to return an error if the key is not 
+     valid (weak or incorrect parity).
+     [Steve Henson]
+
+  *) Add a local set of CRLs that can be used by X509_verify_cert() as well
+     as looking them up. This is useful when the verified structure may contain
+     CRLs, for example PKCS#7 signedData. Modify PKCS7_verify() to use any CRLs
+     present unless the new PKCS7_NO_CRL flag is asserted.
+     [Steve Henson]
+
+  *) Extend ASN1 oid configuration module. It now additionally accepts the
+     syntax:
+
+     shortName = some long name, 1.2.3.4
+     [Steve Henson]
+
+  *) Reimplemented the BN_CTX implementation. There is now no more static
+     limitation on the number of variables it can handle nor the depth of the
+     "stack" handling for BN_CTX_start()/BN_CTX_end() pairs. The stack
+     information can now expand as required, and rather than having a single
+     static array of bignums, BN_CTX now uses a linked-list of such arrays
+     allowing it to expand on demand whilst maintaining the usefulness of
+     BN_CTX's "bundling".
+     [Geoff Thorpe]
+
+  *) Add a missing BN_CTX parameter to the 'rsa_mod_exp' callback in RSA_METHOD
+     to allow all RSA operations to function using a single BN_CTX.
+     [Geoff Thorpe]
+
+  *) Preliminary support for certificate policy evaluation and checking. This
+     is initially intended to pass the tests outlined in "Conformance Testing
+     of Relying Party Client Certificate Path Processing Logic" v1.07.
+     [Steve Henson]
+
+  *) bn_dup_expand() has been deprecated, it was introduced in 0.9.7 and
+     remained unused and not that useful. A variety of other little bignum
+     tweaks and fixes have also been made continuing on from the audit (see
+     below).
+     [Geoff Thorpe]
+
+  *) Constify all or almost all d2i, c2i, s2i and r2i functions, along with
+     associated ASN1, EVP and SSL functions and old ASN1 macros.
+     [Richard Levitte]
+
+  *) BN_zero() only needs to set 'top' and 'neg' to zero for correct results,
+     and this should never fail. So the return value from the use of
+     BN_set_word() (which can fail due to needless expansion) is now deprecated;
+     if OPENSSL_NO_DEPRECATED is defined, BN_zero() is a void macro.
+     [Geoff Thorpe]
+
+  *) BN_CTX_get() should return zero-valued bignums, providing the same
+     initialised value as BN_new().
+     [Geoff Thorpe, suggested by Ulf Möller]
+
+  *) Support for inhibitAnyPolicy certificate extension.
+     [Steve Henson]
+
+  *) An audit of the BIGNUM code is underway, for which debugging code is
+     enabled when BN_DEBUG is defined. This makes stricter enforcements on what
+     is considered valid when processing BIGNUMs, and causes execution to
+     assert() when a problem is discovered. If BN_DEBUG_RAND is defined,
+     further steps are taken to deliberately pollute unused data in BIGNUM
+     structures to try and expose faulty code further on. For now, openssl will
+     (in its default mode of operation) continue to tolerate the inconsistent
+     forms that it has tolerated in the past, but authors and packagers should
+     consider trying openssl and their own applications when compiled with
+     these debugging symbols defined. It will help highlight potential bugs in
+     their own code, and will improve the test coverage for OpenSSL itself. At
+     some point, these tighter rules will become openssl's default to improve
+     maintainability, though the assert()s and other overheads will remain only
+     in debugging configurations. See bn.h for more details.
+     [Geoff Thorpe, Nils Larsch, Ulf Möller]
+
+  *) BN_CTX_init() has been deprecated, as BN_CTX is an opaque structure
+     that can only be obtained through BN_CTX_new() (which implicitly
+     initialises it). The presence of this function only made it possible
+     to overwrite an existing structure (and cause memory leaks).
+     [Geoff Thorpe]
+
+  *) Because of the callback-based approach for implementing LHASH as a
+     template type, lh_insert() adds opaque objects to hash-tables and
+     lh_doall() or lh_doall_arg() are typically used with a destructor callback
+     to clean up those corresponding objects before destroying the hash table
+     (and losing the object pointers). So some over-zealous constifications in
+     LHASH have been relaxed so that lh_insert() does not take (nor store) the
+     objects as "const" and the lh_doall[_arg] callback wrappers are not
+     prototyped to have "const" restrictions on the object pointers they are
+     given (and so aren't required to cast them away any more).
+     [Geoff Thorpe]
+
+  *) The tmdiff.h API was so ugly and minimal that our own timing utility
+     (speed) prefers to use its own implementation. The two implementations
+     haven't been consolidated as yet (volunteers?) but the tmdiff API has had
+     its object type properly exposed (MS_TM) instead of casting to/from "char
+     *". This may still change yet if someone realises MS_TM and "ms_time_***"
+     aren't necessarily the greatest nomenclatures - but this is what was used
+     internally to the implementation so I've used that for now.
+     [Geoff Thorpe]
+
+  *) Ensure that deprecated functions do not get compiled when
+     OPENSSL_NO_DEPRECATED is defined. Some "openssl" subcommands and a few of
+     the self-tests were still using deprecated key-generation functions so
+     these have been updated also.
+     [Geoff Thorpe]
+
+  *) Reorganise PKCS#7 code to separate the digest location functionality
+     into PKCS7_find_digest(), digest addtion into PKCS7_bio_add_digest().
+     New function PKCS7_set_digest() to set the digest type for PKCS#7
+     digestedData type. Add additional code to correctly generate the
+     digestedData type and add support for this type in PKCS7 initialization
+     functions.
+     [Steve Henson]
+
+  *) New function PKCS7_set0_type_other() this initializes a PKCS7 
+     structure of type "other".
+     [Steve Henson]
+
+  *) Fix prime generation loop in crypto/bn/bn_prime.pl by making
+     sure the loop does correctly stop and breaking ("division by zero")
+     modulus operations are not performed. The (pre-generated) prime
+     table crypto/bn/bn_prime.h was already correct, but it could not be
+     re-generated on some platforms because of the "division by zero"
+     situation in the script.
+     [Ralf S. Engelschall]
+
+  *) Update support for ECC-based TLS ciphersuites according to
+     draft-ietf-tls-ecc-03.txt: the KDF1 key derivation function with
+     SHA-1 now is only used for "small" curves (where the
+     representation of a field element takes up to 24 bytes); for
+     larger curves, the field element resulting from ECDH is directly
+     used as premaster secret.
+     [Douglas Stebila (Sun Microsystems Laboratories)]
+
+  *) Add code for kP+lQ timings to crypto/ec/ectest.c, and add SEC2
+     curve secp160r1 to the tests.
+     [Douglas Stebila (Sun Microsystems Laboratories)]
+
+  *) Add the possibility to load symbols globally with DSO.
+     [Götz Babin-Ebell <babin-ebell@trustcenter.de> via Richard Levitte]
+
+  *) Add the functions ERR_set_mark() and ERR_pop_to_mark() for better
+     control of the error stack.
+     [Richard Levitte]
+
+  *) Add support for STORE in ENGINE.
+     [Richard Levitte]
+
+  *) Add the STORE type.  The intention is to provide a common interface
+     to certificate and key stores, be they simple file-based stores, or
+     HSM-type store, or LDAP stores, or...
+     NOTE: The code is currently UNTESTED and isn't really used anywhere.
+     [Richard Levitte]
+
+  *) Add a generic structure called OPENSSL_ITEM.  This can be used to
+     pass a list of arguments to any function as well as provide a way
+     for a function to pass data back to the caller.
+     [Richard Levitte]
+
+  *) Add the functions BUF_strndup() and BUF_memdup().  BUF_strndup()
+     works like BUF_strdup() but can be used to duplicate a portion of
+     a string.  The copy gets NUL-terminated.  BUF_memdup() duplicates
+     a memory area.
+     [Richard Levitte]
+
+  *) Add the function sk_find_ex() which works like sk_find(), but will
+     return an index to an element even if an exact match couldn't be
+     found.  The index is guaranteed to point at the element where the
+     searched-for key would be inserted to preserve sorting order.
+     [Richard Levitte]
+
+  *) Add the function OBJ_bsearch_ex() which works like OBJ_bsearch() but
+     takes an extra flags argument for optional functionality.  Currently,
+     the following flags are defined:
+
+        OBJ_BSEARCH_VALUE_ON_NOMATCH
+        This one gets OBJ_bsearch_ex() to return a pointer to the first
+        element where the comparing function returns a negative or zero
+        number.
+
+        OBJ_BSEARCH_FIRST_VALUE_ON_MATCH
+        This one gets OBJ_bsearch_ex() to return a pointer to the first
+        element where the comparing function returns zero.  This is useful
+        if there are more than one element where the comparing function
+        returns zero.
+     [Richard Levitte]
+
+  *) Make it possible to create self-signed certificates with 'openssl ca'
+     in such a way that the self-signed certificate becomes part of the
+     CA database and uses the same mechanisms for serial number generation
+     as all other certificate signing.  The new flag '-selfsign' enables
+     this functionality.  Adapt CA.sh and CA.pl.in.
+     [Richard Levitte]
+
+  *) Add functionality to check the public key of a certificate request
+     against a given private.  This is useful to check that a certificate
+     request can be signed by that key (self-signing).
+     [Richard Levitte]
+
+  *) Make it possible to have multiple active certificates with the same
+     subject in the CA index file.  This is done only if the keyword
+     'unique_subject' is set to 'no' in the main CA section (default
+     if 'CA_default') of the configuration file.  The value is saved
+     with the database itself in a separate index attribute file,
+     named like the index file with '.attr' appended to the name.
+     [Richard Levitte]
+
+  *) Generate muti valued AVAs using '+' notation in config files for
+     req and dirName.
+     [Steve Henson]
+
+  *) Support for nameConstraints certificate extension.
+     [Steve Henson]
+
+  *) Support for policyConstraints certificate extension.
+     [Steve Henson]
+
+  *) Support for policyMappings certificate extension.
+     [Steve Henson]
+
+  *) Make sure the default DSA_METHOD implementation only uses its
+     dsa_mod_exp() and/or bn_mod_exp() handlers if they are non-NULL,
+     and change its own handlers to be NULL so as to remove unnecessary
+     indirection. This lets alternative implementations fallback to the
+     default implementation more easily.
+     [Geoff Thorpe]
+
+  *) Support for directoryName in GeneralName related extensions
+     in config files.
+     [Steve Henson]
+
+  *) Make it possible to link applications using Makefile.shared.
+     Make that possible even when linking against static libraries!
+     [Richard Levitte]
+
+  *) Support for single pass processing for S/MIME signing. This now
+     means that S/MIME signing can be done from a pipe, in addition
+     cleartext signing (multipart/signed type) is effectively streaming
+     and the signed data does not need to be all held in memory.
+
+     This is done with a new flag PKCS7_STREAM. When this flag is set
+     PKCS7_sign() only initializes the PKCS7 structure and the actual signing
+     is done after the data is output (and digests calculated) in
+     SMIME_write_PKCS7().
+     [Steve Henson]
+
+  *) Add full support for -rpath/-R, both in shared libraries and
+     applications, at least on the platforms where it's known how
+     to do it.
+     [Richard Levitte]
+
+  *) In crypto/ec/ec_mult.c, implement fast point multiplication with
+     precomputation, based on wNAF splitting: EC_GROUP_precompute_mult()
+     will now compute a table of multiples of the generator that
+     makes subsequent invocations of EC_POINTs_mul() or EC_POINT_mul()
+     faster (notably in the case of a single point multiplication,
+     scalar * generator).
+     [Nils Larsch, Bodo Moeller]
+
+  *) IPv6 support for certificate extensions. The various extensions
+     which use the IP:a.b.c.d can now take IPv6 addresses using the
+     formats of RFC1884 2.2 . IPv6 addresses are now also displayed
+     correctly.
+     [Steve Henson]
+
+  *) Added an ENGINE that implements RSA by performing private key
+     exponentiations with the GMP library. The conversions to and from
+     GMP's mpz_t format aren't optimised nor are any montgomery forms
+     cached, and on x86 it appears OpenSSL's own performance has caught up.
+     However there are likely to be other architectures where GMP could
+     provide a boost. This ENGINE is not built in by default, but it can be
+     specified at Configure time and should be accompanied by the necessary
+     linker additions, eg;
+         ./config -DOPENSSL_USE_GMP -lgmp
+     [Geoff Thorpe]
+
+  *) "openssl engine" will not display ENGINE/DSO load failure errors when
+     testing availability of engines with "-t" - the old behaviour is
+     produced by increasing the feature's verbosity with "-tt".
+     [Geoff Thorpe]
+
+  *) ECDSA routines: under certain error conditions uninitialized BN objects
+     could be freed. Solution: make sure initialization is performed early
+     enough. (Reported and fix supplied by Nils Larsch <nla@trustcenter.de>
+     via PR#459)
+     [Lutz Jaenicke]
+
+  *) Key-generation can now be implemented in RSA_METHOD, DSA_METHOD
+     and DH_METHOD (eg. by ENGINE implementations) to override the normal
+     software implementations. For DSA and DH, parameter generation can
+     also be overriden by providing the appropriate method callbacks.
+     [Geoff Thorpe]
+
+  *) Change the "progress" mechanism used in key-generation and
+     primality testing to functions that take a new BN_GENCB pointer in
+     place of callback/argument pairs. The new API functions have "_ex"
+     postfixes and the older functions are reimplemented as wrappers for
+     the new ones. The OPENSSL_NO_DEPRECATED symbol can be used to hide
+     declarations of the old functions to help (graceful) attempts to
+     migrate to the new functions. Also, the new key-generation API
+     functions operate on a caller-supplied key-structure and return
+     success/failure rather than returning a key or NULL - this is to
+     help make "keygen" another member function of RSA_METHOD etc.
+
+     Example for using the new callback interface:
+
+          int (*my_callback)(int a, int b, BN_GENCB *cb) = ...;
+          void *my_arg = ...;
+          BN_GENCB my_cb;
+
+          BN_GENCB_set(&my_cb, my_callback, my_arg);
+
+          return BN_is_prime_ex(some_bignum, BN_prime_checks, NULL, &cb);
+          /* For the meaning of a, b in calls to my_callback(), see the
+           * documentation of the function that calls the callback.
+           * cb will point to my_cb; my_arg can be retrieved as cb->arg.
+           * my_callback should return 1 if it wants BN_is_prime_ex()
+           * to continue, or 0 to stop.
+           */
+
+     [Geoff Thorpe]
+
+  *) Change the ZLIB compression method to be stateful, and make it
+     available to TLS with the number defined in 
+     draft-ietf-tls-compression-04.txt.
+     [Richard Levitte]
+
+  *) Add the ASN.1 structures and functions for CertificatePair, which
+     is defined as follows (according to X.509_4thEditionDraftV6.pdf):
+
+     CertificatePair ::= SEQUENCE {
+        forward         [0]     Certificate OPTIONAL,
+        reverse         [1]     Certificate OPTIONAL,
+        -- at least one of the pair shall be present -- }
+
+     Also implement the PEM functions to read and write certificate
+     pairs, and defined the PEM tag as "CERTIFICATE PAIR".
+
+     This needed to be defined, mostly for the sake of the LDAP
+     attribute crossCertificatePair, but may prove useful elsewhere as
+     well.
+     [Richard Levitte]
+
+  *) Make it possible to inhibit symlinking of shared libraries in
+     Makefile.shared, for Cygwin's sake.
+     [Richard Levitte]
+
+  *) Extend the BIGNUM API by creating a function 
+          void BN_set_negative(BIGNUM *a, int neg);
+     and a macro that behave like
+          int  BN_is_negative(const BIGNUM *a);
+
+     to avoid the need to access 'a->neg' directly in applications.
+     [Nils Larsch]
+
+  *) Implement fast modular reduction for pseudo-Mersenne primes
+     used in NIST curves (crypto/bn/bn_nist.c, crypto/ec/ecp_nist.c).
+     EC_GROUP_new_curve_GFp() will now automatically use this
+     if applicable.
+     [Nils Larsch <nla@trustcenter.de>]
+
+  *) Add new lock type (CRYPTO_LOCK_BN).
+     [Bodo Moeller]
+
+  *) Change the ENGINE framework to automatically load engines
+     dynamically from specific directories unless they could be
+     found to already be built in or loaded.  Move all the
+     current engines except for the cryptodev one to a new
+     directory engines/.
+     The engines in engines/ are built as shared libraries if
+     the "shared" options was given to ./Configure or ./config.
+     Otherwise, they are inserted in libcrypto.a.
+     /usr/local/ssl/engines is the default directory for dynamic
+     engines, but that can be overriden at configure time through
+     the usual use of --prefix and/or --openssldir, and at run
+     time with the environment variable OPENSSL_ENGINES.
+     [Geoff Thorpe and Richard Levitte]
+
+  *) Add Makefile.shared, a helper makefile to build shared
+     libraries.  Addapt Makefile.org.
+     [Richard Levitte]
+
+  *) Add version info to Win32 DLLs.
+     [Peter 'Luna' Runestig" <peter@runestig.com>]
+
+  *) Add new 'medium level' PKCS#12 API. Certificates and keys
+     can be added using this API to created arbitrary PKCS#12
+     files while avoiding the low level API.
+
+     New options to PKCS12_create(), key or cert can be NULL and
+     will then be omitted from the output file. The encryption
+     algorithm NIDs can be set to -1 for no encryption, the mac
+     iteration count can be set to 0 to omit the mac.
+
+     Enhance pkcs12 utility by making the -nokeys and -nocerts
+     options work when creating a PKCS#12 file. New option -nomac
+     to omit the mac, NONE can be set for an encryption algorithm.
+     New code is modified to use the enhanced PKCS12_create()
+     instead of the low level API.
+     [Steve Henson]
+
+  *) Extend ASN1 encoder to support indefinite length constructed
+     encoding. This can output sequences tags and octet strings in
+     this form. Modify pk7_asn1.c to support indefinite length
+     encoding. This is experimental and needs additional code to
+     be useful, such as an ASN1 bio and some enhanced streaming
+     PKCS#7 code.
+
+     Extend template encode functionality so that tagging is passed
+     down to the template encoder.
+     [Steve Henson]
+
+  *) Let 'openssl req' fail if an argument to '-newkey' is not
+     recognized instead of using RSA as a default.
+     [Bodo Moeller]
+
+  *) Add support for ECC-based ciphersuites from draft-ietf-tls-ecc-01.txt.
+     As these are not official, they are not included in "ALL";
+     the "ECCdraft" ciphersuite group alias can be used to select them.
+     [Vipul Gupta and Sumit Gupta (Sun Microsystems Laboratories)]
+
+  *) Add ECDH engine support.
+     [Nils Gura and Douglas Stebila (Sun Microsystems Laboratories)]
+
+  *) Add ECDH in new directory crypto/ecdh/.
+     [Douglas Stebila (Sun Microsystems Laboratories)]
+
+  *) Let BN_rand_range() abort with an error after 100 iterations
+     without success (which indicates a broken PRNG).
+     [Bodo Moeller]
+
+  *) Change BN_mod_sqrt() so that it verifies that the input value
+     is really the square of the return value.  (Previously,
+     BN_mod_sqrt would show GIGO behaviour.)
+     [Bodo Moeller]
+
+  *) Add named elliptic curves over binary fields from X9.62, SECG,
+     and WAP/WTLS; add OIDs that were still missing.
+
+     [Sheueling Chang Shantz and Douglas Stebila
+     (Sun Microsystems Laboratories)]
+
+  *) Extend the EC library for elliptic curves over binary fields
+     (new files ec2_smpl.c, ec2_smpt.c, ec2_mult.c in crypto/ec/).
+     New EC_METHOD:
+
+          EC_GF2m_simple_method
+
+     New API functions:
+
+          EC_GROUP_new_curve_GF2m
+          EC_GROUP_set_curve_GF2m
+          EC_GROUP_get_curve_GF2m
+          EC_POINT_set_affine_coordinates_GF2m
+          EC_POINT_get_affine_coordinates_GF2m
+          EC_POINT_set_compressed_coordinates_GF2m
+
+     Point compression for binary fields is disabled by default for
+     patent reasons (compile with OPENSSL_EC_BIN_PT_COMP defined to
+     enable it).
+
+     As binary polynomials are represented as BIGNUMs, various members
+     of the EC_GROUP and EC_POINT data structures can be shared
+     between the implementations for prime fields and binary fields;
+     the above ..._GF2m functions (except for EX_GROUP_new_curve_GF2m)
+     are essentially identical to their ..._GFp counterparts.
+     (For simplicity, the '..._GFp' prefix has been dropped from
+     various internal method names.)
+
+     An internal 'field_div' method (similar to 'field_mul' and
+     'field_sqr') has been added; this is used only for binary fields.
+
+     [Sheueling Chang Shantz and Douglas Stebila
+     (Sun Microsystems Laboratories)]
+
+  *) Optionally dispatch EC_POINT_mul(), EC_POINT_precompute_mult()
+     through methods ('mul', 'precompute_mult').
+
+     The generic implementations (now internally called 'ec_wNAF_mul'
+     and 'ec_wNAF_precomputed_mult') remain the default if these
+     methods are undefined.
+
+     [Sheueling Chang Shantz and Douglas Stebila
+     (Sun Microsystems Laboratories)]
+
+  *) New function EC_GROUP_get_degree, which is defined through
+     EC_METHOD.  For curves over prime fields, this returns the bit
+     length of the modulus.
+
+     [Sheueling Chang Shantz and Douglas Stebila
+     (Sun Microsystems Laboratories)]
+
+  *) New functions EC_GROUP_dup, EC_POINT_dup.
+     (These simply call ..._new  and ..._copy).
+
+     [Sheueling Chang Shantz and Douglas Stebila
+     (Sun Microsystems Laboratories)]
+
+  *) Add binary polynomial arithmetic software in crypto/bn/bn_gf2m.c.
+     Polynomials are represented as BIGNUMs (where the sign bit is not
+     used) in the following functions [macros]:  
+
+          BN_GF2m_add
+          BN_GF2m_sub             [= BN_GF2m_add]
+          BN_GF2m_mod             [wrapper for BN_GF2m_mod_arr]
+          BN_GF2m_mod_mul         [wrapper for BN_GF2m_mod_mul_arr]
+          BN_GF2m_mod_sqr         [wrapper for BN_GF2m_mod_sqr_arr]
+          BN_GF2m_mod_inv
+          BN_GF2m_mod_exp         [wrapper for BN_GF2m_mod_exp_arr]
+          BN_GF2m_mod_sqrt        [wrapper for BN_GF2m_mod_sqrt_arr]
+          BN_GF2m_mod_solve_quad  [wrapper for BN_GF2m_mod_solve_quad_arr]
+          BN_GF2m_cmp             [= BN_ucmp]
+
+     (Note that only the 'mod' functions are actually for fields GF(2^m).
+     BN_GF2m_add() is misnomer, but this is for the sake of consistency.)
+
+     For some functions, an the irreducible polynomial defining a
+     field can be given as an 'unsigned int[]' with strictly
+     decreasing elements giving the indices of those bits that are set;
+     i.e., p[] represents the polynomial
+          f(t) = t^p[0] + t^p[1] + ... + t^p[k]
+     where
+          p[0] > p[1] > ... > p[k] = 0.
+     This applies to the following functions:
+
+          BN_GF2m_mod_arr
+          BN_GF2m_mod_mul_arr
+          BN_GF2m_mod_sqr_arr
+          BN_GF2m_mod_inv_arr        [wrapper for BN_GF2m_mod_inv]
+          BN_GF2m_mod_div_arr        [wrapper for BN_GF2m_mod_div]
+          BN_GF2m_mod_exp_arr
+          BN_GF2m_mod_sqrt_arr
+          BN_GF2m_mod_solve_quad_arr
+          BN_GF2m_poly2arr
+          BN_GF2m_arr2poly
+
+     Conversion can be performed by the following functions:
+
+          BN_GF2m_poly2arr
+          BN_GF2m_arr2poly
+
+     bntest.c has additional tests for binary polynomial arithmetic.
+
+     Two implementations for BN_GF2m_mod_div() are available.
+     The default algorithm simply uses BN_GF2m_mod_inv() and
+     BN_GF2m_mod_mul().  The alternative algorithm is compiled in only
+     if OPENSSL_SUN_GF2M_DIV is defined (patent pending; read the
+     copyright notice in crypto/bn/bn_gf2m.c before enabling it).
+
+     [Sheueling Chang Shantz and Douglas Stebila
+     (Sun Microsystems Laboratories)]
+
+  *) Add new error code 'ERR_R_DISABLED' that can be used when some
+     functionality is disabled at compile-time.
+     [Douglas Stebila <douglas.stebila@sun.com>]
+
+  *) Change default behaviour of 'openssl asn1parse' so that more
+     information is visible when viewing, e.g., a certificate:
+
+     Modify asn1_parse2 (crypto/asn1/asn1_par.c) so that in non-'dump'
+     mode the content of non-printable OCTET STRINGs is output in a
+     style similar to INTEGERs, but with '[HEX DUMP]' prepended to
+     avoid the appearance of a printable string.
+     [Nils Larsch <nla@trustcenter.de>]
+
+  *) Add 'asn1_flag' and 'asn1_form' member to EC_GROUP with access
+     functions
+          EC_GROUP_set_asn1_flag()
+          EC_GROUP_get_asn1_flag()
+          EC_GROUP_set_point_conversion_form()
+          EC_GROUP_get_point_conversion_form()
+     These control ASN1 encoding details:
+     - Curves (i.e., groups) are encoded explicitly unless asn1_flag
+       has been set to OPENSSL_EC_NAMED_CURVE.
+     - Points are encoded in uncompressed form by default; options for
+       asn1_for are as for point2oct, namely
+          POINT_CONVERSION_COMPRESSED
+          POINT_CONVERSION_UNCOMPRESSED
+          POINT_CONVERSION_HYBRID
+
+     Also add 'seed' and 'seed_len' members to EC_GROUP with access
+     functions
+          EC_GROUP_set_seed()
+          EC_GROUP_get0_seed()
+          EC_GROUP_get_seed_len()
+     This is used only for ASN1 purposes (so far).
+     [Nils Larsch <nla@trustcenter.de>]
+
+  *) Add 'field_type' member to EC_METHOD, which holds the NID
+     of the appropriate field type OID.  The new function
+     EC_METHOD_get_field_type() returns this value.
+     [Nils Larsch <nla@trustcenter.de>]
+
+  *) Add functions 
+          EC_POINT_point2bn()
+          EC_POINT_bn2point()
+          EC_POINT_point2hex()
+          EC_POINT_hex2point()
+     providing useful interfaces to EC_POINT_point2oct() and
+     EC_POINT_oct2point().
+     [Nils Larsch <nla@trustcenter.de>]
+
+  *) Change internals of the EC library so that the functions
+          EC_GROUP_set_generator()
+          EC_GROUP_get_generator()
+          EC_GROUP_get_order()
+          EC_GROUP_get_cofactor()
+     are implemented directly in crypto/ec/ec_lib.c and not dispatched
+     to methods, which would lead to unnecessary code duplication when
+     adding different types of curves.
+     [Nils Larsch <nla@trustcenter.de> with input by Bodo Moeller]
+
+  *) Implement compute_wNAF (crypto/ec/ec_mult.c) without BIGNUM
+     arithmetic, and such that modified wNAFs are generated
+     (which avoid length expansion in many cases).
+     [Bodo Moeller]
+
+  *) Add a function EC_GROUP_check_discriminant() (defined via
+     EC_METHOD) that verifies that the curve discriminant is non-zero.
+
+     Add a function EC_GROUP_check() that makes some sanity tests
+     on a EC_GROUP, its generator and order.  This includes
+     EC_GROUP_check_discriminant().
+     [Nils Larsch <nla@trustcenter.de>]
+
+  *) Add ECDSA in new directory crypto/ecdsa/.
+
+     Add applications 'openssl ecparam' and 'openssl ecdsa'
+     (these are based on 'openssl dsaparam' and 'openssl dsa').
+
+     ECDSA support is also included in various other files across the
+     library.  Most notably,
+     - 'openssl req' now has a '-newkey ecdsa:file' option;
+     - EVP_PKCS82PKEY (crypto/evp/evp_pkey.c) now can handle ECDSA;
+     - X509_PUBKEY_get (crypto/asn1/x_pubkey.c) and
+       d2i_PublicKey (crypto/asn1/d2i_pu.c) have been modified to make
+       them suitable for ECDSA where domain parameters must be
+       extracted before the specific public key;
+     - ECDSA engine support has been added.
+     [Nils Larsch <nla@trustcenter.de>]
+
+  *) Include some named elliptic curves, and add OIDs from X9.62,
+     SECG, and WAP/WTLS.  Each curve can be obtained from the new
+     function
+          EC_GROUP_new_by_curve_name(),
+     and the list of available named curves can be obtained with
+          EC_get_builtin_curves().
+     Also add a 'curve_name' member to EC_GROUP objects, which can be
+     accessed via
+         EC_GROUP_set_curve_name()
+         EC_GROUP_get_curve_name()
+     [Nils Larsch <larsch@trustcenter.de, Bodo Moeller]
+ 
+  *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
+     was actually never needed) and in BN_mul().  The removal in BN_mul()
+     required a small change in bn_mul_part_recursive() and the addition
+     of the functions bn_cmp_part_words(), bn_sub_part_words() and
+     bn_add_part_words(), which do the same thing as bn_cmp_words(),
+     bn_sub_words() and bn_add_words() except they take arrays with
+     differing sizes.
+     [Richard Levitte]
+
+ Changes between 0.9.7m and 0.9.7n  [xx XXX xxxx]
+
+  *) In the SSL/TLS server implementation, be strict about session ID
+     context matching (which matters if an application uses a single
+     external cache for different purposes).  Previously,
+     out-of-context reuse was forbidden only if SSL_VERIFY_PEER was
+     set.  This did ensure strict client verification, but meant that,
+     with applications using a single external cache for quite
+     different requirements, clients could circumvent ciphersuite
+     restrictions for a given session ID context by starting a session
+     in a different context.
+     [Bodo Moeller]
+
+ Changes between 0.9.7l and 0.9.7m  [23 Feb 2007]
+
+  *) Cleanse PEM buffers before freeing them since they may contain 
+     sensitive data.
+     [Benjamin Bennett <ben@psc.edu>]
+
+  *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
+     a ciphersuite string such as "DEFAULT:RSA" cannot enable
+     authentication-only ciphersuites.
+     [Bodo Moeller]
+
+  *) Since AES128 and AES256 share a single mask bit in the logic of
+     ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
+     kludge to work properly if AES128 is available and AES256 isn't.
+     [Victor Duchovni]
+
+  *) Expand security boundary to match 1.1.1 module.
+     [Steve Henson]
+
+  *) Remove redundant features: hash file source, editing of test vectors
+     modify fipsld to use external fips_premain.c signature.
+     [Steve Henson]
+
+  *) New perl script mkfipsscr.pl to create shell scripts or batch files to
+     run algorithm test programs.
+     [Steve Henson]
+
+  *) Make algorithm test programs more tolerant of whitespace.
+     [Steve Henson]
+
+  *) Have SSL/TLS server implementation tolerate "mismatched" record
+     protocol version while receiving ClientHello even if the
+     ClientHello is fragmented.  (The server can't insist on the
+     particular protocol version it has chosen before the ServerHello
+     message has informed the client about his choice.)
+     [Bodo Moeller]
+
+  *) Load error codes if they are not already present instead of using a
+     static variable. This allows them to be cleanly unloaded and reloaded.
+     [Steve Henson]
+
+ Changes between 0.9.7k and 0.9.7l  [28 Sep 2006]
+
+  *) Introduce limits to prevent malicious keys being able to
+     cause a denial of service.  (CVE-2006-2940)
+     [Steve Henson, Bodo Moeller]
+
+  *) Fix ASN.1 parsing of certain invalid structures that can result
+     in a denial of service.  (CVE-2006-2937)  [Steve Henson]
+
+  *) Fix buffer overflow in SSL_get_shared_ciphers() function. 
+     (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
+
+  *) Fix SSL client code which could crash if connecting to a
+     malicious SSLv2 server.  (CVE-2006-4343)
+     [Tavis Ormandy and Will Drewry, Google Security Team]
+
+  *) Change ciphersuite string processing so that an explicit
+     ciphersuite selects this one ciphersuite (so that "AES256-SHA"
+     will no longer include "AES128-SHA"), and any other similar
+     ciphersuite (same bitmap) from *other* protocol versions (so that
+     "RC4-MD5" will still include both the SSL 2.0 ciphersuite and the
+     SSL 3.0/TLS 1.0 ciphersuite).  This is a backport combining
+     changes from 0.9.8b and 0.9.8d.
+     [Bodo Moeller]
+
+ Changes between 0.9.7j and 0.9.7k  [05 Sep 2006]
+
+  *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
+     (CVE-2006-4339)  [Ben Laurie and Google Security Team]
+
+  *) Change the Unix randomness entropy gathering to use poll() when
+     possible instead of select(), since the latter has some
+     undesirable limitations.
+     [Darryl Miles via Richard Levitte and Bodo Moeller]
+
+  *) Disable rogue ciphersuites:
+
+      - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
+      - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
+      - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
+
+     The latter two were purportedly from
+     draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
+     appear there.
+
+     Also deactive the remaining ciphersuites from
+     draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
+     unofficial, and the ID has long expired.
+     [Bodo Moeller]
+
+  *) Fix RSA blinding Heisenbug (problems sometimes occured on
+     dual-core machines) and other potential thread-safety issues.
+     [Bodo Moeller]
+
  Changes between 0.9.7i and 0.9.7j  [04 May 2006]
 
   *) Adapt fipsld and the build system to link against the validated FIPS
diff --git a/src/lib/libssl/src/Configure b/src/lib/libssl/src/Configure
index a38783dd98..1a9a59f969 100644
--- a/src/lib/libssl/src/Configure
+++ b/src/lib/libssl/src/Configure
@@ -10,7 +10,7 @@ use strict;
 
 # see INSTALL for instructions.
 
-my $usage="Usage: Configure [no-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-engine] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [no-krb5] [386] [[no-]fips] [debug] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--test-sanity] os/compiler[:flags]\n";
+my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [enable-montasm] [no-asm] [no-dso] [no-krb5] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--test-sanity] os/compiler[:flags]\n";
 
 # Options:
 #
@@ -38,7 +38,6 @@ my $usage="Usage: Configure [no-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-
 # --test-sanity Make a number of sanity checks on the data in this file.
 #               This is a debugging tool for OpenSSL developers.
 #
-# no-engine     do not compile in any engine code.
 # no-hw-xxx     do not compile support for specific crypto hardware.
 #               Generic OpenSSL-style methods relating to this support
 #               are always compiled but return NULL if the hardware
@@ -55,7 +54,10 @@ my $usage="Usage: Configure [no-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-
 # [no-]zlib     [don't] compile support for zlib compression.
 # zlib-dynamic  Like "zlib", but the zlib library is expected to be a shared
 #               library and will be loaded in run-time by the OpenSSL library.
+# enable-montasm 0.9.8 branch only: enable Montgomery x86 assembler backport
+#               from 0.9.9
 # 386           generate 80386 code
+# no-sse2       disables IA-32 SSE2 code, above option implies no-sse2
 # no-<cipher>   build without specified algorithm (rsa, idea, rc5, ...)
 # -<xxx> +<xxx> compiler options are passed through 
 #
@@ -87,9 +89,15 @@ my $usage="Usage: Configure [no-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-
 #               (intended for 64-bit CPUs running 32-bit OS).
 # BF_PTR        use 'pointer arithmatic' for Blowfish (unsafe on Alpha).
 # BF_PTR2       intel specific version (generic version is more efficient).
+#
+# Following are set automatically by this script
+#
 # MD5_ASM       use some extra md5 assember,
 # SHA1_ASM      use some extra sha1 assember, must define L_ENDIAN for x86
 # RMD160_ASM    use some extra ripemd160 assember,
+# SHA256_ASM    sha256_block is implemented in assembler
+# SHA512_ASM    sha512_block is implemented in assembler
+# AES_ASM       ASE_[en|de]crypt is implemented in assembler
 
 my $x86_gcc_des="DES_PTR DES_RISC1 DES_UNROLL";
 
@@ -108,19 +116,25 @@ my $tlib="-lnsl -lsocket";
 my $bits1="THIRTY_TWO_BIT ";
 my $bits2="SIXTY_FOUR_BIT ";
 
-my $x86_elf_asm="asm/bn86-elf.o asm/co86-elf.o:asm/dx86-elf.o asm/yx86-elf.o:asm/bx86-elf.o:asm/mx86-elf.o:asm/sx86-elf.o:asm/cx86-elf.o:asm/rx86-elf.o:asm/rm86-elf.o:asm/r586-elf.o";
-my $x86_out_asm="asm/bn86-out.o asm/co86-out.o:asm/dx86-out.o asm/yx86-out.o:asm/bx86-out.o:asm/mx86-out.o:asm/sx86-out.o:asm/cx86-out.o:asm/rx86-out.o:asm/rm86-out.o:asm/r586-out.o";
-my $x86_bsdi_asm="asm/bn86bsdi.o asm/co86bsdi.o:asm/dx86bsdi.o asm/yx86bsdi.o:asm/bx86bsdi.o:asm/mx86bsdi.o:asm/sx86bsdi.o:asm/cx86bsdi.o:asm/rx86bsdi.o:asm/rm86bsdi.o:asm/r586bsdi.o";
+my $x86_elf_asm="x86cpuid-elf.o:bn86-elf.o co86-elf.o MAYBE-MO86-elf.o:dx86-elf.o yx86-elf.o:ax86-elf.o:bx86-elf.o:mx86-elf.o:sx86-elf.o s512sse2-elf.o:cx86-elf.o:rx86-elf.o rc4_skey.o:rm86-elf.o:r586-elf.o";
+my $x86_coff_asm="x86cpuid-cof.o:bn86-cof.o co86-cof.o MAYBE-MO86-cof.o:dx86-cof.o yx86-cof.o:ax86-cof.o:bx86-cof.o:mx86-cof.o:sx86-cof.o s512sse2-cof.o:cx86-cof.o:rx86-cof.o rc4_skey.o:rm86-cof.o:r586-cof.o";
+my $x86_out_asm="x86cpuid-out.o:bn86-out.o co86-out.o MAYBE-MO86-out.o:dx86-out.o yx86-out.o:ax86-out.o:bx86-out.o:mx86-out.o:sx86-out.o s512sse2-out.o:cx86-out.o:rx86-out.o rc4_skey.o:rm86-out.o:r586-out.o";
+
+my $x86_64_asm="x86_64cpuid.o:x86_64-gcc.o x86_64-mont.o::aes-x86_64.o::md5-x86_64.o:sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o::rc4-x86_64.o::";
+my $ia64_asm=":bn-ia64.o::aes_core.o aes_cbc.o aes-ia64.o:::sha1-ia64.o sha256-ia64.o sha512-ia64.o::rc4-ia64.o rc4_skey.o::";
 
-my $mips3_irix_asm="asm/mips3.o::::::::";
-# There seems to be boundary faults in asm/alpha.s.
-#my $alpha_asm="asm/alpha.o::::::::";
-my $alpha_asm="::::::::";
+my $no_asm="::::::::::";
 
-# -DB_ENDIAN slows things down on a sparc for md5, but helps sha1.
-# So the md5_locl.h file has an undef B_ENDIAN if sun is defined
+# As for $BSDthreads. Idea is to maintain "collective" set of flags,
+# which would cover all BSD flavors. -pthread applies to them all, 
+# but is treated differently. OpenBSD expands is as -D_POSIX_THREAD
+# -lc_r, which is sufficient. FreeBSD 4.x expands it as -lc_r,
+# which has to be accompanied by explicit -D_THREAD_SAFE and
+# sometimes -D_REENTRANT. FreeBSD 5.x expands it as -lc_r, which
+# seems to be sufficient?
+my $BSDthreads="-pthread -D_THREAD_SAFE -D_REENTRANT";
 
-#config-string  $cc : $cflags : $unistd : $thread_cflag : $sys_id : $lflags : $bn_ops : $bn_obj : $des_obj : $bf_obj : $md5_obj : $sha1_obj : $cast_obj : $rc4_obj : $rmd160_obj : $rc5_obj : $dso_scheme : $shared_target : $shared_cflag : $shared_ldflag : $shared_extension : $ranlib : $arflags
+#config-string  $cc : $cflags : $unistd : $thread_cflag : $sys_id : $lflags : $bn_ops : $cpuid_obj : $bn_obj : $des_obj : $aes_obj : $bf_obj : $md5_obj : $sha1_obj : $cast_obj : $rc4_obj : $rmd160_obj : $rc5_obj : $dso_scheme : $shared_target : $shared_cflag : $shared_ldflag : $shared_extension : $ranlib : $arflags
 
 my %table=(
 # File 'TABLE' (created by 'make TABLE') contains the data from this list,
@@ -135,21 +149,28 @@ my %table=(
 # Our development configs
 "purify",       "purify gcc:-g -DPURIFY -Wall::(unknown)::-lsocket -lnsl::::",
 "debug",        "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DOPENSSL_NO_ASM -ggdb -g2 -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror::(unknown)::-lefence::::",
-"debug-ben",    "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -O2 -Wall -Wshadow -Werror -pipe::(unknown)::::asm/bn86-elf.o asm/co86-elf.o",
+"debug-ben",    "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown):::::bn86-elf.o co86-elf.o",
 "debug-ben-openbsd","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_OPENBSD_DEV_CRYPTO -DOPENSSL_NO_ASM -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::",
 "debug-ben-openbsd-debug","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_OPENBSD_DEV_CRYPTO -DOPENSSL_NO_ASM -g3 -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::",
-"debug-ben-debug",      "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -g3 -O2 -Wall -Wshadow -Werror -pipe::(unknown)::::::",
+"debug-ben-debug",      "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -g3 -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::::",
 "debug-ben-strict",     "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DCONST_STRICT -O2 -Wall -Wshadow -Werror -Wpointer-arith -Wcast-qual -Wwrite-strings -pipe::(unknown)::::::",
-"debug-ben-fips-debug","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_FIPS -g3 -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::asm/bn86-elf.o asm/co86-elf.o",
 "debug-rse","cc:-DTERMIOS -DL_ENDIAN -pipe -O -g -ggdb3 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}",
-"debug-bodo",   "gcc:-DL_ENDIAN -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DBIO_PAIR_DEBUG -DPEDANTIC -g -m486 -pedantic -Wshadow -Wall::-D_REENTRANT:::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}",
-"debug-ulf",    "gcc:-DL_ENDIAN -DREF_CHECK -DCONF_DEBUG -DBN_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -g -O2 -m486 -Wall -Werror -Wshadow -pipe::-D_REENTRANT:::${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}",
-"debug-steve",  "gcc:-DL_ENDIAN -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DDEBUG_SAFESTACK -DCRYPTO_MDEBUG_ALL -DPEDANTIC -g -mcpu=i486 -pedantic -Wno-long-long -Wall -Werror -Wshadow -pipe::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn",
-"debug-steve-linux-pseudo64",   "gcc:-DL_ENDIAN -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DDEBUG_SAFESTACK -DCRYPTO_MDEBUG_ALL -DOPENSSL_NO_ASM -g -mcpu=i486 -Wall -Werror -Wshadow -pipe::-D_REENTRANT::-rdynamic -ldl:SIXTY_FOUR_BIT::dlfcn",
-"debug-levitte-linux-elf","gcc:-DLEVITTE_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -D_POSIX_SOURCE -DPEDANTIC -ggdb -g3 -mcpu=i486 -pedantic -ansi -Wall -Wshadow -Wcast-align -Wmissing-prototypes -Wno-long-long -pipe::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debug-levitte-linux-noasm","gcc:-DLEVITTE_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DOPENSSL_NO_ASM -DL_ENDIAN -DTERMIO -D_POSIX_SOURCE -DPEDANTIC -ggdb -g3 -mcpu=i486 -pedantic -ansi -Wall -Wshadow -Wcast-align -Wmissing-prototypes -Wno-long-long -pipe::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debug-levitte-linux-elf-extreme","gcc:-DLEVITTE_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -D_POSIX_SOURCE -DPEDANTIC -ggdb -g3 -mcpu=i486 -pedantic -ansi -Wall -W -Wundef -Wshadow -Wcast-align -Wmissing-prototypes -Wconversion -Wno-long-long -pipe::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debug-levitte-linux-noasm-extreme","gcc:-DLEVITTE_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DOPENSSL_NO_ASM -DL_ENDIAN -DTERMIO -D_POSIX_SOURCE -DPEDANTIC -ggdb -g3 -mcpu=i486 -pedantic -ansi -Wall -W -Wundef -Wshadow -Wcast-align -Wmissing-prototypes -Wconversion -Wno-long-long -pipe::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-bodo",   "gcc:-DL_ENDIAN -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBIO_PAIR_DEBUG -DPEDANTIC -g -march=i486 -pedantic -Wshadow -Wall::-D_REENTRANT:::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}",
+"debug-ulf", "gcc:-DTERMIOS -DL_ENDIAN -march=i486 -Wall -DBN_DEBUG -DBN_DEBUG_RAND -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DOPENSSL_NO_ASM -g -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations:::CYGWIN32:::${no_asm}:win32:cygwin-shared:::.dll",
+"debug-steve64", "gcc:-m64 -DL_ENDIAN -DTERMIO -DREF_CHECK -DCONF_DEBUG -DDEBUG_SAFESTACK -DCRYPTO_MDEBUG_ALL -DPEDANTIC -DOPENSSL_NO_DEPRECATED -g -pedantic -Wall -Werror -Wno-long-long -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-steve32", "gcc:-m32 -DL_ENDIAN -DREF_CHECK -DCONF_DEBUG -DDEBUG_SAFESTACK -DCRYPTO_MDEBUG_ALL -DPEDANTIC -DOPENSSL_NO_DEPRECATED -g -pedantic -Wno-long-long -Wall -Werror -Wshadow -pipe::-D_REENTRANT::-rdynamic -ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC:-m32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-steve",  "gcc:-DL_ENDIAN -DREF_CHECK -DCONF_DEBUG -DDEBUG_SAFESTACK -DCRYPTO_MDEBUG_ALL -DPEDANTIC -m32 -g -pedantic -Wno-long-long -Wall -Werror -Wshadow -pipe::-D_REENTRANT::-rdynamic -ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared",
+"debug-steve-opt",      "gcc:-DL_ENDIAN -DREF_CHECK -DCONF_DEBUG -DDEBUG_SAFESTACK -DCRYPTO_MDEBUG_ALL -DPEDANTIC -m32 -O3 -g -pedantic -Wno-long-long -Wall -Werror -Wshadow -pipe::-D_REENTRANT::-rdynamic -ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared",
+"debug-steve-linux-pseudo64",   "gcc:-DL_ENDIAN -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DDEBUG_SAFESTACK -DCRYPTO_MDEBUG_ALL -DOPENSSL_NO_ASM -g -mcpu=i486 -Wall -Werror -Wshadow -pipe::-D_REENTRANT::-rdynamic -ldl:SIXTY_FOUR_BIT:${no_asm}:dlfcn:linux-shared",
+"debug-levitte-linux-elf","gcc:-DLEVITTE_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_DEBUG -DBN_DEBUG_RAND -DCRYPTO_MDEBUG -DENGINE_CONF_DEBUG -DL_ENDIAN -DTERMIO -D_POSIX_SOURCE -DPEDANTIC -ggdb -g3 -mcpu=i486 -pedantic -ansi -Wall -Wshadow -Wcast-align -Wstrict-prototypes -Wmissing-prototypes -Wno-long-long -Wundef -Wconversion -pipe::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-levitte-linux-noasm","gcc:-DLEVITTE_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_DEBUG -DBN_DEBUG_RAND -DCRYPTO_MDEBUG -DENGINE_CONF_DEBUG -DOPENSSL_NO_ASM -DL_ENDIAN -DTERMIO -D_POSIX_SOURCE -DPEDANTIC -ggdb -g3 -mcpu=i486 -pedantic -ansi -Wall -Wshadow -Wcast-align -Wstrict-prototypes -Wmissing-prototypes -Wno-long-long -Wundef -Wconversion -pipe::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-levitte-linux-elf-extreme","gcc:-DLEVITTE_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_DEBUG -DBN_DEBUG_RAND -DCRYPTO_MDEBUG -DENGINE_CONF_DEBUG -DL_ENDIAN -DTERMIO -D_POSIX_SOURCE -DPEDANTIC -ggdb -g3 -mcpu=i486 -pedantic -ansi -Wall -W -Wundef -Wshadow -Wcast-align -Wstrict-prototypes -Wmissing-prototypes -Wno-long-long -Wundef -Wconversion -pipe::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-levitte-linux-noasm-extreme","gcc:-DLEVITTE_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_DEBUG -DBN_DEBUG_RAND -DCRYPTO_MDEBUG -DENGINE_CONF_DEBUG -DOPENSSL_NO_ASM -DL_ENDIAN -DTERMIO -D_POSIX_SOURCE -DPEDANTIC -ggdb -g3 -mcpu=i486 -pedantic -ansi -Wall -W -Wundef -Wshadow -Wcast-align -Wstrict-prototypes -Wmissing-prototypes -Wno-long-long -Wundef -Wconversion -pipe::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-geoff","gcc:-DBN_DEBUG -DBN_DEBUG_RAND -DBN_STRICT -DPURIFY -DOPENSSL_NO_DEPRECATED -DOPENSSL_NO_ASM -DOPENSSL_NO_INLINE_ASM -DL_ENDIAN -DTERMIO -DPEDANTIC -O1 -ggdb2 -Wall -Werror -Wundef -pedantic -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wsign-compare -Wmissing-prototypes -Wmissing-declarations -Wno-long-long::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-linux-pentium","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -mcpu=pentium -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn",
+"debug-linux-ppro","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -mcpu=pentiumpro -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn",
+"debug-linux-elf","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -march=i486 -Wall::-D_REENTRANT::-lefence -ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-linux-elf-noefence","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "dist",         "cc:-O::(unknown)::::::",
 
 # Basic configs that should work on any (32 and less bit) box
@@ -157,10 +178,8 @@ my %table=(
 "cc",           "cc:-O::(unknown)::::::",
 
 ####VOS Configurations
-"vos-gcc","gcc:-b hppa1.1-stratus-vos -O3 -Wall -Wuninitialized -D_POSIX_C_SOURCE=200112L -D_BSD::(unknown):VOS:-Wl,-map:BN_LLONG:::::::::::::.so:",
-"debug-vos-gcc","gcc:-b hppa1.1-stratus-vos -O0 -g -Wall -D_POSIX_C_SOURCE=200112L -D_BSD -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG::(unknown):VOS:-Wl,-map:BN_LLONG:::::::::::::.so:",
-"vos-vcc","vcc:-b i386-stratus-vos -O3 -D_POSIX_C_SOURCE=200112L -D_BSD::(unknown):VOS:-Wl,-map::::::::::::::.so:",
-"debug-vos-vcc","vcc:-b i386-stratus-vos -O0 -g -D_POSIX_C_SOURCE=200112L -D_BSD -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG::(unknown):VOS:-Wl,-map::::::::::::::.so:",
+"vos-gcc","gcc:-O3 -Wall -D_POSIX_C_SOURCE=200112L -D_BSD -DB_ENDIAN::(unknown):VOS:-Wl,-map:BN_LLONG:${no_asm}:::::.so:",
+"debug-vos-gcc","gcc:-O0 -g -Wall -D_POSIX_C_SOURCE=200112L -D_BSD -DB_ENDIAN -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG::(unknown):VOS:-Wl,-map:BN_LLONG:${no_asm}:::::.so:",
 
 #### Solaris x86 with GNU C setups
 # -DOPENSSL_NO_INLINE_ASM switches off inline assembler. We have to do it
@@ -168,7 +187,7 @@ my %table=(
 # surrounds it with #APP #NO_APP comment pair which (at least Solaris
 # 7_x86) /usr/ccs/bin/as fails to assemble with "Illegal mnemonic"
 # error message.
-"solaris-x86-gcc","gcc:-O3 -fomit-frame-pointer -m486 -Wall -DL_ENDIAN -DOPENSSL_NO_INLINE_ASM::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"solaris-x86-gcc","gcc:-O3 -fomit-frame-pointer -march=pentium -Wall -DL_ENDIAN -DOPENSSL_NO_INLINE_ASM::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 # -shared -static-libgcc might appear controversial, but modules taken
 # from static libgcc do not have relocations and linking them into our
 # shared objects doesn't have any negative side-effects. On the contrary,
@@ -177,69 +196,50 @@ my %table=(
 # actually recommend to consider using gcc shared build even with vendor
 # compiler:-)
 #                                               <appro@fy.chalmers.se>
-"solaris64-x86_64-gcc","gcc:-m64 -O3 -Wall -DL_ENDIAN -DMD32_REG_T=int::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK RC4_CHAR BF_PTR2 DES_INT DES_UNROLL:asm/x86_64-gcc.o::::::asm/rc4-x86_64.o:::dlfcn:solaris-shared:-fPIC:-m64 -shared -static-libgcc:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-
+"solaris64-x86_64-gcc","gcc:-m64 -O3 -Wall -DL_ENDIAN -DMD32_REG_T=int::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:solaris-shared:-fPIC:-m64 -shared -static-libgcc:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ 
 #### Solaris x86 with Sun C setups
-"solaris-x86-cc","cc:-fast -O -Xa::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_UNROLL BF_PTR::::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"solaris64-x86_64-cc","cc:-fast -xarch=amd64 -xstrconst -Xa -DL_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK RC4_CHAR BF_PTR2 DES_INT DES_UNROLL::::::::::dlfcn:solaris-shared:-KPIC:-xarch=amd64 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"solaris-x86-cc","cc:-fast -O -Xa::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"solaris64-x86_64-cc","cc:-fast -xarch=amd64 -xstrconst -Xa -DL_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:solaris-shared:-KPIC:-xarch=amd64 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 
 #### SPARC Solaris with GNU C setups
-"solaris-sparcv7-gcc","gcc:-O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::::::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"solaris-sparcv8-gcc","gcc:-mv8 -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8.o:::::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"solaris-sparcv7-gcc","gcc:-O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"solaris-sparcv8-gcc","gcc:-mv8 -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 # -m32 should be safe to add as long as driver recognizes -mcpu=ultrasparc
-"solaris-sparcv9-gcc","gcc:-m32 -mcpu=ultrasparc -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"solaris64-sparcv9-gcc31","gcc:-mcpu=ultrasparc -m64 -O3 -fomit-frame-pointer -Wall -DB_ENDIAN::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::asm/md5-sparcv9.o::::::dlfcn:solaris-shared:-fPIC:-m64 -shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-# gcc pre-2.8 doesn't understand -mcpu=ultrasparc, so fall down to -mv8
-# but keep the assembler modules.
-"solaris-sparcv9-gcc27","gcc:-mv8 -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8plus-gcc27.o:::asm/md5-sparcv8plus-gcc27.o::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"solaris64-sparcv9-gcc","gcc:-m64 -mcpu=ultrasparc -O3 -Wall -DB_ENDIAN::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::asm/md5-sparcv9.o::::::dlfcn:solaris-shared:-fPIC:-m64 -shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-
+"solaris-sparcv9-gcc","gcc:-m32 -mcpu=ultrasparc -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"solaris64-sparcv9-gcc","gcc:-m64 -mcpu=ultrasparc -O3 -Wall -DB_ENDIAN::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:::des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-fPIC:-m64 -shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 ####
-"debug-solaris-sparcv8-gcc","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -O -g -mv8 -Wall -DB_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8.o:::::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debug-solaris-sparcv9-gcc","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -O -g -mcpu=ultrasparc -Wall -DB_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8plus.o:::::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-solaris-sparcv8-gcc","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG_ALL -O -g -mv8 -Wall -DB_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8.o::::::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-solaris-sparcv9-gcc","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG_ALL -DPEDANTIC -O -g -mcpu=ultrasparc -pedantic -ansi -Wall -Wshadow -Wno-long-long -D__EXTENSIONS__ -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 
 #### SPARC Solaris with Sun C setups
-# DO NOT use /xO[34] on sparc with SC3.0.  It is broken, and will not pass the tests
-"solaris-sparc-sc3","cc:-fast -O -Xa -DB_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_UNROLL BF_PTR::::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 # SC4.0 doesn't pass 'make test', upgrade to SC5.0 or SC4.2.
 # SC4.2 is ok, better than gcc even on bn as long as you tell it -xarch=v8
 # SC5.0 note: Compiler common patch 107357-01 or later is required!
-"solaris-sparcv7-cc","cc:-xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"solaris-sparcv8-cc","cc:-xarch=v8 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8.o:::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"solaris-sparcv9-cc","cc:-xtarget=ultra -xarch=v8plus -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"solaris64-sparcv9-cc","cc:-xtarget=ultra -xarch=v9 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::asm/md5-sparcv9.o::::::dlfcn:solaris-shared:-KPIC:-xarch=v9 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):/usr/ccs/bin/ar rs",
+"solaris-sparcv7-cc","cc:-xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"solaris-sparcv8-cc","cc:-xarch=v8 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR::sparcv8.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"solaris-sparcv9-cc","cc:-xtarget=ultra -xarch=v8plus -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"solaris64-sparcv9-cc","cc:-xtarget=ultra -xarch=v9 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:::des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:solaris-shared:-KPIC:-xarch=v9 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):/usr/ccs/bin/ar rs",
 ####
-"debug-solaris-sparcv8-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -xarch=v8 -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8.o:::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debug-solaris-sparcv9-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -xtarget=ultra -xarch=v8plus -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-
-#### SPARC Linux setups
-"linux-sparcv7","gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::",
-# Ray Miller <ray.miller@computing-services.oxford.ac.uk> has patiently
-# assisted with debugging of following two configs.
-"linux-sparcv8","gcc:-mv8 -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8.o:::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-# it's a real mess with -mcpu=ultrasparc option under Linux, but
-# -Wa,-Av8plus should do the trick no matter what.
-"linux-sparcv9","gcc:-mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -Wa,-Av8plus -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-# GCC 3.1 is a requirement
-"linux64-sparcv9","gcc:-m64 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:ULTRASPARC:-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::::asm/md5-sparcv9.o::::::dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-solaris-sparcv8-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG_ALL -xarch=v8 -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR::sparcv8.o::::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-solaris-sparcv9-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG_ALL -xtarget=ultra -xarch=v8plus -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR::sparcv8plus.o::::::::::dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", 
 
-# Sunos configs, assuming sparc for the gcc one.
-##"sunos-cc", "cc:-O4 -DNOPROTO -DNOCONST::(unknown):SUNOS::DES_UNROLL:::",
-"sunos-gcc","gcc:-O3 -mv8 -Dssize_t=int::(unknown):SUNOS::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL DES_PTR DES_RISC1:::",
+#### SunOS configs, assuming sparc for the gcc one.
+#"sunos-cc", "cc:-O4 -DNOPROTO -DNOCONST::(unknown):SUNOS::DES_UNROLL:${no_asm}::",
+"sunos-gcc","gcc:-O3 -mv8 -Dssize_t=int::(unknown):SUNOS::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL DES_PTR DES_RISC1:${no_asm}::",
 
 #### IRIX 5.x configs
 # -mips2 flag is added by ./config when appropriate.
-"irix-gcc","gcc:-O3 -DTERMIOS -DB_ENDIAN::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK DES_UNROLL DES_RISC2 DES_PTR BF_PTR::::::::::dlfcn:irix-shared:::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"irix-cc", "cc:-O2 -use_readonly_const -DTERMIOS -DB_ENDIAN::(unknown):::BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC2 DES_UNROLL BF_PTR::::::::::dlfcn:irix-shared:::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"irix-gcc","gcc:-O3 -DTERMIOS -DB_ENDIAN::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK DES_UNROLL DES_RISC2 DES_PTR BF_PTR:${no_asm}:dlfcn:irix-shared:::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"irix-cc", "cc:-O2 -use_readonly_const -DTERMIOS -DB_ENDIAN::(unknown):::BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC2 DES_UNROLL BF_PTR:${no_asm}:dlfcn:irix-shared:::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 #### IRIX 6.x configs
 # Only N32 and N64 ABIs are supported. If you need O32 ABI build, invoke
 # './Configure irix-cc -o32' manually.
-# -mips4 flag is added by ./config when appropriate.
-"irix-mips3-gcc","gcc:-mabi=n32 -mmips-as -O3 -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK_LL DES_UNROLL DES_RISC2 DES_PTR BF_PTR SIXTY_FOUR_BIT:${mips3_irix_asm}:dlfcn:irix-shared::-mabi=n32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"irix-mips3-cc", "cc:-n32 -mips3 -O2 -use_readonly_const -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::DES_PTR RC4_CHAR RC4_CHUNK_LL DES_RISC2 DES_UNROLL BF_PTR SIXTY_FOUR_BIT:${mips3_irix_asm}:dlfcn:irix-shared::-n32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"irix-mips3-gcc","gcc:-mabi=n32 -O3 -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK_LL DES_UNROLL DES_RISC2 DES_PTR BF_PTR SIXTY_FOUR_BIT::bn-mips3.o::::::::::dlfcn:irix-shared::-mabi=n32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"irix-mips3-cc", "cc:-n32 -mips3 -O2 -use_readonly_const -G0 -rdata_shared -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::DES_PTR RC4_CHAR RC4_CHUNK_LL DES_RISC2 DES_UNROLL BF_PTR SIXTY_FOUR_BIT::bn-mips3.o::::::::::dlfcn:irix-shared::-n32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 # N64 ABI builds.
-"irix64-mips4-gcc","gcc:-mabi=64 -mips4 -mmips-as -O3 -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG:${mips3_irix_asm}:dlfcn:irix-shared::-mabi=64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"irix64-mips4-cc", "cc:-64 -mips4 -O2 -use_readonly_const -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG:${mips3_irix_asm}:dlfcn:irix-shared::-64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"irix64-mips4-gcc","gcc:-mabi=64 -mips4 -O3 -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG::bn-mips3.o::::::::::dlfcn:irix-shared::-mabi=64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"irix64-mips4-cc", "cc:-64 -mips4 -O2 -use_readonly_const -G0 -rdata_shared -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE:::RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG::bn-mips3.o::::::::::dlfcn:irix-shared::-64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 
 #### Unified HP-UX ANSI C configs.
 # Special notes:
@@ -258,7 +258,7 @@ my %table=(
 #   suitable for execution on the host you're currently compiling at.
 #   If the toolkit is ment to be used on various PA-RISC processors
 #   consider './config +DAportable'.
-# - +DD64 is chosen in favour of +DA2.0W because it's ment to be
+# - +DD64 is chosen in favour of +DA2.0W because it's meant to be
 #   compatible with *future* releases.
 # - If you run ./Configure hpux-parisc-[g]cc manually don't forget to
 #   pass -D_REENTRANT on HP-UX 10 and later.
@@ -269,106 +269,77 @@ my %table=(
 #   crypto/sha/sha_lcl.h.
 #                                       <appro@fy.chalmers.se>
 #
-#!#"hpux-parisc-cc","cc:-Ae +O3 +ESlit -z -DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY::::-ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl",
 # Since there is mention of this in shlib/hpux10-cc.sh
-"hpux-parisc-cc-o4","cc:-Ae +O4 +ESlit -z -DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY::::-Wl,+cdp,../%3a,+cdp,./%3a,+s,+b,\$(INSTALLTOP)/lib -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"hpux-parisc-gcc","gcc:-O3 -DB_ENDIAN -DBN_DIV2W::::-Wl,+cdp,../%3a,+cdp,./%3a,+s,+b,\$(INSTALLTOP)/lib -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:-fPIC:-shared:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"hpux64-parisc-cc","cc:-Ae +DD64 +O3 +ESlit -z -DB_ENDIAN -DMD32_XARRAY::-D_REENTRANT::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldl:SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT::::::::::dlfcn:hpux-shared:+Z:+DD64 -b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-# 64bit PARISC for GCC without optimization, which seems to make problems.
-# Submitted by <ross.alexander@uk.neceur.com>
-"hpux64-parisc-gcc","gcc:-DB_ENDIAN -DMD32_XARRAY::-D_REENTRANT::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldl:SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT::::::::::dlfcn:hpux-shared:-fpic:-shared:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"hpux64-parisc2-gcc","gcc:-O3 -DB_ENDIAN -DMD32_XARRAY::-D_REENTRANT::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldl:SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT:asm/pa-risc2W.o:::::::::dlfcn:hpux-shared:-fPIC:-shared:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-
-# IA-64 targets
-"hpux-ia64-cc","cc:-Ae +DD32 +O3 +Olit=all -z -DB_ENDIAN::-D_REENTRANT::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldl:SIXTY_FOUR_BIT MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT:asm/ia64-cpp.o::::asm/sha1-ia64.o::asm/rc4-ia64.o:::dlfcn:hpux-shared:+Z:-b:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-# Frank Geurts <frank.geurts@nl.abnamro.com> has patiently assisted with
-# with debugging of the following config.
-"hpux64-ia64-cc","cc:-Ae +DD64 +O3 +Olit=all -z -DB_ENDIAN::-D_REENTRANT::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldl:SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT:asm/ia64-cpp.o::::asm/sha1-ia64.o::asm/rc4-ia64.o:::dlfcn:hpux-shared:+Z:+DD64 -b:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"hpux-parisc-cc-o4","cc:-Ae +O4 +ESlit -z -DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY::-D_REENTRANT::-ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1:${no_asm}:dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"hpux-parisc-gcc","gcc:-O3 -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-Wl,+s -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1:${no_asm}:dl:hpux-shared:-fPIC:-shared:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"hpux-parisc2-gcc","gcc:-march=2.0 -O3 -DB_ENDIAN -D_REENTRANT::::-Wl,+s -ldld:SIXTY_FOUR_BIT RC4_CHAR RC4_CHUNK DES_PTR DES_UNROLL DES_RISC1::pa-risc2.o::::::::::dl:hpux-shared:-fPIC:-shared:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"hpux64-parisc2-gcc","gcc:-O3 -DB_ENDIAN -D_REENTRANT::::-ldl:SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT::pa-risc2W.o::::::::::dlfcn:hpux-shared:-fpic:-shared:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 
 # More attempts at unified 10.X and 11.X targets for HP C compiler.
 #
 # Chris Ruemmler <ruemmler@cup.hp.com>
 # Kevin Steves <ks@hp.se>
-"hpux-parisc-cc","cc:+O3 +Optrs_strongly_typed -Ae +ESlit -DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY::-D_REENTRANT::-Wl,+cdp,../%3a,+cdp,./%3a,+s,+b,\$(INSTALLTOP)/lib -ldld:MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT::::::::::dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"hpux-parisc2-cc","cc:+DA2.0 +DS2.0 +O3 +Optrs_strongly_typed -Ae +ESlit -DB_ENDIAN -DMD32_XARRAY::-D_REENTRANT::-Wl,+cdp,../%3a,+cdp,./%3a,+s,+b,\$(INSTALLTOP)/lib -ldld:SIXTY_FOUR_BIT MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT:asm/pa-risc2.o:::::::::dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"hpux64-parisc2-cc","cc:+DD64 +O3 +Optrs_strongly_typed -Ae +ESlit -DB_ENDIAN -DMD32_XARRAY::-D_REENTRANT::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldl:SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT:asm/pa-risc2W.o:::::::::dlfcn:hpux-shared:+Z:+DD64 -b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-# Isn't the line below meaningless? HP-UX cc optimizes for host by default.
-# hpux-parisc1_0-cc with +DAportable flag would make more sense. <appro>
-"hpux-parisc1_1-cc","cc:+DA1.1 +DS1.1 +O3 +Optrs_strongly_typed -Ae +ESlit -DB_ENDIAN -DMD32_XARRAY::-D_REENTRANT::-Wl,+cdp,../%3a,+cdp,./%3a,+s,+b,\$(INSTALLTOP)/lib -ldld:MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT::::::::::dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-
-# HPUX 9.X config.
-# Don't use the bundled cc.  It is broken.  Use HP ANSI C if possible, or
-# egcs.  gcc 2.8.1 is also broken.
-
-"hpux-cc",      "cc:-DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY -Ae +ESlit +O3 -z::(unknown)::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-# If hpux-cc fails (e.g. during "make test"), try the next one; otherwise,
-# please report your OS and compiler version to the openssl-bugs@openssl.org
-# mailing list.
-"hpux-brokencc",        "cc:-DB_ENDIAN -DBN_DIV2W -Ae +ESlit +O2 -z::(unknown)::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldld:DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-
-"hpux-gcc",     "gcc:-DB_ENDIAN -DBN_DIV2W -O3::(unknown)::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:-fPIC:-shared:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-# If hpux-gcc fails, try this one:
-"hpux-brokengcc",       "gcc:-DB_ENDIAN -DBN_DIV2W -O3::(unknown)::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldld:DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:-fPIC:-shared:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-
-# HPUX 9.X on Motorola 68k platforms with gcc
-"hpux-m68k-gcc",  "gcc:-DB_ENDIAN -DBN_DIV2W -O3::(unknown):::BN_LLONG DES_PTR DES_UNROLL:::::::::::::",
-
-# HPUX 10.X config.  Supports threads.
-"hpux10-cc",    "cc:-DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY -Ae +ESlit +O3 -z::-D_REENTRANT::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-# If hpux10-cc fails, try this one (if still fails, try deleting BN_LLONG):
-"hpux10-brokencc",      "cc:-DB_ENDIAN -DBN_DIV2W -Ae +ESlit +O2 -z::-D_REENTRANT::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-
-"hpux10-gcc",   "gcc:-DB_ENDIAN -DBN_DIV2W -O3::-D_REENTRANT::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:-fPIC:-shared:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-# If hpux10-gcc fails, try this one:
-"hpux10-brokengcc",     "gcc:-DB_ENDIAN -DBN_DIV2W -O3::-D_REENTRANT::-Wl,+s,+b,\$(INSTALLTOP)/lib -ldld:DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:-fPIC:-shared:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-
-# HPUX 11.X from www.globus.org.
-# Only works on PA-RISC 2.0 cpus, and not optimized.  Why?
-#"hpux11-32bit-cc","cc:+DA2.0 -DB_ENDIAN -D_HPUX_SOURCE -Aa -Ae +ESlit::-D_REENTRANT:::DES_PTR DES_UNROLL DES_RISC1:::",
-#"hpux11-64bit-cc","cc:+DA2.0W -g -D_HPUX_SOURCE -Aa -Ae +ESlit::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT :::",
-# Use unified settings above instead.
+"hpux-parisc-cc","cc:+O3 +Optrs_strongly_typed -Ae +ESlit -DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY::-D_REENTRANT::-Wl,+s -ldld:MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT:${no_asm}:dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"hpux-parisc1_0-cc","cc:+DAportable +O3 +Optrs_strongly_typed -Ae +ESlit -DB_ENDIAN -DMD32_XARRAY::-D_REENTRANT::-Wl,+s -ldld:MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT:${no_asm}:dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"hpux-parisc2-cc","cc:+DA2.0 +DS2.0 +O3 +Optrs_strongly_typed -Ae +ESlit -DB_ENDIAN -DMD32_XARRAY -D_REENTRANT::::-Wl,+s -ldld:SIXTY_FOUR_BIT MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT::pa-risc2.o::::::::::dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"hpux64-parisc2-cc","cc:+DD64 +O3 +Optrs_strongly_typed -Ae +ESlit -DB_ENDIAN -DMD32_XARRAY -D_REENTRANT::::-ldl:SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT::pa-risc2W.o::::::::::dlfcn:hpux-shared:+Z:+DD64 -b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 
-#### HP MPE/iX http://jazz.external.hp.com/src/openssl/
-"MPE/iX-gcc", "gcc:-D_ENDIAN -DBN_DIV2W -O3 -D_POSIX_SOURCE -D_SOCKET_SOURCE -I/SYSLOG/PUB::(unknown):MPE:-L/SYSLOG/PUB -lsyslog -lsocket -lcurses:BN_LLONG DES_PTR DES_UNROLL DES_RISC1:::",
+# HP/UX IA-64 targets
+"hpux-ia64-cc","cc:-Ae +DD32 +O2 +Olit=all -z -DB_ENDIAN -D_REENTRANT::::-ldl:SIXTY_FOUR_BIT MD2_CHAR RC4_INDEX DES_UNROLL DES_RISC1 DES_INT:${ia64_asm}:dlfcn:hpux-shared:+Z:+DD32 -b:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+# Frank Geurts <frank.geurts@nl.abnamro.com> has patiently assisted with
+# with debugging of the following config.
+"hpux64-ia64-cc","cc:-Ae +DD64 +O3 +Olit=all -z -DB_ENDIAN -D_REENTRANT::::-ldl:SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX DES_UNROLL DES_RISC1 DES_INT:${ia64_asm}:dlfcn:hpux-shared:+Z:+DD64 -b:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+# GCC builds...
+"hpux-ia64-gcc","gcc:-O3 -DB_ENDIAN -D_REENTRANT::::-ldl:SIXTY_FOUR_BIT MD2_CHAR RC4_INDEX DES_UNROLL DES_RISC1 DES_INT:${ia64_asm}:dlfcn:hpux-shared:-fpic:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"hpux64-ia64-gcc","gcc:-mlp64 -O3 -DB_ENDIAN -D_REENTRANT::::-ldl:SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX DES_UNROLL DES_RISC1 DES_INT:${ia64_asm}:dlfcn:hpux-shared:-fpic:-mlp64 -shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", 
 
-#### PARISC Linux setups
-"linux-parisc","gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT:::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::",
+# Legacy HPUX 9.X configs...
+"hpux-cc",      "cc:-DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY -Ae +ESlit +O2 -z::(unknown)::-Wl,+s -ldld:DES_PTR DES_UNROLL DES_RISC1:${no_asm}:dl:hpux-shared:+Z:-b:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"hpux-gcc",     "gcc:-DB_ENDIAN -DBN_DIV2W -O3::(unknown)::-Wl,+s -ldld:DES_PTR DES_UNROLL DES_RISC1:${no_asm}:dl:hpux-shared:-fPIC:-shared:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 
-# Dec Alpha, OSF/1 - the alpha164-cc is historical, for the conversion
-# from the older DEC C Compiler to the newer compiler.  It's now the
-# same as the preferred entry, alpha-cc.  If you are still using the
-# older compiler (you're at 3.x or earlier, or perhaps very early 4.x)
-# you should use `alphaold-cc'.
+#### HP MPE/iX http://jazz.external.hp.com/src/openssl/
+"MPE/iX-gcc",   "gcc:-D_ENDIAN -DBN_DIV2W -O3 -D_POSIX_SOURCE -D_SOCKET_SOURCE -I/SYSLOG/PUB::(unknown):MPE:-L/SYSLOG/PUB -lsyslog -lsocket -lcurses:BN_LLONG DES_PTR DES_UNROLL DES_RISC1:::",
+
+# DEC Alpha OSF/1/Tru64 targets.
 #
 #       "What's in a name? That which we call a rose
 #        By any other word would smell as sweet."
 #
 # - William Shakespeare, "Romeo & Juliet", Act II, scene II.
 #
-# For OSF/1 3.2b and earlier, and Digital UNIX 3.2c - 3.2g, with the
-# vendor compiler, use alphaold-cc.
-# For Digital UNIX 4.0 - 4.0e, with the vendor compiler, use alpha-cc.
-# For Tru64 UNIX 4.f - current, with the vendor compiler, use alpha-cc.
-#
-# There's also an alternate target available (which `config' will never
-# select) called alpha-cc-rpath.  This target builds an RPATH into the
-# shared libraries, which is very convenient on Tru64 since binaries
-# linked against that shared library will automatically inherit that RPATH,
-# and hence know where to look for the openssl libraries, even if they're in
-# an odd place.
-#
 # For gcc, the following gave a %50 speedup on a 164 over the 'DES_INT' version
 #
-"alpha-gcc","gcc:-O3::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_RISC1:${alpha_asm}:dlfcn:alpha-osf1-shared:::.so",
-"alphaold-cc", "cc:-std1 -tune host -O4 -readonly_strings::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${alpha_asm}:dlfcn:alpha-osf1-shared:::.so",
-"alpha164-cc", "cc:-std1 -tune host -fast -readonly_strings::-pthread:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${alpha_asm}:dlfcn:tru64-shared:::.so",
-"alpha-cc", "cc:-std1 -tune host -fast -readonly_strings::-pthread:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${alpha_asm}:dlfcn:tru64-shared:::.so",
-"alpha-cc-rpath", "cc:-std1 -tune host -fast -readonly_strings::-pthread:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${alpha_asm}:dlfcn:tru64-shared-rpath:::.so",
-#
-# This probably belongs in a different section.
-#
-"FreeBSD-alpha","gcc:-DTERMIOS -O -fomit-frame-pointer::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC2::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"osf1-alpha-gcc", "gcc:-O3::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_RISC1:${no_asm}:dlfcn:alpha-osf1-shared:::.so",
+"osf1-alpha-cc",  "cc:-std1 -tune host -O4 -readonly_strings::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${no_asm}:dlfcn:alpha-osf1-shared:::.so",
+"tru64-alpha-cc", "cc:-std1 -tune host -fast -readonly_strings::-pthread:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${no_asm}:dlfcn:alpha-osf1-shared::-msym:.so",
 
+####
+#### Variety of LINUX:-)
+####
+# *-generic* is endian-neutral target, but ./config is free to
+# throw in -D[BL]_ENDIAN, whichever appropriate...
+"linux-generic32","gcc:-DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-ppc",    "gcc:-DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL::linux_ppc32.o::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+#### IA-32 targets...
+"linux-ia32-icc",       "icc:-DL_ENDIAN -DTERMIO -O2 -no_cpprt::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-KPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-elf",    "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-aout",   "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -march=i486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}",
+####
+"linux-generic64","gcc:-DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-ppc64",  "gcc:-m64 -DB_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL::linux_ppc64.o::::::::::dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-ia64",   "gcc:-DL_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-ia64-ecc","ecc:-DL_ENDIAN -DTERMIO -O2 -Wall -no_cpprt::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-ia64-icc","icc:-DL_ENDIAN -DTERMIO -O2 -Wall -no_cpprt::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-x86_64", "gcc:-m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+#### SPARC Linux setups
+# Ray Miller <ray.miller@computing-services.oxford.ac.uk> has patiently
+# assisted with debugging of following two configs.
+"linux-sparcv8","gcc:-mv8 -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+# it's a real mess with -mcpu=ultrasparc option under Linux, but
+# -Wa,-Av8plus should do the trick no matter what.
+"linux-sparcv9","gcc:-m32 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -Wa,-Av8plus -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:linux-shared:-fPIC:-m32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+# GCC 3.1 is a requirement
+"linux64-sparcv9","gcc:-m64 -mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:ULTRASPARC:-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::::::::::::dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 #### Alpha Linux with GNU C and Compaq C setups
 # Special notes:
 # - linux-alpha+bwx-gcc is ment to be used from ./config only. If you
@@ -382,63 +353,39 @@ my %table=(
 #
 #                                       <appro@fy.chalmers.se>
 #
-"linux-alpha-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-alpha+bwx-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-alpha-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
-"linux-alpha+bwx-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
-
-# assembler versions -- currently defunct:
-##"OpenBSD-alpha","gcc:-DTERMIOS -O3 -fomit-frame-pointer:::(unknown):SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2:${alpha_asm}",
-
-# The intel boxes :-), It would be worth seeing if bsdi-gcc can use the
-# bn86-elf.o file file since it is hand tweaked assembler.
-"linux-elf",    "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -m486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-pentium",        "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -mcpu=pentium -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-ppro",   "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -mcpu=pentiumpro -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-k6",     "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -mcpu=k6 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debug-linux-pentium","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -mcpu=pentium -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn",
-"debug-linux-ppro","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -mcpu=pentiumpro -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn",
-"debug-linux-elf","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -m486 -Wall::-D_REENTRANT::-lefence -ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"debug-linux-elf-noefence","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -m486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-aout",   "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -m486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}",
-"linux-mipsel",   "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-mips",   "gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-ppc",    "gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:asm/linux_ppc32.o:::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-# -bpowerpc64-linux is transient option, -m64 should be the one to use...
-"linux-ppc64",  "gcc:-bpowerpc64-linux -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:asm/linux_ppc64.o:::::::::dlfcn:linux-shared:-fPIC:-bpowerpc64-linux:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-m68k",   "gcc:-DB_ENDIAN -DTERMIO -O2 -fomit-frame-pointer -Wall::-D_REENTRANT:::BN_LLONG::",
-"linux-s390",   "gcc:-DB_ENDIAN -DTERMIO -DNO_ASM -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-s390x",  "gcc:-DB_ENDIAN -DTERMIO -DNO_ASM -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-ia64",   "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK RC4_CHAR:asm/ia64.o::::asm/sha1-ia64.o::asm/rc4-ia64.o:::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-ia64-ecc",   "ecc:-DL_ENDIAN -DTERMIO -O2 -Wall -no_cpprt::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK RC4_CHAR:asm/ia64.o::::asm/sha1-ia64.o::asm/rc4-ia64.o:::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"linux-x86_64", "gcc:-m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK RC4_CHAR BF_PTR2 DES_INT DES_UNROLL:asm/x86_64-gcc.o::::::asm/rc4-x86_64.o:::dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"NetBSD-sparc", "gcc:-DTERMIOS -O3 -fomit-frame-pointer -mv8 -Wall -DB_ENDIAN::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"NetBSD-m68",   "gcc:-DTERMIOS -O3 -fomit-frame-pointer -Wall -DB_ENDIAN::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"NetBSD-x86",   "gcc:-DTERMIOS -O3 -fomit-frame-pointer -m486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"FreeBSD-elf",  "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::-pthread -D_REENTRANT -D_THREAD_SAFE -D_THREADSAFE:::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"FreeBSD-sparc64","gcc:-DB_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer::-pthread -D_REENTRANT -D_THREAD_SAFE -D_THREADSAFE:::SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2 BF_PTR::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"FreeBSD-ia64","gcc:-DL_ENDIAN -DTERMIOS -O -fomit-frame-pointer::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK RC4_CHAR:asm/ia64-cpp.o:::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"FreeBSD",      "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}",
-"bsdi-gcc",     "gcc:-O3 -ffast-math -DL_ENDIAN -DPERL5 -m486::(unknown):::RSA_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_bsdi_asm}",
-"bsdi-elf-gcc",     "gcc:-DPERL5 -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::(unknown)::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-alpha-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-alpha+bwx-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-alpha-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${no_asm}",
+"linux-alpha+bwx-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${no_asm}",
+
+#### *BSD [do see comment about ${BSDthreads} above!]
+"BSD-generic32","gcc:-DTERMIOS -O3 -fomit-frame-pointer -Wall::${BSDthreads}:::BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL:${no_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"BSD-x86",      "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -Wall::${BSDthreads}:::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}:dlfcn:bsd-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"BSD-x86-elf",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -Wall::${BSDthreads}:::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debug-BSD-x86-elf",    "gcc:-DL_ENDIAN -DTERMIOS -O3 -Wall -g::${BSDthreads}:::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"BSD-sparcv8",  "gcc:-DB_ENDIAN -DTERMIOS -O3 -mv8 -Wall::${BSDthreads}:::BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL::sparcv8.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+
+"BSD-generic64","gcc:-DTERMIOS -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${no_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+# -DMD32_REG_T=int doesn't actually belong in sparc64 target, it
+# simply *happens* to work around a compiler bug in gcc 3.3.3,
+# triggered by RIPEMD160 code.
+"BSD-sparc64",  "gcc:-DB_ENDIAN -DTERMIOS -O3 -DMD32_REG_T=int -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC2_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC2 BF_PTR:::des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"BSD-ia64",     "gcc:-DL_ENDIAN -DTERMIOS -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${ia64_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"BSD-x86_64",   "gcc:-DL_ENDIAN -DTERMIOS -O3 -DMD32_REG_T=int -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+
+"bsdi-elf-gcc",     "gcc:-DPERL5 -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall::(unknown)::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+
 "nextstep",     "cc:-O -Wall:<libc.h>:(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::",
 "nextstep3.3",  "cc:-O3 -Wall:<libc.h>:(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::",
 
 # NCR MP-RAS UNIX ver 02.03.01
 "ncr-scde","cc:-O6 -Xa -Hoff=BEHAVED -686 -Hwide -Hiw::(unknown)::-lsocket -lnsl -lc89:${x86_gcc_des} ${x86_gcc_opts}:::",
 
-# QNX 4
+# QNX
 "qnx4", "cc:-DL_ENDIAN -DTERMIO::(unknown):::${x86_gcc_des} ${x86_gcc_opts}:",
-
-# QNX 6
 "qnx6", "cc:-DL_ENDIAN -DTERMIOS::(unknown)::-lsocket:${x86_gcc_des} ${x86_gcc_opts}:",
 
-# Linux on ARM
-# ARM comes in both little- and big-endian flavors. The following line is
-# endian neutral, but ./config is free to throw in -D[BL]_ENDIAN...
-"linux-elf-arm","gcc:-DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-
-# SCO/Caldera targets.
+#### SCO/Caldera targets.
 #
 # Originally we had like unixware-*, unixware-*-pentium, unixware-*-p6, etc.
 # Now we only have blended unixware-* as it's the only one used by ./config.
@@ -449,24 +396,23 @@ my %table=(
 # compiler drivers and assemblers. Tim Rice <tim@multitalents.net> has
 # patiently assisted to debug most of it.
 #
-# UnixWare 2.0x fails destest with -O
+# UnixWare 2.0x fails destest with -O.
 "unixware-2.0","cc:-DFILIO_H -DNO_STRINGS_H::-Kthread::-lsocket -lnsl -lresolv -lx:${x86_gcc_des} ${x86_gcc_opts}:::",
 "unixware-2.1","cc:-O -DFILIO_H::-Kthread::-lsocket -lnsl -lresolv -lx:${x86_gcc_des} ${x86_gcc_opts}:::",
 "unixware-7","cc:-O -DFILIO_H -Kalloca::-Kthread::-lsocket -lnsl:BN_LLONG MD2_CHAR RC4_INDEX ${x86_gcc_des}:${x86_elf_asm}:dlfcn:svr5-shared:-Kpic::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"unixware-7-gcc","gcc:-DL_ENDIAN -DFILIO_H -O3 -fomit-frame-pointer -m486 -Wall::-D_REENTRANT::-lsocket -lnsl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:gnu-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"OpenUNIX-8","cc:-O -DFILIO_H -Kalloca::-Kthread::-lsocket -lnsl:BN_LLONG MD2_CHAR RC4_INDEX ${x86_gcc_des}:${x86_elf_asm}:dlfcn:svr5-shared:-Kpic::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"OpenUNIX-8-gcc","gcc:-O -DFILIO_H -fomit-frame-pointer::-pthread::-lsocket -lnsl:BN_LLONG MD2_CHAR RC4_INDEX ${x86_gcc_des}:${x86_elf_asm}:dlfcn:svr5-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"sco3-gcc",  "gcc:-O3 -fomit-frame-pointer -Dssize_t=int -DNO_SYS_UN_H::(unknown)::-lsocket:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::", # the SCO assembler doesn't seem to like our assembler files ...
+"unixware-7-gcc","gcc:-DL_ENDIAN -DFILIO_H -O3 -fomit-frame-pointer -march=pentium -Wall::-D_REENTRANT::-lsocket -lnsl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:gnu-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 # SCO 5 - Ben Laurie <ben@algroup.co.uk> says the -O breaks the SCO cc.
 "sco5-cc",  "cc:-belf::(unknown)::-lsocket -lnsl:${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:svr3-shared:-Kpic::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "sco5-gcc",  "gcc:-O3 -fomit-frame-pointer::(unknown)::-lsocket -lnsl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:svr3-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 
-
-# IBM's AIX.
-"aix3-cc",    "cc:-O -DB_ENDIAN -qmaxmem=16384::(unknown):AIX::BN_LLONG RC4_CHAR:::",
-"aix-gcc",    "gcc:-O3 -DB_ENDIAN::-D_THREAD_SAFE:AIX::BN_LLONG RC4_CHAR:asm/aix_ppc32.o:::::::::dlfcn:",
-"aix-cc",     "cc:-q32 -O -DB_ENDIAN -qmaxmem=16384::-qthreaded:AIX::BN_LLONG RC4_CHAR:asm/aix_ppc32.o:::::::::dlfcn:aix-shared::-q32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X 32",
-"aix64-cc",   "cc:-q64 -O -DB_ENDIAN -qmaxmem=16384::-qthreaded:AIX::SIXTY_FOUR_BIT_LONG RC4_CHAR:asm/aix_ppc64.o:::::::::dlfcn:aix-shared::-q64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X 64",
+#### IBM's AIX.
+"aix3-cc",  "cc:-O -DB_ENDIAN -qmaxmem=16384::(unknown):AIX::BN_LLONG RC4_CHAR:::",
+"aix-gcc",  "gcc:-O -DB_ENDIAN::-D_THREAD_SAFE:AIX::BN_LLONG RC4_CHAR::aix_ppc32.o::::::::::dlfcn:aix-shared:::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X 32",
+"aix64-gcc","gcc:-maix64 -O -DB_ENDIAN::-D_THREAD_SAFE:AIX::SIXTY_FOUR_BIT_LONG RC4_CHAR::aix_ppc64.o::::::::::dlfcn:aix-shared::-maix64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X64",
+# Below targets assume AIX 5. Idea is to effectively disregard $OBJECT_MODE
+# at build time. $OBJECT_MODE is respected at ./config stage!
+"aix-cc",   "cc:-q32 -O -DB_ENDIAN -qmaxmem=16384 -qro -qroconst::-qthreaded:AIX::BN_LLONG RC4_CHAR::aix_ppc32.o::::::::::dlfcn:aix-shared::-q32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X 32",
+"aix64-cc", "cc:-q64 -O -DB_ENDIAN -qmaxmem=16384 -qro -qroconst::-qthreaded:AIX::SIXTY_FOUR_BIT_LONG RC4_CHAR::aix_ppc64.o::::::::::dlfcn:aix-shared::-q64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)::-X 64",
 
 #
 # Cray T90 and similar (SDSC)
@@ -501,7 +447,7 @@ my %table=(
 
 # Sinix/ReliantUNIX RM400
 # NOTE: The CDS++ Compiler up to V2.0Bsomething has the IRIX_CC_BUG optimizer problem. Better use -g  */
-"ReliantUNIX","cc:-KPIC -g -DTERMIOS -DB_ENDIAN::-Kthread:SNI:-lsocket -lnsl -lc -L/usr/ucblib -lucb:BN_LLONG DES_PTR DES_RISC2 DES_UNROLL BF_PTR::::::::::dlfcn:reliantunix-shared:::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"ReliantUNIX","cc:-KPIC -g -DTERMIOS -DB_ENDIAN::-Kthread:SNI:-lsocket -lnsl -lc -L/usr/ucblib -lucb:BN_LLONG DES_PTR DES_RISC2 DES_UNROLL BF_PTR:${no_asm}:dlfcn:reliantunix-shared:::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "SINIX","cc:-O::(unknown):SNI:-lsocket -lnsl -lc -L/usr/ucblib -lucb:RC4_INDEX RC4_CHAR:::",
 "SINIX-N","/usr/ucb/cc:-O2 -misaligned::(unknown)::-lucb:RC4_INDEX RC4_CHAR:::",
 
@@ -514,56 +460,60 @@ my %table=(
 #
 "OS390-Unix","c89.sh:-O -DB_ENDIAN -DCHARSET_EBCDIC -DNO_SYS_PARAM_H  -D_ALL_SOURCE::(unknown):::THIRTY_TWO_BIT DES_PTR DES_UNROLL MD2_CHAR RC4_INDEX RC4_CHAR BF_PTR:::",
 
-# Windows NT, Microsoft Visual C++ 4.0
+# Win64 targets, WIN64I denotes IA-64 and WIN64A - AMD64
+"VC-WIN64I","cl::::WIN64I::SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT EXPORT_VAR_AS_FN:${no_asm}:win32",
+"VC-WIN64A","cl::::WIN64A::SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT EXPORT_VAR_AS_FN:${no_asm}:win32",
 
-"VC-NT","cl::::WINNT::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}::::::::::win32",
-"VC-CE","cl::::WINCE::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}::::::::::win32",
-"VC-WIN32","cl::::WIN32::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}::::::::::win32",
-"VC-WIN16","cl:::(unknown):WIN16::MD2_CHAR DES_UNROLL DES_PTR RC4_INDEX THIRTY_TWO_BIT:::",
-"VC-W31-16","cl:::(unknown):WIN16::BN_LLONG MD2_CHAR DES_UNROLL DES_PTR RC4_INDEX SIXTEEN_BIT:::",
-"VC-W31-32","cl::::WIN16::BN_LLONG MD2_CHAR DES_UNROLL DES_PTR RC4_INDEX THIRTY_TWO_BIT:::",
-"VC-MSDOS","cl:::(unknown):MSDOS::BN_LLONG MD2_CHAR DES_UNROLL DES_PTR RC4_INDEX SIXTEEN_BIT:::",
+# Visual C targets
+"VC-NT","cl::::WINNT::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}:${no_asm}:win32",
+"VC-CE","cl::::WINCE::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}:${no_asm}:win32",
+"VC-WIN32","cl::::WIN32::BN_LLONG RC4_INDEX EXPORT_VAR_AS_FN ${x86_gcc_opts}:${no_asm}:win32",
 
 # Borland C++ 4.5
-"BC-32","bcc32::::WIN32::BN_LLONG DES_PTR RC4_INDEX EXPORT_VAR_AS_FN::::::::::win32",
-"BC-16","bcc:::(unknown):WIN16::BN_LLONG DES_PTR RC4_INDEX SIXTEEN_BIT:::",
+"BC-32","bcc32::::WIN32::BN_LLONG DES_PTR RC4_INDEX EXPORT_VAR_AS_FN:${no_asm}:win32",
 
 # MinGW
-"mingw", "gcc:-DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -mno-cygwin -Wall -D_WIN32_WINNT=0x333:::MINGW32:-lwsock32 -lgdi32:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts} EXPORT_VAR_AS_FN:${x86_out_asm}:win32:cygwin-shared:-D_WINDLL:-mno-cygwin:.dll.a",
+"mingw", "gcc:-mno-cygwin -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall -D_WIN32_WINNT=0x333:::MINGW32:-lwsock32 -lgdi32:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts} EXPORT_VAR_AS_FN:${x86_coff_asm}:win32:cygwin-shared:-D_WINDLL -DOPENSSL_USE_APPLINK:-mno-cygwin -shared:.dll.a",
 
 # UWIN 
-"UWIN", "cc:-DTERMIOS -DL_ENDIAN -O -Wall:::UWIN::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::win32",
+"UWIN", "cc:-DTERMIOS -DL_ENDIAN -O -Wall:::UWIN::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:win32",
 
 # Cygwin
-"Cygwin-pre1.3", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::(unknown):CYGWIN32::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::win32",
-"Cygwin", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall:::CYGWIN32::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}:dlfcn:cygwin-shared:-D_WINDLL::.dll.a",
+"Cygwin-pre1.3", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::(unknown):CYGWIN32::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:win32",
+"Cygwin", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall:::CYGWIN32::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_coff_asm}:dlfcn:cygwin-shared:-D_WINDLL:-shared:.dll.a",
+"debug-Cygwin", "gcc:-DTERMIOS -DL_ENDIAN -march=i486 -Wall -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DOPENSSL_NO_ASM -g -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror:::CYGWIN32:::${no_asm}:dlfcn:cygwin-shared:-D_WINDLL:-shared:.dll.a",
+
+# NetWare from David Ward (dsward@novell.com)
+# requires either MetroWerks NLM development tools, or gcc / nlmconv
+# NetWare defaults socket bio to WinSock sockets. However,
+# the builds can be configured to use BSD sockets instead.
+# netware-clib => legacy CLib c-runtime support
+"netware-clib", "mwccnlm::::::${x86_gcc_opts}::",
+"netware-clib-bsdsock", "mwccnlm::::::${x86_gcc_opts}::",
+"netware-clib-gcc", "i586-netware-gcc:-nostdinc -I/ndk/nwsdk/include/nlm -I/ndk/ws295sdk/include -DL_ENDIAN -DNETWARE_CLIB -DOPENSSL_SYSNAME_NETWARE -O2 -Wall:::::${x86_gcc_opts}::",
+"netware-clib-bsdsock-gcc", "i586-netware-gcc:-nostdinc -I/ndk/nwsdk/include/nlm -DNETWARE_BSDSOCK -DNETDB_USE_INTERNET -DL_ENDIAN -DNETWARE_CLIB -DOPENSSL_SYSNAME_NETWARE -O2 -Wall:::::${x86_gcc_opts}::",
+# netware-libc => LibC/NKS support
+"netware-libc", "mwccnlm::::::BN_LLONG ${x86_gcc_opts}::",
+"netware-libc-bsdsock", "mwccnlm::::::BN_LLONG ${x86_gcc_opts}::",
+"netware-libc-gcc", "i586-netware-gcc:-nostdinc -I/ndk/libc/include -I/ndk/libc/include/winsock -DL_ENDIAN -DNETWARE_LIBC -DOPENSSL_SYSNAME_NETWARE -DTERMIO -O2 -Wall:::::BN_LLONG ${x86_gcc_opts}::",
+"netware-libc-bsdsock-gcc", "i586-netware-gcc:-nostdinc -I/ndk/libc/include -DNETWARE_BSDSOCK -DL_ENDIAN -DNETWARE_LIBC -DOPENSSL_SYSNAME_NETWARE -DTERMIO -O2 -Wall:::::BN_LLONG ${x86_gcc_opts}::",
 
 # DJGPP
-"DJGPP", "gcc:-I/dev/env/WATT_ROOT/inc -DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O2 -Wall:::MSDOS:-L/dev/env/WATT_ROOT/lib -lwatt:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::",
+"DJGPP", "gcc:-I/dev/env/WATT_ROOT/inc -DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O2 -Wall:::MSDOS:-L/dev/env/WATT_ROOT/lib -lwatt:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}:",
 
 # Ultrix from Bernhard Simon <simon@zid.tuwien.ac.at>
 "ultrix-cc","cc:-std1 -O -Olimit 2500 -DL_ENDIAN::(unknown):::::::",
-"ultrix-gcc","gcc:-O3 -DL_ENDIAN::(unknown):::::::",
+"ultrix-gcc","gcc:-O3 -DL_ENDIAN::(unknown):::BN_LLONG::::",
 # K&R C is no longer supported; you need gcc on old Ultrix installations
 ##"ultrix","cc:-O2 -DNOPROTO -DNOCONST -DL_ENDIAN::(unknown):::::::",
 
-# Some OpenBSD from Bob Beck <beck@obtuse.com>
-"OpenBSD",              "gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown):::BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"OpenBSD-alpha",        "gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown):::SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"OpenBSD-i386", "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"OpenBSD-m68k",         "gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown):::BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"OpenBSD-m88k",         "gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown):::BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"OpenBSD-mips",         "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer::(unknown):::BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"OpenBSD-powerpc",      "gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown):::BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"OpenBSD-sparc",        "gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown):::BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"OpenBSD-sparc64",      "gcc:-DB_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer::(unknown):::SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2 BF_PTR::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"OpenBSD-vax",          "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer::(unknown):::BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-"OpenBSD-hppa",         "gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown):::BN_LLONG RC2_CHAR RC4_INDEX DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-
 ##### MacOS X (a.k.a. Rhapsody or Darwin) setup
-"rhapsody-ppc-cc","cc:-O3 -DB_ENDIAN::(unknown):MACOSX_RHAPSODY::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:::",
-"darwin-ppc-cc","cc:-O3 -fomit-frame-pointer -DB_ENDIAN::-D_REENTRANT:MACOSX::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/osx_ppc32.o:::::::::dlfcn:darwin-shared:-fPIC -fno-common::.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
-"darwin-i386-cc","cc:-O3 -fomit-frame-pointer -fno-common::-D_REENTRANT:MACOSX::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:::::::::::darwin-shared:-fPIC::.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+"rhapsody-ppc-cc","cc:-O3 -DB_ENDIAN::(unknown):MACOSX_RHAPSODY::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}::",
+"darwin-ppc-cc","cc:-arch ppc -O3 -DB_ENDIAN::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::osx_ppc32.o::::::::::dlfcn:darwin-shared:-fPIC -fno-common:-arch ppc -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+"darwin64-ppc-cc","cc:-arch ppc64 -O3 -DB_ENDIAN::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:ppccpuid_osx64.o:osx_ppc64.o osx_ppc64-mont.o:::::sha1-ppc_osx64.o sha256-ppc_osx64.o sha512-ppc_osx64.o:::::dlfcn:darwin-shared:-fPIC -fno-common:-arch ppc64 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+"darwin-i386-cc","cc:-arch i386 -O3 -fomit-frame-pointer -fno-common::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:dlfcn:darwin-shared:-fPIC -fno-common:-arch i386 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+"darwin64-x86_64-cc","cc:-arch x86_64 -O3 -fomit-frame-pointer -DL_ENDIAN -DMD32_REG_T=int -Wall::-D_REENTRANT:MACOSX:-Wl,-search_paths_first%:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${no_asm}:dlfcn:darwin-shared:-fPIC -fno-common:-arch x86_64 -dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
+"debug-darwin-ppc-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DB_ENDIAN -g -Wall -O::-D_REENTRANT:MACOSX::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::osx_ppc32.o::::::::::dlfcn:darwin-shared:-fPIC -fno-common:-dynamiclib:.\$(SHLIB_MAJOR).\$(SHLIB_MINOR).dylib",
 
 ##### A/UX
 "aux3-gcc","gcc:-O2 -DTERMIO::(unknown):AUX:-lbsd:RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:::",
@@ -572,7 +522,7 @@ my %table=(
 "newsos4-gcc","gcc:-O -DB_ENDIAN::(unknown):NEWS4:-lmld -liberty:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::",
 
 ##### GNU Hurd
-"hurd-x86",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -m486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC",
+"hurd-x86",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC",
 
 ##### OS/2 EMX
 "OS2-EMX", "gcc::::::::",
@@ -580,17 +530,20 @@ my %table=(
 ##### VxWorks for various targets
 "vxworks-ppc405","ccppc:-g -msoft-float -mlongcall -DCPU=PPC405 -I\$(WIND_BASE)/target/h:::VXWORKS:-r:::::",
 "vxworks-ppc750","ccppc:-ansi -nostdinc -DPPC750 -D_REENTRANT -fvolatile -fno-builtin -fno-for-scope -fsigned-char -Wall -msoft-float -mlongcall -DCPU=PPC604 -I\$(WIND_BASE)/target/h \$(DEBUG_FLAG):::VXWORKS:-r:::::",
-"vxworks-ppc750-debug","ccppc:-ansi -nostdinc -DPPC750 -D_REENTRANT -fvolatile -fno-builtin -fno-for-scope -fsigned-char -Wall -msoft-float -mlongcall -DCPU=PPC604 -I\$(WIND_BASE)/target/h -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DDEBUG -g:::VXWORKS:-r:::::",
+"vxworks-ppc750-debug","ccppc:-ansi -nostdinc -DPPC750 -D_REENTRANT -fvolatile -fno-builtin -fno-for-scope -fsigned-char -Wall -msoft-float -mlongcall -DCPU=PPC604 -I\$(WIND_BASE)/target/h -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DDEBUG -g:::VXWORKS:-r:::::",
 "vxworks-ppc860","ccppc:-nostdinc -msoft-float -DCPU=PPC860 -DNO_STRINGS_H -I\$(WIND_BASE)/target/h:::VXWORKS:-r:::::",
-"vxworks-mipsle","ccmips:-B\$(WIND_BASE)/host/\$(WIND_HOST_TYPE)/lib/gcc-lib/ -DL_ENDIAN -EL -Wl,-EL -mips2 -mno-branch-likely -G 0 -fno-builtin -msoft-float -DCPU=MIPS32 -DMIPSEL -DNO_STRINGS_H -I\$(WIND_BASE)/target/h:::VXWORKS:-r::::::::::::::::ranlibmips:",
+"vxworks-mipsle","ccmips:-B\$(WIND_BASE)/host/\$(WIND_HOST_TYPE)/lib/gcc-lib/ -DL_ENDIAN -EL -Wl,-EL -mips2 -mno-branch-likely -G 0 -fno-builtin -msoft-float -DCPU=MIPS32 -DMIPSEL -DNO_STRINGS_H -I\$(WIND_BASE)/target/h:::VXWORKS:-r::${no_asm}::::::ranlibmips:",
 
 ##### Compaq Non-Stop Kernel (Tandem)
 "tandem-c89","c89:-Ww -D__TANDEM -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1 -D_TANDEM_SOURCE -DB_ENDIAN::(unknown):::THIRTY_TWO_BIT:::",
 
 );
 
-my @WinTargets=qw(VC-NT VC-CE VC-WIN32 VC-WIN16 VC-W31-16 VC-W31-32 VC-MSDOS
-        BC-32 BC-16 Mingw32 OS2-EMX);
+my @MK1MF_Builds=qw(VC-WIN64I VC-WIN64A
+                    VC-NT VC-CE VC-WIN32
+                    BC-32 OS2-EMX
+                    netware-clib netware-clib-bsdsock
+                    netware-libc netware-libc-bsdsock);
 
 my $idx = 0;
 my $idx_cc = $idx++;
@@ -600,8 +553,10 @@ my $idx_thread_cflag = $idx++;
 my $idx_sys_id = $idx++;
 my $idx_lflags = $idx++;
 my $idx_bn_ops = $idx++;
+my $idx_cpuid_obj = $idx++;
 my $idx_bn_obj = $idx++;
 my $idx_des_obj = $idx++;
+my $idx_aes_obj = $idx++;
 my $idx_bf_obj = $idx++;
 my $idx_md5_obj = $idx++;
 my $idx_sha1_obj = $idx++;
@@ -621,15 +576,16 @@ my $prefix="";
 my $openssldir="";
 my $exe_ext="";
 my $install_prefix="";
-my $fipslibdir="/usr/local/ssl/lib";
-my $baseaddr="0xFB00000";
 my $no_threads=0;
-my $no_shared=1;
-my $zlib=0;
-my $no_krb5=0;
 my $threads=0;
+my $no_shared=0; # but "no-shared" is default
+my $zlib=1;      # but "no-zlib" is default
+my $no_krb5=0;   # but "no-krb5" is implied unless "--with-krb5-..." is used
+my $no_rfc3779=1; # but "no-rfc3779" is default
+my $montasm=1;   # but "no-montasm" is default
 my $no_asm=0;
 my $no_dso=0;
+my $no_gmp=0;
 my @skip=();
 my $Makefile="Makefile";
 my $des_locl="crypto/des/des_locl.h";
@@ -643,10 +599,10 @@ my $rc2	="crypto/rc2/rc2.h";
 my $bf  ="crypto/bf/bf_locl.h";
 my $bn_asm      ="bn_asm.o";
 my $des_enc="des_enc.o fcrypt_b.o";
-my $fips_des_enc="fips_des_enc.o";
+my $aes_enc="aes_core.o aes_cbc.o";
 my $bf_enc      ="bf_enc.o";
 my $cast_enc="c_enc.o";
-my $rc4_enc="rc4_enc.o";
+my $rc4_enc="rc4_enc.o rc4_skey.o";
 my $rc5_enc="rc5_enc.o";
 my $md5_obj="";
 my $sha1_obj="";
@@ -654,16 +610,34 @@ my $rmd160_obj="";
 my $processor="";
 my $default_ranlib;
 my $perl;
-my $fips=0;
-my $debug=0;
 
-my $no_ssl2=0;
-my $no_ssl3=0;
-my $no_tls1=0;
-my $no_md5=0;
-my $no_sha=0;
-my $no_rsa=0;
-my $no_dh=0;
+
+# All of the following is disabled by default (RC5 was enabled before 0.9.8):
+
+my %disabled = ( # "what"         => "comment"
+                 "camellia"       => "default",
+                 "cms"            => "default",
+                 "gmp"            => "default",
+                 "mdc2"           => "default",
+                 "montasm"        => "default", # explicit option in 0.9.8 only (implicitly enabled in 0.9.9)
+                 "rc5"            => "default",
+                 "rfc3779"        => "default",
+                 "seed"           => "default",
+                 "shared"         => "default",
+                 "tlsext"         => "default",
+                 "zlib"           => "default",
+                 "zlib-dynamic"   => "default"
+               );
+
+# Additional "no-..." options will be collected in %disabled.
+# To remove something from %disabled, use e.g. "enable-rc5".
+# For symmetry, "disable-..." is a synonym for "no-...".
+
+# This is what $depflags will look like with the above default:
+my $default_depflags = "-DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_CMS -DOPENSSL_NO_GMP -DOPENSSL_NO_MDC2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SEED -DOPENSSL_NO_TLSEXT ";
+
+
+my $no_sse2=0;
 
 &usage if ($#ARGV < 0);
 
@@ -705,102 +679,38 @@ PROCESS_ARGS:
         foreach (@argvcopy)
                 {
                 s /^-no-/no-/; # some people just can't read the instructions
-                if (/^--test-sanity$/)
-                        {
-                        exit(&test_sanity());
-                        }
-                elsif (/^no-asm$/)
-                        {
-                        $no_asm=1;
-                        $flags .= "-DOPENSSL_NO_ASM ";
-                        $openssl_other_defines .= "#define OPENSSL_NO_ASM\n";
-                        }
-                elsif (/^no-err$/)
-                        {
-                        $flags .= "-DOPENSSL_NO_ERR ";
-                        $openssl_other_defines .= "#define OPENSSL_NO_ERR\n";
-                        }
-                elsif (/^no-hw-(.+)$/)
-                        {
-                        my $hw=$1;
-                        $hw =~ tr/[a-z]/[A-Z]/;
-                        $flags .= "-DOPENSSL_NO_HW_$hw ";
-                        $openssl_other_defines .= "#define OPENSSL_NO_HW_$hw\n";
-                        }
-                elsif (/^no-hw$/)
-                        {
-                        $flags .= "-DOPENSSL_NO_HW ";
-                        $openssl_other_defines .= "#define OPENSSL_NO_HW\n";
-                        }
-                elsif (/^no-dso$/)
-                        { $no_dso=1; }
-                elsif (/^no-krb5$/)
-                        { $no_krb5=1; }
-                elsif (/^no-threads$/)
-                        { $no_threads=1; }
-                elsif (/^threads$/)
-                        { $threads=1; }
-                elsif (/^no-shared$/)
-                        { $no_shared=1; }
-                elsif (/^shared$/ || /^-shared$/ || /^--shared$/)
-                        { $no_shared=0; }
-                elsif (/^no-zlib$/)
-                        { $zlib=0; }
-                elsif (/^zlib$/)
-                        { $zlib=1; }
-                elsif (/^zlib-dynamic$/)
-                        { $zlib=2; }
-                elsif (/^no-symlinks$/)
-                        { $symlink=0; }
-                elsif (/^no-ssl$/)
-                        { $no_ssl2 = $no_ssl3 = 1; }
-                elsif (/^no-ssl2$/)
-                        { $no_ssl2 = 1; }
-                elsif (/^no-ssl3$/)
-                        { $no_ssl3 = 1; }
-                elsif (/^no-tls1?$/)
-                        { $no_tls1 = 1; }
-                elsif (/^no-fips$/)
-                        { $fips = 0; }
-                elsif (/^no-(.+)$/)
+
+                # rewrite some options in "enable-..." form
+                s /^-?-?shared$/enable-shared/;
+                s /^threads$/enable-threads/;
+                s /^zlib$/enable-zlib/;
+                s /^zlib-dynamic$/enable-zlib-dynamic/;
+
+                if (/^no-(.+)$/ || /^disable-(.+)$/)
                         {
-                        my $algo=$1;
-                        push @skip,$algo;
-                        $algo =~ tr/[a-z]/[A-Z]/;
-                        $flags .= "-DOPENSSL_NO_$algo ";
-                        $depflags .= "-DOPENSSL_NO_$algo ";
-                        $openssl_algorithm_defines .= "#define OPENSSL_NO_$algo\n";
-                        if ($algo eq "RIJNDAEL")
-                                {
-                                push @skip, "aes";
-                                $flags .= "-DOPENSSL_NO_AES ";
-                                $depflags .= "-DOPENSSL_NO_AES ";
-                                $openssl_algorithm_defines .= "#define OPENSSL_NO_AES\n";
-                                }
-                        if ($algo eq "DES")
+                        if ($1 eq "ssl")
                                 {
-                                push @skip, "mdc2";
-                                $options .= " no-mdc2";
-                                $flags .= "-DOPENSSL_NO_MDC2 ";
-                                $depflags .= "-DOPENSSL_NO_MDC2 ";
-                                $openssl_algorithm_defines .= "#define OPENSSL_NO_MDC2\n";
+                                $disabled{"ssl2"} = "option(ssl)";
+                                $disabled{"ssl3"} = "option(ssl)";
                                 }
-                        if ($algo eq "MD5")
+                        elsif ($1 eq "tls")
                                 {
-                                $no_md5 = 1;
+                                $disabled{"tls1"} = "option(tls)"
                                 }
-                        if ($algo eq "SHA")
-                                {
-                                $no_sha = 1;
-                                }
-                        if ($algo eq "RSA")
-                                {
-                                $no_rsa = 1;
-                                }
-                        if ($algo eq "DH")
+                        else
                                 {
-                                $no_dh = 1;
+                                $disabled{$1} = "option";
                                 }
+                        }                       
+                elsif (/^enable-(.+)$/)
+                        {
+                        delete $disabled{$1};
+
+                        $threads = 1 if ($1 eq "threads");
+                        }
+                elsif (/^--test-sanity$/)
+                        {
+                        exit(&test_sanity());
                         }
                 elsif (/^reconfigure/ || /^reconf/)
                         {
@@ -827,14 +737,6 @@ PROCESS_ARGS:
                         }
                 elsif (/^386$/)
                         { $processor=386; }
-                elsif (/^fips$/)
-                        {
-                        $fips=1;
-                        }
-                elsif (/^debug$/)
-                        {
-                        $debug=1;
-                        }
                 elsif (/^rsaref$/)
                         {
                         # No RSAref support any more since it's not needed.
@@ -871,14 +773,6 @@ PROCESS_ARGS:
                                 {
                                 $withargs{"zlib-lib"}=$1;
                                 }
-                        elsif (/^--with-fipslibdir=(.*)$/)
-                                {
-                                $fipslibdir="$1";
-                                }
-                        elsif (/^--with-baseaddr=(.*)$/)
-                                {
-                                $baseaddr="$1";
-                                }
                         elsif (/^--with-zlib-include=(.*)$/)
                                 {
                                 $withargs{"zlib-include"}="-I$1";
@@ -899,47 +793,72 @@ PROCESS_ARGS:
                         die "target already defined - $target (offending arg: $_)\n" if ($target ne "");
                         $target=$_;
                         }
-                unless ($_ eq $target) {
-                        if ($options eq "") {
-                                $options = $_;
-                        } else {
-                                $options .= " ".$_;
+
+                unless ($_ eq $target || /^no-/ || /^disable-/)
+                        {
+                        # "no-..." follows later after implied disactivations
+                        # have been derived.  (Don't take this too seroiusly,
+                        # we really only write OPTIONS to the Makefile out of
+                        # nostalgia.)
+
+                        if ($options eq "")
+                                { $options = $_; }
+                        else
+                                { $options .= " ".$_; }
                         }
                 }
         }
-}
 
-$no_ssl3=1 if ($no_md5 || $no_sha);
-$no_ssl3=1 if ($no_rsa && $no_dh);
 
-$no_ssl2=1 if ($no_md5);
-$no_ssl2=1 if ($no_rsa);
 
-$no_tls1=1 if ($no_md5 || $no_sha);
-$no_tls1=1 if ($no_dh);
+if ($processor eq "386")
+        {
+        $disabled{"sse2"} = "forced";
+        }
+
+if (!defined($withargs{"krb5-flavor"}) || $withargs{"krb5-flavor"} eq "")
+        {
+        $disabled{"krb5"} = "krb5-flavor not specified";
+        }
+
+if (!defined($disabled{"zlib-dynamic"}))
+        {
+        # "zlib-dynamic" was specifically enabled, so enable "zlib"
+        delete $disabled{"zlib"};
+        }
+
+if (defined($disabled{"rijndael"}))
+        {
+        $disabled{"aes"} = "forced";
+        }
+if (defined($disabled{"des"}))
+        {
+        $disabled{"mdc2"} = "forced";
+        }
+if (defined($disabled{"ec"}))
+        {
+        $disabled{"ecdsa"} = "forced";
+        $disabled{"ecdh"} = "forced";
+        }
 
-if ($no_ssl2)
+# SSL 2.0 requires MD5 and RSA
+if (defined($disabled{"md5"}) || defined($disabled{"rsa"}))
         {
-        push @skip,"SSL2";
-        $flags .= "-DOPENSSL_NO_SSL2 ";
-        $depflags .= "-DOPENSSL_NO_SSL2 ";
-        $openssl_algorithm_defines .= "#define OPENSSL_NO_SSL2\n";
+        $disabled{"ssl2"} = "forced";
         }
 
-if ($no_ssl3)
+# SSL 3.0 and TLS requires MD5 and SHA and either RSA or DSA+DH
+if (defined($disabled{"md5"}) || defined($disabled{"sha"})
+    || (defined($disabled{"rsa"})
+        && (defined($disabled{"dsa"}) || defined($disabled{"dh"}))))
         {
-        push @skip,"SSL3";
-        $flags .= "-DOPENSSL_NO_SSL3 ";
-        $depflags .= "-DOPENSSL_NO_SSL3 ";
-        $openssl_algorithm_defines .= "#define OPENSSL_NO_SSL3\n";
+        $disabled{"ssl3"} = "forced";
+        $disabled{"tls1"} = "forced";
         }
 
-if ($no_tls1)
+if (defined($disabled{"tls1"}))
         {
-        push @skip,"TLS1";
-        $flags .= "-DOPENSSL_NO_TLS1 ";
-        $depflags .= "-DOPENSSL_NO_TLS1 ";
-        $openssl_algorithm_defines .= "#define OPENSSL_NO_TLS1\n";
+        $disabled{"tlsext"} = "forced";
         }
 
 if ($target eq "TABLE") {
@@ -965,10 +884,72 @@ print "Configuring for $target\n";
 
 &usage if (!defined($table{$target}));
 
-my $IsWindows=scalar grep /^$target$/,@WinTargets;
+
+foreach (sort (keys %disabled))
+        {
+        $options .= " no-$_";
+
+        printf "    no-%-12s %-10s", $_, "[$disabled{$_}]";
+
+        if (/^dso$/)
+                { $no_dso = 1; }
+        elsif (/^threads$/)
+                { $no_threads = 1; }
+        elsif (/^shared$/)
+                { $no_shared = 1; }
+        elsif (/^zlib$/)
+                { $zlib = 0; }
+        elsif (/^montasm$/)
+                { $montasm = 0; }
+        elsif (/^static-engine$/)
+                { }
+        elsif (/^zlib-dynamic$/)
+                { }
+        elsif (/^symlinks$/)
+                { $symlink = 0; }
+        elsif (/^sse2$/)
+                { $no_sse2 = 1; }
+        else
+                {
+                my ($ALGO, $algo);
+                ($ALGO = $algo = $_) =~ tr/[a-z]/[A-Z]/;
+
+                if (/^asm$/ || /^err$/ || /^hw$/ || /^hw-/)
+                        {
+                        $openssl_other_defines .= "#define OPENSSL_NO_$ALGO\n";
+                        print " OPENSSL_NO_$ALGO";
+                
+                        if (/^err$/)    { $flags .= "-DOPENSSL_NO_ERR "; }
+                        elsif (/^asm$/) { $no_asm = 1; }
+                        }
+                else
+                        {
+                        $openssl_algorithm_defines .= "#define OPENSSL_NO_$ALGO\n";
+                        print " OPENSSL_NO_$ALGO";
+
+                        if (/^krb5$/)
+                                { $no_krb5 = 1; }
+                        else
+                                {
+                                push @skip, $algo;
+                                print " (skip dir)";
+
+                                $depflags .="-DOPENSSL_NO_$ALGO ";
+                                }
+                        }
+                }
+
+        print "\n";
+        }
+
+
+my $IsMK1MF=scalar grep /^$target$/,@MK1MF_Builds;
+
+$IsMK1MF=1 if ($target eq "mingw" && $^O ne "cygwin" && !is_msys());
 
 $exe_ext=".exe" if ($target eq "Cygwin" || $target eq "DJGPP" || $target eq "mingw");
-$exe_ext=".pm" if ($target eq "vos-gcc" or $target eq "debug-vos-gcc" or $target eq "vos-vcc" or $target eq "debug-vos-vcc");
+$exe_ext=".nlm" if ($target =~ /netware/);
+$exe_ext=".pm"  if ($target =~ /vos/);
 $openssldir="/usr/local/ssl" if ($openssldir eq "" and $prefix eq "");
 $prefix=$openssldir if $prefix eq "";
 
@@ -982,26 +963,10 @@ chop $prefix if $prefix =~ /\/$/;
 $openssldir=$prefix . "/ssl" if $openssldir eq "";
 $openssldir=$prefix . "/" . $openssldir if $openssldir !~ /(^\/|^[a-zA-Z]:[\\\/])/;
 
-if ($fips && ! -f "$fipslibdir/fipscanister.o")
-        {
-        my $fipswinerr = "";
-        $fipswinerr = <<EOF if $IsWindows;
- Ensure that the correct path to the FIPS module directory
-has been given to the --with-fipslibdir option.
-EOF
-        print STDERR <<EOF;
-The file fipscanister.o could not be located. Please build and install the
-FIPS module using the instructions in the user guide before compiling OpenSSL
-in FIPS mode.$fipswinerr
-EOF
-        exit 1;
-        }
 
-
-print "IsWindows=$IsWindows\n";
+print "IsMK1MF=$IsMK1MF\n";
 
 my @fields = split(/\s*:\s*/,$table{$target} . ":" x 30 , -1);
-for (@fields) { s/%([\dA-Fa-f]{2})/chr(hex($1))/eg; }
 my $cc = $fields[$idx_cc];
 my $cflags = $fields[$idx_cflags];
 my $unistd = $fields[$idx_unistd];
@@ -1009,14 +974,16 @@ my $thread_cflag = $fields[$idx_thread_cflag];
 my $sys_id = $fields[$idx_sys_id];
 my $lflags = $fields[$idx_lflags];
 my $bn_ops = $fields[$idx_bn_ops];
+my $cpuid_obj = $fields[$idx_cpuid_obj];
 my $bn_obj = $fields[$idx_bn_obj];
 my $des_obj = $fields[$idx_des_obj];
+my $aes_obj = $fields[$idx_aes_obj];
 my $bf_obj = $fields[$idx_bf_obj];
-$md5_obj = $fields[$idx_md5_obj];
-$sha1_obj = $fields[$idx_sha1_obj];
+my $md5_obj = $fields[$idx_md5_obj];
+my $sha1_obj = $fields[$idx_sha1_obj];
 my $cast_obj = $fields[$idx_cast_obj];
 my $rc4_obj = $fields[$idx_rc4_obj];
-$rmd160_obj = $fields[$idx_rmd160_obj];
+my $rmd160_obj = $fields[$idx_rmd160_obj];
 my $rc5_obj = $fields[$idx_rc5_obj];
 my $dso_scheme = $fields[$idx_dso_scheme];
 my $shared_target = $fields[$idx_shared_target];
@@ -1026,21 +993,20 @@ my $shared_extension = $fields[$idx_shared_extension];
 my $ranlib = $fields[$idx_ranlib];
 my $arflags = $fields[$idx_arflags];
 
+# '%' in $lflags is used to split flags to "pre-" and post-flags
+my ($prelflags,$postlflags)=split('%',$lflags);
+if (defined($postlflags))       { $lflags=$postlflags;  }
+else                            { $lflags=$prelflags; undef $prelflags; }
+
 my $no_shared_warn=0;
+my $no_user_cflags=0;
 
-$cflags="$flags$cflags" if ($flags ne "");
+if ($flags ne "")       { $cflags="$flags$cflags"; }
+else                    { $no_user_cflags=1;       }
 
 # Kerberos settings.  The flavor must be provided from outside, either through
 # the script "config" or manually.
-if ($no_krb5
-        || !defined($withargs{"krb5-flavor"})
-        || $withargs{"krb5-flavor"} eq "")
-        {
-        $cflags="-DOPENSSL_NO_KRB5 $cflags";
-        $options.=" no-krb5" unless $no_krb5;
-        $openssl_algorithm_defines .= "#define OPENSSL_NO_KRB5\n";
-        }
-else
+if (!$no_krb5)
         {
         my ($lresolv, $lpath, $lext);
         if ($withargs{"krb5-flavor"} =~ /^[Hh]eimdal$/)
@@ -1060,7 +1026,7 @@ else
                         if $withargs{"krb5-dir"} eq "";
                 $withargs{"krb5-lib"} = "-L".$withargs{"krb5-dir"}.
                         "/lib -lgssapi -lkrb5 -lcom_err"
-                        if $withargs{"krb5-lib"} eq "" && !$IsWindows;
+                        if $withargs{"krb5-lib"} eq "" && !$IsMK1MF;
                 $cflags="-DKRB5_HEIMDAL $cflags";
                 }
         if ($withargs{"krb5-flavor"} =~ /^[Mm][Ii][Tt]/)
@@ -1069,7 +1035,7 @@ else
                         if $withargs{"krb5-dir"} eq "";
                 $withargs{"krb5-lib"} = "-L".$withargs{"krb5-dir"}.
                         "/lib -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto"
-                        if $withargs{"krb5-lib"} eq "" && !$IsWindows;
+                        if $withargs{"krb5-lib"} eq "" && !$IsMK1MF;
                 $cflags="-DKRB5_MIT $cflags";
                 $withargs{"krb5-flavor"} =~ s/^[Mm][Ii][Tt][._-]*//;
                 if ($withargs{"krb5-flavor"} =~ /^1[._-]*[01]/)
@@ -1088,7 +1054,7 @@ else
                         }
                 }
         $withargs{"krb5-lib"} .= " -lresolv"
-                if ("$lresolv" ne "" && !$IsWindows);
+                if ("$lresolv" ne "");
         $withargs{"krb5-include"} = "-I".$withargs{"krb5-dir"}."/include"
                 if $withargs{"krb5-include"} eq "" &&
                    $withargs{"krb5-dir"} ne "";
@@ -1126,10 +1092,17 @@ if ($thread_cflag ne "(unknown)" && !$no_threads)
         # If we know how to do it, support threads by default.
         $threads = 1;
         }
-if ($thread_cflag eq "(unknown)")
+if ($thread_cflag eq "(unknown)" && $threads)
         {
-        # If the user asked for "threads", hopefully they also provided
-        # any system-dependent compiler options that are necessary.
+        # If the user asked for "threads", [s]he is also expected to
+        # provide any system-dependent compiler options that are
+        # necessary.
+        if ($no_user_cflags)
+                {
+                print "You asked for multi-threading support, but didn't\n";
+                print "provide any system-specific compiler options\n";
+                exit(1);
+                }
         $thread_cflags="-DOPENSSL_THREADS $cflags" ;
         $thread_defines .= "#define OPENSSL_THREADS\n";
         }
@@ -1151,9 +1124,17 @@ $lflags="$libs$lflags" if ($libs ne "");
 
 if ($no_asm)
         {
-        $bn_obj=$des_obj=$bf_obj=$cast_obj=$rc4_obj=$rc5_obj="";
+        $cpuid_obj=$bn_obj=$des_obj=$aes_obj=$bf_obj=$cast_obj=$rc4_obj=$rc5_obj="";
         $sha1_obj=$md5_obj=$rmd160_obj="";
         }
+if ($montasm)
+        {
+        $bn_obj =~ s/MAYBE-MO86-/mo86-/;
+        }
+else
+        {
+        $bn_obj =~ s/MAYBE-MO86-[a-z.]*//;
+        }
 
 if (!$no_shared)
         {
@@ -1169,8 +1150,14 @@ if ($threads)
 if ($zlib)
         {
         $cflags = "-DZLIB $cflags";
-        $cflags = "-DZLIB_SHARED $cflags" if $zlib == 2;
-        $lflags = "$lflags -lz" if $zlib == 1;
+        if (defined($disabled{"zlib-dynamic"}))
+                {
+                $lflags = "$lflags -lz";
+                }
+        else
+                {
+                $cflags = "-DZLIB_SHARED $cflags";
+                }
         }
 
 # You will find shlib_mark1 and shlib_mark2 explained in Makefile.org
@@ -1185,13 +1172,68 @@ if (!$no_shared)
         if ($shared_cflag ne "")
                 {
                 $cflags = "$shared_cflag -DOPENSSL_PIC $cflags";
-                $shared_ldflag = "$shared_ldflag $shared_cflag" if($fips);
                 }
         }
 
+if (!$IsMK1MF)
+        {
+        if ($no_shared)
+                {
+                $openssl_other_defines.="#define OPENSSL_NO_DYNAMIC_ENGINE\n";
+                }
+        else
+                {
+                $openssl_other_defines.="#define OPENSSL_NO_STATIC_ENGINE\n";
+                }
+        }
+
+$cpuid_obj.=" uplink.o uplink-cof.o" if ($cflags =~ /\-DOPENSSL_USE_APPLINK/);
+
+#
+# Platform fix-ups
+#
+if ($target =~ /\-icc$/)        # Intel C compiler
+        {
+        my $iccver=0;
+        if (open(FD,"$cc -V 2>&1 |"))
+                {
+                while(<FD>) { $iccver=$1 if (/Version ([0-9]+)\./); }
+                close(FD);
+                }
+        if ($iccver>=8)
+                {
+                # Eliminate unnecessary dependency from libirc.a. This is
+                # essential for shared library support, as otherwise
+                # apps/openssl can end up in endless loop upon startup...
+                $cflags.=" -Dmemcpy=__builtin_memcpy -Dmemset=__builtin_memset";
+                }
+        if ($iccver>=9)
+                {
+                $cflags.=" -i-static";
+                $cflags=~s/\-no_cpprt/-no-cpprt/;
+                }
+        if ($iccver>=10)
+                {
+                $cflags=~s/\-i\-static/-static-intel/;
+                }
+        }
+
+# Unlike other OSes (like Solaris, Linux, Tru64, IRIX) BSD run-time
+# linkers (tested OpenBSD, NetBSD and FreeBSD) "demand" RPATH set on
+# .so objects. Apparently application RPATH is not global and does
+# not apply to .so linked with other .so. Problem manifests itself
+# when libssl.so fails to load libcrypto.so. One can argue that we
+# should engrave this into Makefile.shared rules or into BSD-* config
+# lines above. Meanwhile let's try to be cautious and pass -rpath to
+# linker only when --prefix is not /usr.
+if ($target =~ /^BSD\-/)
+        {
+        $shared_ldflag.=" -Wl,-rpath,\$(LIBRPATH)" if ($prefix !~ m|^/usr[/]*$|);
+        }
+
 if ($sys_id ne "")
         {
-        $cflags="-DOPENSSL_SYSNAME_$sys_id $cflags";
+        #$cflags="-DOPENSSL_SYSNAME_$sys_id $cflags";
         $openssl_sys_defines="#define OPENSSL_SYSNAME_$sys_id\n";
         }
 
@@ -1205,37 +1247,31 @@ if ($ranlib eq "")
 #$bn1=$bn_asm unless ($bn1 =~ /\.o$/);
 #$bn_obj="$bn1";
 
+$cpuid_obj="" if ($processor eq "386");
+
 $bn_obj = $bn_asm unless $bn_obj ne "";
+# bn86* is the only one implementing bn_*_part_words
+$cflags.=" -DOPENSSL_BN_ASM_PART_WORDS" if ($bn_obj =~ /bn86/);
+$cflags.=" -DOPENSSL_IA32_SSE2" if (!$no_sse2 && $bn_obj =~ /bn86/);
+$cflags.=" -DOPENSSL_BN_ASM_MONT" if ($bn_obj =~ /\-mont|mo86\-/);
 
-my $fips_des_obj;
-my $fips_aes_obj;
-my $fips_sha1_obj;
-if ($fips)
-        {
-        if ($des_obj =~ /\-elf\.o$/)
-                {
-                $fips_des_obj='asm/fips-dx86-elf.o';
-                $openssl_other_defines.="#define OPENSSL_FIPS_DES_ASM\n";
-                $fips_aes_obj='asm/fips-ax86-elf.o';
-                $openssl_other_defines.="#define OPENSSL_FIPS_AES_ASM\n";
-                }
-        else    {
-                $fips_des_obj=$fips_des_enc;
-                $fips_aes_obj='fips_aes_core.o';
-                }
-        $fips_sha1_obj='asm/fips-sx86-elf.o' if ($sha1_obj =~ /\-elf\.o$/);
-        $des_obj=$sha1_obj="";
-        $openssl_other_defines.="#define OPENSSL_FIPS\n";
-        }
 $des_obj=$des_enc       unless ($des_obj =~ /\.o$/);
 $bf_obj=$bf_enc         unless ($bf_obj =~ /\.o$/);
 $cast_obj=$cast_enc     unless ($cast_obj =~ /\.o$/);
 $rc4_obj=$rc4_enc       unless ($rc4_obj =~ /\.o$/);
 $rc5_obj=$rc5_enc       unless ($rc5_obj =~ /\.o$/);
-if ($sha1_obj =~ /\.o$/ || $fips_sha1_obj =~ /\.o$/)
+if ($sha1_obj =~ /\.o$/)
         {
 #       $sha1_obj=$sha1_enc;
-        $cflags.=" -DSHA1_ASM";
+        $cflags.=" -DSHA1_ASM"   if ($sha1_obj =~ /sx86/ || $sha1_obj =~ /sha1/);
+        $cflags.=" -DSHA256_ASM" if ($sha1_obj =~ /sha256/);
+        $cflags.=" -DSHA512_ASM" if ($sha1_obj =~ /sha512/);
+        if ($sha1_obj =~ /sse2/)
+            {   if ($no_sse2)
+                {   $sha1_obj =~ s/\S*sse2\S+//;        }
+                elsif ($cflags !~ /OPENSSL_IA32_SSE2/)
+                {   $cflags.=" -DOPENSSL_IA32_SSE2";    }
+            }
         }
 if ($md5_obj =~ /\.o$/)
         {
@@ -1247,11 +1283,12 @@ if ($rmd160_obj =~ /\.o$/)
 #       $rmd160_obj=$rmd160_enc;
         $cflags.=" -DRMD160_ASM";
         }
-
-if ($debug)
+if ($aes_obj =~ /\.o$/)
         {
-        $cflags.=" -g";
-        $cflags=~s/-fomit-frame-pointer//;
+        $cflags.=" -DAES_ASM";
+        }
+else    {
+        $aes_obj=$aes_enc;
         }
 
 # "Stringify" the C flags string.  This permits it to be made part of a string
@@ -1259,6 +1296,7 @@ if ($debug)
 $cflags =~ s/([\\\"])/\\\1/g;
 
 my $version = "unknown";
+my $version_num = "unknown";
 my $major = "unknown";
 my $minor = "unknown";
 my $shlib_version_number = "unknown";
@@ -1270,6 +1308,7 @@ open(IN,'<crypto/opensslv.h') || die "unable to read opensslv.h:$!\n";
 while (<IN>)
         {
         $version=$1 if /OPENSSL.VERSION.TEXT.*OpenSSL (\S+) /;
+        $version_num=$1 if /OPENSSL.VERSION.NUMBER.*0x(\S+)/;
         $shlib_version_number=$1 if /SHLIB_VERSION_NUMBER *"([^"]+)"/;
         $shlib_version_history=$1 if /SHLIB_VERSION_HISTORY *"([^"]*)"/;
         }
@@ -1322,19 +1361,19 @@ while (<IN>)
         s/^MAKEDEPPROG=.*$/MAKEDEPPROG= $cc/ if $cc eq "gcc";
         s/^CFLAG=.*$/CFLAG= $cflags/;
         s/^DEPFLAG=.*$/DEPFLAG= $depflags/;
+        s/^PEX_LIBS=.*$/PEX_LIBS= $prelflags/;
         s/^EX_LIBS=.*$/EX_LIBS= $lflags/;
         s/^EXE_EXT=.*$/EXE_EXT= $exe_ext/;
+        s/^CPUID_OBJ=.*$/CPUID_OBJ= $cpuid_obj/;
         s/^BN_ASM=.*$/BN_ASM= $bn_obj/;
         s/^DES_ENC=.*$/DES_ENC= $des_obj/;
-        s/^FIPS_DES_ENC=.*$/FIPS_DES_ENC= $fips_des_obj/;
-        s/^FIPS_AES_ENC=.*$/FIPS_AES_ENC= $fips_aes_obj/;
+        s/^AES_ASM_OBJ=.*$/AES_ASM_OBJ= $aes_obj/;
         s/^BF_ENC=.*$/BF_ENC= $bf_obj/;
         s/^CAST_ENC=.*$/CAST_ENC= $cast_obj/;
         s/^RC4_ENC=.*$/RC4_ENC= $rc4_obj/;
         s/^RC5_ENC=.*$/RC5_ENC= $rc5_obj/;
         s/^MD5_ASM_OBJ=.*$/MD5_ASM_OBJ= $md5_obj/;
         s/^SHA1_ASM_OBJ=.*$/SHA1_ASM_OBJ= $sha1_obj/;
-        s/^FIPS_SHA1_ASM_OBJ=.*$/FIPS_SHA1_ASM_OBJ= $fips_sha1_obj/;
         s/^RMD160_ASM_OBJ=.*$/RMD160_ASM_OBJ= $rmd160_obj/;
         s/^PROCESSOR=.*/PROCESSOR= $processor/;
         s/^RANLIB=.*/RANLIB= $ranlib/;
@@ -1343,8 +1382,6 @@ while (<IN>)
         s/^KRB5_INCLUDES=.*/KRB5_INCLUDES=$withargs{"krb5-include"}/;
         s/^LIBKRB5=.*/LIBKRB5=$withargs{"krb5-lib"}/;
         s/^LIBZLIB=.*/LIBZLIB=$withargs{"zlib-lib"}/;
-        s/^FIPSLIBDIR=.*/FIPSLIBDIR=$fipslibdir/;
-        s/^BASEADDR=.*/BASEADDR=$baseaddr/;
         s/^ZLIB_INCLUDE=.*/ZLIB_INCLUDE=$withargs{"zlib-include"}/;
         s/^SHLIB_TARGET=.*/SHLIB_TARGET=$shared_target/;
         s/^SHLIB_MARK=.*/SHLIB_MARK=$shared_mark/;
@@ -1378,8 +1415,10 @@ rename("$Makefile.new",$Makefile) || die "unable to rename $Makefile.new\n";
 print "CC            =$cc\n";
 print "CFLAG         =$cflags\n";
 print "EX_LIBS       =$lflags\n";
+print "CPUID_OBJ     =$cpuid_obj\n";
 print "BN_ASM        =$bn_obj\n";
 print "DES_ENC       =$des_obj\n";
+print "AES_ASM_OBJ   =$aes_obj\n";
 print "BF_ENC        =$bf_obj\n";
 print "CAST_ENC      =$cast_obj\n";
 print "RC4_ENC       =$rc4_obj\n";
@@ -1471,10 +1510,14 @@ print OUT "#ifdef OPENSSL_ALGORITHM_DEFINES\n";
 print OUT $openssl_algorithm_defines_trans;
 print OUT "#endif\n\n";
 
+print OUT "#define OPENSSL_CPUID_OBJ\n\n" if ($cpuid_obj);
+
 while (<IN>)
         {
         if      (/^#define\s+OPENSSLDIR/)
                 { print OUT "#define OPENSSLDIR \"$openssldir\"\n"; }
+        elsif   (/^#define\s+ENGINESDIR/)
+                { print OUT "#define ENGINESDIR \"$prefix/lib/engines\"\n"; }
         elsif   (/^#((define)|(undef))\s+OPENSSL_EXPORT_VAR_AS_FUNCTION/)
                 { printf OUT "#undef OPENSSL_EXPORT_VAR_AS_FUNCTION\n"
                         if $export_var_as_fn;
@@ -1519,7 +1562,7 @@ while (<IN>)
         elsif   (/^#((define)|(undef))\s+RC4_INDEX/)
                 { printf OUT "#%s RC4_INDEX\n",($rc4_idx)?"define":"undef"; }
         elsif (/^#(define|undef)\s+I386_ONLY/)
-                { printf OUT "#%s I386_ONLY\n", ($processor == 386)?
+                { printf OUT "#%s I386_ONLY\n", ($processor eq "386")?
                         "define":"undef"; }
         elsif   (/^#define\s+MD2_INT\s/)
                 { printf OUT "#define MD2_INT unsigned %s\n",$type[$md2_int]; }
@@ -1566,12 +1609,12 @@ print "RC2 uses u$type[$rc2_int]\n" if $rc2_int != $def_int;
 print "BF_PTR used\n" if $bf_ptr == 1; 
 print "BF_PTR2 used\n" if $bf_ptr == 2; 
 
-if($IsWindows) {
+if($IsMK1MF) {
         open (OUT,">crypto/buildinf.h") || die "Can't open buildinf.h";
         printf OUT <<EOF;
 #ifndef MK1MF_BUILD
   /* auto-generated by Configure for crypto/cversion.c:
-   * for Unix builds, crypto/Makefile generates functional definitions;
+   * for Unix builds, crypto/Makefile.ssl generates functional definitions;
    * Windows builds (and other mk1mf builds) compile cversion.c with
    * -DMK1MF_BUILD and use definitions added to this file by util/mk1mf.pl. */
   #error "Windows builds (PLATFORM=$target) use mk1mf.pl-created Makefiles"
@@ -1582,7 +1625,7 @@ EOF
         my $make_command = "make PERL=\'$perl\'";
         my $make_targets = "";
         $make_targets .= " links" if $symlink;
-        $make_targets .= " depend" if $depflags ne "" && $make_depend;
+        $make_targets .= " depend" if $depflags ne $default_depflags && $make_depend;
         $make_targets .= " gentests" if $symlink;
         (system $make_command.$make_targets) == 0 or exit $?
                 if $make_targets ne "";
@@ -1594,17 +1637,79 @@ EOF
             &dofile("tools/c_rehash",'/usr/local/bin/perl','^#!/', '#!%s','^my \$dir;$', 'my $dir = "' . $openssldir . '";');
             &dofile("apps/CA.pl",'/usr/local/bin/perl','^#!/', '#!%s');
         }
-        if ($depflags ne "" && !$make_depend) {
+        if ($depflags ne $default_depflags && !$make_depend) {
                 print <<EOF;
 
-Since you've disabled at least one algorithm, you need to do the following
-before building:
+Since you've disabled or enabled at least one algorithm, you need to do
+the following before building:
 
         make depend
 EOF
         }
 }
 
+# create the ms/version32.rc file if needed
+if ($IsMK1MF && ($target !~ /^netware/)) {
+        my ($v1, $v2, $v3, $v4);
+        if ($version_num =~ /(^[0-9a-f]{1})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})/i) {
+                $v1=hex $1;
+                $v2=hex $2;
+                $v3=hex $3;
+                $v4=hex $4;
+        }
+        open (OUT,">ms/version32.rc") || die "Can't open ms/version32.rc";
+        print OUT <<EOF;
+#include <winver.h>
+
+LANGUAGE 0x09,0x01
+
+1 VERSIONINFO
+  FILEVERSION $v1,$v2,$v3,$v4
+  PRODUCTVERSION $v1,$v2,$v3,$v4
+  FILEFLAGSMASK 0x3fL
+#ifdef _DEBUG
+  FILEFLAGS 0x01L
+#else
+  FILEFLAGS 0x00L
+#endif
+  FILEOS VOS__WINDOWS32
+  FILETYPE VFT_DLL
+  FILESUBTYPE 0x0L
+BEGIN
+    BLOCK "StringFileInfo"
+    BEGIN
+        BLOCK "040904b0"
+        BEGIN
+            // Required:            
+            VALUE "CompanyName", "The OpenSSL Project, http://www.openssl.org/\\0"
+            VALUE "FileDescription", "OpenSSL Shared Library\\0"
+            VALUE "FileVersion", "$version\\0"
+#if defined(CRYPTO)
+            VALUE "InternalName", "libeay32\\0"
+            VALUE "OriginalFilename", "libeay32.dll\\0"
+#elif defined(SSL)
+            VALUE "InternalName", "ssleay32\\0"
+            VALUE "OriginalFilename", "ssleay32.dll\\0"
+#endif
+            VALUE "ProductName", "The OpenSSL Toolkit\\0"
+            VALUE "ProductVersion", "$version\\0"
+            // Optional:
+            //VALUE "Comments", "\\0"
+            VALUE "LegalCopyright", "Copyright © 1998-2005 The OpenSSL Project. Copyright © 1995-1998 Eric A. Young, Tim J. Hudson. All rights reserved.\\0"
+            //VALUE "LegalTrademarks", "\\0"
+            //VALUE "PrivateBuild", "\\0"
+            //VALUE "SpecialBuild", "\\0"
+        END
+    END
+    BLOCK "VarFileInfo"
+    BEGIN
+        VALUE "Translation", 0x409, 0x4b0
+    END
+END
+EOF
+        close(OUT);
+  }
+  
 print <<EOF;
 
 Configured for $target.
@@ -1699,13 +1804,12 @@ sub print_table_entry
         {
         my $target = shift;
 
-        my @fields = split(/\s*:\s*/,$table{$target} . ":" x 30 , -1);
-        for (@fields) { s/%([\dA-Fa-f]{2})/chr(hex($1))/eg; }
         (my $cc,my $cflags,my $unistd,my $thread_cflag,my $sys_id,my $lflags,
-        my $bn_ops,my $bn_obj,my $des_obj,my $bf_obj,
+        my $bn_ops,my $cpuid_obj,my $bn_obj,my $des_obj,my $aes_obj, my $bf_obj,
         my $md5_obj,my $sha1_obj,my $cast_obj,my $rc4_obj,my $rmd160_obj,
         my $rc5_obj,my $dso_scheme,my $shared_target,my $shared_cflag,
-        my $shared_ldflag,my $shared_extension,my $ranlib,my $arflags)=@fields;
+        my $shared_ldflag,my $shared_extension,my $ranlib,my $arflags)=
+        split(/\s*:\s*/,$table{$target} . ":" x 30 , -1);
                         
         print <<EOF
 
@@ -1717,8 +1821,10 @@ sub print_table_entry
 \$sys_id       = $sys_id
 \$lflags       = $lflags
 \$bn_ops       = $bn_ops
+\$cpuid_obj    = $cpuid_obj
 \$bn_obj       = $bn_obj
 \$des_obj      = $des_obj
+\$aes_obj      = $aes_obj
 \$bf_obj       = $bf_obj
 \$md5_obj      = $md5_obj
 \$sha1_obj     = $sha1_obj
@@ -1748,7 +1854,6 @@ sub test_sanity
         foreach $target (sort keys %table)
                 {
                 @fields = split(/\s*:\s*/,$table{$target} . ":" x 30 , -1);
-                for (@fields) { s/%([\dA-Fa-f]{2})/chr(hex($1))/eg; }
 
                 if ($fields[$idx_dso_scheme-1] =~ /^(dl|dlfcn|win32|vms)$/)
                         {
@@ -1772,3 +1877,11 @@ sub test_sanity
         print STDERR "No sanity errors detected!\n" if $errorcnt == 0;
         return $errorcnt;
         }
+
+# Attempt to detect MSYS environment
+
+sub is_msys
+        {
+        return 1 if (exists $ENV{"TERM"} && $ENV{"TERM"} eq "msys");
+        return 0;
+        }
diff --git a/src/lib/libssl/src/FAQ b/src/lib/libssl/src/FAQ
index 6545cd72aa..09f700cc3a 100644
--- a/src/lib/libssl/src/FAQ
+++ b/src/lib/libssl/src/FAQ
@@ -31,6 +31,8 @@ OpenSSL  -  Frequently Asked Questions
 * Why does my browser give a warning about a mismatched hostname?
 * How do I install a CA certificate into a browser?
 * Why is OpenSSL x509 DN output not conformant to RFC2253?
+* What is a "128 bit certificate"? Can I create one with OpenSSL?
+* How can I set up a bundle of commercial root CA certificates?
 
 [BUILD] Questions about building and testing OpenSSL
 
@@ -46,6 +48,9 @@ OpenSSL  -  Frequently Asked Questions
 * Why does the OpenSSL test suite fail on MacOS X?
 * Why does the OpenSSL test suite fail in BN_sqr test [on a 64-bit platform]?
 * Why does OpenBSD-i386 build fail on des-586.s with "Unimplemented segment type"?
+* Why does the OpenSSL test suite fail in sha512t on x86 CPU?
+* Why does compiler fail to compile sha512.c?
+* Test suite still fails, what to do?
 
 [PROG] Questions about programming with OpenSSL
 
@@ -62,6 +67,7 @@ OpenSSL  -  Frequently Asked Questions
 * Why doesn't my server application receive a client certificate?
 * Why does compilation fail due to an undefined symbol NID_uniqueIdentifier?
 * I think I've detected a memory leak, is this a bug?
+* Why does Valgrind complain about the use of uninitialized data?
 
 ===============================================================================
 
@@ -70,7 +76,7 @@ OpenSSL  -  Frequently Asked Questions
 * Which is the current version of OpenSSL?
 
 The current version is available from <URL: http://www.openssl.org>.
-OpenSSL 0.9.7j was released on May 4, 2006.
+OpenSSL 0.9.8h was released on May 28th, 2008.
 
 In addition to the current stable release, you can also access daily
 snapshots of the OpenSSL development version at <URL:
@@ -152,7 +158,8 @@ Use MD5 to check that a tarball from a mirror site is identical:
    md5sum TARBALL | awk '{print $1;}' | cmp - TARBALL.md5
 
 You can check authenticity using pgp or gpg. You need the OpenSSL team
-member public key used to sign it (download it from a key server). Then
+member public key used to sign it (download it from a key server, see a
+list of keys at <URL: http://www.openssl.org/about/>). Then
 just do:
 
    pgp TARBALL.asc
@@ -166,8 +173,8 @@ you if you want to use OpenSSL.  For information on intellectual
 property rights, please consult a lawyer.  The OpenSSL team does not
 offer legal advice.
 
-You can configure OpenSSL so as not to use RC5 and IDEA by using
- ./config no-rc5 no-idea
+You can configure OpenSSL so as not to use IDEA, MDC2 and RC5 by using
+ ./config no-idea no-mdc2 no-rc5
 
 
 * Can I use OpenSSL with GPL software?
@@ -383,6 +390,57 @@ interface, the "-nameopt" option could be introduded. See the manual
 page of the "openssl x509" commandline tool for details. The old behaviour
 has however been left as default for the sake of compatibility.
 
+* What is a "128 bit certificate"? Can I create one with OpenSSL?
+
+The term "128 bit certificate" is a highly misleading marketing term. It does
+*not* refer to the size of the public key in the certificate! A certificate
+containing a 128 bit RSA key would have negligible security.
+
+There were various other names such as "magic certificates", "SGC
+certificates", "step up certificates" etc.
+
+You can't generally create such a certificate using OpenSSL but there is no
+need to any more. Nowadays web browsers using unrestricted strong encryption
+are generally available.
+
+When there were tight export restrictions on the export of strong encryption
+software from the US only weak encryption algorithms could be freely exported
+(initially 40 bit and then 56 bit). It was widely recognised that this was
+inadequate. A relaxation the rules allowed the use of strong encryption but
+only to an authorised server.
+
+Two slighly different techniques were developed to support this, one used by
+Netscape was called "step up", the other used by MSIE was called "Server Gated
+Cryptography" (SGC). When a browser initially connected to a server it would
+check to see if the certificate contained certain extensions and was issued by
+an authorised authority. If these test succeeded it would reconnect using
+strong encryption.
+
+Only certain (initially one) certificate authorities could issue the
+certificates and they generally cost more than ordinary certificates.
+
+Although OpenSSL can create certificates containing the appropriate extensions
+the certificate would not come from a permitted authority and so would not
+be recognized.
+
+The export laws were later changed to allow almost unrestricted use of strong
+encryption so these certificates are now obsolete.
+
+
+* How can I set up a bundle of commercial root CA certificates?
+
+The OpenSSL software is shipped without any root CA certificate as the
+OpenSSL project does not have any policy on including or excluding
+any specific CA and does not intend to set up such a policy. Deciding
+about which CAs to support is up to application developers or
+administrators.
+
+Other projects do have other policies so you can for example extract the CA
+bundle used by Mozilla and/or modssl as described in this article:
+
+  http://www.mail-archive.com/modssl-users@modssl.org/msg16980.html
+
+
 [BUILD] =======================================================================
 
 * Why does the linker complain about undefined symbols?
@@ -462,7 +520,7 @@ get the best result from OpenSSL.  A bit more complicated solution is the
 following:
 
 ----- snip:start -----
-  make DIRS=crypto SDIRS=sha "`grep '^CFLAG=' Makefile | \
+  make DIRS=crypto SDIRS=sha "`grep '^CFLAG=' Makefile.ssl | \
        sed -e 's/ -O[0-9] / -O0 /'`"
   rm `ls crypto/*.o crypto/sha/*.o | grep -v 'sha_dgst\.o'`
   make
@@ -472,7 +530,7 @@ This will only compile sha_dgst.c with -O0, the rest with the optimization
 level chosen by the configuration process.  When the above is done, do the
 test and installation and you're set.
 
-3. Reconfigure the toolkit with no-sha0 option to leave out SHA0. It
+3. Reconfigure the toolkit with no-sha0 option to leave out SHA0. It 
 should not be used and is not used in SSL/TLS nor any other recognized
 protocol in either case.
 
@@ -597,6 +655,35 @@ Reportedly elder *BSD a.out platforms also suffer from this problem and
 remedy should be same. Provided binary is statically linked and should be
 working across wider range of *BSD branches, not just OpenBSD.
 
+* Why does the OpenSSL test suite fail in sha512t on x86 CPU?
+
+If the test program in question fails withs SIGILL, Illegal Instruction
+exception, then you more than likely to run SSE2-capable CPU, such as
+Intel P4, under control of kernel which does not support SSE2
+instruction extentions. See accompanying INSTALL file and
+OPENSSL_ia32cap(3) documentation page for further information.
+
+* Why does compiler fail to compile sha512.c?
+
+OpenSSL SHA-512 implementation depends on compiler support for 64-bit
+integer type. Few elder compilers [ULTRIX cc, SCO compiler to mention a
+couple] lack support for this and therefore are incapable of compiling
+the module in question. The recommendation is to disable SHA-512 by
+adding no-sha512 to ./config [or ./Configure] command line. Another
+possible alternative might be to switch to GCC.
+
+* Test suite still fails, what to do?
+
+Another common reason for failure to complete some particular test is
+simply bad code generated by a buggy component in toolchain or deficiency
+in run-time environment. There are few cases documented in PROBLEMS file,
+consult it for possible workaround before you beat the drum. Even if you
+don't find solution or even mention there, do reserve for possibility of
+a compiler bug. Compiler bugs might appear in rather bizarre ways, they
+never make sense, and tend to emerge when you least expect them. In order
+to identify one, drop optimization level, e.g. by editing CFLAG line in
+top-level Makefile, recompile and re-run the test.
+
 [PROG] ========================================================================
 
 * Is OpenSSL thread-safe?
@@ -608,8 +695,9 @@ libraries.  If your platform is not one of these, consult the INSTALL
 file.
 
 Multi-threaded applications must provide two callback functions to
-OpenSSL.  This is described in the threads(3) manpage.
-
+OpenSSL by calling CRYPTO_set_locking_callback() and
+CRYPTO_set_id_callback().  This is described in the threads(3)
+manpage.
 
 * I've compiled a program under Windows and it crashes: why?
 
@@ -629,10 +717,10 @@ your application must link  against the same by which OpenSSL was
 built.  If you are using MS Visual C++ (Studio) this can be changed
 by:
 
-1.  Select Settings... from the Project Menu.
-2.  Select the C/C++ Tab.
-3.  Select "Code Generation from the "Category" drop down list box
-4.  Select the Appropriate library (see table below) from the "Use
+ 1. Select Settings... from the Project Menu.
+ 2. Select the C/C++ Tab.
+ 3. Select "Code Generation from the "Category" drop down list box
+ 4. Select the Appropriate library (see table below) from the "Use
     run-time library" drop down list box.  Perform this step for both
     your debug and release versions of your application (look at the
     top left of the settings panel to change between the two)
@@ -651,30 +739,44 @@ by:
 Note that debug and release libraries are NOT interchangeable.  If you
 built OpenSSL with /MD your application must use /MD and cannot use /MDd.
 
+As per 0.9.8 the above limitation is eliminated for .DLLs. OpenSSL
+.DLLs compiled with some specific run-time option [we insist on the
+default /MD] can be deployed with application compiled with different
+option or even different compiler. But there is a catch! Instead of
+re-compiling OpenSSL toolkit, as you would have to with prior versions,
+you have to compile small C snippet with compiler and/or options of
+your choice. The snippet gets installed as
+<install-root>/include/openssl/applink.c and should be either added to
+your application project or simply #include-d in one [and only one]
+of your application source files. Failure to link this shim module
+into your application manifests itself as fatal "no OPENSSL_Applink"
+run-time error. An explicit reminder is due that in this situation
+[mixing compiler options] it is as important to add CRYPTO_malloc_init
+prior first call to OpenSSL.
 
 * How do I read or write a DER encoded buffer using the ASN1 functions?
 
 You have two options. You can either use a memory BIO in conjunction
-with the i2d_XXX_bio() or d2i_XXX_bio() functions or you can use the
-i2d_XXX(), d2i_XXX() functions directly. Since these are often the
+with the i2d_*_bio() or d2i_*_bio() functions or you can use the
+i2d_*(), d2i_*() functions directly. Since these are often the
 cause of grief here are some code fragments using PKCS7 as an example:
 
-unsigned char *buf, *p;
-int len;
+ unsigned char *buf, *p;
+ int len;
 
-len = i2d_PKCS7(p7, NULL);
-buf = OPENSSL_malloc(len); /* or Malloc, error checking omitted */
-p = buf;
-i2d_PKCS7(p7, &p);
+ len = i2d_PKCS7(p7, NULL);
+ buf = OPENSSL_malloc(len); /* or Malloc, error checking omitted */
+ p = buf;
+ i2d_PKCS7(p7, &p);
 
 At this point buf contains the len bytes of the DER encoding of
 p7.
 
 The opposite assumes we already have len bytes in buf:
 
-unsigned char *p;
-p = buf;
-p7 = d2i_PKCS7(NULL, &p, len);
+ unsigned char *p;
+ p = buf;
+ p7 = d2i_PKCS7(NULL, &p, len);
 
 At this point p7 contains a valid PKCS7 structure of NULL if an error
 occurred. If an error occurred ERR_print_errors(bio) should give more
@@ -736,11 +838,11 @@ code itself (the hex digits after the second colon).
 
 * Why do I get errors about unknown algorithms?
 
-This can happen under several circumstances such as reading in an
-encrypted private key or attempting to decrypt a PKCS#12 file. The cause
-is forgetting to load OpenSSL's table of algorithms with
-OpenSSL_add_all_algorithms(). See the manual page for more information.
-
+The cause is forgetting to load OpenSSL's table of algorithms with
+OpenSSL_add_all_algorithms(). See the manual page for more information. This
+can cause several problems such as being unable to read in an encrypted
+PEM file, unable to decrypt a PKCS#12 file or signature failure when
+verifying certificates.
 
 * Why can't the OpenSSH configure script detect OpenSSL?
 
@@ -808,5 +910,15 @@ thread-safe):
   ERR_free_strings(), EVP_cleanup() and CRYPTO_cleanup_all_ex_data().
 
 
+* Why does Valgrind complain about the use of uninitialized data?
+
+When OpenSSL's PRNG routines are called to generate random numbers the supplied
+buffer contents are mixed into the entropy pool: so it technically does not
+matter whether the buffer is initialized at this point or not.  Valgrind (and
+other test tools) will complain about this. When using Valgrind, make sure the
+OpenSSL library has been compiled with the PURIFY macro defined (-DPURIFY)
+to get rid of these warnings.
+
+
 ===============================================================================
 
diff --git a/src/lib/libssl/src/INSTALL b/src/lib/libssl/src/INSTALL
index 503474f2e4..c72cc1dcee 100644
--- a/src/lib/libssl/src/INSTALL
+++ b/src/lib/libssl/src/INSTALL
@@ -2,8 +2,10 @@
  INSTALLATION ON THE UNIX PLATFORM
  ---------------------------------
 
- [Installation on DOS (with djgpp), Windows, OpenVMS and MacOS (before MacOS X)
-  is described in INSTALL.DJGPP, INSTALL.W32, INSTALL.VMS and INSTALL.MacOS.
+ [Installation on DOS (with djgpp), Windows, OpenVMS, MacOS (before MacOS X)
+  and NetWare is described in INSTALL.DJGPP, INSTALL.W32, INSTALL.VMS,
+  INSTALL.MacOS and INSTALL.NW.
+  
   This document describes installation on operating systems in the Unix
   family.]
 
@@ -73,14 +75,30 @@
   no-asm        Do not use assembler code.
 
   386           Use the 80386 instruction set only (the default x86 code is
-                more efficient, but requires at least a 486).
+                more efficient, but requires at least a 486). Note: Use
+                compiler flags for any other CPU specific configuration,
+                e.g. "-m32" to build x86 code on an x64 system.
+
+  no-sse2       Exclude SSE2 code pathes. Normally SSE2 extention is
+                detected at run-time, but the decision whether or not the
+                machine code will be executed is taken solely on CPU
+                capability vector. This means that if you happen to run OS
+                kernel which does not support SSE2 extension on Intel P4
+                processor, then your application might be exposed to
+                "illegal instruction" exception. There might be a way
+                to enable support in kernel, e.g. FreeBSD kernel can be
+                compiled with CPU_ENABLE_SSE, and there is a way to
+                disengage SSE2 code pathes upon application start-up,
+                but if you aim for wider "audience" running such kernel,
+                consider no-sse2. Both 386 and no-asm options above imply
+                no-sse2.
 
   no-<cipher>   Build without the specified cipher (bf, cast, des, dh, dsa,
                 hmac, md2, md5, mdc2, rc2, rc4, rc5, rsa, sha).
                 The crypto/<cipher> directory can be removed after running
                 "make depend".
 
-  -Dxxx, -lxxx, -Lxxx, -fxxx, -Kxxx These system specific options will
+  -Dxxx, -lxxx, -Lxxx, -fxxx, -mxxx, -Kxxx These system specific options will
                 be passed through to the compiler to allow you to
                 define preprocessor symbols, specify additional libraries,
                 library directories or other compiler options.
@@ -123,7 +141,7 @@
      generic configurations "cc" or "gcc" should usually work on 32 bit
      systems.
 
-     Configure creates the file Makefile from Makefile.org and
+     Configure creates the file Makefile.ssl from Makefile.org and
      defines various macros in crypto/opensslconf.h (generated from
      crypto/opensslconf.h.in).
 
@@ -140,7 +158,7 @@
      standard headers).  If it is a problem with OpenSSL itself, please
      report the problem to <openssl-bugs@openssl.org> (note that your
      message will be recorded in the request tracker publicly readable
-     via http://www.openssl.org/support/rt2.html and will be forwarded to a
+     via http://www.openssl.org/support/rt.html and will be forwarded to a
      public mailing list). Include the output of "make report" in your message.
      Please check out the request tracker. Maybe the bug was already
      reported or has already been fixed.
@@ -159,10 +177,10 @@
      the failure that isn't a problem in OpenSSL itself (like a missing
      or malfunctioning bc).  If it is a problem with OpenSSL itself,
      try removing any compiler optimization flags from the CFLAG line
-     in Makefile and run "make clean; make". Please send a bug
+     in Makefile.ssl and run "make clean; make". Please send a bug
      report to <openssl-bugs@openssl.org>, including the output of
      "make report" in order to be added to the request tracker at
-     http://www.openssl.org/support/rt2.html.
+     http://www.openssl.org/support/rt.html.
 
   4. If everything tests ok, install OpenSSL with
 
@@ -284,10 +302,10 @@
  Note on shared libraries
  ------------------------
 
- Shared library is currently an experimental feature.  The only reason to
- have them would be to conserve memory on systems where several program
- are using OpenSSL.  Binary backward compatibility can't be guaranteed
- before OpenSSL version 1.0.
+ Shared libraries have certain caveats.  Binary backward compatibility
+ can't be guaranteed before OpenSSL version 1.0.  The only reason to
+ use them would be to conserve memory on systems where several programs
+ are using OpenSSL.
 
  For some systems, the OpenSSL Configure script knows what is needed to
  build shared libraries for libcrypto and libssl.  On these systems,
@@ -312,7 +330,7 @@
  Note on support for multiple builds
  -----------------------------------
 
- OpenSSL is usually built in it's source tree.  Unfortunately, this doesn't
+ OpenSSL is usually built in its source tree.  Unfortunately, this doesn't
  support building for multiple platforms from the same source tree very well.
  It is however possible to build in a separate tree through the use of lots
  of symbolic links, which should be prepared like this:
diff --git a/src/lib/libssl/src/INSTALL.W32 b/src/lib/libssl/src/INSTALL.W32
index c277efa18b..3dd7832f4e 100644
--- a/src/lib/libssl/src/INSTALL.W32
+++ b/src/lib/libssl/src/INSTALL.W32
@@ -3,6 +3,7 @@
  ----------------------------------
 
  [Instructions for building for Windows CE can be found in INSTALL.WCE]
+ [Instructions for building for Win64 can be found in INSTALL.W64]
 
  Heres a few comments about building OpenSSL in Windows environments.  Most
  of this is tested on Win32 but it may also work in Win 3.1 with some
@@ -46,13 +47,14 @@
  http://www.kernel.org/pub/software/devel/nasm/binaries/win32/
  The NASM binary nasmw.exe needs to be installed anywhere on your PATH.
 
- Firstly you should run Configure (to build a FIPS-certified variant of
- OpenSSL, add the option "fips"):
+ Firstly you should run Configure:
 
- > perl Configure VC-WIN32
+ > perl Configure VC-WIN32 --prefix=c:/some/openssl/dir
+
+Where the prefix argument specifies where OpenSSL will be installed to.
 
  Next you need to build the Makefiles and optionally the assembly language
- files (to build a FIPS-certified variant of OpenSSL, add the argument "fips"):
+ files:
 
  - If you are using MASM then run:
 
@@ -77,8 +79,12 @@
  If all is well it should compile and you will have some DLLs and executables
  in out32dll. If you want to try the tests then do:
  
- > cd out32dll
- > ..\ms\test
+ > nmake -f ms\ntdll.mak test
+
+
+To install OpenSSL to the specified location do:
+
+> nmake -f ms\ntdll.mak install
 
  Tweaks:
 
@@ -88,6 +94,12 @@
  compiled in. Note that mk1mf.pl expects the platform to be the last argument
  on the command line, so 'debug' must appear before that, as all other options.
 
+
+ By default in 0.9.8 OpenSSL will compile builtin ENGINES into the libeay32.dll
+ shared library. If you specify the "no-static-engine" option on the command
+ line to Configure the shared library build (ms\ntdll.mak) will compile the
+ engines as separate DLLs.
+
  The default Win32 environment is to leave out any Windows NT specific
  features.
 
@@ -98,15 +110,15 @@
  You can also build a static version of the library using the Makefile
  ms\nt.mak
 
+
+
  Borland C++ builder 5
  ---------------------
 
- * Configure for building with Borland Builder (to build a FIPS-certified
-   variant of OpenSSL, add the option "fips"):
+ * Configure for building with Borland Builder:
    > perl Configure BC-32
 
- * Create the appropriate makefile (to build a FIPS-certified variant of
-   OpenSSL, add the argument "fips")
+ * Create the appropriate makefile
    > ms\do_nasm
 
  * Build
@@ -197,8 +209,6 @@
    occur, try
    > ms\mingw32 no-asm
    instead.
-   If you want to build a FIPS-certified variant of OpenSSL, add the argument
-   "fips"
 
    libcrypto.a and libssl.a are the static libraries. To use the DLLs,
    link with libeay32.a and libssl32.a instead.
@@ -291,3 +301,21 @@
  (e.g. fopen()), and OpenSSL cannot change these; so in general you cannot
  rely on CRYPTO_malloc_init() solving your problem, and you should
  consistently use the multithreaded library.
+
+ Linking your application
+ ------------------------
+
+ If you link with static OpenSSL libraries [those built with ms/nt.mak],
+ then you're expected to additionally link your application with
+ WSOCK32.LIB, ADVAPI32.LIB, GDI32.LIB and USER32.LIB. Those developing
+ non-interactive service applications might feel concerned about linking
+ with latter two, as they are justly associated with interactive desktop,
+ which is not available to service processes. The toolkit is designed
+ to detect in which context it's currently executed, GUI, console app
+ or service, and act accordingly, namely whether or not to actually make
+ GUI calls.
+
+ If you link with OpenSSL .DLLs, then you're expected to include into
+ your application code small "shim" snippet, which provides glue between
+ OpenSSL BIO layer and your compiler run-time. Look up OPENSSL_Applink
+ reference page for further details.
diff --git a/src/lib/libssl/src/LICENSE b/src/lib/libssl/src/LICENSE
index e6afecc724..a2c4adcbe6 100644
--- a/src/lib/libssl/src/LICENSE
+++ b/src/lib/libssl/src/LICENSE
@@ -12,7 +12,7 @@
   ---------------
 
 /* ====================================================================
- * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2008 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/src/lib/libssl/src/Makefile.org b/src/lib/libssl/src/Makefile.org
index b9db0dd57d..22b1699257 100644
--- a/src/lib/libssl/src/Makefile.org
+++ b/src/lib/libssl/src/Makefile.org
@@ -57,9 +57,8 @@ OPENSSLDIR=/usr/local/ssl
 # equal 4.
 # PKCS1_CHECK - pkcs1 tests.
 
-CC= gcc
-#CFLAG= -DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -m486 -Wall -Wuninitialized -DSHA1_ASM -DMD5_ASM -DRMD160_ASM
-CFLAG= -DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall -DSHA1_ASM -DMD5_ASM -DRMD160_ASM
+CC= cc
+CFLAG= -O
 DEPFLAG= 
 PEX_LIBS= 
 EX_LIBS= 
@@ -80,93 +79,22 @@ MAKEDEPPROG=makedepend
 AS=$(CC) -c
 ASFLAG=$(CFLAG)
 
-# Set BN_ASM to bn_asm.o if you want to use the C version
-BN_ASM= bn_asm.o
-#BN_ASM= bn_asm.o
-#BN_ASM= asm/bn86-elf.o # elf, linux-elf
-#BN_ASM= asm/bn86-sol.o # solaris
-#BN_ASM= asm/bn86-out.o # a.out, FreeBSD
-#BN_ASM= asm/bn86bsdi.o # bsdi
-#BN_ASM= asm/alpha.o    # DEC Alpha
-#BN_ASM= asm/pa-risc2.o # HP-UX PA-RISC
-#BN_ASM= asm/r3000.o    # SGI MIPS cpu
-#BN_ASM= asm/sparc.o    # Sun solaris/SunOS
-#BN_ASM= asm/bn-win32.o # Windows 95/NT
-#BN_ASM= asm/x86w16.o   # 16 bit code for Windows 3.1/DOS
-#BN_ASM= asm/x86w32.o   # 32 bit code for Windows 3.1
-
 # For x86 assembler: Set PROCESSOR to 386 if you want to support
 # the 80386.
 PROCESSOR=
 
-# Set DES_ENC to des_enc.o if you want to use the C version
-#There are 4 x86 assember options.
-FIPS_DES_ENC= des_enc.o fcrypt_b.o
-FIPS_AES_ENC= fips_aes_core.o
-DES_ENC= asm/dx86-out.o asm/yx86-out.o
-#DES_ENC= des_enc.o fcrypt_b.o          # C
-#DES_ENC= asm/dx86-elf.o asm/yx86-elf.o # elf
-#DES_ENC= asm/dx86-sol.o asm/yx86-sol.o # solaris
-#DES_ENC= asm/dx86-out.o asm/yx86-out.o # a.out, FreeBSD
-#DES_ENC= asm/dx86bsdi.o asm/yx86bsdi.o # bsdi
-
-# Set BF_ENC to bf_enc.o if you want to use the C version
-#There are 4 x86 assember options.
-BF_ENC= asm/bx86-out.o
-#BF_ENC= bf_enc.o
-#BF_ENC= asm/bx86-elf.o # elf
-#BF_ENC= asm/bx86-sol.o # solaris
-#BF_ENC= asm/bx86-out.o # a.out, FreeBSD
-#BF_ENC= asm/bx86bsdi.o # bsdi
-
-# Set CAST_ENC to c_enc.o if you want to use the C version
-#There are 4 x86 assember options.
-CAST_ENC= asm/cx86-out.o
-#CAST_ENC= c_enc.o
-#CAST_ENC= asm/cx86-elf.o # elf
-#CAST_ENC= asm/cx86-sol.o # solaris
-#CAST_ENC= asm/cx86-out.o # a.out, FreeBSD
-#CAST_ENC= asm/cx86bsdi.o # bsdi
-
-# Set RC4_ENC to rc4_enc.o if you want to use the C version
-#There are 4 x86 assember options.
-RC4_ENC= asm/rx86-out.o
-#RC4_ENC= rc4_enc.o
-#RC4_ENC= asm/rx86-elf.o # elf
-#RC4_ENC= asm/rx86-sol.o # solaris
-#RC4_ENC= asm/rx86-out.o # a.out, FreeBSD
-#RC4_ENC= asm/rx86bsdi.o # bsdi
-
-# Set RC5_ENC to rc5_enc.o if you want to use the C version
-#There are 4 x86 assember options.
-RC5_ENC= asm/r586-out.o
-#RC5_ENC= rc5_enc.o
-#RC5_ENC= asm/r586-elf.o # elf
-#RC5_ENC= asm/r586-sol.o # solaris
-#RC5_ENC= asm/r586-out.o # a.out, FreeBSD
-#RC5_ENC= asm/r586bsdi.o # bsdi
-
-# Also need MD5_ASM defined
-MD5_ASM_OBJ= asm/mx86-out.o
-#MD5_ASM_OBJ= asm/mx86-elf.o        # elf
-#MD5_ASM_OBJ= asm/mx86-sol.o        # solaris
-#MD5_ASM_OBJ= asm/mx86-out.o        # a.out, FreeBSD
-#MD5_ASM_OBJ= asm/mx86bsdi.o        # bsdi
-
-# Also need SHA1_ASM defined
-SHA1_ASM_OBJ= asm/sx86-out.o
-FIPS_SHA1_ASM_OBJ= asm/sx86-out.o
-#SHA1_ASM_OBJ= asm/sx86-elf.o       # elf
-#SHA1_ASM_OBJ= asm/sx86-sol.o       # solaris
-#SHA1_ASM_OBJ= asm/sx86-out.o       # a.out, FreeBSD
-#SHA1_ASM_OBJ= asm/sx86bsdi.o       # bsdi
-
-# Also need RMD160_ASM defined
-RMD160_ASM_OBJ= asm/rm86-out.o
-#RMD160_ASM_OBJ= asm/rm86-elf.o       # elf
-#RMD160_ASM_OBJ= asm/rm86-sol.o       # solaris
-#RMD160_ASM_OBJ= asm/rm86-out.o       # a.out, FreeBSD
-#RMD160_ASM_OBJ= asm/rm86bsdi.o       # bsdi
+# CPUID module collects small commonly used assembler snippets
+CPUID_OBJ= 
+BN_ASM= bn_asm.o
+DES_ENC= des_enc.o fcrypt_b.o
+AES_ASM_OBJ=aes_core.o aes_cbc.o
+BF_ENC= bf_enc.o
+CAST_ENC= c_enc.o
+RC4_ENC= rc4_enc.o
+RC5_ENC= rc5_enc.o
+MD5_ASM_OBJ= 
+SHA1_ASM_OBJ= 
+RMD160_ASM_OBJ= 
 
 # KRB5 stuff
 KRB5_INCLUDES=
@@ -176,36 +104,20 @@ LIBKRB5=
 ZLIB_INCLUDE=
 LIBZLIB=
 
-# This is the location of fipscanister.o and friends.
-# The FIPS module build will place it $(INSTALLTOP)/lib
-# but since $(INSTALLTOP) can only take the default value
-# when the module is built it will be in /usr/local/ssl/lib
-# $(INSTALLTOP) for this build make be different so hard
-# code the path.
-
-FIPSLIBDIR=/usr/local/ssl/lib
-
-# Shared library base address. Currently only used on Windows.
-#
-
-BASEADDR=
-
-# When we're prepared to use shared libraries in the programs we link here
-# we might set SHLIB_MARK to '$(SHARED_LIBS)'.
-SHLIB_MARK=
-
-DIRS=   crypto fips-1.0 ssl $(SHLIB_MARK) apps test tools
+DIRS=   crypto ssl engines apps test tools
 SHLIBDIRS= crypto ssl
 
 # dirs in crypto to build
-SDIRS=  objects \
+SDIRS=  \
+        objects \
         md2 md4 md5 sha mdc2 hmac ripemd \
-        des rc2 rc4 rc5 idea bf cast \
-        bn ec rsa dsa dh dso engine aes \
+        des aes rc2 rc4 rc5 idea bf cast camellia seed \
+        bn ec rsa dsa ecdsa dh ecdh dso engine \
         buffer bio stack lhash rand err \
-        evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui krb5
-
-FDIRS=  sha rand des aes dsa rsa dh hmac
+        evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui krb5 \
+        store cms pqueue
+# keep in mind that the above list is adjusted by ./Configure
+# according to no-xxx arguments...
 
 # tests to perform.  "alltests" is a special word indicating that all tests
 # should be performed.
@@ -238,38 +150,106 @@ WTARFILE=       $(NAME)-win.tar
 EXHEADER=       e_os2.h
 HEADER=         e_os.h
 
-# When we're prepared to use shared libraries in the programs we link here
-# we might remove 'clean-shared' from the targets to perform at this stage
+all: Makefile build_all openssl.pc libssl.pc libcrypto.pc
+
+# as we stick to -e, CLEARENV ensures that local variables in lower
+# Makefiles remain local and variable. $${VAR+VAR} is tribute to Korn
+# shell, which [annoyingly enough] terminates unset with error if VAR
+# is not present:-( TOP= && unset TOP is tribute to HP-UX /bin/sh,
+# which terminates unset with error if no variable was present:-(
+CLEARENV=       TOP= && unset TOP $${LIB+LIB} $${LIBS+LIBS}     \
+                $${INCLUDE+INCLUDE} $${INCLUDES+INCLUDES}       \
+                $${DIR+DIR} $${DIRS+DIRS} $${SRC+SRC}           \
+                $${LIBSRC+LIBSRC} $${LIBOBJ+LIBOBJ} $${ALL+ALL} \
+                $${EXHEADER+EXHEADER} $${HEADER+HEADER}         \
+                $${GENERAL+GENERAL} $${CFLAGS+CFLAGS}           \
+                $${ASFLAGS+ASFLAGS} $${AFLAGS+AFLAGS}           \
+                $${LDCMD+LDCMD} $${LDFLAGS+LDFLAGS}             \
+                $${SHAREDCMD+SHAREDCMD} $${SHAREDFLAGS+SHAREDFLAGS}     \
+                $${SHARED_LIB+SHARED_LIB} $${LIBEXTRAS+LIBEXTRAS}
+
+BUILDENV=       PLATFORM='${PLATFORM}' PROCESSOR='${PROCESSOR}' \
+                CC='${CC}' CFLAG='${CFLAG}'                     \
+                AS='${CC}' ASFLAG='${CFLAG} -c'                 \
+                AR='${AR}' PERL='${PERL}' RANLIB='${RANLIB}'    \
+                SDIRS='${SDIRS}' LIBRPATH='${INSTALLTOP}/lib'   \
+                INSTALL_PREFIX='${INSTALL_PREFIX}'              \
+                INSTALLTOP='${INSTALLTOP}' OPENSSLDIR='${OPENSSLDIR}'   \
+                MAKEDEPEND='$$$${TOP}/util/domd $$$${TOP} -MD ${MAKEDEPPROG}' \
+                DEPFLAG='-DOPENSSL_NO_DEPRECATED ${DEPFLAG}'    \
+                MAKEDEPPROG='${MAKEDEPPROG}'                    \
+                SHARED_LDFLAGS='${SHARED_LDFLAGS}'              \
+                KRB5_INCLUDES='${KRB5_INCLUDES}' LIBKRB5='${LIBKRB5}'   \
+                EXE_EXT='${EXE_EXT}' SHARED_LIBS='${SHARED_LIBS}'       \
+                SHLIB_EXT='${SHLIB_EXT}' SHLIB_TARGET='${SHLIB_TARGET}' \
+                PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}'     \
+                CPUID_OBJ='${CPUID_OBJ}'                        \
+                BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}'         \
+                AES_ASM_OBJ='${AES_ASM_OBJ}'                    \
+                BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}'       \
+                RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}'       \
+                SHA1_ASM_OBJ='${SHA1_ASM_OBJ}'                  \
+                MD5_ASM_OBJ='${MD5_ASM_OBJ}'                    \
+                RMD160_ASM_OBJ='${RMD160_ASM_OBJ}'              \
+                THIS=$${THIS:-$@} MAKEFILE=Makefile MAKEOVERRIDES=
+# MAKEOVERRIDES= effectively "equalizes" GNU-ish and SysV-ish make flavors,
+# which in turn eliminates ambiguities in variable treatment with -e.
+
+# BUILD_CMD is a generic macro to build a given target in a given
+# subdirectory.  The target must be given through the shell variable
+# `target' and the subdirectory to build in must be given through `dir'.
+# This macro shouldn't be used directly, use RECURSIVE_BUILD_CMD or
+# BUILD_ONE_CMD instead.
+#
+# BUILD_ONE_CMD is a macro to build a given target in a given
+# subdirectory if that subdirectory is part of $(DIRS).  It requires
+# exactly the same shell variables as BUILD_CMD.
+#
+# RECURSIVE_BUILD_CMD is a macro to build a given target in all
+# subdirectories defined in $(DIRS).  It requires that the target
+# is given through the shell variable `target'.
+BUILD_CMD=  if [ -d "$$dir" ]; then \
+            (   cd $$dir && echo "making $$target in $$dir..." && \
+                $(CLEARENV) && $(MAKE) -e $(BUILDENV) TOP=.. DIR=$$dir $$target \
+            ) || exit 1; \
+            fi
+RECURSIVE_BUILD_CMD=for dir in $(DIRS); do $(BUILD_CMD); done
+BUILD_ONE_CMD=\
+        if echo " $(DIRS) " | grep " $$dir " >/dev/null 2>/dev/null; then \
+                $(BUILD_CMD); \
+        fi
 
-all: Makefile sub_all openssl.pc
+reflect:
+        @[ -n "$(THIS)" ] && $(CLEARENV) && $(MAKE) $(THIS) -e $(BUILDENV)
 
-sub_all:
-        @for i in $(DIRS); \
-        do \
-        if [ -d "$$i" ]; then \
-                (cd $$i && echo "making all in $$i..." && \
-                $(MAKE) CC='${CC}' PLATFORM='${PLATFORM}' CFLAG='${CFLAG}' AS='${AS}' ASFLAG='${ASFLAG}' SDIRS='$(SDIRS)' FDIRS='$(FDIRS)' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' FIPS_DES_ENC='${FIPS_DES_ENC}' FIPS_AES_ENC='${FIPS_AES_ENC}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' FIPS_SHA1_ASM_OBJ='${FIPS_SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' KRB5_INCLUDES='${KRB5_INCLUDES}' LIBKRB5='${LIBKRB5}' EXE_EXT='${EXE_EXT}' SHARED_LIBS='${SHARED_LIBS}' SHLIB_EXT='${SHLIB_EXT}' SHLIB_TARGET='${SHLIB_TARGET}' FIPSLIBDIR='${FIPSLIBDIR}' all ) || exit 1; \
-        else \
-                $(MAKE) $$i; \
-        fi; \
-        done;
+sub_all: build_all
+build_all: build_libs build_apps build_tests build_tools
 
-sub_target:
-        @for i in $(DIRS); \
-        do \
-        if [ -d "$$i" ]; then \
-                (cd $$i && echo "making $(TARGET) in $$i..." && \
-                $(MAKE) CC='${CC}' PLATFORM='${PLATFORM}' CFLAG='${CFLAG}' AS='${AS}' ASFLAG='${ASFLAG}' SDIRS='$(SDIRS)' FDIRS='$(FDIRS)' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' FIPS_DES_ENC='${FIPS_DES_ENC}' FIPS_AES_ENC='${FIPS_AES_ENC}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' FIPS_SHA1_ASM_OBJ='${FIPS_SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' KRB5_INCLUDES='${KRB5_INCLUDES}' LIBKRB5='${LIBKRB5}' EXE_EXT='${EXE_EXT}' SHARED_LIBS='${SHARED_LIBS}' SHLIB_EXT='${SHLIB_EXT}' SHLIB_TARGET='${SHLIB_TARGET}' TARGET='$(TARGET)' sub_target ) || exit 1; \
-        else \
-                $(MAKE) $$i; \
-        fi; \
-        done;
+build_libs: build_crypto build_ssl build_engines
+
+build_crypto:
+        @dir=crypto; target=all; $(BUILD_ONE_CMD)
+build_ssl:
+        @dir=ssl; target=all; $(BUILD_ONE_CMD)
+build_engines:
+        @dir=engines; target=all; $(BUILD_ONE_CMD)
+build_apps:
+        @dir=apps; target=all; $(BUILD_ONE_CMD)
+build_tests:
+        @dir=test; target=all; $(BUILD_ONE_CMD)
+build_tools:
+        @dir=tools; target=all; $(BUILD_ONE_CMD)
+
+all_testapps: build_libs build_testapps
+build_testapps:
+        @dir=crypto; target=testapps; $(BUILD_ONE_CMD)
 
 libcrypto$(SHLIB_EXT): libcrypto.a
         @if [ "$(SHLIB_TARGET)" != "" ]; then \
                 $(MAKE) SHLIBDIRS=crypto build-shared; \
         else \
                 echo "There's no support for shared libraries on this platform" >&2; \
+                exit 1; \
         fi
 
 libssl$(SHLIB_EXT): libcrypto$(SHLIB_EXT) libssl.a
@@ -277,10 +257,11 @@ libssl$(SHLIB_EXT): libcrypto$(SHLIB_EXT) libssl.a
                 $(MAKE) SHLIBDIRS=ssl SHLIBDEPS='-lcrypto' build-shared; \
         else \
                 echo "There's no support for shared libraries on this platform" >&2; \
+                exit 1; \
         fi
 
 clean-shared:
-        @for i in $(SHLIBDIRS); do \
+        @set -e; for i in $(SHLIBDIRS); do \
                 if [ -n "$(SHARED_LIBS_LINK_EXTS)" ]; then \
                         tmp="$(SHARED_LIBS_LINK_EXTS)"; \
                         for j in $${tmp:-x}; do \
@@ -289,312 +270,59 @@ clean-shared:
                 fi; \
                 ( set -x; rm -f lib$$i$(SHLIB_EXT) ); \
                 if [ "$(PLATFORM)" = "Cygwin" ]; then \
-                        ( set -x; rm -f cyg$$i-$(SHLIB_VERSION_NUMBER)$(SHLIB_EXT) lib$$i$(SHLIB_EXT).a ); \
+                        ( set -x; rm -f cyg$$i$(SHLIB_EXT) lib$$i$(SHLIB_EXT).a ); \
                 fi; \
         done
 
 link-shared:
-        @if [ -n "$(SHARED_LIBS_LINK_EXTS)" ]; then \
-                tmp="$(SHARED_LIBS_LINK_EXTS)"; \
-                for i in $(SHLIBDIRS); do \
-                        prev=lib$$i$(SHLIB_EXT); \
-                        for j in $${tmp:-x}; do \
-                                ( set -x; \
-                                rm -f lib$$i$$j; ln -s $$prev lib$$i$$j ); \
-                                prev=lib$$i$$j; \
-                        done; \
-                done; \
-        fi
-
-build-shared: clean-shared do_$(SHLIB_TARGET) link-shared
-
-do_bsd-gcc-shared: do_gnu-shared
-do_linux-shared: do_gnu-shared
-do_gnu-shared:
-        libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
-        if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
-                libs="$(LIBKRB5) $$libs"; \
-        fi; \
-        ( set -x; $${FIPSLD:-${CC}} ${SHARED_LDFLAGS} \
-                -shared -o lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} \
-                -Wl,-soname=lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} \
-                -Wl,-Bsymbolic \
-                -Wl,--whole-archive lib$$i.a \
-                -Wl,--no-whole-archive $$libs ${EX_LIBS} ) || exit 1; \
-        libs="-l$$i $$libs"; \
-        done
-
-DETECT_GNU_LD=(${CC} -Wl,-V /dev/null 2>&1 | grep '^GNU ld' )>/dev/null
-
-# For Darwin AKA Mac OS/X (dyld)
-do_darwin-shared: 
-        libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
-        if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
-                libs="$(LIBKRB5) $$libs"; \
-        fi; \
-        ( set -x; $${FIPSLD:-${CC}} ${SHARED_LDFLAGS} \
-                --verbose -dynamiclib -o lib$$i${SHLIB_EXT} \
-                lib$$i.a $$libs -all_load -current_version ${SHLIB_MAJOR}.${SHLIB_MINOR} \
-                -compatibility_version ${SHLIB_MAJOR}.`echo ${SHLIB_MINOR} | cut -d. -f1` \
-                -install_name ${INSTALLTOP}/lib/lib$$i${SHLIB_EXT} ) || exit 1; \
-        libs="-l`basename $$i${SHLIB_EXT} .dylib` $$libs"; \
-        echo "" ; \
+        @ set -e; for i in ${SHLIBDIRS}; do \
+                $(MAKE) -f $(HERE)/Makefile.shared -e $(BUILDENV) \
+                        LIBNAME=$$i LIBVERSION=${SHLIB_MAJOR}.${SHLIB_MINOR} \
+                        LIBCOMPATVERSIONS=";${SHLIB_VERSION_HISTORY}" \
+                        symlink.$(SHLIB_TARGET); \
+                libs="$$libs -l$$i"; \
         done
 
-do_cygwin-shared:
-        libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
-        if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
-                libs="$(LIBKRB5) $$libs"; \
-        fi; \
-        shlib=cyg$${i}-$(SHLIB_VERSION_NUMBER).dll; \
-        [ "$(PLATFORM)" = "mingw" ] && shlib=$${i}eay32.dll; \
-        [ -f apps/$$shlib ] && rm apps/$$shlib; \
-        [ -f test/$$shlib ] && rm test/$$shlib; \
-        base=;  [ $$i = "crypto" ] && base=-Wl,--image-base,0x63000000; \
-        ( set -x; $${FIPSLD:-${CC}} ${SHARED_LDFLAGS} \
-                -shared $$base -o $$shlib \
-                -Wl,-Bsymbolic \
-                -Wl,--whole-archive lib$$i.a \
-                -Wl,--out-implib,lib$$i.dll.a \
-                -Wl,--no-whole-archive $$libs ${EX_LIBS} ) || exit 1; \
-        cp -p $$shlib apps/; cp -p $$shlib test/; \
-        touch -c lib$$i.dll.a; \
-        libs="-l$$i $$libs"; \
-        done
-
-# This assumes that GNU utilities are *not* used
-do_alpha-osf1-shared:
-        if ${DETECT_GNU_LD}; then \
-                $(MAKE) do_gnu-shared; \
-        else \
-                libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
-                if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
-                        libs="$(LIBKRB5) $$libs"; \
-                fi; \
-                ( set -x; $${FIPSLD:-${CC}} ${SHARED_LDFLAGS} \
-                        -shared -o lib$$i.so \
-                        -set_version "${SHLIB_VERSION_HISTORY}${SHLIB_VERSION_NUMBER}" \
-                        -all lib$$i.a -none $$libs ${EX_LIBS} ) || exit 1; \
-                libs="-l$$i $$libs"; \
-                done; \
-        fi
-
-# This assumes that GNU utilities are *not* used
-# The difference between alpha-osf1-shared and tru64-shared is the `-msym'
-# option passed to the linker.
-do_tru64-shared:
-        if ${DETECT_GNU_LD}; then \
-                $(MAKE) do_gnu-shared; \
-        else \
-                libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
-                if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
-                        libs="$(LIBKRB5) $$libs"; \
-                fi; \
-                ( set -x; $${FIPSLD:-${CC}} ${SHARED_LDFLAGS} \
-                        -shared -msym -o lib$$i.so \
-                        -set_version "${SHLIB_VERSION_HISTORY}${SHLIB_VERSION_NUMBER}" \
-                        -all lib$$i.a -none $$libs ${EX_LIBS} ) || exit 1; \
-                libs="-l$$i $$libs"; \
-                done; \
-        fi
+build-shared: do_$(SHLIB_TARGET) link-shared
 
-# This assumes that GNU utilities are *not* used
-# The difference between tru64-shared and tru64-shared-rpath is the
-# -rpath ${INSTALLTOP}/lib passed to the linker.
-do_tru64-shared-rpath:
-        if ${DETECT_GNU_LD}; then \
-                $(MAKE) do_gnu-shared; \
-        else \
-                libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
+do_$(SHLIB_TARGET):
+        @ set -e; libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
                 if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
                         libs="$(LIBKRB5) $$libs"; \
                 fi; \
-                ( set -x; $${FIPSLD:-${CC}} ${SHARED_LDFLAGS} \
-                        -shared -msym -o lib$$i.so \
-                        -rpath  ${INSTALLTOP}/lib \
-                        -set_version "${SHLIB_VERSION_HISTORY}${SHLIB_VERSION_NUMBER}" \
-                        -all lib$$i.a -none $$libs ${EX_LIBS} ) || exit 1; \
+                $(CLEARENV) && $(MAKE) -f Makefile.shared -e $(BUILDENV) \
+                        LIBNAME=$$i LIBVERSION=${SHLIB_MAJOR}.${SHLIB_MINOR} \
+                        LIBCOMPATVERSIONS=";${SHLIB_VERSION_HISTORY}" \
+                        LIBDEPS="$$libs $(EX_LIBS)" \
+                        link_a.$(SHLIB_TARGET); \
                 libs="-l$$i $$libs"; \
-                done; \
-        fi
-
-
-# This assumes that GNU utilities are *not* used
-do_solaris-shared:
-        if ${DETECT_GNU_LD}; then \
-                $(MAKE) do_gnu-shared; \
-        else \
-                libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
-                if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
-                        libs="$(LIBKRB5) $$libs"; \
-                fi; \
-                ( PATH=/usr/ccs/bin:$$PATH ; export PATH; \
-                  MINUSZ='-z '; \
-                  (${CC} -v 2>&1 | grep gcc) > /dev/null && MINUSZ='-Wl,-z,'; \
-                  set -x; $${FIPSLD:-${CC}} ${SHARED_LDFLAGS} \
-                        -o lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} \
-                        -h lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} \
-                        -Wl,-Bsymbolic \
-                        $${MINUSZ}allextract lib$$i.a $${MINUSZ}defaultextract \
-                        $$libs ${EX_LIBS} ) || exit 1; \
-                libs="-l$$i $$libs"; \
-                done; \
-        fi
-
-# OpenServer 5 native compilers used
-do_svr3-shared:
-        if ${DETECT_GNU_LD}; then \
-                $(MAKE) do_gnu-shared; \
-        else \
-                libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
-                if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
-                        libs="$(LIBKRB5) $$libs"; \
-                fi; \
-                ( PATH=/usr/ccs/bin:$$PATH ; export PATH; \
-                  find . -name "*.o" -print > allobjs ; \
-                  OBJS= ; export OBJS ; \
-                  for obj in `ar t lib$$i.a` ; do \
-                    OBJS="$${OBJS} `grep /$$obj allobjs`" ; \
-                  done ; \
-                  set -x; $${FIPSLD:-${CC}} ${SHARED_LDFLAGS} \
-                        -G -o lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} \
-                        -h lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} \
-                        $${OBJS} $$libs ${EX_LIBS} ) || exit 1; \
-                libs="-l$$i $$libs"; \
-                done; \
-        fi
-
-# UnixWare 7 and OpenUNIX 8 native compilers used
-do_svr5-shared:
-        if ${DETECT_GNU_LD}; then \
-                $(MAKE) do_gnu-shared; \
-        else \
-                libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
-                if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
-                        libs="$(LIBKRB5) $$libs"; \
-                fi; \
-                ( PATH=/usr/ccs/bin:$$PATH ; export PATH; \
-                  SHARE_FLAG='-G'; \
-                  (${CC} -v 2>&1 | grep gcc) > /dev/null && SHARE_FLAG='-shared'; \
-                  find . -name "*.o" -print > allobjs ; \
-                  OBJS= ; export OBJS ; \
-                  for obj in `ar t lib$$i.a` ; do \
-                    OBJS="$${OBJS} `grep /$$obj allobjs`" ; \
-                  done ; \
-                  set -x; LD_LIBRARY_PATH=.:$$LD_LIBRARY_PATH \
-                        $${FIPSLD:-${CC}} ${SHARED_LDFLAGS} \
-                        $${SHARE_FLAG} -o lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} \
-                        -h lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} \
-                        $${OBJS} $$libs ${EX_LIBS} ) || exit 1; \
-                libs="-l$$i $$libs"; \
-                done; \
-        fi
-
-# This assumes that GNU utilities are *not* used
-do_irix-shared:
-        if ${DETECT_GNU_LD}; then \
-                $(MAKE) do_gnu-shared; \
-        else \
-                libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
-                if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
-                        libs="$(LIBKRB5) $$libs"; \
-                fi; \
-                ( WHOLELIB="-all lib$$i.a -none"; \
-                  (${CC} -v 2>&1 | grep gcc) > /dev/null && WHOLELIB="-Wl,-all,lib$$i.a,-none"; \
-                  set -x; $${FIPSLD:-${CC}} ${SHARED_LDFLAGS} \
-                        -shared -o lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} \
-                        -Wl,-soname,lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} \
-                        $${WHOLELIB} $$libs ${EX_LIBS}) || exit 1; \
-                libs="-l$$i $$libs"; \
-                done; \
-        fi
-
-# This assumes that GNU utilities are *not* used
-#
-do_hpux-shared:
-        for i in ${SHLIBDIRS}; do \
-        if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
-                libs="$(LIBKRB5) $$libs"; \
-        fi; \
-        if expr $(PLATFORM) : '.*ia64' > /dev/null; then \
-                shlib=lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR}; \
-        else \
-                shlib=lib$$i.sl.${SHLIB_MAJOR}.${SHLIB_MINOR}; \
-        fi; \
-        [ -f $$shlib ] && rm -f $$shlib; \
-        ALLSYMSFLAGS='-Wl,-Fl'; \
-        expr $(PLATFORM) : 'hpux64' > /dev/null && ALLSYMSFLAGS='-Wl,+forceload'; \
-        ( set -x; $${FIPSLD:-${CC}} ${SHARED_LDFLAGS} \
-                -Wl,-B,symbolic,+vnocompatwarnings,-z,+h,$$shlib \
-                -o $$shlib $$ALLSYMSFLAGS,lib$$i.a -ldld ) || exit 1; \
-        chmod a=rx $$shlib; \
         done
 
-# The following method is said to work on all platforms.  Tests will
-# determine if that's how it's gong to be used.
-# This assumes that for all but GNU systems, GNU utilities are *not* used.
-# ALLSYMSFLAGS would be:
-#  GNU systems: --whole-archive
-#  Tru64 Unix:  -all
-#  Solaris:     -z allextract
-#  Irix:        -all
-#  HP/UX-32bit: -Fl
-#  HP/UX-64bit: +forceload
-#  AIX:         -bnogc
-# SHAREDFLAGS would be:
-#  GNU systems: -shared -Wl,-soname=lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR}
-#  Tru64 Unix:  -shared \
-#               -set_version "${SHLIB_VERSION_HISTORY}${SHLIB_VERSION_NUMBER}"
-#  Solaris:     -G -h lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR}
-#  Irix:        -shared -Wl,-soname,lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR}
-#  HP/UX-32bit: +vnocompatwarnings -b -z +s \
-#               +h lib$$i.sl.${SHLIB_MAJOR}.${SHLIB_MINOR}
-#  HP/UX-64bit: -b -z +h lib$$i.sl.${SHLIB_MAJOR}.${SHLIB_MINOR}
-#  AIX:         -G -bE:lib$$i.exp -bM:SRE
-# SHAREDCMD would be:
-#  GNU systems: $(CC)
-#  Tru64 Unix:  $(CC)
-#  Solaris:     $(CC)
-#  Irix:        $(CC)
-#  HP/UX-32bit: /usr/ccs/bin/ld
-#  HP/UX-64bit: /usr/ccs/bin/ld
-#  AIX:         $(CC)
-ALLSYMSFLAG=-bnogc
-SHAREDFLAGS=${SHARED_LDFLAGS} -G -bE:lib$$i.exp -bM:SRE
-SHAREDCMD=$(CC)
-do_aix-shared:
-        libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
-        if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
-                libs="$(LIBKRB5) $$libs"; \
-        fi; \
-        ( set -x; \
-          OBJECT_MODE=`expr x${SHARED_LDFLAGS} : 'x\-[a-z]\([0-9]*\)'`; \
-          OBJECT_MODE=$${OBJECT_MODE:-32}; export OBJECT_MODE; \
-          ld -r -o lib$$i.o $(ALLSYMSFLAG) lib$$i.a && \
-          ( nm -Pg lib$$i.o | grep ' [BD] ' | cut -f1 -d' ' > lib$$i.exp; \
-            $${FIPSLD:-${CC}} $(SHAREDFLAGS) \
-                -o lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} lib$$i.o \
-                $$libs ${EX_LIBS} ) ) \
-        || exit 1; \
-        libs="-l$$i $$libs"; \
-        done
+libcrypto.pc: Makefile
+        @ ( echo 'prefix=$(INSTALLTOP)'; \
+            echo 'exec_prefix=$${prefix}'; \
+            echo 'libdir=$${exec_prefix}/lib'; \
+            echo 'includedir=$${prefix}/include'; \
+            echo ''; \
+            echo 'Name: OpenSSL-libcrypto'; \
+            echo 'Description: OpenSSL cryptography library'; \
+            echo 'Version: '$(VERSION); \
+            echo 'Requires: '; \
+            echo 'Libs: -L$${libdir} -lcrypto $(EX_LIBS)'; \
+            echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > libcrypto.pc
 
-do_reliantunix-shared:
-        libs='-L. ${SHLIBDEPS}'; for i in ${SHLIBDIRS}; do \
-        if [ "${SHLIBDIRS}" = "ssl" -a -n "$(LIBKRB5)" ]; then \
-                libs="$(LIBKRB5) $$libs"; \
-        fi; \
-        tmpdir=/tmp/openssl.$$$$ ; rm -rf $$tmpdir ; \
-        ( set -x; \
-          ( Opwd=`pwd` ; mkdir $$tmpdir || exit 1; \
-            cd $$tmpdir || exit 1 ; ar x $$Opwd/lib$$i.a ; \
-            $${FIPSLD:-${CC}} -G -o lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} *.o \
-          ) || exit 1; \
-          cp $$tmpdir/lib$$i.so.${SHLIB_MAJOR}.${SHLIB_MINOR} . ; \
-        ) || exit 1; \
-        rm -rf $$tmpdir ; \
-        libs="-l$$i $$libs"; \
-        done
+libssl.pc: Makefile
+        @ ( echo 'prefix=$(INSTALLTOP)'; \
+            echo 'exec_prefix=$${prefix}'; \
+            echo 'libdir=$${exec_prefix}/lib'; \
+            echo 'includedir=$${prefix}/include'; \
+            echo ''; \
+            echo 'Name: OpenSSL'; \
+            echo 'Description: Secure Sockets Layer and cryptography libraries'; \
+            echo 'Version: '$(VERSION); \
+            echo 'Requires: '; \
+            echo 'Libs: -L$${libdir} -lssl -lcrypto $(EX_LIBS)'; \
+            echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > libssl.pc
 
 openssl.pc: Makefile
         @ ( echo 'prefix=$(INSTALLTOP)'; \
@@ -606,31 +334,25 @@ openssl.pc: Makefile
             echo 'Description: Secure Sockets Layer and cryptography libraries and tools'; \
             echo 'Version: '$(VERSION); \
             echo 'Requires: '; \
-            echo 'Libs: -L$${libdir} -lssl -lcrypto $(LIBKRB5) $(EX_LIBS)'; \
+            echo 'Libs: -L$${libdir} -lssl -lcrypto $(EX_LIBS)'; \
             echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > openssl.pc
 
-Makefile: Makefile.org
-        @echo "Makefile is older than Makefile.org."
+Makefile: Makefile.org Configure config
+        @echo "Makefile is older than Makefile.org, Configure or config."
         @echo "Reconfigure the source tree (via './config' or 'perl Configure'), please."
         @false
 
 libclean:
-        rm -f *.map *.so *.so.* engines/*.so *.a */lib */*/lib
+        rm -f *.map *.so *.so.* *.dll engines/*.so engines/*.dll *.a engines/*.a */lib */*/lib
 
 clean:  libclean
         rm -f shlib/*.o *.o core a.out fluff rehash.time testlog make.log cctest cctest.c
-        @for i in $(DIRS) ;\
-        do \
-        if [ -d "$$i" ]; then \
-                (cd $$i && echo "making clean in $$i..." && \
-                $(MAKE) EXE_EXT='${EXE_EXT}' SDIRS='${SDIRS}' clean ) || exit 1; \
-                rm -f $(LIBS); \
-        fi; \
-        done;
-        rm -f openssl.pc
+        @set -e; target=clean; $(RECURSIVE_BUILD_CMD)
+        rm -f $(LIBS)
+        rm -f openssl.pc libssl.pc libcrypto.pc
         rm -f speed.* .pure
         rm -f $(TARFILE)
-        @for i in $(ONEDIRS) ;\
+        @set -e; for i in $(ONEDIRS) ;\
         do \
         rm -fr $$i/*; \
         done
@@ -641,37 +363,20 @@ makefile.one: files
 
 files:
         $(PERL) $(TOP)/util/files.pl Makefile > $(TOP)/MINFO
-        @for i in $(DIRS) ;\
-        do \
-        if [ -d "$$i" ]; then \
-                (cd $$i && echo "making 'files' in $$i..." && \
-                $(MAKE) SDIRS='${SDIRS}' PERL='${PERL}' files ) || exit 1; \
-        fi; \
-        done;
+        @set -e; target=files; $(RECURSIVE_BUILD_CMD)
 
 links:
         @$(PERL) $(TOP)/util/mkdir-p.pl include/openssl
         @$(PERL) $(TOP)/util/mklink.pl include/openssl $(EXHEADER)
-        @for i in $(DIRS); do \
-        if [ -d "$$i" ]; then \
-                (cd $$i && echo "making links in $$i..." && \
-                $(MAKE) CC='${CC}' PLATFORM='${PLATFORM}' CFLAG='${CFLAG}' SDIRS='$(SDIRS)' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' FIPS_DES_ENC='${FIPS_DES_ENC}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' FIPS_SHA1_ASM_OBJ='${FIPS_SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' AR='${AR}' PERL='${PERL}' KRB5_INCLUDES='${KRB5_INCLUDES}' LIBKRB5='${LIBKRB5}' links ) || exit 1; \
-        fi; \
-        done;
+        @set -e; target=links; $(RECURSIVE_BUILD_CMD)
 
 gentests:
         @(cd test && echo "generating dummy tests (if needed)..." && \
-        $(MAKE) CC='${CC}' PLATFORM='${PLATFORM}' CFLAG='${CFLAG}' SDIRS='$(SDIRS)' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' FIPS_DES_ENC='${FIPS_DES_ENC}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' FIPS_SHA1_ASM_OBJ='${FIPS_SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' TESTS='${TESTS}' KRB5_INCLUDES='${KRB5_INCLUDES}' LIBKRB5='${LIBKRB5}' EXE_EXT='${EXE_EXT}' SHARED_LIBS='${SHARED_LIBS}' SHLIB_EXT='${SHLIB_EXT}' SHLIB_TARGET='${SHLIB_TARGET}' TESTS='${TESTS}' OPENSSL_DEBUG_MEMORY=on generate );
+        $(CLEARENV) && $(MAKE) -e $(BUILDENV) TESTS='${TESTS}' OPENSSL_DEBUG_MEMORY=on generate );
 
 dclean:
         rm -f *.bak
-        @for i in $(DIRS) ;\
-        do \
-        if [ -d "$$i" ]; then \
-                (cd $$i && echo "making dclean in $$i..." && \
-                $(MAKE) SDIRS='${SDIRS}' PERL='${PERL}' dclean ) || exit 1; \
-        fi; \
-        done;
+        @set -e; target=dclean; $(RECURSIVE_BUILD_CMD)
 
 rehash: rehash.time
 rehash.time: certs
@@ -685,29 +390,17 @@ test:   tests
 
 tests: rehash
         @(cd test && echo "testing..." && \
-        $(MAKE) CC='${CC}' PLATFORM='${PLATFORM}' CFLAG='${CFLAG}' SDIRS='$(SDIRS)' INSTALLTOP='${INSTALLTOP}' PEX_LIBS='${PEX_LIBS}' EX_LIBS='${EX_LIBS}' BN_ASM='${BN_ASM}' DES_ENC='${DES_ENC}' FIPS_DES_ENC='${FIPS_DES_ENC}' BF_ENC='${BF_ENC}' CAST_ENC='${CAST_ENC}' RC4_ENC='${RC4_ENC}' RC5_ENC='${RC5_ENC}' SHA1_ASM_OBJ='${SHA1_ASM_OBJ}' FIPS_SHA1_ASM_OBJ='${FIPS_SHA1_ASM_OBJ}' MD5_ASM_OBJ='${MD5_ASM_OBJ}' RMD160_ASM_OBJ='${RMD160_ASM_OBJ}' AR='${AR}' PROCESSOR='${PROCESSOR}' PERL='${PERL}' RANLIB='${RANLIB}' TESTS='${TESTS}' KRB5_INCLUDES='${KRB5_INCLUDES}' LIBKRB5='${LIBKRB5}' EXE_EXT='${EXE_EXT}' SHARED_LIBS='${SHARED_LIBS}' SHLIB_EXT='${SHLIB_EXT}' SHLIB_TARGET='${SHLIB_TARGET}' TESTS='${TESTS}' OPENSSL_DEBUG_MEMORY=on tests );
-        util/shlib_wrap.sh apps/openssl version -a
+        $(CLEARENV) && $(MAKE) -e $(BUILDENV) TOP=.. TESTS='${TESTS}' OPENSSL_DEBUG_MEMORY=on tests );
+        util/opensslwrap.sh version -a
 
 report:
         @$(PERL) util/selftest.pl
 
 depend:
-        @for i in $(DIRS) ;\
-        do \
-        if [ -d "$$i" ]; then \
-                (cd $$i && echo "making dependencies $$i..." && \
-                $(MAKE) SDIRS='${SDIRS}' CFLAG='${CFLAG}' DEPFLAG='${DEPFLAG}' MAKEDEPPROG='${MAKEDEPPROG}' KRB5_INCLUDES='${KRB5_INCLUDES}' PERL='${PERL}' depend ) || exit 1; \
-        fi; \
-        done;
+        @set -e; target=depend; $(RECURSIVE_BUILD_CMD)
 
 lint:
-        @for i in $(DIRS) ;\
-        do \
-        if [ -d "$$i" ]; then \
-                (cd $$i && echo "making lint $$i..." && \
-                $(MAKE) SDIRS='${SDIRS}' lint ) || exit 1; \
-        fi; \
-        done;
+        @set -e; target=lint; $(RECURSIVE_BUILD_CMD)
 
 tags:
         rm -f TAGS
@@ -715,7 +408,8 @@ tags:
 
 errors:
         $(PERL) util/mkerr.pl -recurse -write
-        (cd crypto/engine; $(MAKE) PERL=$(PERL) errors)
+        (cd engines; $(MAKE) PERL=$(PERL) errors)
+        $(PERL) util/ck_errf.pl */*.c */*/*.c
 
 stacks:
         $(PERL) util/mkstack.pl -write
@@ -777,45 +471,36 @@ dist:
         @$(MAKE) TAR='${TAR}' TARFLAGS='${TARFLAGS}' tar
 
 dist_pem_h:
-        (cd crypto/pem; $(MAKE) CC='${CC}' SDIRS='${SDIRS}' CFLAG='${CFLAG}' pem.h; $(MAKE) clean)
+        (cd crypto/pem; $(MAKE) -e $(BUILDENV) pem.h; $(MAKE) clean)
 
 install: all install_docs install_sw
 
 install_sw:
         @$(PERL) $(TOP)/util/mkdir-p.pl $(INSTALL_PREFIX)$(INSTALLTOP)/bin \
                 $(INSTALL_PREFIX)$(INSTALLTOP)/lib \
+                $(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines \
                 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/pkgconfig \
                 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl \
                 $(INSTALL_PREFIX)$(OPENSSLDIR)/misc \
                 $(INSTALL_PREFIX)$(OPENSSLDIR)/certs \
                 $(INSTALL_PREFIX)$(OPENSSLDIR)/private
-        @headerlist="$(EXHEADER)"; for i in $$headerlist ;\
+        @set -e; headerlist="$(EXHEADER)"; for i in $$headerlist;\
         do \
         (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
         chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
         done;
-        @for i in $(DIRS) ;\
-        do \
-        if [ -d "$$i" ]; then \
-                (cd $$i; echo "installing $$i..."; \
-                $(MAKE) CC='${CC}' CFLAG='${CFLAG}' INSTALL_PREFIX='${INSTALL_PREFIX}' INSTALLTOP='${INSTALLTOP}' OPENSSLDIR='${OPENSSLDIR}' EX_LIBS='${EX_LIBS}' SDIRS='${SDIRS}' RANLIB='${RANLIB}' EXE_EXT='${EXE_EXT}' install ); \
-        fi; \
-        done
-        @for i in $(LIBS) ;\
+        @set -e; target=install; $(RECURSIVE_BUILD_CMD)
+        @set -e; for i in $(LIBS) ;\
         do \
                 if [ -f "$$i" ]; then \
                 (       echo installing $$i; \
                         cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.new; \
-                        if egrep 'define OPENSSL_FIPS' $(TOP)/include/openssl/opensslconf.h > /dev/null; then \
-                                : ; \
-                        else \
-                                $(RANLIB) $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.new; \
-                        fi; \
+                        $(RANLIB) $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.new; \
                         chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.new; \
                         mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.new $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i ); \
                 fi; \
         done;
-        @if [ -n "$(SHARED_LIBS)" ]; then \
+        @set -e; if [ -n "$(SHARED_LIBS)" ]; then \
                 tmp="$(SHARED_LIBS)"; \
                 for i in $${tmp:-x}; \
                 do \
@@ -826,20 +511,19 @@ install_sw:
                                         chmod 555 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.new; \
                                         mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.new $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i; \
                                 else \
-                                        c=`echo $$i | sed 's/^lib\(.*\)\.dll/cyg\1-$(SHLIB_VERSION_NUMBER).dll/'`; \
+                                        c=`echo $$i | sed 's/^lib\(.*\)\.dll\.a/cyg\1-$(SHLIB_VERSION_NUMBER).dll/'`; \
                                         cp $$c $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$c.new; \
                                         chmod 755 $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$c.new; \
                                         mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$c.new $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$c; \
-                                        cp $$i.a $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.a.new; \
-                                        chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.a.new; \
-                                        mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.a.new $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.a; \
+                                        cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.new; \
+                                        chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.new; \
+                                        mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i.new $(INSTALL_PREFIX)$(INSTALLTOP)/lib/$$i; \
                                 fi ); \
                         fi; \
                 done; \
                 (       here="`pwd`"; \
                         cd $(INSTALL_PREFIX)$(INSTALLTOP)/lib; \
-                        set $(MAKE); \
-                        $$1 -f $$here/Makefile link-shared ); \
+                        $(MAKE) -f $$here/Makefile HERE="$$here" link-shared ); \
                 if [ "$(INSTALLTOP)" != "/usr" ]; then \
                         echo 'OpenSSL shared libraries have been installed in:'; \
                         echo '  $(INSTALLTOP)'; \
@@ -847,6 +531,10 @@ install_sw:
                         sed -e '1,/^$$/d' doc/openssl-shared.txt; \
                 fi; \
         fi
+        cp libcrypto.pc $(INSTALL_PREFIX)$(INSTALLTOP)/lib/pkgconfig
+        chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/pkgconfig/libcrypto.pc
+        cp libssl.pc $(INSTALL_PREFIX)$(INSTALLTOP)/lib/pkgconfig
+        chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/pkgconfig/libssl.pc
         cp openssl.pc $(INSTALL_PREFIX)$(INSTALLTOP)/lib/pkgconfig
         chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/pkgconfig/openssl.pc
 
@@ -862,9 +550,9 @@ install_docs:
         if [ "$(PLATFORM)" = "DJGPP" -o "$(PLATFORM)" = "Cygwin" -o "$(PLATFORM)" = "mingw" ]; then \
                 filecase=-i; \
         fi; \
-        for i in doc/apps/*.pod; do \
+        set -e; for i in doc/apps/*.pod; do \
                 fn=`basename $$i .pod`; \
-                if [ "$$fn" = "config" ]; then sec=5; else sec=1; fi; \
+                sec=`$(PERL) util/extract-section.pl 1 < $$i`; \
                 echo "installing man$$sec/$$fn.$${sec}$(MANSUFFIX)"; \
                 (cd `$(PERL) util/dirname.pl $$i`; \
                 sh -c "$$pod2man \
@@ -879,9 +567,9 @@ install_docs:
                                 $$here/util/point.sh $$fn.$${sec}$(MANSUFFIX) "$$n".$${sec}$(MANSUFFIX); \
                          done); \
         done; \
-        for i in doc/crypto/*.pod doc/ssl/*.pod; do \
+        set -e; for i in doc/crypto/*.pod doc/ssl/*.pod; do \
                 fn=`basename $$i .pod`; \
-                if [ "$$fn" = "des_modes" ]; then sec=7; else sec=3; fi; \
+                sec=`$(PERL) util/extract-section.pl 3 < $$i`; \
                 echo "installing man$$sec/$$fn.$${sec}$(MANSUFFIX)"; \
                 (cd `$(PERL) util/dirname.pl $$i`; \
                 sh -c "$$pod2man \
diff --git a/src/lib/libssl/src/NEWS b/src/lib/libssl/src/NEWS
index 49b443ed4d..40ded1aebf 100644
--- a/src/lib/libssl/src/NEWS
+++ b/src/lib/libssl/src/NEWS
@@ -5,8 +5,138 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
+  Major changes between OpenSSL 0.9.8f and OpenSSL 0.9.8g:
+
+      o Fixes for bugs introduced with 0.9.8f.
+
+  Major changes between OpenSSL 0.9.8e and OpenSSL 0.9.8f:
+
+      o Add gcc 4.2 support.
+      o Add support for AES and SSE2 assembly lanugauge optimization
+        for VC++ build.
+      o Support for RFC4507bis and server name extensions if explicitly 
+        selected at compile time.
+      o DTLS improvements.
+      o RFC4507bis support.
+      o TLS Extensions support.
+
+  Major changes between OpenSSL 0.9.8d and OpenSSL 0.9.8e:
+
+      o Various ciphersuite selection fixes.
+      o RFC3779 support.
+
+  Major changes between OpenSSL 0.9.8c and OpenSSL 0.9.8d:
+
+      o Introduce limits to prevent malicious key DoS  (CVE-2006-2940)
+      o Fix security issues (CVE-2006-2937, CVE-2006-3737, CVE-2006-4343)
+      o Changes to ciphersuite selection algorithm
+
+  Major changes between OpenSSL 0.9.8b and OpenSSL 0.9.8c:
+
+      o Fix Daniel Bleichenbacher forged signature attack, CVE-2006-4339
+      o New cipher Camellia
+
+  Major changes between OpenSSL 0.9.8a and OpenSSL 0.9.8b:
+
+      o Cipher string fixes.
+      o Fixes for VC++ 2005.
+      o Updated ECC cipher suite support.
+      o New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free().
+      o Zlib compression usage fixes.
+      o Built in dynamic engine compilation support on Win32.
+      o Fixes auto dynamic engine loading in Win32.
+
+  Major changes between OpenSSL 0.9.8 and OpenSSL 0.9.8a:
+
+      o Fix potential SSL 2.0 rollback, CVE-2005-2969
+      o Extended Windows CE support
+
+  Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.8:
+
+      o Major work on the BIGNUM library for higher efficiency and to
+        make operations more streamlined and less contradictory.  This
+        is the result of a major audit of the BIGNUM library.
+      o Addition of BIGNUM functions for fields GF(2^m) and NIST
+        curves, to support the Elliptic Crypto functions.
+      o Major work on Elliptic Crypto; ECDH and ECDSA added, including
+        the use through EVP, X509 and ENGINE.
+      o New ASN.1 mini-compiler that's usable through the OpenSSL
+        configuration file.
+      o Added support for ASN.1 indefinite length constructed encoding.
+      o New PKCS#12 'medium level' API to manipulate PKCS#12 files.
+      o Complete rework of shared library construction and linking
+        programs with shared or static libraries, through a separate
+        Makefile.shared.
+      o Rework of the passing of parameters from one Makefile to another.
+      o Changed ENGINE framework to load dynamic engine modules
+        automatically from specifically given directories.
+      o New structure and ASN.1 functions for CertificatePair.
+      o Changed the ZLIB compression method to be stateful.
+      o Changed the key-generation and primality testing "progress"
+        mechanism to take a structure that contains the ticker
+        function and an argument.
+      o New engine module: GMP (performs private key exponentiation).
+      o New engine module: VIA PadLOck ACE extension in VIA C3
+        Nehemiah processors.
+      o Added support for IPv6 addresses in certificate extensions.
+        See RFC 1884, section 2.2.
+      o Added support for certificate policy mappings, policy
+        constraints and name constraints.
+      o Added support for multi-valued AVAs in the OpenSSL
+        configuration file.
+      o Added support for multiple certificates with the same subject
+        in the 'openssl ca' index file.
+      o Make it possible to create self-signed certificates using
+        'openssl ca -selfsign'.
+      o Make it possible to generate a serial number file with
+        'openssl ca -create_serial'.
+      o New binary search functions with extended functionality.
+      o New BUF functions.
+      o New STORE structure and library to provide an interface to all
+        sorts of data repositories.  Supports storage of public and
+        private keys, certificates, CRLs, numbers and arbitrary blobs.
+        This library is unfortunately unfinished and unused withing
+        OpenSSL.
+      o New control functions for the error stack.
+      o Changed the PKCS#7 library to support one-pass S/MIME
+        processing.
+      o Added the possibility to compile without old deprecated
+        functionality with the OPENSSL_NO_DEPRECATED macro or the
+        'no-deprecated' argument to the config and Configure scripts.
+      o Constification of all ASN.1 conversion functions, and other
+        affected functions.
+      o Improved platform support for PowerPC.
+      o New FIPS 180-2 algorithms (SHA-224, -256, -384 and -512).
+      o New X509_VERIFY_PARAM structure to support parametrisation
+        of X.509 path validation.
+      o Major overhaul of RC4 performance on Intel P4, IA-64 and
+        AMD64.
+      o Changed the Configure script to have some algorithms disabled
+        by default.  Those can be explicitely enabled with the new
+        argument form 'enable-xxx'.
+      o Change the default digest in 'openssl' commands from MD5 to
+        SHA-1.
+      o Added support for DTLS.
+      o New BIGNUM blinding.
+      o Added support for the RSA-PSS encryption scheme
+      o Added support for the RSA X.931 padding.
+      o Added support for BSD sockets on NetWare.
+      o Added support for files larger than 2GB.
+      o Added initial support for Win64.
+      o Added alternate pkg-config files.
+
+  Major changes between OpenSSL 0.9.7k and OpenSSL 0.9.7l:
+
+      o Introduce limits to prevent malicious key DoS  (CVE-2006-2940)
+      o Fix security issues (CVE-2006-2937, CVE-2006-3737, CVE-2006-4343)
+
+  Major changes between OpenSSL 0.9.7j and OpenSSL 0.9.7k:
+
+      o Fix Daniel Bleichenbacher forged signature attack, CVE-2006-4339
+
   Major changes between OpenSSL 0.9.7i and OpenSSL 0.9.7j:
 
+      o Visual C++ 2005 fixes.
       o Update Windows build system for FIPS.
 
   Major changes between OpenSSL 0.9.7h and OpenSSL 0.9.7i:
@@ -15,7 +145,7 @@
 
   Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.7h:
 
-      o Fix SSL 2.0 Rollback, CAN-2005-2969
+      o Fix SSL 2.0 Rollback, CVE-2005-2969
       o Allow use of fixed-length exponent on DSA signing
       o Default fixed-window RSA, DSA, DH private-key operations
 
diff --git a/src/lib/libssl/src/README b/src/lib/libssl/src/README
index a6a97c8858..df02ae076d 100644
--- a/src/lib/libssl/src/README
+++ b/src/lib/libssl/src/README
@@ -1,7 +1,7 @@
 
- OpenSSL 0.9.7j 04 May 2006
+ OpenSSL 0.9.8h
 
- Copyright (c) 1998-2005 The OpenSSL Project
+ Copyright (c) 1998-2008 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
  All rights reserved.
 
@@ -36,12 +36,13 @@
      actually logically part of it. It includes routines for the following:
 
      Ciphers
-        libdes - EAY's libdes DES encryption package which has been floating
-                 around the net for a few years.  It includes 15
-                 'modes/variations' of DES (1, 2 and 3 key versions of ecb,
-                 cbc, cfb and ofb; pcbc and a more general form of cfb and
-                 ofb) including desx in cbc mode, a fast crypt(3), and
-                 routines to read passwords from the keyboard.
+        libdes - EAY's libdes DES encryption package which was floating
+                 around the net for a few years, and was then relicensed by
+                 him as part of SSLeay.  It includes 15 'modes/variations'
+                 of DES (1, 2 and 3 key versions of ecb, cbc, cfb and ofb;
+                 pcbc and a more general form of cfb and ofb) including desx
+                 in cbc mode, a fast crypt(3), and routines to read
+                 passwords from the keyboard.
         RC4 encryption,
         RC2 encryption      - 4 different modes, ecb, cbc, cfb and ofb.
         Blowfish encryption - 4 different modes, ecb, cbc, cfb and ofb.
@@ -113,6 +114,10 @@
 
  The MDC2 algorithm is patented by IBM.
 
+ NTT and Mitsubishi have patents and pending patents on the Camellia
+ algorithm, but allow use at no charge without requiring an explicit
+ licensing agreement: http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html
+
  INSTALLATION
  ------------
 
@@ -156,7 +161,7 @@
     - Stack Traceback (if the application dumps core)
 
  Report the bug to the OpenSSL project via the Request Tracker
- (http://www.openssl.org/support/rt2.html) by mail to:
+ (http://www.openssl.org/support/rt.html) by mail to:
 
     openssl-bugs@openssl.org
 
diff --git a/src/lib/libssl/src/VMS/mkshared.com b/src/lib/libssl/src/VMS/mkshared.com
index 19f3821bc6..1356fb9dd7 100644
--- a/src/lib/libssl/src/VMS/mkshared.com
+++ b/src/lib/libssl/src/VMS/mkshared.com
@@ -266,14 +266,6 @@ $             falsesum = falsesum + 1
 $         endif
 $         if plat_entry .eqs. "VMS" then truesum = truesum + 1
 $         if plat_entry .eqs. "!VMS" then falsesum = falsesum + 1
-$         if f$trnlnm("OPENSSL_FIPS") .nes. ""
-$         then
-$           if plat_entry .eqs. "OPENSSL_FIPS" then truesum = truesum + 1
-$           if plat_entry .eqs. "!OPENSSL_FIPS" then falsesum = falsesum + 1
-$         else
-$           if plat_entry .eqs. "OPENSSL_FIPS" then falsesum = falsesum + 1
-$           if plat_entry .eqs. "!OPENSSL_FIPS" then truesum = truesum + 1
-$         endif
 $         goto loop1
 $       endif
 $     endloop1:
@@ -293,6 +285,7 @@ $       if alg_entry .eqs. "" then goto loop2
 $       if alg_entry .nes. ","
 $       then
 $         if alg_entry .eqs. "KRB5" then goto loop ! Special for now
+$         if alg_entry .eqs. "STATIC_ENGINE" then goto loop ! Special for now
 $         if f$trnlnm("OPENSSL_NO_"+alg_entry) .nes. "" then goto loop
 $         goto loop2
 $       endif
diff --git a/src/lib/libssl/src/apps/CA.pl.in b/src/lib/libssl/src/apps/CA.pl.in
index 9c99739092..c783a6e6a5 100644
--- a/src/lib/libssl/src/apps/CA.pl.in
+++ b/src/lib/libssl/src/apps/CA.pl.in
@@ -45,7 +45,8 @@ if(defined $ENV{OPENSSL}) {
 }
 
 $SSLEAY_CONFIG=$ENV{"SSLEAY_CONFIG"};
-$DAYS="-days 365";
+$DAYS="-days 365";      # 1 year
+$CADAYS="-days 1095";   # 3 years
 $REQ="$openssl req $SSLEAY_CONFIG";
 $CA="$openssl ca $SSLEAY_CONFIG";
 $VERIFY="$openssl verify";
@@ -54,6 +55,7 @@ $PKCS12="$openssl pkcs12";
 
 $CATOP="./demoCA";
 $CAKEY="cakey.pem";
+$CAREQ="careq.pem";
 $CACERT="cacert.pem";
 
 $DIRMODE = 0777;
@@ -92,6 +94,9 @@ foreach (@ARGV) {
                 mkdir "${CATOP}/private", $DIRMODE;
                 open OUT, ">${CATOP}/index.txt";
                 close OUT;
+                open OUT, ">${CATOP}/crlnumber";
+                print OUT "01\n";
+                close OUT;
             }
             if ( ! -f "${CATOP}/private/$CAKEY" ) {
                 print "CA certificate filename (or enter to create)\n";
@@ -106,15 +111,16 @@ foreach (@ARGV) {
                     $RET=$?;
                 } else {
                     print "Making CA certificate ...\n";
-                    system ("$REQ -new -x509 -keyout " .
-                        "${CATOP}/private/$CAKEY -out ${CATOP}/$CACERT $DAYS");
+                    system ("$REQ -new -keyout " .
+                        "${CATOP}/private/$CAKEY -out ${CATOP}/$CAREQ");
+                    system ("$CA -create_serial " .
+                        "-out ${CATOP}/$CACERT $CADAYS -batch " . 
+                        "-keyfile ${CATOP}/private/$CAKEY -selfsign " .
+                        "-extensions v3_ca " .
+                        "-infiles ${CATOP}/$CAREQ ");
                     $RET=$?;
                 }
             }
-            if (! -f "${CATOP}/serial" ) {
-                system ("$X509 -in ${CATOP}/$CACERT -noout "
-                        . "-next_serial -out ${CATOP}/serial");
-            }
         } elsif (/^-pkcs12$/) {
             my $cname = $ARGV[1];
             $cname = "My Certificate" unless defined $cname;
diff --git a/src/lib/libssl/src/apps/CA.sh b/src/lib/libssl/src/apps/CA.sh
index 84d7ec0b33..a0b20d85a9 100644
--- a/src/lib/libssl/src/apps/CA.sh
+++ b/src/lib/libssl/src/apps/CA.sh
@@ -32,7 +32,8 @@
 
 if [ -z "$OPENSSL" ]; then OPENSSL=openssl; fi
 
-DAYS="-days 365"
+DAYS="-days 365"        # 1 year
+CADAYS="-days 1095"     # 3 years
 REQ="$OPENSSL req $SSLEAY_CONFIG"
 CA="$OPENSSL ca $SSLEAY_CONFIG"
 VERIFY="$OPENSSL verify"
@@ -40,6 +41,7 @@ X509="$OPENSSL x509"
 
 CATOP=./demoCA
 CAKEY=./cakey.pem
+CAREQ=./careq.pem
 CACERT=./cacert.pem
 
 for i
@@ -72,7 +74,7 @@ case $i in
         mkdir ${CATOP}/crl 
         mkdir ${CATOP}/newcerts
         mkdir ${CATOP}/private
-        echo "01" > ${CATOP}/serial
+        echo "00" > ${CATOP}/serial
         touch ${CATOP}/index.txt
     fi
     if [ ! -f ${CATOP}/private/$CAKEY ]; then
@@ -85,8 +87,11 @@ case $i in
             RET=$?
         else
             echo "Making CA certificate ..."
-            $REQ -new -x509 -keyout ${CATOP}/private/$CAKEY \
-                           -out ${CATOP}/$CACERT $DAYS
+            $REQ -new -keyout ${CATOP}/private/$CAKEY \
+                           -out ${CATOP}/$CAREQ
+            $CA -out ${CATOP}/$CACERT $CADAYS -batch \
+                           -keyfile ${CATOP}/private/$CAKEY -selfsign \
+                           -infiles ${CATOP}/$CAREQ 
             RET=$?
         fi
     fi
diff --git a/src/lib/libssl/src/apps/apps.c b/src/lib/libssl/src/apps/apps.c
index 9b07e913c5..5209caba2e 100644
--- a/src/lib/libssl/src/apps/apps.c
+++ b/src/lib/libssl/src/apps/apps.c
@@ -125,13 +125,17 @@
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#include <openssl/bn.h>
 
 #define NON_MAIN
 #include "apps.h"
 #undef NON_MAIN
 
 typedef struct {
-        char *name;
+        const char *name;
         unsigned long flag;
         unsigned long mask;
 } NAME_EX_TBL;
@@ -250,7 +254,7 @@ int str2fmt(char *s)
                 return(FORMAT_UNDEF);
         }
 
-#if defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WIN16)
+#if defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WIN16) || defined(OPENSSL_SYS_NETWARE)
 void program_name(char *in, char *out, int size)
         {
         int i,n;
@@ -269,12 +273,23 @@ void program_name(char *in, char *out, int size)
         if (p == NULL)
                 p=in;
         n=strlen(p);
+
+#if defined(OPENSSL_SYS_NETWARE)
+   /* strip off trailing .nlm if present. */
+   if ((n > 4) && (p[n-4] == '.') &&
+      ((p[n-3] == 'n') || (p[n-3] == 'N')) &&
+      ((p[n-2] == 'l') || (p[n-2] == 'L')) &&
+      ((p[n-1] == 'm') || (p[n-1] == 'M')))
+      n-=4;
+#else
         /* strip off trailing .exe if present. */
         if ((n > 4) && (p[n-4] == '.') &&
                 ((p[n-3] == 'e') || (p[n-3] == 'E')) &&
                 ((p[n-2] == 'x') || (p[n-2] == 'X')) &&
                 ((p[n-1] == 'e') || (p[n-1] == 'E')))
                 n-=4;
+#endif
+
         if (n > size-1)
                 n=size-1;
 
@@ -761,7 +776,7 @@ X509 *load_cert(BIO *err, const char *file, int format,
                 x=d2i_X509_bio(cert,NULL);
         else if (format == FORMAT_NETSCAPE)
                 {
-                unsigned char *p,*op;
+                const unsigned char *p,*op;
                 int size=0,i;
 
                 /* We sort of have to do it this way because it is sort of nice
@@ -1263,7 +1278,7 @@ static int set_table_opts(unsigned long *flags, const char *arg, const NAME_EX_T
         return 0;
 }
 
-void print_name(BIO *out, char *title, X509_NAME *nm, unsigned long lflags)
+void print_name(BIO *out, const char *title, X509_NAME *nm, unsigned long lflags)
 {
         char *buf;
         char mline = 0;
@@ -1731,23 +1746,10 @@ CA_DB *load_index(char *dbfile, DB_ATTR *db_attr)
                 char *p = NCONF_get_string(dbattr_conf,NULL,"unique_subject");
                 if (p)
                         {
+#ifdef RL_DEBUG
                         BIO_printf(bio_err, "DEBUG[load_index]: unique_subject = \"%s\"\n", p);
-                        switch(*p)
-                                {
-                        case 'f': /* false */
-                        case 'F': /* FALSE */
-                        case 'n': /* no */
-                        case 'N': /* NO */
-                                retdb->attributes.unique_subject = 0;
-                                break;
-                        case 't': /* true */
-                        case 'T': /* TRUE */
-                        case 'y': /* yes */
-                        case 'Y': /* YES */
-                        default:
-                                retdb->attributes.unique_subject = 1;
-                                break;
-                                }
+#endif
+                        retdb->attributes.unique_subject = parse_yesno(p,1);
                         }
                 }
 
@@ -1782,7 +1784,7 @@ int index_index(CA_DB *db)
         return 1;
         }
 
-int save_index(char *dbfile, char *suffix, CA_DB *db)
+int save_index(const char *dbfile, const char *suffix, CA_DB *db)
         {
         char buf[3][BSIZE];
         BIO *out = BIO_new(BIO_s_file());
@@ -1849,7 +1851,7 @@ int save_index(char *dbfile, char *suffix, CA_DB *db)
         return 0;
         }
 
-int rotate_index(char *dbfile, char *new_suffix, char *old_suffix)
+int rotate_index(const char *dbfile, const char *new_suffix, const char *old_suffix)
         {
         char buf[5][BSIZE];
         int i,j;
@@ -1989,9 +1991,174 @@ void free_index(CA_DB *db)
                 }
         }
 
+int parse_yesno(const char *str, int def)
+        {
+        int ret = def;
+        if (str)
+                {
+                switch (*str)
+                        {
+                case 'f': /* false */
+                case 'F': /* FALSE */
+                case 'n': /* no */
+                case 'N': /* NO */
+                case '0': /* 0 */
+                        ret = 0;
+                        break;
+                case 't': /* true */
+                case 'T': /* TRUE */
+                case 'y': /* yes */
+                case 'Y': /* YES */
+                case '1': /* 1 */
+                        ret = 1;
+                        break;
+                default:
+                        ret = def;
+                        break;
+                        }
+                }
+        return ret;
+        }
+
+/*
+ * subject is expected to be in the format /type0=value0/type1=value1/type2=...
+ * where characters may be escaped by \
+ */
+X509_NAME *parse_name(char *subject, long chtype, int multirdn)
+        {
+        size_t buflen = strlen(subject)+1; /* to copy the types and values into. due to escaping, the copy can only become shorter */
+        char *buf = OPENSSL_malloc(buflen);
+        size_t max_ne = buflen / 2 + 1; /* maximum number of name elements */
+        char **ne_types = OPENSSL_malloc(max_ne * sizeof (char *));
+        char **ne_values = OPENSSL_malloc(max_ne * sizeof (char *));
+        int *mval = OPENSSL_malloc (max_ne * sizeof (int));
+
+        char *sp = subject, *bp = buf;
+        int i, ne_num = 0;
+
+        X509_NAME *n = NULL;
+        int nid;
+
+        if (!buf || !ne_types || !ne_values)
+                {
+                BIO_printf(bio_err, "malloc error\n");
+                goto error;
+                }       
+
+        if (*subject != '/')
+                {
+                BIO_printf(bio_err, "Subject does not start with '/'.\n");
+                goto error;
+                }
+        sp++; /* skip leading / */
+
+        /* no multivalued RDN by default */
+        mval[ne_num] = 0;
+
+        while (*sp)
+                {
+                /* collect type */
+                ne_types[ne_num] = bp;
+                while (*sp)
+                        {
+                        if (*sp == '\\') /* is there anything to escape in the type...? */
+                                {
+                                if (*++sp)
+                                        *bp++ = *sp++;
+                                else    
+                                        {
+                                        BIO_printf(bio_err, "escape character at end of string\n");
+                                        goto error;
+                                        }
+                                }       
+                        else if (*sp == '=')
+                                {
+                                sp++;
+                                *bp++ = '\0';
+                                break;
+                                }
+                        else
+                                *bp++ = *sp++;
+                        }
+                if (!*sp)
+                        {
+                        BIO_printf(bio_err, "end of string encountered while processing type of subject name element #%d\n", ne_num);
+                        goto error;
+                        }
+                ne_values[ne_num] = bp;
+                while (*sp)
+                        {
+                        if (*sp == '\\')
+                                {
+                                if (*++sp)
+                                        *bp++ = *sp++;
+                                else
+                                        {
+                                        BIO_printf(bio_err, "escape character at end of string\n");
+                                        goto error;
+                                        }
+                                }
+                        else if (*sp == '/')
+                                {
+                                sp++;
+                                /* no multivalued RDN by default */
+                                mval[ne_num+1] = 0;
+                                break;
+                                }
+                        else if (*sp == '+' && multirdn)
+                                {
+                                /* a not escaped + signals a mutlivalued RDN */
+                                sp++;
+                                mval[ne_num+1] = -1;
+                                break;
+                                }
+                        else
+                                *bp++ = *sp++;
+                        }
+                *bp++ = '\0';
+                ne_num++;
+                }       
+
+        if (!(n = X509_NAME_new()))
+                goto error;
+
+        for (i = 0; i < ne_num; i++)
+                {
+                if ((nid=OBJ_txt2nid(ne_types[i])) == NID_undef)
+                        {
+                        BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_types[i]);
+                        continue;
+                        }
+
+                if (!*ne_values[i])
+                        {
+                        BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_types[i]);
+                        continue;
+                        }
+
+                if (!X509_NAME_add_entry_by_NID(n, nid, chtype, (unsigned char*)ne_values[i], -1,-1,mval[i]))
+                        goto error;
+                }
+
+        OPENSSL_free(ne_values);
+        OPENSSL_free(ne_types);
+        OPENSSL_free(buf);
+        return n;
+
+error:
+        X509_NAME_free(n);
+        if (ne_values)
+                OPENSSL_free(ne_values);
+        if (ne_types)
+                OPENSSL_free(ne_types);
+        if (buf)
+                OPENSSL_free(buf);
+        return NULL;
+}
+
 /* This code MUST COME AFTER anything that uses rename() */
 #ifdef OPENSSL_SYS_WIN32
-int WIN32_rename(char *from, char *to)
+int WIN32_rename(const char *from, const char *to)
         {
 #ifndef OPENSSL_SYS_WINCE
         /* Windows rename gives an error if 'to' exists, so delete it
@@ -2027,3 +2194,142 @@ int WIN32_rename(char *from, char *to)
 #endif
         }
 #endif
+
+int args_verify(char ***pargs, int *pargc,
+                        int *badarg, BIO *err, X509_VERIFY_PARAM **pm)
+        {
+        ASN1_OBJECT *otmp = NULL;
+        unsigned long flags = 0;
+        int i;
+        int purpose = 0;
+        char **oldargs = *pargs;
+        char *arg = **pargs, *argn = (*pargs)[1];
+        if (!strcmp(arg, "-policy"))
+                {
+                if (!argn)
+                        *badarg = 1;
+                else
+                        {
+                        otmp = OBJ_txt2obj(argn, 0);
+                        if (!otmp)
+                                {
+                                BIO_printf(err, "Invalid Policy \"%s\"\n",
+                                                                        argn);
+                                *badarg = 1;
+                                }
+                        }
+                (*pargs)++;
+                }
+        else if (strcmp(arg,"-purpose") == 0)
+                {
+                X509_PURPOSE *xptmp;
+                if (!argn)
+                        *badarg = 1;
+                else
+                        {
+                        i = X509_PURPOSE_get_by_sname(argn);
+                        if(i < 0)
+                                {
+                                BIO_printf(err, "unrecognized purpose\n");
+                                *badarg = 1;
+                                }
+                        else
+                                {
+                                xptmp = X509_PURPOSE_get0(i);
+                                purpose = X509_PURPOSE_get_id(xptmp);
+                                }
+                        }
+                (*pargs)++;
+                }
+        else if (!strcmp(arg, "-ignore_critical"))
+                flags |= X509_V_FLAG_IGNORE_CRITICAL;
+        else if (!strcmp(arg, "-issuer_checks"))
+                flags |= X509_V_FLAG_CB_ISSUER_CHECK;
+        else if (!strcmp(arg, "-crl_check"))
+                flags |=  X509_V_FLAG_CRL_CHECK;
+        else if (!strcmp(arg, "-crl_check_all"))
+                flags |= X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL;
+        else if (!strcmp(arg, "-policy_check"))
+                flags |= X509_V_FLAG_POLICY_CHECK;
+        else if (!strcmp(arg, "-explicit_policy"))
+                flags |= X509_V_FLAG_EXPLICIT_POLICY;
+        else if (!strcmp(arg, "-x509_strict"))
+                flags |= X509_V_FLAG_X509_STRICT;
+        else if (!strcmp(arg, "-policy_print"))
+                flags |= X509_V_FLAG_NOTIFY_POLICY;
+        else
+                return 0;
+
+        if (*badarg)
+                {
+                if (*pm)
+                        X509_VERIFY_PARAM_free(*pm);
+                *pm = NULL;
+                goto end;
+                }
+
+        if (!*pm && !(*pm = X509_VERIFY_PARAM_new()))
+                {
+                *badarg = 1;
+                goto end;
+                }
+
+        if (otmp)
+                X509_VERIFY_PARAM_add0_policy(*pm, otmp);
+        if (flags)
+                X509_VERIFY_PARAM_set_flags(*pm, flags);
+
+        if (purpose)
+                X509_VERIFY_PARAM_set_purpose(*pm, purpose);
+
+        end:
+
+        (*pargs)++;
+
+        if (pargc)
+                *pargc -= *pargs - oldargs;
+
+        return 1;
+
+        }
+
+static void nodes_print(BIO *out, const char *name,
+        STACK_OF(X509_POLICY_NODE) *nodes)
+        {
+        X509_POLICY_NODE *node;
+        int i;
+        BIO_printf(out, "%s Policies:", name);
+        if (nodes)
+                {
+                BIO_puts(out, "\n");
+                for (i = 0; i < sk_X509_POLICY_NODE_num(nodes); i++)
+                        {
+                        node = sk_X509_POLICY_NODE_value(nodes, i);
+                        X509_POLICY_NODE_print(out, node, 2);
+                        }
+                }
+        else
+                BIO_puts(out, " <empty>\n");
+        }
+
+void policies_print(BIO *out, X509_STORE_CTX *ctx)
+        {
+        X509_POLICY_TREE *tree;
+        int explicit_policy;
+        int free_out = 0;
+        if (out == NULL)
+                {
+                out = BIO_new_fp(stderr, BIO_NOCLOSE);
+                free_out = 1;
+                }
+        tree = X509_STORE_CTX_get0_policy_tree(ctx);
+        explicit_policy = X509_STORE_CTX_get_explicit_policy(ctx);
+
+        BIO_printf(out, "Require explicit Policy: %s\n",
+                                explicit_policy ? "True" : "False");
+
+        nodes_print(out, "Authority", X509_policy_tree_get0_policies(tree));
+        nodes_print(out, "User", X509_policy_tree_get0_user_policies(tree));
+        if (free_out)
+                BIO_free(out);
+        }
diff --git a/src/lib/libssl/src/apps/apps.h b/src/lib/libssl/src/apps/apps.h
index 4320410dad..0df170813a 100644
--- a/src/lib/libssl/src/apps/apps.h
+++ b/src/lib/libssl/src/apps/apps.h
@@ -114,9 +114,7 @@
 
 #include "e_os.h"
 
-#include <openssl/buffer.h>
 #include <openssl/bio.h>
-#include <openssl/crypto.h>
 #include <openssl/x509.h>
 #include <openssl/lhash.h>
 #include <openssl/conf.h>
@@ -124,6 +122,9 @@
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
+#ifndef OPENSSL_NO_OCSP
+#include <openssl/ocsp.h>
+#endif
 #include <openssl/ossl_typ.h>
 
 int app_RAND_load_file(const char *file, BIO *bio_e, int dont_warn);
@@ -138,7 +139,7 @@ long app_RAND_load_files(char *file); /* `file' is a list of files to read,
 
 #ifdef OPENSSL_SYS_WIN32
 #define rename(from,to) WIN32_rename((from),(to))
-int WIN32_rename(char *oldname,char *newname);
+int WIN32_rename(const char *oldname,const char *newname);
 #endif
 
 #ifndef MONOLITH
@@ -148,11 +149,9 @@ int WIN32_rename(char *oldname,char *newname);
 #ifndef NON_MAIN
 CONF *config=NULL;
 BIO *bio_err=NULL;
-int in_FIPS_mode=0;
 #else
 extern CONF *config;
 extern BIO *bio_err;
-extern int in_FIPS_mode;
 #endif
 
 #else
@@ -161,11 +160,12 @@ extern int in_FIPS_mode;
 extern CONF *config;
 extern char *default_config_file;
 extern BIO *bio_err;
-extern int in_FIPS_mode;
 
 #endif
 
+#ifndef OPENSSL_SYS_NETWARE
 #include <signal.h>
+#endif
 
 #ifdef SIGPIPE
 #define do_pipe_sig()   signal(SIGPIPE,SIG_IGN)
@@ -231,6 +231,12 @@ extern int in_FIPS_mode;
 #  endif
 #endif
 
+#ifdef OPENSSL_SYSNAME_WIN32
+#  define openssl_fdset(a,b) FD_SET((unsigned int)a, b)
+#else
+#  define openssl_fdset(a,b) FD_SET(a, b)
+#endif
+
 typedef struct args_st
         {
         char **data;
@@ -257,7 +263,7 @@ void program_name(char *in,char *out,int size);
 int chopup_args(ARGS *arg,char *buf, int *argc, char **argv[]);
 #ifdef HEADER_X509_H
 int dump_cert_text(BIO *out, X509 *x);
-void print_name(BIO *out, char *title, X509_NAME *nm, unsigned long lflags);
+void print_name(BIO *out, const char *title, X509_NAME *nm, unsigned long lflags);
 #endif
 int set_cert_ex(unsigned long *flags, const char *arg);
 int set_name_ex(unsigned long *flags, const char *arg);
@@ -278,12 +284,18 @@ X509_STORE *setup_verify(BIO *bp, char *CAfile, char *CApath);
 ENGINE *setup_engine(BIO *err, const char *engine, int debug);
 #endif
 
+#ifndef OPENSSL_NO_OCSP
+OCSP_RESPONSE *process_responder(BIO *err, OCSP_REQUEST *req,
+                        char *host, char *path, char *port, int use_ssl,
+                        int req_timeout);
+#endif
+
 int load_config(BIO *err, CONF *cnf);
 char *make_config_name(void);
 
 /* Functions defined in ca.c and also used in ocsp.c */
 int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
-                        ASN1_GENERALIZEDTIME **pinvtm, char *str);
+                        ASN1_GENERALIZEDTIME **pinvtm, const char *str);
 
 #define DB_type         0
 #define DB_exp_date     1
@@ -313,12 +325,16 @@ int rotate_serial(char *serialfile, char *new_suffix, char *old_suffix);
 int rand_serial(BIGNUM *b, ASN1_INTEGER *ai);
 CA_DB *load_index(char *dbfile, DB_ATTR *dbattr);
 int index_index(CA_DB *db);
-int save_index(char *dbfile, char *suffix, CA_DB *db);
-int rotate_index(char *dbfile, char *new_suffix, char *old_suffix);
+int save_index(const char *dbfile, const char *suffix, CA_DB *db);
+int rotate_index(const char *dbfile, const char *new_suffix, const char *old_suffix);
 void free_index(CA_DB *db);
 int index_name_cmp(const char **a, const char **b);
+int parse_yesno(const char *str, int def);
 
-X509_NAME *do_subject(char *str, long chtype);
+X509_NAME *parse_name(char *str, long chtype, int multirdn);
+int args_verify(char ***pargs, int *pargc,
+                        int *badarg, BIO *err, X509_VERIFY_PARAM **pm);
+void policies_print(BIO *out, X509_STORE_CTX *ctx);
 
 #define FORMAT_UNDEF    0
 #define FORMAT_ASN1     1
diff --git a/src/lib/libssl/src/apps/asn1pars.c b/src/lib/libssl/src/apps/asn1pars.c
index a6b6c41f13..b1a7c8e5db 100644
--- a/src/lib/libssl/src/apps/asn1pars.c
+++ b/src/lib/libssl/src/apps/asn1pars.c
@@ -82,6 +82,8 @@
 
 int MAIN(int, char **);
 
+static int do_generate(BIO *bio, char *genstr, char *genconf, BUF_MEM *buf);
+
 int MAIN(int argc, char **argv)
         {
         int i,badops=0,offset=0,ret=1,j;
@@ -90,7 +92,9 @@ int MAIN(int argc, char **argv)
         BIO *in=NULL,*out=NULL,*b64=NULL, *derout = NULL;
         int informat,indent=0, noout = 0, dump = 0;
         char *infile=NULL,*str=NULL,*prog,*oidfile=NULL, *derfile=NULL;
+        char *genstr=NULL, *genconf=NULL;
         unsigned char *tmpbuf;
+        const unsigned char *ctmpbuf;
         BUF_MEM *buf=NULL;
         STACK *osk=NULL;
         ASN1_TYPE *at=NULL;
@@ -167,6 +171,16 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         sk_push(osk,*(++argv));
                         }
+                else if (strcmp(*argv,"-genstr") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        genstr= *(++argv);
+                        }
+                else if (strcmp(*argv,"-genconf") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        genconf= *(++argv);
+                        }
                 else
                         {
                         BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -195,6 +209,8 @@ bad:
                 BIO_printf(bio_err," -strparse offset\n");
                 BIO_printf(bio_err,"               a series of these can be used to 'dig' into multiple\n");
                 BIO_printf(bio_err,"               ASN1 blob wrappings\n");
+                BIO_printf(bio_err," -genstr str   string to generate ASN1 structure from\n");
+                BIO_printf(bio_err," -genconf file file to generate ASN1 structure from\n");
                 goto end;
                 }
 
@@ -248,25 +264,39 @@ bad:
         if ((buf=BUF_MEM_new()) == NULL) goto end;
         if (!BUF_MEM_grow(buf,BUFSIZ*8)) goto end; /* Pre-allocate :-) */
 
-        if (informat == FORMAT_PEM)
+        if (genstr || genconf)
                 {
-                BIO *tmp;
-
-                if ((b64=BIO_new(BIO_f_base64())) == NULL)
+                num = do_generate(bio_err, genstr, genconf, buf);
+                if (num < 0)
+                        {
+                        ERR_print_errors(bio_err);
                         goto end;
-                BIO_push(b64,in);
-                tmp=in;
-                in=b64;
-                b64=tmp;
+                        }
                 }
 
-        num=0;
-        for (;;)
+        else
                 {
-                if (!BUF_MEM_grow(buf,(int)num+BUFSIZ)) goto end;
-                i=BIO_read(in,&(buf->data[num]),BUFSIZ);
-                if (i <= 0) break;
-                num+=i;
+
+                if (informat == FORMAT_PEM)
+                        {
+                        BIO *tmp;
+
+                        if ((b64=BIO_new(BIO_f_base64())) == NULL)
+                                goto end;
+                        BIO_push(b64,in);
+                        tmp=in;
+                        in=b64;
+                        b64=tmp;
+                        }
+
+                num=0;
+                for (;;)
+                        {
+                        if (!BUF_MEM_grow(buf,(int)num+BUFSIZ)) goto end;
+                        i=BIO_read(in,&(buf->data[num]),BUFSIZ);
+                        if (i <= 0) break;
+                        num+=i;
+                        }
                 }
         str=buf->data;
 
@@ -278,8 +308,8 @@ bad:
                 tmplen=num;
                 for (i=0; i<sk_num(osk); i++)
                         {
-                        int typ;
                         ASN1_TYPE *atmp;
+                        int typ;
                         j=atoi(sk_value(osk,i));
                         if (j == 0)
                                 {
@@ -289,7 +319,8 @@ bad:
                         tmpbuf+=j;
                         tmplen-=j;
                         atmp = at;
-                        at = d2i_ASN1_TYPE(NULL,&tmpbuf,tmplen);
+                        ctmpbuf = tmpbuf;
+                        at = d2i_ASN1_TYPE(NULL,&ctmpbuf,tmplen);
                         ASN1_TYPE_free(atmp);
                         if(!at)
                                 {
@@ -353,3 +384,61 @@ end:
         OPENSSL_EXIT(ret);
         }
 
+static int do_generate(BIO *bio, char *genstr, char *genconf, BUF_MEM *buf)
+        {
+        CONF *cnf = NULL;
+        int len;
+        long errline;
+        unsigned char *p;
+        ASN1_TYPE *atyp = NULL;
+
+        if (genconf)
+                {
+                cnf = NCONF_new(NULL);
+                if (!NCONF_load(cnf, genconf, &errline))
+                        goto conferr;
+                if (!genstr)
+                        genstr = NCONF_get_string(cnf, "default", "asn1");
+                if (!genstr)
+                        {
+                        BIO_printf(bio, "Can't find 'asn1' in '%s'\n", genconf);
+                        goto err;
+                        }
+                }
+
+        atyp = ASN1_generate_nconf(genstr, cnf);
+        NCONF_free(cnf);
+
+        if (!atyp)
+                return -1;
+
+        len = i2d_ASN1_TYPE(atyp, NULL);
+
+        if (len <= 0)
+                goto err;
+
+        if (!BUF_MEM_grow(buf,len))
+                goto err;
+
+        p=(unsigned char *)buf->data;
+
+        i2d_ASN1_TYPE(atyp, &p);
+
+        ASN1_TYPE_free(atyp);
+        return len;
+
+        conferr:
+
+        if (errline > 0)
+                BIO_printf(bio, "Error on line %ld of config file '%s'\n",
+                                                        errline, genconf);
+        else
+                BIO_printf(bio, "Error loading config file '%s'\n", genconf);
+
+        err:
+        NCONF_free(cnf);
+        ASN1_TYPE_free(atyp);
+
+        return -1;
+
+        }
diff --git a/src/lib/libssl/src/apps/ca.c b/src/lib/libssl/src/apps/ca.c
index c6cd4c9aa9..d74a8bcfcf 100644
--- a/src/lib/libssl/src/apps/ca.c
+++ b/src/lib/libssl/src/apps/ca.c
@@ -83,7 +83,7 @@
 #    else
 #      include <unixlib.h>
 #    endif
-#  elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS)
+#  elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_NETWARE)
 #    include <sys/file.h>
 #  endif
 #endif
@@ -105,6 +105,9 @@
 
 #define ENV_DEFAULT_CA          "default_ca"
 
+#define STRING_MASK     "string_mask"
+#define UTF8_IN                 "utf8"
+
 #define ENV_DIR                 "dir"
 #define ENV_CERTS               "certs"
 #define ENV_CRL_DIR             "crl_dir"
@@ -131,6 +134,7 @@
 #define ENV_NAMEOPT             "name_opt"
 #define ENV_CERTOPT             "cert_opt"
 #define ENV_EXTCOPY             "copy_extensions"
+#define ENV_UNIQUE_SUBJECT      "unique_subject"
 
 #define ENV_DATABASE            "database"
 
@@ -142,7 +146,7 @@
 #define REV_KEY_COMPROMISE      3       /* Value is cert key compromise time */
 #define REV_CA_COMPROMISE       4       /* Value is CA key compromise time */
 
-static char *ca_usage[]={
+static const char *ca_usage[]={
 "usage: ca args\n",
 "\n",
 " -verbose        - Talk alot while doing things\n",
@@ -160,6 +164,7 @@ static char *ca_usage[]={
 " -keyform arg    - private key file format (PEM or ENGINE)\n",
 " -key arg        - key to decode the private key if it is encrypted\n",
 " -cert file      - The CA certificate\n",
+" -selfsign       - sign a certificate with the key associated with it\n",
 " -in file        - The input PEM encoded certificate request(s)\n",
 " -out file       - Where to put the output file(s)\n",
 " -outdir dir     - Where to put output certificates\n",
@@ -172,6 +177,8 @@ static char *ca_usage[]={
 " -msie_hack      - msie modifications to handle all those universal strings\n",
 " -revoke file    - Revoke a certificate (given in file)\n",
 " -subj arg       - Use arg instead of request's subject\n",
+" -utf8           - input characters are UTF8 (default ASCII)\n",
+" -multivalue-rdn - enable support for multivalued RDNs\n",
 " -extensions ..  - Extension section (override value in config file)\n",
 " -extfile file   - Configuration file with X509v3 extentions to add\n",
 " -crlexts ..     - CRL extension section (override value in config file)\n",
@@ -189,40 +196,40 @@ extern int EF_PROTECT_BELOW;
 extern int EF_ALIGNMENT;
 #endif
 
-static void lookup_fail(char *name,char *tag);
+static void lookup_fail(const char *name, const char *tag);
 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
                    const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,CA_DB *db,
-                   BIGNUM *serial, char *subj, int email_dn, char *startdate,
+                   BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate,
                    char *enddate, long days, int batch, char *ext_sect, CONF *conf,
                    int verbose, unsigned long certopt, unsigned long nameopt,
-                   int default_op, int ext_copy);
+                   int default_op, int ext_copy, int selfsign);
 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
                         const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
-                        CA_DB *db, BIGNUM *serial, char *subj, int email_dn,
+                        CA_DB *db, BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn,
                         char *startdate, char *enddate, long days, int batch,
                         char *ext_sect, CONF *conf,int verbose, unsigned long certopt,
                         unsigned long nameopt, int default_op, int ext_copy,
                         ENGINE *e);
 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
                          const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
-                         CA_DB *db, BIGNUM *serial,char *subj, int email_dn,
+                         CA_DB *db, BIGNUM *serial,char *subj,unsigned long chtype, int multirdn, int email_dn,
                          char *startdate, char *enddate, long days, char *ext_sect,
                          CONF *conf, int verbose, unsigned long certopt, 
                          unsigned long nameopt, int default_op, int ext_copy);
 static int fix_data(int nid, int *type);
 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
-        STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,char *subj,
+        STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,char *subj,unsigned long chtype, int multirdn,
         int email_dn, char *startdate, char *enddate, long days, int batch,
         int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
         unsigned long certopt, unsigned long nameopt, int default_op,
-        int ext_copy);
+        int ext_copy, int selfsign);
 static int do_revoke(X509 *x509, CA_DB *db, int ext, char *extval);
 static int get_certificate_status(const char *ser_status, CA_DB *db);
 static int do_updatedb(CA_DB *db);
 static int check_time_format(char *str);
 char *make_revocation_str(int rev_type, char *rev_arg);
-int make_revoked(X509_REVOKED *rev, char *str);
+int make_revoked(X509_REVOKED *rev, const char *str);
 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
 static CONF *conf=NULL;
 static CONF *extconf=NULL;
@@ -272,6 +279,8 @@ int MAIN(int argc, char **argv)
         char *extensions=NULL;
         char *extfile=NULL;
         char *subj=NULL;
+        unsigned long chtype = MBSTRING_ASC;
+        int multirdn = 0;
         char *tmp_email_dn=NULL;
         char *crl_ext=NULL;
         int rev_type = REV_NONE;
@@ -286,7 +295,8 @@ int MAIN(int argc, char **argv)
         unsigned long nameopt = 0, certopt = 0;
         int default_op = 1;
         int ext_copy = EXT_COPY_NONE;
-        X509 *x509=NULL;
+        int selfsign = 0;
+        X509 *x509=NULL, *x509p = NULL;
         X509 *x=NULL;
         BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
         char *dbfile=NULL;
@@ -295,7 +305,8 @@ int MAIN(int argc, char **argv)
         X509_REVOKED *r=NULL;
         ASN1_TIME *tmptm;
         ASN1_INTEGER *tmpser;
-        char **pp,*p,*f;
+        char *f;
+        const char *p, **pp;
         int i,j;
         const EVP_MD *dgst=NULL;
         STACK_OF(CONF_VALUE) *attribs=NULL;
@@ -350,6 +361,12 @@ EF_ALIGNMENT=0;
                         subj= *(++argv);
                         /* preserve=1; */
                         }
+                else if (strcmp(*argv,"-utf8") == 0)
+                        chtype = MBSTRING_UTF8;
+                else if (strcmp(*argv,"-create_serial") == 0)
+                        create_ser = 1;
+                else if (strcmp(*argv,"-multivalue-rdn") == 0)
+                        multirdn=1;
                 else if (strcmp(*argv,"-startdate") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -400,6 +417,8 @@ EF_ALIGNMENT=0;
                         if (--argc < 1) goto bad;
                         certfile= *(++argv);
                         }
+                else if (strcmp(*argv,"-selfsign") == 0)
+                        selfsign=1;
                 else if (strcmp(*argv,"-in") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -633,29 +652,31 @@ bad:
                 ERR_clear_error();
         app_RAND_load_file(randfile, bio_err, 0);
 
+        f = NCONF_get_string(conf, section, STRING_MASK);
+        if (!f)
+                ERR_clear_error();
+
+        if(f && !ASN1_STRING_set_default_mask_asc(f)) {
+                BIO_printf(bio_err, "Invalid global string mask setting %s\n", f);
+                goto err;
+        }
+
+        if (chtype != MBSTRING_UTF8){
+                f = NCONF_get_string(conf, section, UTF8_IN);
+                if (!f)
+                        ERR_clear_error();
+                else if (!strcmp(f, "yes"))
+                        chtype = MBSTRING_UTF8;
+        }
+
         db_attr.unique_subject = 1;
-        p = NCONF_get_string(conf, section, "unique_subject");
+        p = NCONF_get_string(conf, section, ENV_UNIQUE_SUBJECT);
         if (p)
                 {
 #ifdef RL_DEBUG
                 BIO_printf(bio_err, "DEBUG: unique_subject = \"%s\"\n", p);
 #endif
-                switch(*p)
-                        {
-                case 'f': /* false */
-                case 'F': /* FALSE */
-                case 'n': /* no */
-                case 'N': /* NO */
-                        db_attr.unique_subject = 0;
-                        break;
-                case 't': /* true */
-                case 'T': /* TRUE */
-                case 'y': /* yes */
-                case 'Y': /* YES */
-                default:
-                        db_attr.unique_subject = 1;
-                        break;
-                        }
+                db_attr.unique_subject = parse_yesno(p,1);
                 }
         else
                 ERR_clear_error();
@@ -699,7 +720,7 @@ bad:
         }
 
         /*****************************************************************/
-        /* we definitely need a public key, so let's get it */
+        /* we definitely need a private key, so let's get it */
 
         if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
                 section,ENV_PRIVATE_KEY)) == NULL))
@@ -727,22 +748,27 @@ bad:
 
         /*****************************************************************/
         /* we need a certificate */
-        if ((certfile == NULL) && ((certfile=NCONF_get_string(conf,
-                section,ENV_CERTIFICATE)) == NULL))
+        if (!selfsign || spkac_file || ss_cert_file || gencrl)
                 {
-                lookup_fail(section,ENV_CERTIFICATE);
-                goto err;
-                }
-        x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
-                "CA certificate");
-        if (x509 == NULL)
-                goto err;
+                if ((certfile == NULL)
+                        && ((certfile=NCONF_get_string(conf,
+                                     section,ENV_CERTIFICATE)) == NULL))
+                        {
+                        lookup_fail(section,ENV_CERTIFICATE);
+                        goto err;
+                        }
+                x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
+                        "CA certificate");
+                if (x509 == NULL)
+                        goto err;
 
-        if (!X509_check_private_key(x509,pkey))
-                {
-                BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
-                goto err;
+                if (!X509_check_private_key(x509,pkey))
+                        {
+                        BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
+                        goto err;
+                        }
                 }
+        if (!selfsign) x509p = x509;
 
         f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
         if (f == NULL)
@@ -856,7 +882,7 @@ bad:
         /* Lets check some fields */
         for (i=0; i<sk_num(db->db->data); i++)
                 {
-                pp=(char **)sk_value(db->db->data,i);
+                pp=(const char **)sk_value(db->db->data,i);
                 if ((pp[DB_type][0] != DB_TYPE_REV) &&
                         (pp[DB_rev_date][0] != '\0'))
                         {
@@ -869,7 +895,7 @@ bad:
                         BIO_printf(bio_err," in entry %d\n", i+1);
                         goto err;
                         }
-                if (!check_time_format(pp[DB_exp_date]))
+                if (!check_time_format((char *)pp[DB_exp_date]))
                         {
                         BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
                         goto err;
@@ -1132,7 +1158,7 @@ bad:
                         {
                         total++;
                         j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
-                                serial,subj,email_dn,startdate,enddate,days,extensions,
+                                serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,extensions,
                                 conf,verbose,certopt,nameopt,default_op,ext_copy);
                         if (j < 0) goto err;
                         if (j > 0)
@@ -1156,7 +1182,7 @@ bad:
                         {
                         total++;
                         j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
-                                db,serial,subj,email_dn,startdate,enddate,days,batch,
+                                db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
                                 extensions,conf,verbose, certopt, nameopt,
                                 default_op, ext_copy, e);
                         if (j < 0) goto err;
@@ -1175,10 +1201,10 @@ bad:
                 if (infile != NULL)
                         {
                         total++;
-                        j=certify(&x,infile,pkey,x509,dgst,attribs,db,
-                                serial,subj,email_dn,startdate,enddate,days,batch,
+                        j=certify(&x,infile,pkey,x509p,dgst,attribs,db,
+                                serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
                                 extensions,conf,verbose, certopt, nameopt,
-                                default_op, ext_copy);
+                                default_op, ext_copy, selfsign);
                         if (j < 0) goto err;
                         if (j > 0)
                                 {
@@ -1195,10 +1221,10 @@ bad:
                 for (i=0; i<argc; i++)
                         {
                         total++;
-                        j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
-                                serial,subj,email_dn,startdate,enddate,days,batch,
+                        j=certify(&x,argv[i],pkey,x509p,dgst,attribs,db,
+                                serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
                                 extensions,conf,verbose, certopt, nameopt,
-                                default_op, ext_copy);
+                                default_op, ext_copy, selfsign);
                         if (j < 0) goto err;
                         if (j > 0)
                                 {
@@ -1249,7 +1275,7 @@ bad:
                         x=sk_X509_value(cert_sk,i);
 
                         j=x->cert_info->serialNumber->length;
-                        p=(char *)x->cert_info->serialNumber->data;
+                        p=(const char *)x->cert_info->serialNumber->data;
                         
                         if(strlen(outdir) >= (size_t)(j ? BSIZE-j*2-6 : BSIZE-8))
                                 {
@@ -1370,7 +1396,7 @@ bad:
 
                 for (i=0; i<sk_num(db->db->data); i++)
                         {
-                        pp=(char **)sk_value(db->db->data,i);
+                        pp=(const char **)sk_value(db->db->data,i);
                         if (pp[DB_type][0] == DB_TYPE_REV)
                                 {
                                 if ((r=X509_REVOKED_new()) == NULL) goto err;
@@ -1399,6 +1425,11 @@ bad:
 #ifndef OPENSSL_NO_DSA
                 if (pkey->type == EVP_PKEY_DSA) 
                         dgst=EVP_dss1();
+                else
+#endif
+#ifndef OPENSSL_NO_ECDSA
+                if (pkey->type == EVP_PKEY_EC)
+                        dgst=EVP_ecdsa();
 #endif
 
                 /* Add any extensions asked for */
@@ -1486,25 +1517,26 @@ err:
         BN_free(serial);
         free_index(db);
         EVP_PKEY_free(pkey);
-        X509_free(x509);
+        if (x509) X509_free(x509);
         X509_CRL_free(crl);
         NCONF_free(conf);
+        NCONF_free(extconf);
         OBJ_cleanup();
         apps_shutdown();
         OPENSSL_EXIT(ret);
         }
 
-static void lookup_fail(char *name, char *tag)
+static void lookup_fail(const char *name, const char *tag)
         {
         BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
         }
 
 static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
-             BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
+             BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
              unsigned long certopt, unsigned long nameopt, int default_op,
-             int ext_copy)
+             int ext_copy, int selfsign)
         {
         X509_REQ *req=NULL;
         BIO *in=NULL;
@@ -1529,6 +1561,12 @@ static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
 
         BIO_printf(bio_err,"Check that the request matches the signature\n");
 
+        if (selfsign && !X509_REQ_check_private_key(req,pkey))
+                {
+                BIO_printf(bio_err,"Certificate request and CA private key do not match\n");
+                ok=0;
+                goto err;
+                }
         if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
                 {
                 BIO_printf(bio_err,"error unpacking public key\n");
@@ -1551,9 +1589,9 @@ static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
         else
                 BIO_printf(bio_err,"Signature ok\n");
 
-        ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj, email_dn,
+        ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn, email_dn,
                 startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
-                certopt, nameopt, default_op, ext_copy);
+                certopt, nameopt, default_op, ext_copy, selfsign);
 
 err:
         if (req != NULL) X509_REQ_free(req);
@@ -1563,7 +1601,7 @@ err:
 
 static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
-             BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
+             BIGNUM *serial, char *subj, unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
              unsigned long certopt, unsigned long nameopt, int default_op,
              int ext_copy, ENGINE *e)
@@ -1605,9 +1643,9 @@ static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
         if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
                 goto err;
 
-        ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
+        ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
                 days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
-                ext_copy);
+                ext_copy, 0);
 
 err:
         if (rreq != NULL) X509_REQ_free(rreq);
@@ -1617,10 +1655,11 @@ err:
 
 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
              STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
+             unsigned long chtype, int multirdn,
              int email_dn, char *startdate, char *enddate, long days, int batch,
              int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
              unsigned long certopt, unsigned long nameopt, int default_op,
-             int ext_copy)
+             int ext_copy, int selfsign)
         {
         X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
         ASN1_UTCTIME *tm,*tmptm;
@@ -1632,7 +1671,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
         X509_NAME_ENTRY *tne,*push;
         EVP_PKEY *pktmp;
         int ok= -1,i,j,last,nid;
-        char *p;
+        const char *p;
         CONF_VALUE *cv;
         char *row[DB_NUMBER],**rrow=NULL,**irow=NULL;
         char buf[25];
@@ -1649,7 +1688,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
 
         if (subj)
                 {
-                X509_NAME *n = do_subject(subj, MBSTRING_ASC);
+                X509_NAME *n = parse_name(subj, chtype, multirdn);
 
                 if (!n)
                         {
@@ -1724,7 +1763,10 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
                 }
 
         /* take a copy of the issuer name before we mess with it. */
-        CAname=X509_NAME_dup(x509->cert_info->subject);
+        if (selfsign)
+                CAname=X509_NAME_dup(name);
+        else
+                CAname=X509_NAME_dup(x509->cert_info->subject);
         if (CAname == NULL) goto err;
         str=str2=NULL;
 
@@ -1936,8 +1978,16 @@ again2:
 
         if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
                 goto err;
-        if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
-                goto err;
+        if (selfsign)
+                {
+                if (!X509_set_issuer_name(ret,subject))
+                        goto err;
+                }
+        else
+                {
+                if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
+                        goto err;
+                }
 
         if (strcmp(startdate,"today") == 0)
                 X509_gmtime_adj(X509_get_notBefore(ret),0);
@@ -1972,7 +2022,10 @@ again2:
                 ci->extensions = NULL;
 
                 /* Initialize the context structure */
-                X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
+                if (selfsign)
+                        X509V3_set_ctx(&ctx, ret, ret, req, NULL, 0);
+                else
+                        X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
 
                 if (extconf)
                         {
@@ -2039,7 +2092,7 @@ again2:
 
         BIO_printf(bio_err,"Certificate is to be certified until ");
         ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
-        if (days) BIO_printf(bio_err," (%d days)",days);
+        if (days) BIO_printf(bio_err," (%ld days)",days);
         BIO_printf(bio_err, "\n");
 
         if (!batch)
@@ -2066,6 +2119,16 @@ again2:
                 EVP_PKEY_copy_parameters(pktmp,pkey);
         EVP_PKEY_free(pktmp);
 #endif
+#ifndef OPENSSL_NO_ECDSA
+        if (pkey->type == EVP_PKEY_EC)
+                dgst = EVP_ecdsa();
+        pktmp = X509_get_pubkey(ret);
+        if (EVP_PKEY_missing_parameters(pktmp) &&
+                !EVP_PKEY_missing_parameters(pkey))
+                EVP_PKEY_copy_parameters(pktmp, pkey);
+        EVP_PKEY_free(pktmp);
+#endif
+
 
         if (!X509_sign(ret,pkey,dgst))
                 goto err;
@@ -2162,7 +2225,7 @@ static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
 
 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
-             BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
+             BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
              long days, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
              unsigned long nameopt, int default_op, int ext_copy)
         {
@@ -2303,9 +2366,9 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
 
         X509_REQ_set_pubkey(req,pktmp);
         EVP_PKEY_free(pktmp);
-        ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
+        ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
                    days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
-                        ext_copy);
+                        ext_copy, 0);
 err:
         if (req != NULL) X509_REQ_free(req);
         if (parms != NULL) CONF_free(parms);
@@ -2616,7 +2679,7 @@ err:
         return (cnt);
         }
 
-static char *crl_reasons[] = {
+static const char *crl_reasons[] = {
         /* CRL reason strings */
         "unspecified",
         "keyCompromise",
@@ -2644,7 +2707,8 @@ static char *crl_reasons[] = {
 
 char *make_revocation_str(int rev_type, char *rev_arg)
         {
-        char *reason = NULL, *other = NULL, *str;
+        char *other = NULL, *str;
+        const char *reason = NULL;
         ASN1_OBJECT *otmp;
         ASN1_UTCTIME *revtm = NULL;
         int i;
@@ -2738,7 +2802,7 @@ char *make_revocation_str(int rev_type, char *rev_arg)
  */
 
 
-int make_revoked(X509_REVOKED *rev, char *str)
+int make_revoked(X509_REVOKED *rev, const char *str)
         {
         char *tmp = NULL;
         int reason_code = -1;
@@ -2792,129 +2856,6 @@ int make_revoked(X509_REVOKED *rev, char *str)
         return ret;
         }
 
-/*
- * subject is expected to be in the format /type0=value0/type1=value1/type2=...
- * where characters may be escaped by \
- */
-X509_NAME *do_subject(char *subject, long chtype)
-        {
-        size_t buflen = strlen(subject)+1; /* to copy the types and values into. due to escaping, the copy can only become shorter */
-        char *buf = OPENSSL_malloc(buflen);
-        size_t max_ne = buflen / 2 + 1; /* maximum number of name elements */
-        char **ne_types = OPENSSL_malloc(max_ne * sizeof (char *));
-        char **ne_values = OPENSSL_malloc(max_ne * sizeof (char *));
-
-        char *sp = subject, *bp = buf;
-        int i, ne_num = 0;
-
-        X509_NAME *n = NULL;
-        int nid;
-
-        if (!buf || !ne_types || !ne_values)
-        {
-                BIO_printf(bio_err, "malloc error\n");
-                goto error;
-        }
-
-        if (*subject != '/')
-        {
-                BIO_printf(bio_err, "Subject does not start with '/'.\n");
-                goto error;
-        }
-        sp++; /* skip leading / */
-
-        while (*sp)
-                {
-                /* collect type */
-                ne_types[ne_num] = bp;
-                while (*sp)
-                        {
-                        if (*sp == '\\') /* is there anything to escape in the type...? */
-                                {
-                                if (*++sp)
-                                        *bp++ = *sp++;
-                                else
-                                        {
-                                        BIO_printf(bio_err, "escape character at end of string\n");
-                                        goto error;
-                                        }
-                                }
-                        else if (*sp == '=')
-                                {
-                                sp++;
-                                *bp++ = '\0';
-                                break;
-                                }
-                        else
-                                *bp++ = *sp++;
-                        }
-                if (!*sp)
-                        {
-                        BIO_printf(bio_err, "end of string encountered while processing type of subject name element #%d\n", ne_num);
-                        goto error;
-                        }
-                ne_values[ne_num] = bp;
-                while (*sp)
-                        {
-                        if (*sp == '\\')
-                                {
-                                if (*++sp)
-                                        *bp++ = *sp++;
-                                else
-                                        {
-                                        BIO_printf(bio_err, "escape character at end of string\n");
-                                        goto error;
-                                        }
-                                }
-                        else if (*sp == '/')
-                                {
-                                sp++;
-                                break;
-                                }
-                        else
-                                *bp++ = *sp++;
-                        }
-                *bp++ = '\0';
-                ne_num++;
-                }
-
-        if (!(n = X509_NAME_new()))
-                goto error;
-
-        for (i = 0; i < ne_num; i++)
-                {
-                if ((nid=OBJ_txt2nid(ne_types[i])) == NID_undef)
-                        {
-                        BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_types[i]);
-                        continue;
-                        }
-
-                if (!*ne_values[i])
-                        {
-                        BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_types[i]);
-                        continue;
-                        }
-
-                if (!X509_NAME_add_entry_by_NID(n, nid, chtype, (unsigned char*)ne_values[i], -1,-1,0))
-                        goto error;
-                }
-
-        OPENSSL_free(ne_values);
-        OPENSSL_free(ne_types);
-        OPENSSL_free(buf);
-        return n;
-
-error:
-        X509_NAME_free(n);
-        if (ne_values)
-                OPENSSL_free(ne_values);
-        if (ne_types)
-                OPENSSL_free(ne_types);
-        if (buf)
-                OPENSSL_free(buf);
-        return NULL;
-}
-
 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
         {
         char buf[25],*pbuf, *p;
@@ -2941,25 +2882,35 @@ int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
         p=(char *)str->data;
         for (j=str->length; j>0; j--)
                 {
+#ifdef CHARSET_EBCDIC
+                if ((*p >= 0x20) && (*p <= 0x7e))
+                        BIO_printf(bp,"%c",os_toebcdic[*p]);
+#else
                 if ((*p >= ' ') && (*p <= '~'))
                         BIO_printf(bp,"%c",*p);
+#endif
                 else if (*p & 0x80)
                         BIO_printf(bp,"\\0x%02X",*p);
                 else if ((unsigned char)*p == 0xf7)
                         BIO_printf(bp,"^?");
+#ifdef CHARSET_EBCDIC
+                else    BIO_printf(bp,"^%c",os_toebcdic[*p+0x40]);
+#else
                 else    BIO_printf(bp,"^%c",*p+'@');
+#endif
                 p++;
                 }
         BIO_printf(bp,"'\n");
         return 1;
         }
 
-int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, char *str)
+int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)
         {
         char *tmp = NULL;
         char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
         int reason_code = -1;
-        int i, ret = 0;
+        int ret = 0;
+        unsigned int i;
         ASN1_OBJECT *hold = NULL;
         ASN1_GENERALIZEDTIME *comp_time = NULL;
         tmp = BUF_strdup(str);
diff --git a/src/lib/libssl/src/apps/ciphers.c b/src/lib/libssl/src/apps/ciphers.c
index 7c62fc5dc3..43f0ac594a 100644
--- a/src/lib/libssl/src/apps/ciphers.c
+++ b/src/lib/libssl/src/apps/ciphers.c
@@ -69,7 +69,7 @@
 #undef PROG
 #define PROG    ciphers_main
 
-static char *ciphers_usage[]={
+static const char *ciphers_usage[]={
 "usage: ciphers args\n",
 " -v          - verbose mode, a textual listing of the ciphers in SSLeay\n",
 " -ssl2       - SSL2 mode\n",
@@ -84,7 +84,7 @@ int MAIN(int argc, char **argv)
         {
         int ret=1,i;
         int verbose=0;
-        char **pp;
+        const char **pp;
         const char *p;
         int badops=0;
         SSL_CTX *ctx=NULL;
diff --git a/src/lib/libssl/src/apps/crl.c b/src/lib/libssl/src/apps/crl.c
index 878f65468e..a0040fba11 100644
--- a/src/lib/libssl/src/apps/crl.c
+++ b/src/lib/libssl/src/apps/crl.c
@@ -72,7 +72,7 @@
 #undef POSTFIX
 #define POSTFIX ".rvk"
 
-static char *crl_usage[]={
+static const char *crl_usage[]={
 "usage: crl args\n",
 "\n",
 " -inform arg     - input format - default PEM (DER or PEM)\n",
@@ -108,14 +108,14 @@ int MAIN(int argc, char **argv)
         char *infile=NULL,*outfile=NULL;
         int hash=0,issuer=0,lastupdate=0,nextupdate=0,noout=0,text=0;
         int fingerprint = 0;
-        char **pp;
+        const char **pp;
         X509_STORE *store = NULL;
         X509_STORE_CTX ctx;
         X509_LOOKUP *lookup = NULL;
         X509_OBJECT xobj;
         EVP_PKEY *pkey;
         int do_ver = 0;
-        const EVP_MD *md_alg,*digest=EVP_md5();
+        const EVP_MD *md_alg,*digest=EVP_sha1();
 
         apps_startup();
 
diff --git a/src/lib/libssl/src/apps/dgst.c b/src/lib/libssl/src/apps/dgst.c
index 17fb87b77c..c5ecf93d1b 100644
--- a/src/lib/libssl/src/apps/dgst.c
+++ b/src/lib/libssl/src/apps/dgst.c
@@ -74,11 +74,9 @@
 #undef PROG
 #define PROG    dgst_main
 
-static HMAC_CTX hmac_ctx;
-
 int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
           EVP_PKEY *key, unsigned char *sigin, int siglen, const char *title,
-          const char *file,BIO *bmd,const char *hmac_key, int non_fips_allow);
+          const char *file,BIO *bmd,const char *hmac_key);
 
 int MAIN(int, char **);
 
@@ -108,7 +106,6 @@ int MAIN(int argc, char **argv)
         char *engine=NULL;
 #endif
         char *hmac_key=NULL;
-        int non_fips_allow = 0;
 
         apps_startup();
 
@@ -193,8 +190,8 @@ int MAIN(int argc, char **argv)
                         out_bin = 1;
                 else if (strcmp(*argv,"-d") == 0)
                         debug=1;
-                else if (strcmp(*argv,"-non-fips-allow") == 0)
-                        non_fips_allow=1;
+                else if (!strcmp(*argv,"-fips-fingerprint"))
+                        hmac_key = "etaonrishdlcupfm";
                 else if (!strcmp(*argv,"-hmac"))
                         {
                         if (--argc < 1)
@@ -232,30 +229,45 @@ int MAIN(int argc, char **argv)
                 BIO_printf(bio_err,"-keyform arg    key file format (PEM or ENGINE)\n");
                 BIO_printf(bio_err,"-signature file signature to verify\n");
                 BIO_printf(bio_err,"-binary         output in binary form\n");
+                BIO_printf(bio_err,"-hmac key       create hashed MAC with key\n");
 #ifndef OPENSSL_NO_ENGINE
                 BIO_printf(bio_err,"-engine e       use engine e, possibly a hardware device.\n");
 #endif
 
-                BIO_printf(bio_err,"-%3s to use the %s message digest algorithm (default)\n",
+                BIO_printf(bio_err,"-%-14s to use the %s message digest algorithm (default)\n",
                         LN_md5,LN_md5);
-                BIO_printf(bio_err,"-%3s to use the %s message digest algorithm\n",
+                BIO_printf(bio_err,"-%-14s to use the %s message digest algorithm\n",
                         LN_md4,LN_md4);
-                BIO_printf(bio_err,"-%3s to use the %s message digest algorithm\n",
+                BIO_printf(bio_err,"-%-14s to use the %s message digest algorithm\n",
                         LN_md2,LN_md2);
-                BIO_printf(bio_err,"-%3s to use the %s message digest algorithm\n",
+#ifndef OPENSSL_NO_SHA
+                BIO_printf(bio_err,"-%-14s to use the %s message digest algorithm\n",
                         LN_sha1,LN_sha1);
-                BIO_printf(bio_err,"-%3s to use the %s message digest algorithm\n",
+                BIO_printf(bio_err,"-%-14s to use the %s message digest algorithm\n",
                         LN_sha,LN_sha);
-                BIO_printf(bio_err,"-%3s to use the %s message digest algorithm\n",
+#ifndef OPENSSL_NO_SHA256
+                BIO_printf(bio_err,"-%-14s to use the %s message digest algorithm\n",
+                        LN_sha224,LN_sha224);
+                BIO_printf(bio_err,"-%-14s to use the %s message digest algorithm\n",
+                        LN_sha256,LN_sha256);
+#endif
+#ifndef OPENSSL_NO_SHA512
+                BIO_printf(bio_err,"-%-14s to use the %s message digest algorithm\n",
+                        LN_sha384,LN_sha384);
+                BIO_printf(bio_err,"-%-14s to use the %s message digest algorithm\n",
+                        LN_sha512,LN_sha512);
+#endif
+#endif
+                BIO_printf(bio_err,"-%-14s to use the %s message digest algorithm\n",
                         LN_mdc2,LN_mdc2);
-                BIO_printf(bio_err,"-%3s to use the %s message digest algorithm\n",
+                BIO_printf(bio_err,"-%-14s to use the %s message digest algorithm\n",
                         LN_ripemd160,LN_ripemd160);
                 err=1;
                 goto end;
                 }
 
 #ifndef OPENSSL_NO_ENGINE
-        e = setup_engine(bio_err, engine, 0);
+        e = setup_engine(bio_err, engine, 0);
 #endif
 
         in=BIO_new(BIO_s_file());
@@ -264,7 +276,7 @@ int MAIN(int argc, char **argv)
                 {
                 BIO_set_callback(in,BIO_debug_callback);
                 /* needed for windows 3.1 */
-                BIO_set_callback_arg(in,bio_err);
+                BIO_set_callback_arg(in,(char *)bio_err);
                 }
 
         if(!app_passwd(bio_err, passargin, NULL, &passin, NULL))
@@ -344,19 +356,13 @@ int MAIN(int argc, char **argv)
                         goto end;
                 }
         }
+                
 
-        if (non_fips_allow)
-                {
-                EVP_MD_CTX *md_ctx;
-                BIO_get_md_ctx(bmd,&md_ctx);
-                EVP_MD_CTX_set_flags(md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-                }
 
         /* we use md as a filter, reading from 'in' */
         if (!BIO_set_md(bmd,md))
                 {
-                BIO_printf(bio_err, "Error setting digest %s\n",
-                                                        EVP_MD_name(md));
+                BIO_printf(bio_err, "Error setting digest %s\n", pname);
                 ERR_print_errors(bio_err);
                 goto end;
                 }
@@ -367,7 +373,7 @@ int MAIN(int argc, char **argv)
                 {
                 BIO_set_fp(in,stdin,BIO_NOCLOSE);
                 err=do_fp(out, buf,inp,separator, out_bin, sigkey, sigbuf,
-                          siglen,"","(stdin)",bmd,hmac_key, non_fips_allow);
+                          siglen,"","(stdin)",bmd,hmac_key);
                 }
         else
                 {
@@ -393,7 +399,7 @@ int MAIN(int argc, char **argv)
                         else
                                 tmp="";
                         r=do_fp(out,buf,inp,separator,out_bin,sigkey,sigbuf,
-                                siglen,tmp,argv[i],bmd,hmac_key,non_fips_allow);
+                                siglen,tmp,argv[i],bmd,hmac_key);
                         if(r)
                             err=r;
                         if(tofree)
@@ -420,11 +426,12 @@ end:
 
 int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
           EVP_PKEY *key, unsigned char *sigin, int siglen, const char *title,
-          const char *file,BIO *bmd,const char *hmac_key, int non_fips_allow)
+          const char *file,BIO *bmd,const char *hmac_key)
         {
         unsigned int len;
         int i;
         EVP_MD_CTX *md_ctx;
+        HMAC_CTX hmac_ctx;
 
         if (hmac_key)
                 {
@@ -432,9 +439,6 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
 
                 BIO_get_md(bmd,&md);
                 HMAC_CTX_init(&hmac_ctx);
-                if (non_fips_allow)
-                        HMAC_CTX_set_flags(&hmac_ctx,
-                                        EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
                 HMAC_Init_ex(&hmac_ctx,hmac_key,strlen(hmac_key),md, NULL);
                 BIO_get_md_ctx(bmd,&md_ctx);
                 BIO_set_md_ctx(bmd,&hmac_ctx.md_ctx);
@@ -493,7 +497,7 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
         else 
                 {
                 BIO_write(out,title,strlen(title));
-                for (i=0; (unsigned int)i<len; i++)
+                for (i=0; i<(int)len; i++)
                         {
                         if (sep && (i != 0))
                                 BIO_printf(out, ":");
diff --git a/src/lib/libssl/src/apps/dh.c b/src/lib/libssl/src/apps/dh.c
index cd01fed139..c4d891e125 100644
--- a/src/lib/libssl/src/apps/dh.c
+++ b/src/lib/libssl/src/apps/dh.c
@@ -57,6 +57,7 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/opensslconf.h>        /* for OPENSSL_NO_DH */
 #ifndef OPENSSL_NO_DH
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/src/lib/libssl/src/apps/dhparam.c b/src/lib/libssl/src/apps/dhparam.c
index 8fe3f18d7c..5725a20d07 100644
--- a/src/lib/libssl/src/apps/dhparam.c
+++ b/src/lib/libssl/src/apps/dhparam.c
@@ -109,6 +109,7 @@
  *
  */
 
+#include <openssl/opensslconf.h>        /* for OPENSSL_NO_DH */
 #ifndef OPENSSL_NO_DH
 #include <stdio.h>
 #include <stdlib.h>
@@ -142,7 +143,7 @@
  * -C
  */
 
-static void MS_CALLBACK dh_cb(int p, int n, void *arg);
+static int MS_CALLBACK dh_cb(int p, int n, BN_GENCB *cb);
 
 int MAIN(int, char **);
 
@@ -294,6 +295,8 @@ bad:
 
         if(num) {
 
+                BN_GENCB cb;
+                BN_GENCB_set(&cb, dh_cb, bio_err);
                 if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL)
                         {
                         BIO_printf(bio_err,"warning, not much extra random data, consider using the -rand option\n");
@@ -305,12 +308,13 @@ bad:
 #ifndef OPENSSL_NO_DSA
                 if (dsaparam)
                         {
-                        DSA *dsa;
+                        DSA *dsa = DSA_new();
                         
                         BIO_printf(bio_err,"Generating DSA parameters, %d bit long prime\n",num);
-                        dsa = DSA_generate_parameters(num, NULL, 0, NULL, NULL, dh_cb, bio_err);
-                        if (dsa == NULL)
+                        if(!dsa || !DSA_generate_parameters_ex(dsa, num,
+                                                NULL, 0, NULL, NULL, &cb))
                                 {
+                                if(dsa) DSA_free(dsa);
                                 ERR_print_errors(bio_err);
                                 goto end;
                                 }
@@ -326,12 +330,12 @@ bad:
                 else
 #endif
                         {
+                        dh = DH_new();
                         BIO_printf(bio_err,"Generating DH parameters, %d bit long safe prime, generator %d\n",num,g);
                         BIO_printf(bio_err,"This is going to take a long time\n");
-                        dh=DH_generate_parameters(num,g,dh_cb,bio_err);
-                        
-                        if (dh == NULL)
+                        if(!dh || !DH_generate_parameters_ex(dh, num, g, &cb))
                                 {
+                                if(dh) DH_free(dh);
                                 ERR_print_errors(bio_err);
                                 goto end;
                                 }
@@ -534,7 +538,7 @@ end:
         }
 
 /* dh_cb is identical to dsa_cb in apps/dsaparam.c */
-static void MS_CALLBACK dh_cb(int p, int n, void *arg)
+static int MS_CALLBACK dh_cb(int p, int n, BN_GENCB *cb)
         {
         char c='*';
 
@@ -542,11 +546,12 @@ static void MS_CALLBACK dh_cb(int p, int n, void *arg)
         if (p == 1) c='+';
         if (p == 2) c='*';
         if (p == 3) c='\n';
-        BIO_write((BIO *)arg,&c,1);
-        (void)BIO_flush((BIO *)arg);
+        BIO_write(cb->arg,&c,1);
+        (void)BIO_flush(cb->arg);
 #ifdef LINT
         p=n;
 #endif
+        return 1;
         }
 
 #endif
diff --git a/src/lib/libssl/src/apps/dsa.c b/src/lib/libssl/src/apps/dsa.c
index e9de3a3bdf..9e103037dd 100644
--- a/src/lib/libssl/src/apps/dsa.c
+++ b/src/lib/libssl/src/apps/dsa.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/opensslconf.h>        /* for OPENSSL_NO_DSA */
 #ifndef OPENSSL_NO_DSA
 #include <stdio.h>
 #include <stdlib.h>
@@ -68,6 +69,7 @@
 #include <openssl/evp.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
+#include <openssl/bn.h>
 
 #undef PROG
 #define PROG    dsa_main
@@ -82,6 +84,10 @@
  * -aes128      - encrypt output if PEM format
  * -aes192      - encrypt output if PEM format
  * -aes256      - encrypt output if PEM format
+ * -camellia128 - encrypt output if PEM format
+ * -camellia192 - encrypt output if PEM format
+ * -camellia256 - encrypt output if PEM format
+ * -seed        - encrypt output if PEM format
  * -text        - print a text version
  * -modulus     - print the DSA public key
  */
@@ -210,6 +216,13 @@ bad:
                 BIO_printf(bio_err," -aes128, -aes192, -aes256\n");
                 BIO_printf(bio_err,"                 encrypt PEM output with cbc aes\n");
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+                BIO_printf(bio_err," -camellia128, -camellia192, -camellia256\n");
+                BIO_printf(bio_err,"                 encrypt PEM output with cbc camellia\n");
+#endif
+#ifndef OPENSSL_NO_SEED
+                BIO_printf(bio_err," -seed           encrypt PEM output with cbc seed\n");
+#endif
                 BIO_printf(bio_err," -text           print the key in text\n");
                 BIO_printf(bio_err," -noout          don't print key out\n");
                 BIO_printf(bio_err," -modulus        print the DSA public value\n");
diff --git a/src/lib/libssl/src/apps/dsaparam.c b/src/lib/libssl/src/apps/dsaparam.c
index 04861e8986..c301e81af1 100644
--- a/src/lib/libssl/src/apps/dsaparam.c
+++ b/src/lib/libssl/src/apps/dsaparam.c
@@ -56,6 +56,13 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/opensslconf.h>        /* for OPENSSL_NO_DSA */
+/* Until the key-gen callbacks are modified to use newer prototypes, we allow
+ * deprecated functions for openssl-internal code */
+#ifdef OPENSSL_NO_DEPRECATED
+#undef OPENSSL_NO_DEPRECATED
+#endif
+
 #ifndef OPENSSL_NO_DSA
 #include <assert.h>
 #include <stdio.h>
@@ -82,9 +89,23 @@
  * -C
  * -noout
  * -genkey
+ *  #ifdef GENCB_TEST
+ * -timebomb n  - interrupt keygen after <n> seconds
+ *  #endif
  */
 
-static void MS_CALLBACK dsa_cb(int p, int n, void *arg);
+#ifdef GENCB_TEST
+
+static int stop_keygen_flag = 0;
+
+static void timebomb_sigalarm(int foo)
+        {
+        stop_keygen_flag = 1;
+        }
+
+#endif
+
+static int MS_CALLBACK dsa_cb(int p, int n, BN_GENCB *cb);
 
 int MAIN(int, char **);
 
@@ -103,6 +124,9 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_ENGINE
         char *engine=NULL;
 #endif
+#ifdef GENCB_TEST
+        int timebomb=0;
+#endif
 
         apps_startup();
 
@@ -150,6 +174,13 @@ int MAIN(int argc, char **argv)
                         engine = *(++argv);
                         }
 #endif
+#ifdef GENCB_TEST
+                else if(strcmp(*argv, "-timebomb") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        timebomb = atoi(*(++argv));
+                        }
+#endif
                 else if (strcmp(*argv,"-text") == 0)
                         text=1;
                 else if (strcmp(*argv,"-C") == 0)
@@ -200,6 +231,9 @@ bad:
 #ifndef OPENSSL_NO_ENGINE
                 BIO_printf(bio_err," -engine e     use engine e, possibly a hardware device.\n");
 #endif
+#ifdef GENCB_TEST
+                BIO_printf(bio_err," -timebomb n   interrupt keygen after <n> seconds\n");
+#endif
                 BIO_printf(bio_err," number        number of bits to use for generating private key\n");
                 goto end;
                 }
@@ -257,10 +291,47 @@ bad:
 
         if (numbits > 0)
                 {
+                BN_GENCB cb;
+                BN_GENCB_set(&cb, dsa_cb, bio_err);
                 assert(need_rand);
+                dsa = DSA_new();
+                if(!dsa)
+                        {
+                        BIO_printf(bio_err,"Error allocating DSA object\n");
+                        goto end;
+                        }
                 BIO_printf(bio_err,"Generating DSA parameters, %d bit long prime\n",num);
                 BIO_printf(bio_err,"This could take some time\n");
-                dsa=DSA_generate_parameters(num,NULL,0,NULL,NULL, dsa_cb,bio_err);
+#ifdef GENCB_TEST
+                if(timebomb > 0)
+        {
+                struct sigaction act;
+                act.sa_handler = timebomb_sigalarm;
+                act.sa_flags = 0;
+                BIO_printf(bio_err,"(though I'll stop it if not done within %d secs)\n",
+                                timebomb);
+                if(sigaction(SIGALRM, &act, NULL) != 0)
+                        {
+                        BIO_printf(bio_err,"Error, couldn't set SIGALRM handler\n");
+                        goto end;
+                        }
+                alarm(timebomb);
+        }
+#endif
+                if(!DSA_generate_parameters_ex(dsa,num,NULL,0,NULL,NULL, &cb))
+                        {
+#ifdef GENCB_TEST
+                        if(stop_keygen_flag)
+                                {
+                                BIO_printf(bio_err,"DSA key generation time-stopped\n");
+                                /* This is an asked-for behaviour! */
+                                ret = 0;
+                                goto end;
+                                }
+#endif
+                        BIO_printf(bio_err,"Error, DSA key generation failed\n");
+                        goto end;
+                        }
                 }
         else if (informat == FORMAT_ASN1)
                 dsa=d2i_DSAparams_bio(in,NULL);
@@ -385,7 +456,7 @@ end:
         OPENSSL_EXIT(ret);
         }
 
-static void MS_CALLBACK dsa_cb(int p, int n, void *arg)
+static int MS_CALLBACK dsa_cb(int p, int n, BN_GENCB *cb)
         {
         char c='*';
 
@@ -393,10 +464,15 @@ static void MS_CALLBACK dsa_cb(int p, int n, void *arg)
         if (p == 1) c='+';
         if (p == 2) c='*';
         if (p == 3) c='\n';
-        BIO_write(arg,&c,1);
-        (void)BIO_flush(arg);
+        BIO_write(cb->arg,&c,1);
+        (void)BIO_flush(cb->arg);
 #ifdef LINT
         p=n;
 #endif
+#ifdef GENCB_TEST
+        if(stop_keygen_flag)
+                return 0;
+#endif
+        return 1;
         }
 #endif
diff --git a/src/lib/libssl/src/apps/enc.c b/src/lib/libssl/src/apps/enc.c
index 6f3161395e..a41ea800ac 100644
--- a/src/lib/libssl/src/apps/enc.c
+++ b/src/lib/libssl/src/apps/enc.c
@@ -127,7 +127,6 @@ int MAIN(int argc, char **argv)
         char *engine = NULL;
 #endif
         const EVP_MD *dgst=NULL;
-        int non_fips_allow = 0;
 
         apps_startup();
 
@@ -262,8 +261,6 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         md= *(++argv);
                         }
-                else if (strcmp(*argv,"-non-fips-allow") == 0)
-                        non_fips_allow = 1;
                 else if ((argv[0][0] == '-') &&
                         ((c=EVP_get_cipherbyname(&(argv[0][1]))) != NULL))
                         {
@@ -317,10 +314,7 @@ bad:
 
         if (dgst == NULL)
                 {
-                if (in_FIPS_mode)
-                        dgst = EVP_sha1();
-                else
-                        dgst = EVP_md5();
+                dgst = EVP_md5();
                 }
 
         if (bufsize != NULL)
@@ -346,7 +340,7 @@ bad:
                         }
 
                 /* It must be large enough for a base64 encoded line */
-                if (n < 80) n=80;
+                if (base64 && n < 80) n=80;
 
                 bsize=(int)n;
                 if (verbose) BIO_printf(bio_err,"bufsize=%d\n",bsize);
@@ -371,12 +365,16 @@ bad:
                 {
                 BIO_set_callback(in,BIO_debug_callback);
                 BIO_set_callback(out,BIO_debug_callback);
-                BIO_set_callback_arg(in,bio_err);
-                BIO_set_callback_arg(out,bio_err);
+                BIO_set_callback_arg(in,(char *)bio_err);
+                BIO_set_callback_arg(out,(char *)bio_err);
                 }
 
         if (inf == NULL)
+                {
+                if (bufsize != NULL)
+                        setvbuf(stdin, (char *)NULL, _IONBF, 0);
                 BIO_set_fp(in,stdin,BIO_NOCLOSE);
+                }
         else
                 {
                 if (BIO_read_filename(in,inf) <= 0)
@@ -427,6 +425,8 @@ bad:
         if (outf == NULL)
                 {
                 BIO_set_fp(out,stdout,BIO_NOCLOSE);
+                if (bufsize != NULL)
+                        setvbuf(stdout, (char *)NULL, _IONBF, 0);
 #ifdef OPENSSL_SYS_VMS
                 {
                 BIO *tmpbio = BIO_new(BIO_f_linebuffer());
@@ -453,7 +453,7 @@ bad:
                 if (debug)
                         {
                         BIO_set_callback(b64,BIO_debug_callback);
-                        BIO_set_callback_arg(b64,bio_err);
+                        BIO_set_callback_arg(b64,(char *)bio_err);
                         }
                 if (olb64)
                         BIO_set_flags(b64,BIO_FLAGS_BASE64_NO_NL);
@@ -552,19 +552,7 @@ bad:
                 if (!EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc))
                         {
                         BIO_printf(bio_err, "Error setting cipher %s\n",
-                                        EVP_CIPHER_name(cipher));
-                        ERR_print_errors(bio_err);
-                        goto end;
-                        }
-
-                if (non_fips_allow)
-                        EVP_CIPHER_CTX_set_flags(ctx,
-                                EVP_CIPH_FLAG_NON_FIPS_ALLOW);
-
-                if (!EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, enc))
-                        {
-                        BIO_printf(bio_err, "Error setting cipher %s\n",
-                                        EVP_CIPHER_name(cipher));
+                                EVP_CIPHER_name(cipher));
                         ERR_print_errors(bio_err);
                         goto end;
                         }
@@ -575,7 +563,7 @@ bad:
                 if (!EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, enc))
                         {
                         BIO_printf(bio_err, "Error setting cipher %s\n",
-                                        EVP_CIPHER_name(cipher));
+                                EVP_CIPHER_name(cipher));
                         ERR_print_errors(bio_err);
                         goto end;
                         }
@@ -583,7 +571,7 @@ bad:
                 if (debug)
                         {
                         BIO_set_callback(benc,BIO_debug_callback);
-                        BIO_set_callback_arg(benc,bio_err);
+                        BIO_set_callback_arg(benc,(char *)bio_err);
                         }
 
                 if (printkey)
@@ -591,7 +579,7 @@ bad:
                         if (!nosalt)
                                 {
                                 printf("salt=");
-                                for (i=0; i<sizeof salt; i++)
+                                for (i=0; i<(int)sizeof(salt); i++)
                                         printf("%02X",salt[i]);
                                 printf("\n");
                                 }
diff --git a/src/lib/libssl/src/apps/engine.c b/src/lib/libssl/src/apps/engine.c
index e8a599f9e5..25c8617107 100644
--- a/src/lib/libssl/src/apps/engine.c
+++ b/src/lib/libssl/src/apps/engine.c
@@ -72,14 +72,15 @@
 #undef PROG
 #define PROG    engine_main
 
-static char *engine_usage[]={
+static const char *engine_usage[]={
 "usage: engine opts [engine ...]\n",
 " -v[v[v[v]]] - verbose mode, for each engine, list its 'control commands'\n",
 "               -vv will additionally display each command's description\n",
 "               -vvv will also add the input flags for each command\n",
 "               -vvvv will also show internal input flags\n",
 " -c          - for each engine, also list the capabilities\n",
-" -t          - for each engine, check that they are really available\n",
+" -t[t]       - for each engine, check that they are really available\n",
+"               -tt will display error trace for unavailable engines\n",
 " -pre <cmd>  - runs command 'cmd' against the ENGINE before any attempts\n",
 "               to load it (if -t is used)\n",
 " -post <cmd> - runs command 'cmd' against the ENGINE after loading it\n",
@@ -343,8 +344,8 @@ int MAIN(int, char **);
 int MAIN(int argc, char **argv)
         {
         int ret=1,i;
-        char **pp;
-        int verbose=0, list_cap=0, test_avail=0;
+        const char **pp;
+        int verbose=0, list_cap=0, test_avail=0, test_avail_noise = 0;
         ENGINE *e;
         STACK *engines = sk_new_null();
         STACK *pre_cmds = sk_new_null();
@@ -382,8 +383,14 @@ int MAIN(int argc, char **argv)
                         }
                 else if (strcmp(*argv,"-c") == 0)
                         list_cap=1;
-                else if (strcmp(*argv,"-t") == 0)
+                else if (strncmp(*argv,"-t",2) == 0)
+                        {
                         test_avail=1;
+                        if(strspn(*argv + 1, "t") < strlen(*argv + 1))
+                                goto skip_arg_loop;
+                        if((test_avail_noise = strlen(*argv + 1) - 1) > 1)
+                                goto skip_arg_loop;
+                        }
                 else if (strcmp(*argv,"-pre") == 0)
                         {
                         argc--; argv++;
@@ -502,7 +509,8 @@ skip_digests:
                                 else
                                         {
                                         BIO_printf(bio_out, "[ unavailable ]\n");
-                                        ERR_print_errors_fp(stdout);
+                                        if(test_avail_noise)
+                                                ERR_print_errors_fp(stdout);
                                         ERR_clear_error();
                                         }
                                 }
@@ -516,6 +524,7 @@ skip_digests:
 
         ret=0;
 end:
+
         ERR_print_errors(bio_err);
         sk_pop_free(engines, identity);
         sk_pop_free(pre_cmds, identity);
diff --git a/src/lib/libssl/src/apps/gendh.c b/src/lib/libssl/src/apps/gendh.c
index a34a862caf..47497864b0 100644
--- a/src/lib/libssl/src/apps/gendh.c
+++ b/src/lib/libssl/src/apps/gendh.c
@@ -57,6 +57,13 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/opensslconf.h>
+/* Until the key-gen callbacks are modified to use newer prototypes, we allow
+ * deprecated functions for openssl-internal code */
+#ifdef OPENSSL_NO_DEPRECATED
+#undef OPENSSL_NO_DEPRECATED
+#endif
+
 #ifndef OPENSSL_NO_DH
 #include <stdio.h>
 #include <string.h>
@@ -75,12 +82,13 @@
 #undef PROG
 #define PROG gendh_main
 
-static void MS_CALLBACK dh_cb(int p, int n, void *arg);
+static int MS_CALLBACK dh_cb(int p, int n, BN_GENCB *cb);
 
 int MAIN(int, char **);
 
 int MAIN(int argc, char **argv)
         {
+        BN_GENCB cb;
 #ifndef OPENSSL_NO_ENGINE
         ENGINE *e = NULL;
 #endif
@@ -96,6 +104,7 @@ int MAIN(int argc, char **argv)
 
         apps_startup();
 
+        BN_GENCB_set(&cb, dh_cb, bio_err);
         if (bio_err == NULL)
                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
                         BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
@@ -193,10 +202,10 @@ bad:
 
         BIO_printf(bio_err,"Generating DH parameters, %d bit long safe prime, generator %d\n",num,g);
         BIO_printf(bio_err,"This is going to take a long time\n");
-        dh=DH_generate_parameters(num,g,dh_cb,bio_err);
-                
-        if (dh == NULL) goto end;
 
+        if(((dh = DH_new()) == NULL) || !DH_generate_parameters_ex(dh, num, g, &cb))
+                goto end;
+                
         app_RAND_write_file(NULL, bio_err);
 
         if (!PEM_write_bio_DHparams(out,dh))
@@ -211,7 +220,7 @@ end:
         OPENSSL_EXIT(ret);
         }
 
-static void MS_CALLBACK dh_cb(int p, int n, void *arg)
+static int MS_CALLBACK dh_cb(int p, int n, BN_GENCB *cb)
         {
         char c='*';
 
@@ -219,10 +228,11 @@ static void MS_CALLBACK dh_cb(int p, int n, void *arg)
         if (p == 1) c='+';
         if (p == 2) c='*';
         if (p == 3) c='\n';
-        BIO_write((BIO *)arg,&c,1);
-        (void)BIO_flush((BIO *)arg);
+        BIO_write(cb->arg,&c,1);
+        (void)BIO_flush(cb->arg);
 #ifdef LINT
         p=n;
 #endif
+        return 1;
         }
 #endif
diff --git a/src/lib/libssl/src/apps/gendsa.c b/src/lib/libssl/src/apps/gendsa.c
index 6d2ed06c81..8a296c66e5 100644
--- a/src/lib/libssl/src/apps/gendsa.c
+++ b/src/lib/libssl/src/apps/gendsa.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/opensslconf.h>        /* for OPENSSL_NO_DSA */
 #ifndef OPENSSL_NO_DSA
 #include <stdio.h>
 #include <string.h>
@@ -139,6 +140,10 @@ int MAIN(int argc, char **argv)
                 else if (strcmp(*argv,"-idea") == 0)
                         enc=EVP_idea_cbc();
 #endif
+#ifndef OPENSSL_NO_SEED
+                else if (strcmp(*argv,"-seed") == 0)
+                        enc=EVP_seed_cbc();
+#endif
 #ifndef OPENSSL_NO_AES
                 else if (strcmp(*argv,"-aes128") == 0)
                         enc=EVP_aes_128_cbc();
@@ -147,6 +152,14 @@ int MAIN(int argc, char **argv)
                 else if (strcmp(*argv,"-aes256") == 0)
                         enc=EVP_aes_256_cbc();
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+                else if (strcmp(*argv,"-camellia128") == 0)
+                        enc=EVP_camellia_128_cbc();
+                else if (strcmp(*argv,"-camellia192") == 0)
+                        enc=EVP_camellia_192_cbc();
+                else if (strcmp(*argv,"-camellia256") == 0)
+                        enc=EVP_camellia_256_cbc();
+#endif
                 else if (**argv != '-' && dsaparams == NULL)
                         {
                         dsaparams = *argv;
@@ -169,10 +182,18 @@ bad:
 #ifndef OPENSSL_NO_IDEA
                 BIO_printf(bio_err," -idea     - encrypt the generated key with IDEA in cbc mode\n");
 #endif
+#ifndef OPENSSL_NO_SEED
+                BIO_printf(bio_err," -seed\n");
+                BIO_printf(bio_err,"                 encrypt PEM output with cbc seed\n");
+#endif
 #ifndef OPENSSL_NO_AES
                 BIO_printf(bio_err," -aes128, -aes192, -aes256\n");
                 BIO_printf(bio_err,"                 encrypt PEM output with cbc aes\n");
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+                BIO_printf(bio_err," -camellia128, -camellia192, -camellia256\n");
+                BIO_printf(bio_err,"                 encrypt PEM output with cbc camellia\n");
+#endif
 #ifndef OPENSSL_NO_ENGINE
                 BIO_printf(bio_err," -engine e - use engine e, possibly a hardware device.\n");
 #endif
diff --git a/src/lib/libssl/src/apps/genrsa.c b/src/lib/libssl/src/apps/genrsa.c
index 7dbd0923b6..1599bb7a69 100644
--- a/src/lib/libssl/src/apps/genrsa.c
+++ b/src/lib/libssl/src/apps/genrsa.c
@@ -56,6 +56,13 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/opensslconf.h>
+/* Until the key-gen callbacks are modified to use newer prototypes, we allow
+ * deprecated functions for openssl-internal code */
+#ifdef OPENSSL_NO_DEPRECATED
+#undef OPENSSL_NO_DEPRECATED
+#endif
+
 #ifndef OPENSSL_NO_RSA
 #include <stdio.h>
 #include <string.h>
@@ -75,22 +82,19 @@
 #undef PROG
 #define PROG genrsa_main
 
-static void MS_CALLBACK genrsa_cb(int p, int n, void *arg);
+static int MS_CALLBACK genrsa_cb(int p, int n, BN_GENCB *cb);
 
 int MAIN(int, char **);
 
 int MAIN(int argc, char **argv)
         {
+        BN_GENCB cb;
 #ifndef OPENSSL_NO_ENGINE
         ENGINE *e = NULL;
 #endif
         int ret=1;
-        RSA *rsa=NULL;
         int i,num=DEFBITS;
         long l;
-#ifdef OPENSSL_FIPS
-        int use_x931 = 0;
-#endif
         const EVP_CIPHER *enc=NULL;
         unsigned long f4=RSA_F4;
         char *outfile=NULL;
@@ -100,8 +104,13 @@ int MAIN(int argc, char **argv)
 #endif
         char *inrand=NULL;
         BIO *out=NULL;
+        BIGNUM *bn = BN_new();
+        RSA *rsa = RSA_new();
+
+        if(!bn || !rsa) goto err;
 
         apps_startup();
+        BN_GENCB_set(&cb, genrsa_cb, bio_err);
 
         if (bio_err == NULL)
                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
@@ -129,10 +138,6 @@ int MAIN(int argc, char **argv)
                         f4=3;
                 else if (strcmp(*argv,"-F4") == 0 || strcmp(*argv,"-f4") == 0)
                         f4=RSA_F4;
-#ifdef OPENSSL_FIPS
-                else if (strcmp(*argv,"-x931") == 0)
-                        use_x931 = 1;
-#endif
 #ifndef OPENSSL_NO_ENGINE
                 else if (strcmp(*argv,"-engine") == 0)
                         {
@@ -155,6 +160,10 @@ int MAIN(int argc, char **argv)
                 else if (strcmp(*argv,"-idea") == 0)
                         enc=EVP_idea_cbc();
 #endif
+#ifndef OPENSSL_NO_SEED
+                else if (strcmp(*argv,"-seed") == 0)
+                        enc=EVP_seed_cbc();
+#endif
 #ifndef OPENSSL_NO_AES
                 else if (strcmp(*argv,"-aes128") == 0)
                         enc=EVP_aes_128_cbc();
@@ -163,6 +172,14 @@ int MAIN(int argc, char **argv)
                 else if (strcmp(*argv,"-aes256") == 0)
                         enc=EVP_aes_256_cbc();
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+                else if (strcmp(*argv,"-camellia128") == 0)
+                        enc=EVP_camellia_128_cbc();
+                else if (strcmp(*argv,"-camellia192") == 0)
+                        enc=EVP_camellia_192_cbc();
+                else if (strcmp(*argv,"-camellia256") == 0)
+                        enc=EVP_camellia_256_cbc();
+#endif
                 else if (strcmp(*argv,"-passout") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -182,10 +199,18 @@ bad:
 #ifndef OPENSSL_NO_IDEA
                 BIO_printf(bio_err," -idea           encrypt the generated key with IDEA in cbc mode\n");
 #endif
+#ifndef OPENSSL_NO_SEED
+                BIO_printf(bio_err," -seed\n");
+                BIO_printf(bio_err,"                 encrypt PEM output with cbc seed\n");
+#endif
 #ifndef OPENSSL_NO_AES
                 BIO_printf(bio_err," -aes128, -aes192, -aes256\n");
                 BIO_printf(bio_err,"                 encrypt PEM output with cbc aes\n");
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+                BIO_printf(bio_err," -camellia128, -camellia192, -camellia256\n");
+                BIO_printf(bio_err,"                 encrypt PEM output with cbc camellia\n");
+#endif
                 BIO_printf(bio_err," -out file       output the key to 'file\n");
                 BIO_printf(bio_err," -passout arg    output file pass phrase source\n");
                 BIO_printf(bio_err," -f4             use F4 (0x10001) for the E value\n");
@@ -240,28 +265,12 @@ bad:
 
         BIO_printf(bio_err,"Generating RSA private key, %d bit long modulus\n",
                 num);
-#ifdef OPENSSL_FIPS
-        if (use_x931)
-                {
-                BIGNUM *pubexp;
-                pubexp = BN_new();
-                BN_set_word(pubexp, f4);
-                rsa = RSA_X931_generate_key(num, pubexp, genrsa_cb, bio_err);
-                BN_free(pubexp);
-                }
-        else
-#endif
-                rsa=RSA_generate_key(num,f4,genrsa_cb,bio_err);
+
+        if(!BN_set_word(bn, f4) || !RSA_generate_key_ex(rsa, num, bn, &cb))
+                goto err;
                 
         app_RAND_write_file(NULL, bio_err);
 
-        if (rsa == NULL)
-                {
-                BIO_printf(bio_err, "Key Generation error\n");
-
-                goto err;
-                }
-        
         /* We need to do the following for when the base number size is <
          * long, esp windows 3.1 :-(. */
         l=0L;
@@ -285,8 +294,9 @@ bad:
 
         ret=0;
 err:
-        if (rsa != NULL) RSA_free(rsa);
-        if (out != NULL) BIO_free_all(out);
+        if (bn) BN_free(bn);
+        if (rsa) RSA_free(rsa);
+        if (out) BIO_free_all(out);
         if(passout) OPENSSL_free(passout);
         if (ret != 0)
                 ERR_print_errors(bio_err);
@@ -294,7 +304,7 @@ err:
         OPENSSL_EXIT(ret);
         }
 
-static void MS_CALLBACK genrsa_cb(int p, int n, void *arg)
+static int MS_CALLBACK genrsa_cb(int p, int n, BN_GENCB *cb)
         {
         char c='*';
 
@@ -302,11 +312,12 @@ static void MS_CALLBACK genrsa_cb(int p, int n, void *arg)
         if (p == 1) c='+';
         if (p == 2) c='*';
         if (p == 3) c='\n';
-        BIO_write((BIO *)arg,&c,1);
-        (void)BIO_flush((BIO *)arg);
+        BIO_write(cb->arg,&c,1);
+        (void)BIO_flush(cb->arg);
 #ifdef LINT
         p=n;
 #endif
+        return 1;
         }
 #else /* !OPENSSL_NO_RSA */
 
diff --git a/src/lib/libssl/src/apps/makeapps.com b/src/lib/libssl/src/apps/makeapps.com
index 7b5ff90c62..826ab5bec6 100644
--- a/src/lib/libssl/src/apps/makeapps.com
+++ b/src/lib/libssl/src/apps/makeapps.com
@@ -139,30 +139,13 @@ $! Define The Application Files.
 $!
 $ LIB_FILES = "VERIFY;ASN1PARS;REQ;DGST;DH;DHPARAM;ENC;PASSWD;GENDH;ERRSTR;"+-
               "CA;PKCS7;CRL2P7;CRL;"+-
-              "RSA;RSAUTL;DSA;DSAPARAM;"+-
+              "RSA;RSAUTL;DSA;DSAPARAM;EC;ECPARAM;"+-
               "X509;GENRSA;GENDSA;S_SERVER;S_CLIENT;SPEED;"+-
               "S_TIME;APPS;S_CB;S_SOCKET;APP_RAND;VERSION;SESS_ID;"+-
-              "CIPHERS;NSEQ;PKCS12;PKCS8;SPKAC;SMIME;RAND;ENGINE;OCSP;PRIME"
-$ APP_FILES := OPENSSL,'OBJ_DIR'VERIFY.OBJ,ASN1PARS.OBJ,REQ.OBJ,DGST.OBJ,DH.OBJ,DHPARAM.OBJ,ENC.OBJ,PASSWD.OBJ,GENDH.OBJ,ERRSTR.OBJ,-
-               CA.OBJ,PKCS7.OBJ,CRL2P7.OBJ,CRL.OBJ,-
-               RSA.OBJ,RSAUTL.OBJ,DSA.OBJ,DSAPARAM.OBJ,-
-               X509.OBJ,GENRSA.OBJ,GENDSA.OBJ,S_SERVER.OBJ,S_CLIENT.OBJ,SPEED.OBJ,-
-               S_TIME.OBJ,APPS.OBJ,S_CB.OBJ,S_SOCKET.OBJ,APP_RAND.OBJ,VERSION.OBJ,SESS_ID.OBJ,-
-               CIPHERS.OBJ,NSEQ.OBJ,PKCS12.OBJ,PKCS8.OBJ,SPKAC.OBJ,SMIME.OBJ,RAND.OBJ,ENGINE.OBJ,OCSP.OBJ,PRIME.OBJ
+              "CIPHERS;NSEQ;PKCS12;PKCS8;SPKAC;SMIME;CMS;RAND;ENGINE;OCSP;PRIME"
 $ TCPIP_PROGRAMS = ",,"
 $ IF COMPILER .EQS. "VAXC" THEN -
      TCPIP_PROGRAMS = ",OPENSSL,"
-$!$ APP_FILES := VERIFY;ASN1PARS;REQ;DGST;DH;ENC;GENDH;ERRSTR;CA;-
-$!             PKCS7;CRL2P7;CRL;-
-$!             RSA;DSA;DSAPARAM;-
-$!             X509;GENRSA;GENDSA;-
-$!             S_SERVER,'OBJ_DIR'S_SOCKET.OBJ,'OBJ_DIR'S_CB.OBJ;-
-$!             S_CLIENT,'OBJ_DIR'S_SOCKET.OBJ,'OBJ_DIR'S_CB.OBJ;-
-$!             SPEED;-
-$!             S_TIME,'OBJ_DIR'S_CB.OBJ;VERSION;SESS_ID;CIPHERS;NSEQ
-$!$ TCPIP_PROGRAMS = ",,"
-$!$ IF COMPILER .EQS. "VAXC" THEN -
-$!     TCPIP_PROGRAMS = ",S_SERVER,S_CLIENT,SESS_ID,CIPHERS,S_TIME,"
 $!
 $! Setup exceptional compilations
 $!
diff --git a/src/lib/libssl/src/apps/ocsp.c b/src/lib/libssl/src/apps/ocsp.c
index 856b797b53..1001f3b25d 100644
--- a/src/lib/libssl/src/apps/ocsp.c
+++ b/src/lib/libssl/src/apps/ocsp.c
@@ -56,14 +56,14 @@
  *
  */
 #ifndef OPENSSL_NO_OCSP
-
+#define USE_SOCKETS
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
-#include "apps.h"
-#include <openssl/pem.h>
-#include <openssl/ocsp.h>
-#include <openssl/err.h>
+#include "apps.h" /* needs to be included before the openssl headers! */
+#include <openssl/e_os2.h>
 #include <openssl/ssl.h>
+#include <openssl/err.h>
 
 /* Maximum leeway in validity period: default 5 minutes */
 #define MAX_VALIDITY_PERIOD     (5 * 60)
@@ -85,6 +85,8 @@ static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser);
 static BIO *init_responder(char *port);
 static int do_responder(OCSP_REQUEST **preq, BIO **pcbio, BIO *acbio, char *port);
 static int send_ocsp_response(BIO *cbio, OCSP_RESPONSE *resp);
+static OCSP_RESPONSE *query_responder(BIO *err, BIO *cbio, char *path,
+                                OCSP_REQUEST *req, int req_timeout);
 
 #undef PROG
 #define PROG ocsp_main
@@ -111,11 +113,11 @@ int MAIN(int argc, char **argv)
         BIO *acbio = NULL, *cbio = NULL;
         BIO *derbio = NULL;
         BIO *out = NULL;
+        int req_timeout = -1;
         int req_text = 0, resp_text = 0;
         long nsec = MAX_VALIDITY_PERIOD, maxage = -1;
         char *CAfile = NULL, *CApath = NULL;
         X509_STORE *store = NULL;
-        SSL_CTX *ctx = NULL;
         STACK_OF(X509) *sign_other = NULL, *verify_other = NULL, *rother = NULL;
         char *sign_certfile = NULL, *verify_certfile = NULL, *rcertfile = NULL;
         unsigned long sign_flags = 0, verify_flags = 0, rflags = 0;
@@ -138,6 +140,7 @@ int MAIN(int argc, char **argv)
         if (!load_config(bio_err, NULL))
                 goto end;
         SSL_load_error_strings();
+        OpenSSL_add_ssl_algorithms();
         args = argv + 1;
         reqnames = sk_new_null();
         ids = sk_OCSP_CERTID_new_null();
@@ -152,6 +155,22 @@ int MAIN(int argc, char **argv)
                                 }
                         else badarg = 1;
                         }
+                else if (!strcmp(*args, "-timeout"))
+                        {
+                        if (args[1])
+                                {
+                                args++;
+                                req_timeout = atol(*args);
+                                if (req_timeout < 0)
+                                        {
+                                        BIO_printf(bio_err,
+                                                "Illegal timeout value %s\n",
+                                                *args);
+                                        badarg = 1;
+                                        }
+                                }
+                        else badarg = 1;
+                        }
                 else if (!strcmp(*args, "-url"))
                         {
                         if (args[1])
@@ -701,47 +720,14 @@ int MAIN(int argc, char **argv)
         else if (host)
                 {
 #ifndef OPENSSL_NO_SOCK
-                cbio = BIO_new_connect(host);
+                resp = process_responder(bio_err, req, host, path,
+                                                port, use_ssl, req_timeout);
+                if (!resp)
+                        goto end;
 #else
                 BIO_printf(bio_err, "Error creating connect BIO - sockets not supported.\n");
                 goto end;
 #endif
-                if (!cbio)
-                        {
-                        BIO_printf(bio_err, "Error creating connect BIO\n");
-                        goto end;
-                        }
-                if (port) BIO_set_conn_port(cbio, port);
-                if (use_ssl == 1)
-                        {
-                        BIO *sbio;
-#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
-                        ctx = SSL_CTX_new(SSLv23_client_method());
-#elif !defined(OPENSSL_NO_SSL3)
-                        ctx = SSL_CTX_new(SSLv3_client_method());
-#elif !defined(OPENSSL_NO_SSL2)
-                        ctx = SSL_CTX_new(SSLv2_client_method());
-#else
-                        BIO_printf(bio_err, "SSL is disabled\n");
-                        goto end;
-#endif
-                        SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
-                        sbio = BIO_new_ssl(ctx, 1);
-                        cbio = BIO_push(sbio, cbio);
-                        }
-                if (BIO_do_connect(cbio) <= 0)
-                        {
-                        BIO_printf(bio_err, "Error connecting BIO\n");
-                        goto end;
-                        }
-                resp = OCSP_sendreq_bio(cbio, path, req);
-                BIO_free_all(cbio);
-                cbio = NULL;
-                if (!resp)
-                        {
-                        BIO_printf(bio_err, "Error querying OCSP responsder\n");
-                        goto end;
-                        }
                 }
         else if (respin)
                 {
@@ -784,7 +770,7 @@ int MAIN(int argc, char **argv)
 
         if (i != OCSP_RESPONSE_STATUS_SUCCESSFUL)
                 {
-                BIO_printf(out, "Responder Error: %s (%ld)\n",
+                BIO_printf(out, "Responder Error: %s (%d)\n",
                                 OCSP_response_status_str(i), i);
                 if (ignore_err)
                         goto redo_accept;
@@ -850,7 +836,7 @@ int MAIN(int argc, char **argv)
 
                 if(i <= 0)
                         {
-                        BIO_printf(bio_err, "Response Verify Failure\n", i);
+                        BIO_printf(bio_err, "Response Verify Failure\n");
                         ERR_print_errors(bio_err);
                         }
                 else
@@ -890,7 +876,6 @@ end:
                 OPENSSL_free(host);
                 OPENSSL_free(port);
                 OPENSSL_free(path);
-                SSL_CTX_free(ctx);
                 }
 
         OPENSSL_EXIT(ret);
@@ -1114,6 +1099,7 @@ static char **lookup_serial(CA_DB *db, ASN1_INTEGER *ser)
         char *itmp, *row[DB_NUMBER],**rrow;
         for (i = 0; i < DB_NUMBER; i++) row[i] = NULL;
         bn = ASN1_INTEGER_to_BN(ser,NULL);
+        OPENSSL_assert(bn); /* FIXME: should report an error at this point and abort */
         if (BN_is_zero(bn))
                 itmp = BUF_strdup("00");
         else
@@ -1220,8 +1206,141 @@ static int send_ocsp_response(BIO *cbio, OCSP_RESPONSE *resp)
                 return 0;
         BIO_printf(cbio, http_resp, i2d_OCSP_RESPONSE(resp, NULL));
         i2d_OCSP_RESPONSE_bio(cbio, resp);
-        BIO_flush(cbio);
+        (void)BIO_flush(cbio);
         return 1;
         }
 
+static OCSP_RESPONSE *query_responder(BIO *err, BIO *cbio, char *path,
+                                OCSP_REQUEST *req, int req_timeout)
+        {
+        int fd;
+        int rv;
+        OCSP_REQ_CTX *ctx = NULL;
+        OCSP_RESPONSE *rsp = NULL;
+        fd_set confds;
+        struct timeval tv;
+
+        if (req_timeout != -1)
+                BIO_set_nbio(cbio, 1);
+
+        rv = BIO_do_connect(cbio);
+
+        if ((rv <= 0) && ((req_timeout == -1) || !BIO_should_retry(cbio)))
+                {
+                BIO_puts(err, "Error connecting BIO\n");
+                return NULL;
+                }
+
+        if (req_timeout == -1)
+                return OCSP_sendreq_bio(cbio, path, req);
+
+        if (BIO_get_fd(cbio, &fd) <= 0)
+                {
+                BIO_puts(err, "Can't get connection fd\n");
+                goto err;
+                }
+
+        if (rv <= 0)
+                {
+                FD_ZERO(&confds);
+                openssl_fdset(fd, &confds);
+                tv.tv_usec = 0;
+                tv.tv_sec = req_timeout;
+                rv = select(fd + 1, NULL, (void *)&confds, NULL, &tv);
+                if (rv == 0)
+                        {
+                        BIO_puts(err, "Timeout on connect\n");
+                        return NULL;
+                        }
+                }
+
+
+        ctx = OCSP_sendreq_new(cbio, path, req, -1);
+        if (!ctx)
+                return NULL;
+        
+        for (;;)
+                {
+                rv = OCSP_sendreq_nbio(&rsp, ctx);
+                if (rv != -1)
+                        break;
+                FD_ZERO(&confds);
+                openssl_fdset(fd, &confds);
+                tv.tv_usec = 0;
+                tv.tv_sec = req_timeout;
+                if (BIO_should_read(cbio))
+                        rv = select(fd + 1, (void *)&confds, NULL, NULL, &tv);
+                else if (BIO_should_write(cbio))
+                        rv = select(fd + 1, NULL, (void *)&confds, NULL, &tv);
+                else
+                        {
+                        BIO_puts(err, "Unexpected retry condition\n");
+                        goto err;
+                        }
+                if (rv == 0)
+                        {
+                        BIO_puts(err, "Timeout on request\n");
+                        break;
+                        }
+                if (rv == -1)
+                        {
+                        BIO_puts(err, "Select error\n");
+                        break;
+                        }
+                        
+                }
+        err:
+        if (ctx)
+                OCSP_REQ_CTX_free(ctx);
+
+        return rsp;
+        }
+
+OCSP_RESPONSE *process_responder(BIO *err, OCSP_REQUEST *req,
+                        char *host, char *path, char *port, int use_ssl,
+                        int req_timeout)
+        {
+        BIO *cbio = NULL;
+        SSL_CTX *ctx = NULL;
+        OCSP_RESPONSE *resp = NULL;
+        cbio = BIO_new_connect(host);
+        if (!cbio)
+                {
+                BIO_printf(err, "Error creating connect BIO\n");
+                goto end;
+                }
+        if (port) BIO_set_conn_port(cbio, port);
+        if (use_ssl == 1)
+                {
+                BIO *sbio;
+#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
+                ctx = SSL_CTX_new(SSLv23_client_method());
+#elif !defined(OPENSSL_NO_SSL3)
+                ctx = SSL_CTX_new(SSLv3_client_method());
+#elif !defined(OPENSSL_NO_SSL2)
+                ctx = SSL_CTX_new(SSLv2_client_method());
+#else
+                BIO_printf(err, "SSL is disabled\n");
+                        goto end;
+#endif
+                if (ctx == NULL)
+                        {
+                        BIO_printf(err, "Error creating SSL context.\n");
+                        goto end;
+                        }
+                SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
+                sbio = BIO_new_ssl(ctx, 1);
+                cbio = BIO_push(sbio, cbio);
+                }
+        resp = query_responder(err, cbio, path, req, req_timeout);
+        if (!resp)
+                BIO_printf(bio_err, "Error querying OCSP responsder\n");
+        end:
+        if (ctx)
+                SSL_CTX_free(ctx);
+        if (cbio)
+                BIO_free_all(cbio);
+        return resp;
+        }
+
 #endif
diff --git a/src/lib/libssl/src/apps/openssl-vms.cnf b/src/lib/libssl/src/apps/openssl-vms.cnf
index 878467ce98..fae82b0d53 100644
--- a/src/lib/libssl/src/apps/openssl-vms.cnf
+++ b/src/lib/libssl/src/apps/openssl-vms.cnf
@@ -44,8 +44,8 @@ new_certs_dir	= $dir.newcerts]		# default place for new certs.
 
 certificate     = $dir]cacert.pem       # The CA certificate
 serial          = $dir]serial.          # The current serial number
-#crlnumber      = $dir]crlnumber.       # the current crl number must be
-                                        # commented out to leave a V1 CRL
+crlnumber       = $dir]crlnumber.       # the current crl number
+                                        # must be commented out to leave a V1 CRL
 crl             = $dir]crl.pem          # The current CRL
 private_key     = $dir.private]cakey.pem# The private key
 RANDFILE        = $dir.private].rand    # private random number file
@@ -67,7 +67,7 @@ cert_opt 	= ca_default		# Certificate field options
 
 default_days    = 365                   # how long to certify for
 default_crl_days= 30                    # how long before next CRL
-default_md      = md5                   # which md to use.
+default_md      = sha1                  # which md to use.
 preserve        = no                    # keep passed DN ordering
 
 # A few difference way of specifying how similar the request should look
@@ -188,7 +188,7 @@ nsComment			= "OpenSSL Generated Certificate"
 
 # PKIX recommendations harmless if included in all certificates.
 subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer:always
+authorityKeyIdentifier=keyid,issuer
 
 # This stuff is for subjectAltName and issuerAltname.
 # Import the email address.
diff --git a/src/lib/libssl/src/apps/openssl.c b/src/lib/libssl/src/apps/openssl.c
index cb6ee740e7..47aee5b712 100644
--- a/src/lib/libssl/src/apps/openssl.c
+++ b/src/lib/libssl/src/apps/openssl.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -129,7 +129,6 @@
 #include "progs.h"
 #include "s_apps.h"
 #include <openssl/err.h>
-#include <openssl/fips.h>
 
 /* The LHASH callbacks ("hash" & "cmp") have been replaced by functions with the
  * base prototypes (we cast each variable inside the function to the required
@@ -148,7 +147,6 @@ char *default_config_file=NULL;
 #ifdef MONOLITH
 CONF *config=NULL;
 BIO *bio_err=NULL;
-int in_FIPS_mode=0;
 #endif
 
 
@@ -222,29 +220,18 @@ int main(int Argc, char *Argv[])
 #define PROG_NAME_SIZE  39
         char pname[PROG_NAME_SIZE+1];
         FUNCTION f,*fp;
-        MS_STATIC char *prompt,buf[1024];
+        MS_STATIC const char *prompt;
+        MS_STATIC char buf[1024];
         char *to_free=NULL;
         int n,i,ret=0;
         int argc;
         char **argv,*p;
         LHASH *prog=NULL;
         long errline;
-
+ 
         arg.data=NULL;
         arg.count=0;
 
-        in_FIPS_mode = 0;
-
-#ifdef OPENSSL_FIPS
-        if(getenv("OPENSSL_FIPS")) {
-                if (!FIPS_mode_set(1)) {
-                        ERR_load_crypto_strings();
-                        ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));
-                        EXIT(1);
-                }
-                in_FIPS_mode = 1;
-                }
-#endif
         if (bio_err == NULL)
                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
                         BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
@@ -458,7 +445,11 @@ static int do_cmd(LHASH *prog, int argc, char *argv[])
                 for (fp=functions; fp->name != NULL; fp++)
                         {
                         nl=0;
+#ifdef OPENSSL_NO_CAMELLIA
                         if (((i++) % 5) == 0)
+#else
+                        if (((i++) % 4) == 0)
+#endif
                                 {
                                 BIO_printf(bio_err,"\n");
                                 nl=1;
@@ -479,7 +470,11 @@ static int do_cmd(LHASH *prog, int argc, char *argv[])
                                         BIO_printf(bio_err,"\nCipher commands (see the `enc' command for more details)\n");
                                         }
                                 }
+#ifdef OPENSSL_NO_CAMELLIA
                         BIO_printf(bio_err,"%-15s",fp->name);
+#else
+                        BIO_printf(bio_err,"%-18s",fp->name);
+#endif
                         }
                 BIO_printf(bio_err,"\n\n");
                 ret=0;
@@ -502,7 +497,7 @@ static LHASH *prog_init(void)
         {
         LHASH *ret;
         FUNCTION *f;
-        int i;
+        size_t i;
 
         /* Purely so it looks nice when the user hits ? */
         for(i=0,f=functions ; f->name != NULL ; ++f,++i)
@@ -520,12 +515,12 @@ static LHASH *prog_init(void)
 /* static int MS_CALLBACK cmp(FUNCTION *a, FUNCTION *b) */
 static int MS_CALLBACK cmp(const void *a_void, const void *b_void)
         {
-        return(strncmp(((FUNCTION *)a_void)->name,
-                        ((FUNCTION *)b_void)->name,8));
+        return(strncmp(((const FUNCTION *)a_void)->name,
+                        ((const FUNCTION *)b_void)->name,8));
         }
 
 /* static unsigned long MS_CALLBACK hash(FUNCTION *a) */
 static unsigned long MS_CALLBACK hash(const void *a_void)
         {
-        return(lh_strhash(((FUNCTION *)a_void)->name));
+        return(lh_strhash(((const FUNCTION *)a_void)->name));
         }
diff --git a/src/lib/libssl/src/apps/openssl.cnf b/src/lib/libssl/src/apps/openssl.cnf
index 4c1d595b0a..9e59020c17 100644
--- a/src/lib/libssl/src/apps/openssl.cnf
+++ b/src/lib/libssl/src/apps/openssl.cnf
@@ -44,8 +44,8 @@ new_certs_dir	= $dir/newcerts		# default place for new certs.
 
 certificate     = $dir/cacert.pem       # The CA certificate
 serial          = $dir/serial           # The current serial number
-#crlnumber      = $dir/crlnumber        # the current crl number must be
-                                        # commented out to leave a V1 CRL
+crlnumber       = $dir/crlnumber        # the current crl number
+                                        # must be commented out to leave a V1 CRL
 crl             = $dir/crl.pem          # The current CRL
 private_key     = $dir/private/cakey.pem# The private key
 RANDFILE        = $dir/private/.rand    # private random number file
@@ -67,7 +67,7 @@ cert_opt 	= ca_default		# Certificate field options
 
 default_days    = 365                   # how long to certify for
 default_crl_days= 30                    # how long before next CRL
-default_md      = md5                   # which md to use.
+default_md      = sha1                  # which md to use.
 preserve        = no                    # keep passed DN ordering
 
 # A few difference way of specifying how similar the request should look
@@ -188,7 +188,7 @@ nsComment			= "OpenSSL Generated Certificate"
 
 # PKIX recommendations harmless if included in all certificates.
 subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer:always
+authorityKeyIdentifier=keyid,issuer
 
 # This stuff is for subjectAltName and issuerAltname.
 # Import the email address.
diff --git a/src/lib/libssl/src/apps/passwd.c b/src/lib/libssl/src/apps/passwd.c
index d78716d1b5..473fe46cbd 100644
--- a/src/lib/libssl/src/apps/passwd.c
+++ b/src/lib/libssl/src/apps/passwd.c
@@ -312,7 +312,8 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
         static char out_buf[6 + 9 + 24 + 2]; /* "$apr1$..salt..$.......md5hash..........\0" */
         unsigned char buf[MD5_DIGEST_LENGTH];
         char *salt_out;
-        int n, i;
+        int n;
+        unsigned int i;
         EVP_MD_CTX md,md2;
         size_t passwd_len, salt_len;
 
@@ -358,13 +359,13 @@ static char *md5crypt(const char *passwd, const char *magic, const char *salt)
         for (i = 0; i < 1000; i++)
                 {
                 EVP_DigestInit_ex(&md2,EVP_md5(), NULL);
-                EVP_DigestUpdate(&md2, (i & 1) ? (unsigned char *) passwd : buf,
+                EVP_DigestUpdate(&md2, (i & 1) ? (unsigned const char *) passwd : buf,
                                        (i & 1) ? passwd_len : sizeof buf);
                 if (i % 3)
                         EVP_DigestUpdate(&md2, salt_out, salt_len);
                 if (i % 7)
                         EVP_DigestUpdate(&md2, passwd, passwd_len);
-                EVP_DigestUpdate(&md2, (i & 1) ? buf : (unsigned char *) passwd,
+                EVP_DigestUpdate(&md2, (i & 1) ? buf : (unsigned const char *) passwd,
                                        (i & 1) ? sizeof buf : passwd_len);
                 EVP_DigestFinal_ex(&md2, buf, NULL);
                 }
@@ -473,7 +474,8 @@ static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
         if ((strlen(passwd) > pw_maxlen))
                 {
                 if (!quiet)
-                        BIO_printf(bio_err, "Warning: truncating password to %u characters\n", pw_maxlen);
+                        /* XXX: really we should know how to print a size_t, not cast it */
+                        BIO_printf(bio_err, "Warning: truncating password to %u characters\n", (unsigned)pw_maxlen);
                 passwd[pw_maxlen] = 0;
                 }
         assert(strlen(passwd) <= pw_maxlen);
diff --git a/src/lib/libssl/src/apps/pkcs12.c b/src/lib/libssl/src/apps/pkcs12.c
index c961e6b57b..7c71b1a88f 100644
--- a/src/lib/libssl/src/apps/pkcs12.c
+++ b/src/lib/libssl/src/apps/pkcs12.c
@@ -1,11 +1,9 @@
 /* pkcs12.c */
-#if !defined(OPENSSL_NO_DES) && !defined(OPENSSL_NO_SHA1)
-
 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
- * project 1999.
+ * project.
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -58,6 +56,9 @@
  *
  */
 
+#include <openssl/opensslconf.h>
+#if !defined(OPENSSL_NO_DES) && !defined(OPENSSL_NO_SHA1)
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -83,7 +84,7 @@ int dump_certs_keys_p12(BIO *out, PKCS12 *p12, char *pass, int passlen, int opti
 int dump_certs_pkeys_bags(BIO *out, STACK_OF(PKCS12_SAFEBAG) *bags, char *pass,
                           int passlen, int options, char *pempass);
 int dump_certs_pkeys_bag(BIO *out, PKCS12_SAFEBAG *bags, char *pass, int passlen, int options, char *pempass);
-int print_attribs(BIO *out, STACK_OF(X509_ATTRIBUTE) *attrlst, char *name);
+int print_attribs(BIO *out, STACK_OF(X509_ATTRIBUTE) *attrlst,const char *name);
 void hex_prin(BIO *out, unsigned char *buf, int len);
 int alg_print(BIO *x, X509_ALGOR *alg);
 int cert_load(BIO *in, STACK_OF(X509) *sk);
@@ -109,7 +110,7 @@ int MAIN(int argc, char **argv)
     int maciter = PKCS12_DEFAULT_ITER;
     int twopass = 0;
     int keytype = 0;
-    int cert_pbe;
+    int cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
     int key_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
     int ret = 1;
     int macver = 1;
@@ -126,13 +127,6 @@ int MAIN(int argc, char **argv)
 
     apps_startup();
 
-#ifdef OPENSSL_FIPS
-    if (FIPS_mode())
-        cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
-    else
-#endif
-    cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;
-
     enc = EVP_des_ede3_cbc();
     if (bio_err == NULL ) bio_err = BIO_new_fp (stderr, BIO_NOCLOSE);
 
@@ -159,25 +153,38 @@ int MAIN(int argc, char **argv)
                         cert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
                 else if (!strcmp (*args, "-export")) export_cert = 1;
                 else if (!strcmp (*args, "-des")) enc=EVP_des_cbc();
+                else if (!strcmp (*args, "-des3")) enc = EVP_des_ede3_cbc();
 #ifndef OPENSSL_NO_IDEA
                 else if (!strcmp (*args, "-idea")) enc=EVP_idea_cbc();
 #endif
-                else if (!strcmp (*args, "-des3")) enc = EVP_des_ede3_cbc();
+#ifndef OPENSSL_NO_SEED
+                else if (!strcmp(*args, "-seed")) enc=EVP_seed_cbc();
+#endif
 #ifndef OPENSSL_NO_AES
                 else if (!strcmp(*args,"-aes128")) enc=EVP_aes_128_cbc();
                 else if (!strcmp(*args,"-aes192")) enc=EVP_aes_192_cbc();
                 else if (!strcmp(*args,"-aes256")) enc=EVP_aes_256_cbc();
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+                else if (!strcmp(*args,"-camellia128")) enc=EVP_camellia_128_cbc();
+                else if (!strcmp(*args,"-camellia192")) enc=EVP_camellia_192_cbc();
+                else if (!strcmp(*args,"-camellia256")) enc=EVP_camellia_256_cbc();
+#endif
                 else if (!strcmp (*args, "-noiter")) iter = 1;
                 else if (!strcmp (*args, "-maciter"))
                                          maciter = PKCS12_DEFAULT_ITER;
                 else if (!strcmp (*args, "-nomaciter"))
                                          maciter = 1;
+                else if (!strcmp (*args, "-nomac"))
+                                         maciter = -1;
                 else if (!strcmp (*args, "-nodes")) enc=NULL;
                 else if (!strcmp (*args, "-certpbe")) {
                         if (args[1]) {
                                 args++;
-                                cert_pbe=OBJ_txt2nid(*args);
+                                if (!strcmp(*args, "NONE"))
+                                        cert_pbe = -1;
+                                else
+                                        cert_pbe=OBJ_txt2nid(*args);
                                 if(cert_pbe == NID_undef) {
                                         BIO_printf(bio_err,
                                                  "Unknown PBE algorithm %s\n", *args);
@@ -187,7 +194,10 @@ int MAIN(int argc, char **argv)
                 } else if (!strcmp (*args, "-keypbe")) {
                         if (args[1]) {
                                 args++;
-                                key_pbe=OBJ_txt2nid(*args);
+                                if (!strcmp(*args, "NONE"))
+                                        key_pbe = -1;
+                                else
+                                        key_pbe=OBJ_txt2nid(*args);
                                 if(key_pbe == NID_undef) {
                                         BIO_printf(bio_err,
                                                  "Unknown PBE algorithm %s\n", *args);
@@ -299,10 +309,17 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_IDEA
         BIO_printf (bio_err, "-idea         encrypt private keys with idea\n");
 #endif
+#ifndef OPENSSL_NO_SEED
+        BIO_printf (bio_err, "-seed         encrypt private keys with seed\n");
+#endif
 #ifndef OPENSSL_NO_AES
         BIO_printf (bio_err, "-aes128, -aes192, -aes256\n");
         BIO_printf (bio_err, "              encrypt PEM output with cbc aes\n");
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+        BIO_printf (bio_err, "-camellia128, -camellia192, -camellia256\n");
+        BIO_printf (bio_err, "              encrypt PEM output with cbc camellia\n");
+#endif
         BIO_printf (bio_err, "-nodes        don't encrypt private keys\n");
         BIO_printf (bio_err, "-noiter       don't use encryption iteration\n");
         BIO_printf (bio_err, "-maciter      use MAC iteration\n");
@@ -372,24 +389,6 @@ int MAIN(int argc, char **argv)
             goto end;
    }
 
-#if 0
-   if (certfile) {
-        if(!(certsin = BIO_new_file(certfile, "r"))) {
-            BIO_printf(bio_err, "Can't open certificate file %s\n", certfile);
-            perror (certfile);
-            goto end;
-        }
-    }
-
-    if (keyname) {
-        if(!(inkey = BIO_new_file(keyname, "r"))) {
-            BIO_printf(bio_err, "Can't key certificate file %s\n", keyname);
-            perror (keyname);
-            goto end;
-        }
-     }
-#endif
-
 #ifdef CRYPTO_MDEBUG
     CRYPTO_pop_info();
     CRYPTO_push_info("write files");
@@ -426,27 +425,31 @@ int MAIN(int argc, char **argv)
 
     if (export_cert) {
         EVP_PKEY *key = NULL;
-        STACK_OF(PKCS12_SAFEBAG) *bags = NULL;
-        STACK_OF(PKCS7) *safes = NULL;
-        PKCS12_SAFEBAG *bag = NULL;
-        PKCS8_PRIV_KEY_INFO *p8 = NULL;
-        PKCS7 *authsafe = NULL;
-        X509 *ucert = NULL;
+        X509 *ucert = NULL, *x = NULL;
         STACK_OF(X509) *certs=NULL;
-        char *catmp = NULL;
+        unsigned char *catmp = NULL;
         int i;
-        unsigned char keyid[EVP_MAX_MD_SIZE];
-        unsigned int keyidlen = 0;
+
+        if ((options & (NOCERTS|NOKEYS)) == (NOCERTS|NOKEYS))
+                {       
+                BIO_printf(bio_err, "Nothing to do!\n");
+                goto export_end;
+                }
+
+        if (options & NOCERTS)
+                chain = 0;
 
 #ifdef CRYPTO_MDEBUG
         CRYPTO_push_info("process -export_cert");
         CRYPTO_push_info("reading private key");
 #endif
-        key = load_key(bio_err, keyname ? keyname : infile, FORMAT_PEM, 1,
-                passin, e, "private key");
-        if (!key) {
-                goto export_end;
-        }
+        if (!(options & NOKEYS))
+                {
+                key = load_key(bio_err, keyname ? keyname : infile,
+                                FORMAT_PEM, 1, passin, e, "private key");
+                if (!key)
+                        goto export_end;
+                }
 
 #ifdef CRYPTO_MDEBUG
         CRYPTO_pop_info();
@@ -454,49 +457,61 @@ int MAIN(int argc, char **argv)
 #endif
 
         /* Load in all certs in input file */
-        if(!(certs = load_certs(bio_err, infile, FORMAT_PEM, NULL, e,
-                "certificates"))) {
-                goto export_end;
-        }
+        if(!(options & NOCERTS))
+                {
+                certs = load_certs(bio_err, infile, FORMAT_PEM, NULL, e,
+                                                        "certificates");
+                if (!certs)
+                        goto export_end;
 
-#ifdef CRYPTO_MDEBUG
-        CRYPTO_pop_info();
-        CRYPTO_push_info("reading certs from input 2");
-#endif
+                if (key)
+                        {
+                        /* Look for matching private key */
+                        for(i = 0; i < sk_X509_num(certs); i++)
+                                {
+                                x = sk_X509_value(certs, i);
+                                if(X509_check_private_key(x, key))
+                                        {
+                                        ucert = x;
+                                        /* Zero keyid and alias */
+                                        X509_keyid_set1(ucert, NULL, 0);
+                                        X509_alias_set1(ucert, NULL, 0);
+                                        /* Remove from list */
+                                        (void)sk_X509_delete(certs, i);
+                                        break;
+                                        }
+                                }
+                        if (!ucert)
+                                {
+                                BIO_printf(bio_err, "No certificate matches private key\n");
+                                goto export_end;
+                                }
+                        }
 
-        for(i = 0; i < sk_X509_num(certs); i++) {
-                ucert = sk_X509_value(certs, i);
-                if(X509_check_private_key(ucert, key)) {
-                        X509_digest(ucert, EVP_sha1(), keyid, &keyidlen);
-                        break;
                 }
-        }
-        if(!keyidlen) {
-                ucert = NULL;
-                BIO_printf(bio_err, "No certificate matches private key\n");
-                goto export_end;
-        }
-        
+
 #ifdef CRYPTO_MDEBUG
         CRYPTO_pop_info();
-        CRYPTO_push_info("reading certs from certfile");
+        CRYPTO_push_info("reading certs from input 2");
 #endif
 
-        bags = sk_PKCS12_SAFEBAG_new_null ();
-
         /* Add any more certificates asked for */
-        if (certfile) {
+        if(certfile)
+                {
                 STACK_OF(X509) *morecerts=NULL;
                 if(!(morecerts = load_certs(bio_err, certfile, FORMAT_PEM,
                                             NULL, e,
-                                            "certificates from certfile"))) {
+                                            "certificates from certfile")))
                         goto export_end;
-                }
-                while(sk_X509_num(morecerts) > 0) {
+                while(sk_X509_num(morecerts) > 0)
                         sk_X509_push(certs, sk_X509_shift(morecerts));
-                }
                 sk_X509_free(morecerts);
-        }
+                }
+
+#ifdef CRYPTO_MDEBUG
+        CRYPTO_pop_info();
+        CRYPTO_push_info("reading certs from certfile");
+#endif
 
 #ifdef CRYPTO_MDEBUG
         CRYPTO_pop_info();
@@ -527,106 +542,64 @@ int MAIN(int argc, char **argv)
                     X509_free(sk_X509_value(chain2, 0));
                     sk_X509_free(chain2);
                 } else {
-                        BIO_printf (bio_err, "Error %s getting chain.\n",
+                        if (vret >= 0)
+                                BIO_printf (bio_err, "Error %s getting chain.\n",
                                         X509_verify_cert_error_string(vret));
+                        else
+                                ERR_print_errors(bio_err);
                         goto export_end;
                 }                       
         }
 
-#ifdef CRYPTO_MDEBUG
-        CRYPTO_pop_info();
-        CRYPTO_push_info("building bags");
-#endif
-
-        /* We now have loads of certificates: include them all */
-        for(i = 0; i < sk_X509_num(certs); i++) {
-                X509 *cert = NULL;
-                cert = sk_X509_value(certs, i);
-                bag = PKCS12_x5092certbag(cert);
-                /* If it matches private key set id */
-                if(cert == ucert) {
-                        if(name) PKCS12_add_friendlyname(bag, name, -1);
-                        PKCS12_add_localkeyid(bag, keyid, keyidlen);
-                } else if((catmp = sk_shift(canames))) 
-                                PKCS12_add_friendlyname(bag, catmp, -1);
-                sk_PKCS12_SAFEBAG_push(bags, bag);
-        }
-        sk_X509_pop_free(certs, X509_free);
-        certs = NULL;
-
-#ifdef CRYPTO_MDEBUG
-        CRYPTO_pop_info();
-        CRYPTO_push_info("encrypting bags");
-#endif
+        /* Add any CA names */
 
-        if(!noprompt &&
-                EVP_read_pw_string(pass, sizeof pass, "Enter Export Password:", 1)) {
-            BIO_printf (bio_err, "Can't read Password\n");
-            goto export_end;
-        }
-        if (!twopass) BUF_strlcpy(macpass, pass, sizeof macpass);
-        /* Turn certbags into encrypted authsafe */
-        authsafe = PKCS12_pack_p7encdata(cert_pbe, cpass, -1, NULL, 0,
-                                                                 iter, bags);
-        sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
-        bags = NULL;
-
-        if (!authsafe) {
-                ERR_print_errors (bio_err);
-                goto export_end;
-        }
-
-        safes = sk_PKCS7_new_null ();
-        sk_PKCS7_push (safes, authsafe);
-
-#ifdef CRYPTO_MDEBUG
-        CRYPTO_pop_info();
-        CRYPTO_push_info("building shrouded key bag");
-#endif
+        for (i = 0; i < sk_num(canames); i++)
+                {
+                catmp = (unsigned char *)sk_value(canames, i);
+                X509_alias_set1(sk_X509_value(certs, i), catmp, -1);
+                }
 
-        /* Make a shrouded key bag */
-        p8 = EVP_PKEY2PKCS8 (key);
-        if(keytype) PKCS8_add_keyusage(p8, keytype);
-        bag = PKCS12_MAKE_SHKEYBAG(key_pbe, cpass, -1, NULL, 0, iter, p8);
-        PKCS8_PRIV_KEY_INFO_free(p8);
-        p8 = NULL;
-        if (name) PKCS12_add_friendlyname (bag, name, -1);
-        if(csp_name) PKCS12_add_CSPName_asc(bag, csp_name, -1);
-        PKCS12_add_localkeyid (bag, keyid, keyidlen);
-        bags = sk_PKCS12_SAFEBAG_new_null();
-        sk_PKCS12_SAFEBAG_push (bags, bag);
+        if (csp_name && key)
+                EVP_PKEY_add1_attr_by_NID(key, NID_ms_csp_name,
+                                MBSTRING_ASC, (unsigned char *)csp_name, -1);
+                
 
 #ifdef CRYPTO_MDEBUG
         CRYPTO_pop_info();
-        CRYPTO_push_info("encrypting shrouded key bag");
+        CRYPTO_push_info("reading password");
 #endif
 
-        /* Turn it into unencrypted safe bag */
-        authsafe = PKCS12_pack_p7data (bags);
-        sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
-        bags = NULL;
-        sk_PKCS7_push (safes, authsafe);
+        if(!noprompt &&
+                EVP_read_pw_string(pass, sizeof pass, "Enter Export Password:", 1))
+                {
+                BIO_printf (bio_err, "Can't read Password\n");
+                goto export_end;
+                }
+        if (!twopass) BUF_strlcpy(macpass, pass, sizeof macpass);
 
 #ifdef CRYPTO_MDEBUG
         CRYPTO_pop_info();
-        CRYPTO_push_info("building pkcs12");
+        CRYPTO_push_info("creating PKCS#12 structure");
 #endif
 
-        p12 = PKCS12_init(NID_pkcs7_data);
-
-        PKCS12_pack_authsafes(p12, safes);
+        p12 = PKCS12_create(cpass, name, key, ucert, certs,
+                                key_pbe, cert_pbe, iter, -1, keytype);
 
-        sk_PKCS7_pop_free(safes, PKCS7_free);
-        safes = NULL;
+        if (!p12)
+                {
+                ERR_print_errors (bio_err);
+                goto export_end;
+                }
 
-        PKCS12_set_mac (p12, mpass, -1, NULL, 0, maciter, NULL);
+        if (maciter != -1)
+                PKCS12_set_mac(p12, mpass, -1, NULL, 0, maciter, NULL);
 
 #ifdef CRYPTO_MDEBUG
         CRYPTO_pop_info();
         CRYPTO_push_info("writing pkcs12");
 #endif
 
-        i2d_PKCS12_bio (out, p12);
+        i2d_PKCS12_bio(out, p12);
 
         ret = 0;
 
@@ -639,8 +612,7 @@ int MAIN(int argc, char **argv)
 
         if (key) EVP_PKEY_free(key);
         if (certs) sk_X509_pop_free(certs, X509_free);
-        if (safes) sk_PKCS7_pop_free(safes, PKCS7_free);
-        if (bags) sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
+        if (ucert) X509_free(ucert);
 
 #ifdef CRYPTO_MDEBUG
         CRYPTO_pop_info();
@@ -848,7 +820,7 @@ int get_cert_chain (X509 *cert, X509_STORE *store, STACK_OF(X509) **chain)
 {
         X509_STORE_CTX store_ctx;
         STACK_OF(X509) *chn;
-        int i;
+        int i = 0;
 
         /* FIXME: Should really check the return status of X509_STORE_CTX_init
          * for an error, but how that fits into the return value of this
@@ -856,13 +828,17 @@ int get_cert_chain (X509 *cert, X509_STORE *store, STACK_OF(X509) **chain)
         X509_STORE_CTX_init(&store_ctx, store, cert, NULL);
         if (X509_verify_cert(&store_ctx) <= 0) {
                 i = X509_STORE_CTX_get_error (&store_ctx);
+                if (i == 0)
+                        /* avoid returning 0 if X509_verify_cert() did not
+                         * set an appropriate error value in the context */
+                        i = -1;
+                chn = NULL;
                 goto err;
-        }
-        chn =  X509_STORE_CTX_get1_chain(&store_ctx);
-        i = 0;
-        *chain = chn;
+        } else
+                chn = X509_STORE_CTX_get1_chain(&store_ctx);
 err:
         X509_STORE_CTX_cleanup(&store_ctx);
+        *chain = chn;
         
         return i;
 }       
@@ -870,13 +846,16 @@ err:
 int alg_print (BIO *x, X509_ALGOR *alg)
 {
         PBEPARAM *pbe;
-        unsigned char *p;
+        const unsigned char *p;
         p = alg->parameter->value.sequence->data;
-        pbe = d2i_PBEPARAM (NULL, &p, alg->parameter->value.sequence->length);
-        BIO_printf (bio_err, "%s, Iteration %d\n", 
-        OBJ_nid2ln(OBJ_obj2nid(alg->algorithm)), ASN1_INTEGER_get(pbe->iter));
+        pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length);
+        if (!pbe)
+                return 1;
+        BIO_printf (bio_err, "%s, Iteration %ld\n", 
+                OBJ_nid2ln(OBJ_obj2nid(alg->algorithm)),
+                ASN1_INTEGER_get(pbe->iter));
         PBEPARAM_free (pbe);
-        return 0;
+        return 1;
 }
 
 /* Load all certificates from a given file */
@@ -908,7 +887,7 @@ int cert_load(BIO *in, STACK_OF(X509) *sk)
 
 /* Generalised attribute print: handle PKCS#8 and bag attributes */
 
-int print_attribs (BIO *out, STACK_OF(X509_ATTRIBUTE) *attrlst, char *name)
+int print_attribs (BIO *out, STACK_OF(X509_ATTRIBUTE) *attrlst,const char *name)
 {
         X509_ATTRIBUTE *attr;
         ASN1_TYPE *av;
diff --git a/src/lib/libssl/src/apps/progs.h b/src/lib/libssl/src/apps/progs.h
index 0493257bde..aafd800bdf 100644
--- a/src/lib/libssl/src/apps/progs.h
+++ b/src/lib/libssl/src/apps/progs.h
@@ -17,6 +17,8 @@ extern int rsa_main(int argc,char *argv[]);
 extern int rsautl_main(int argc,char *argv[]);
 extern int dsa_main(int argc,char *argv[]);
 extern int dsaparam_main(int argc,char *argv[]);
+extern int ec_main(int argc,char *argv[]);
+extern int ecparam_main(int argc,char *argv[]);
 extern int x509_main(int argc,char *argv[]);
 extern int genrsa_main(int argc,char *argv[]);
 extern int gendsa_main(int argc,char *argv[]);
@@ -26,6 +28,7 @@ extern int speed_main(int argc,char *argv[]);
 extern int s_time_main(int argc,char *argv[]);
 extern int version_main(int argc,char *argv[]);
 extern int pkcs7_main(int argc,char *argv[]);
+extern int cms_main(int argc,char *argv[]);
 extern int crl2pkcs7_main(int argc,char *argv[]);
 extern int sess_id_main(int argc,char *argv[]);
 extern int ciphers_main(int argc,char *argv[]);
@@ -35,11 +38,9 @@ extern int pkcs8_main(int argc,char *argv[]);
 extern int spkac_main(int argc,char *argv[]);
 extern int smime_main(int argc,char *argv[]);
 extern int rand_main(int argc,char *argv[]);
-extern int prime_main(int argc,char *argv[]);
-#ifndef OPENSSL_NO_ENGINE
 extern int engine_main(int argc,char *argv[]);
-#endif
 extern int ocsp_main(int argc,char *argv[]);
+extern int prime_main(int argc,char *argv[]);
 
 #define FUNC_TYPE_GENERAL       1
 #define FUNC_TYPE_MD            2
@@ -47,8 +48,8 @@ extern int ocsp_main(int argc,char *argv[]);
 
 typedef struct {
         int type;
-        char *name;
-        int (*func)();
+        const char *name;
+        int (*func)(int argc,char *argv[]);
         } FUNCTION;
 
 FUNCTION functions[] = {
@@ -82,6 +83,12 @@ FUNCTION functions[] = {
 #ifndef OPENSSL_NO_DSA
         {FUNC_TYPE_GENERAL,"dsaparam",dsaparam_main},
 #endif
+#ifndef OPENSSL_NO_EC
+        {FUNC_TYPE_GENERAL,"ec",ec_main},
+#endif
+#ifndef OPENSSL_NO_EC
+        {FUNC_TYPE_GENERAL,"ecparam",ecparam_main},
+#endif
         {FUNC_TYPE_GENERAL,"x509",x509_main},
 #ifndef OPENSSL_NO_RSA
         {FUNC_TYPE_GENERAL,"genrsa",genrsa_main},
@@ -103,6 +110,9 @@ FUNCTION functions[] = {
 #endif
         {FUNC_TYPE_GENERAL,"version",version_main},
         {FUNC_TYPE_GENERAL,"pkcs7",pkcs7_main},
+#ifndef OPENSSL_NO_CMS
+        {FUNC_TYPE_GENERAL,"cms",cms_main},
+#endif
         {FUNC_TYPE_GENERAL,"crl2pkcs7",crl2pkcs7_main},
         {FUNC_TYPE_GENERAL,"sess_id",sess_id_main},
 #if !defined(OPENSSL_NO_SOCK) && !(defined(OPENSSL_NO_SSL2) && defined(OPENSSL_NO_SSL3))
@@ -116,11 +126,11 @@ FUNCTION functions[] = {
         {FUNC_TYPE_GENERAL,"spkac",spkac_main},
         {FUNC_TYPE_GENERAL,"smime",smime_main},
         {FUNC_TYPE_GENERAL,"rand",rand_main},
-        {FUNC_TYPE_GENERAL,"prime",prime_main},
 #ifndef OPENSSL_NO_ENGINE
         {FUNC_TYPE_GENERAL,"engine",engine_main},
 #endif
         {FUNC_TYPE_GENERAL,"ocsp",ocsp_main},
+        {FUNC_TYPE_GENERAL,"prime",prime_main},
 #ifndef OPENSSL_NO_MD2
         {FUNC_TYPE_MD,"md2",dgst_main},
 #endif
@@ -160,6 +170,24 @@ FUNCTION functions[] = {
 #ifndef OPENSSL_NO_AES
         {FUNC_TYPE_CIPHER,"aes-256-ecb",enc_main},
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+        {FUNC_TYPE_CIPHER,"camellia-128-cbc",enc_main},
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+        {FUNC_TYPE_CIPHER,"camellia-128-ecb",enc_main},
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+        {FUNC_TYPE_CIPHER,"camellia-192-cbc",enc_main},
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+        {FUNC_TYPE_CIPHER,"camellia-192-ecb",enc_main},
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+        {FUNC_TYPE_CIPHER,"camellia-256-cbc",enc_main},
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+        {FUNC_TYPE_CIPHER,"camellia-256-ecb",enc_main},
+#endif
         {FUNC_TYPE_CIPHER,"base64",enc_main},
 #ifndef OPENSSL_NO_DES
         {FUNC_TYPE_CIPHER,"des",enc_main},
@@ -173,6 +201,9 @@ FUNCTION functions[] = {
 #ifndef OPENSSL_NO_IDEA
         {FUNC_TYPE_CIPHER,"idea",enc_main},
 #endif
+#ifndef OPENSSL_NO_SEED
+        {FUNC_TYPE_CIPHER,"seed",enc_main},
+#endif
 #ifndef OPENSSL_NO_RC4
         {FUNC_TYPE_CIPHER,"rc4",enc_main},
 #endif
@@ -239,6 +270,18 @@ FUNCTION functions[] = {
 #ifndef OPENSSL_NO_IDEA
         {FUNC_TYPE_CIPHER,"idea-ofb",enc_main},
 #endif
+#ifndef OPENSSL_NO_SEED
+        {FUNC_TYPE_CIPHER,"seed-cbc",enc_main},
+#endif
+#ifndef OPENSSL_NO_SEED
+        {FUNC_TYPE_CIPHER,"seed-ecb",enc_main},
+#endif
+#ifndef OPENSSL_NO_SEED
+        {FUNC_TYPE_CIPHER,"seed-cfb",enc_main},
+#endif
+#ifndef OPENSSL_NO_SEED
+        {FUNC_TYPE_CIPHER,"seed-ofb",enc_main},
+#endif
 #ifndef OPENSSL_NO_RC2
         {FUNC_TYPE_CIPHER,"rc2-cbc",enc_main},
 #endif
diff --git a/src/lib/libssl/src/apps/progs.pl b/src/lib/libssl/src/apps/progs.pl
index d6a40edb91..645432cfcc 100644
--- a/src/lib/libssl/src/apps/progs.pl
+++ b/src/lib/libssl/src/apps/progs.pl
@@ -16,8 +16,8 @@ print <<'EOF';
 
 typedef struct {
         int type;
-        char *name;
-        int (*func)();
+        const char *name;
+        int (*func)(int argc,char *argv[]);
         } FUNCTION;
 
 FUNCTION functions[] = {
@@ -29,14 +29,22 @@ foreach (@ARGV)
         $str="\t{FUNC_TYPE_GENERAL,\"$_\",${_}_main},\n";
         if (($_ =~ /^s_/) || ($_ =~ /^ciphers$/))
                 { print "#if !defined(OPENSSL_NO_SOCK) && !(defined(OPENSSL_NO_SSL2) && defined(OPENSSL_NO_SSL3))\n${str}#endif\n"; } 
+        elsif ( ($_ =~ /^speed$/))
+                { print "#ifndef OPENSSL_NO_SPEED\n${str}#endif\n"; }
+        elsif ( ($_ =~ /^engine$/))
+                { print "#ifndef OPENSSL_NO_ENGINE\n${str}#endif\n"; }
         elsif ( ($_ =~ /^rsa$/) || ($_ =~ /^genrsa$/) || ($_ =~ /^rsautl$/)) 
                 { print "#ifndef OPENSSL_NO_RSA\n${str}#endif\n";  }
         elsif ( ($_ =~ /^dsa$/) || ($_ =~ /^gendsa$/) || ($_ =~ /^dsaparam$/))
                 { print "#ifndef OPENSSL_NO_DSA\n${str}#endif\n"; }
+        elsif ( ($_ =~ /^ec$/) || ($_ =~ /^ecparam$/))
+                { print "#ifndef OPENSSL_NO_EC\n${str}#endif\n";}
         elsif ( ($_ =~ /^dh$/) || ($_ =~ /^gendh$/) || ($_ =~ /^dhparam$/))
                 { print "#ifndef OPENSSL_NO_DH\n${str}#endif\n"; }
         elsif ( ($_ =~ /^pkcs12$/))
                 { print "#if !defined(OPENSSL_NO_DES) && !defined(OPENSSL_NO_SHA1)\n${str}#endif\n"; }
+        elsif ( ($_ =~ /^cms$/))
+                { print "#ifndef OPENSSL_NO_CMS\n${str}#endif\n"; }
         else
                 { print $str; }
         }
@@ -51,14 +59,18 @@ foreach (
         "aes-128-cbc", "aes-128-ecb",
         "aes-192-cbc", "aes-192-ecb",
         "aes-256-cbc", "aes-256-ecb",
+        "camellia-128-cbc", "camellia-128-ecb",
+        "camellia-192-cbc", "camellia-192-ecb",
+        "camellia-256-cbc", "camellia-256-ecb",
         "base64",
-        "des", "des3", "desx", "idea", "rc4", "rc4-40",
+        "des", "des3", "desx", "idea", "seed", "rc4", "rc4-40",
         "rc2", "bf", "cast", "rc5",
         "des-ecb", "des-ede",    "des-ede3",
         "des-cbc", "des-ede-cbc","des-ede3-cbc",
         "des-cfb", "des-ede-cfb","des-ede3-cfb",
         "des-ofb", "des-ede-ofb","des-ede3-ofb",
-        "idea-cbc","idea-ecb",   "idea-cfb", "idea-ofb",
+        "idea-cbc","idea-ecb",    "idea-cfb", "idea-ofb",
+        "seed-cbc","seed-ecb",    "seed-cfb", "seed-ofb",
         "rc2-cbc", "rc2-ecb", "rc2-cfb","rc2-ofb", "rc2-64-cbc", "rc2-40-cbc",
         "bf-cbc",  "bf-ecb",     "bf-cfb",   "bf-ofb",
         "cast5-cbc","cast5-ecb", "cast5-cfb","cast5-ofb",
@@ -69,7 +81,9 @@ foreach (
         $t=sprintf("\t{FUNC_TYPE_CIPHER,\"%s\",enc_main},\n",$_);
         if    ($_ =~ /des/)  { $t="#ifndef OPENSSL_NO_DES\n${t}#endif\n"; }
         elsif ($_ =~ /aes/)  { $t="#ifndef OPENSSL_NO_AES\n${t}#endif\n"; }
+        elsif ($_ =~ /camellia/)  { $t="#ifndef OPENSSL_NO_CAMELLIA\n${t}#endif\n"; }
         elsif ($_ =~ /idea/) { $t="#ifndef OPENSSL_NO_IDEA\n${t}#endif\n"; }
+        elsif ($_ =~ /seed/) { $t="#ifndef OPENSSL_NO_SEED\n${t}#endif\n"; }
         elsif ($_ =~ /rc4/)  { $t="#ifndef OPENSSL_NO_RC4\n${t}#endif\n"; }
         elsif ($_ =~ /rc2/)  { $t="#ifndef OPENSSL_NO_RC2\n${t}#endif\n"; }
         elsif ($_ =~ /bf/)   { $t="#ifndef OPENSSL_NO_BF\n${t}#endif\n"; }
diff --git a/src/lib/libssl/src/apps/rand.c b/src/lib/libssl/src/apps/rand.c
index e23e84af82..fa35505c18 100644
--- a/src/lib/libssl/src/apps/rand.c
+++ b/src/lib/libssl/src/apps/rand.c
@@ -218,7 +218,7 @@ int MAIN(int argc, char **argv)
                 int chunk;
 
                 chunk = num;
-                if (chunk > sizeof buf)
+                if (chunk > (int)sizeof(buf))
                         chunk = sizeof buf;
                 r = RAND_bytes(buf, chunk);
                 if (r <= 0)
@@ -232,7 +232,7 @@ int MAIN(int argc, char **argv)
                 }
                 num -= chunk;
                 }
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         app_RAND_write_file(NULL, bio_err);
         ret = 0;
diff --git a/src/lib/libssl/src/apps/req.c b/src/lib/libssl/src/apps/req.c
index eebe71b15e..5ed08960c1 100644
--- a/src/lib/libssl/src/apps/req.c
+++ b/src/lib/libssl/src/apps/req.c
@@ -56,6 +56,12 @@
  * [including the GNU Public Licence.]
  */
 
+/* Until the key-gen callbacks are modified to use newer prototypes, we allow
+ * deprecated functions for openssl-internal code */
+#ifdef OPENSSL_NO_DEPRECATED
+#undef OPENSSL_NO_DEPRECATED
+#endif
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <time.h>
@@ -73,7 +79,13 @@
 #include <openssl/x509v3.h>
 #include <openssl/objects.h>
 #include <openssl/pem.h>
-#include "../crypto/cryptlib.h"
+#include <openssl/bn.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
 
 #define SECTION         "req"
 
@@ -113,9 +125,10 @@
  *                require.  This format is wrong
  */
 
-static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,char *dn,int attribs,
-                unsigned long chtype);
-static int build_subject(X509_REQ *req, char *subj, unsigned long chtype);
+static int make_REQ(X509_REQ *req,EVP_PKEY *pkey,char *dn,int mutlirdn,
+                int attribs,unsigned long chtype);
+static int build_subject(X509_REQ *req, char *subj, unsigned long chtype,
+                int multirdn);
 static int prompt_info(X509_REQ *req,
                 STACK_OF(CONF_VALUE) *dn_sk, char *dn_sect,
                 STACK_OF(CONF_VALUE) *attr_sk, char *attr_sect, int attribs,
@@ -123,16 +136,16 @@ static int prompt_info(X509_REQ *req,
 static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *sk,
                                 STACK_OF(CONF_VALUE) *attr, int attribs,
                                 unsigned long chtype);
-static int add_attribute_object(X509_REQ *req, char *text,
-                                char *def, char *value, int nid, int n_min,
+static int add_attribute_object(X509_REQ *req, char *text, const char *def,
+                                char *value, int nid, int n_min,
                                 int n_max, unsigned long chtype);
-static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
-        int nid,int n_min,int n_max, unsigned long chtype);
+static int add_DN_object(X509_NAME *n, char *text, const char *def, char *value,
+        int nid,int n_min,int n_max, unsigned long chtype, int mval);
 #ifndef OPENSSL_NO_RSA
-static void MS_CALLBACK req_cb(int p,int n,void *arg);
+static int MS_CALLBACK req_cb(int p, int n, BN_GENCB *cb);
 #endif
 static int req_check_len(int len,int n_min,int n_max);
-static int check_end(char *str, char *end);
+static int check_end(const char *str, const char *end);
 #ifndef MONOLITH
 static char *default_config_file=NULL;
 #endif
@@ -142,6 +155,7 @@ static int batch=0;
 #define TYPE_RSA        1
 #define TYPE_DSA        2
 #define TYPE_DH         3
+#define TYPE_EC         4
 
 int MAIN(int, char **);
 
@@ -151,6 +165,9 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_DSA
         DSA *dsa_params=NULL;
 #endif
+#ifndef OPENSSL_NO_ECDSA
+        EC_KEY *ec_params = NULL;
+#endif
         unsigned long nmflag = 0, reqflag = 0;
         int ex=1,x509=0,days=30;
         X509 *x509ss=NULL;
@@ -175,7 +192,8 @@ int MAIN(int argc, char **argv)
         char *passin = NULL, *passout = NULL;
         char *p;
         char *subj = NULL;
-        const EVP_MD *md_alg=NULL,*digest;
+        int multirdn = 0;
+        const EVP_MD *md_alg=NULL,*digest=EVP_sha1();
         unsigned long chtype = MBSTRING_ASC;
 #ifndef MONOLITH
         char *to_free;
@@ -197,13 +215,6 @@ int MAIN(int argc, char **argv)
         informat=FORMAT_PEM;
         outformat=FORMAT_PEM;
 
-#ifdef  OPENSSL_FIPS
-        if (FIPS_mode())
-                digest = EVP_sha1();
-        else
-#endif
-                digest = EVP_md5();
-
         prog=argv[0];
         argc--;
         argv++;
@@ -329,11 +340,64 @@ int MAIN(int argc, char **argv)
                                                 }
                                         }
                                 BIO_free(in);
-                                newkey=BN_num_bits(dsa_params->p);
                                 in=NULL;
+                                newkey=BN_num_bits(dsa_params->p);
                                 }
                         else 
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                                if (strncmp("ec:",p,3) == 0)
+                                {
+                                X509 *xtmp=NULL;
+                                EVP_PKEY *dtmp;
+                                EC_GROUP *group;
+
+                                pkey_type=TYPE_EC;
+                                p+=3;
+                                if ((in=BIO_new_file(p,"r")) == NULL)
+                                        {
+                                        perror(p);
+                                        goto end;
+                                        }
+                                if ((ec_params = EC_KEY_new()) == NULL)
+                                        goto end;
+                                group = PEM_read_bio_ECPKParameters(in, NULL, NULL, NULL);
+                                if (group == NULL)
+                                        {
+                                        EC_KEY_free(ec_params);
+                                        ERR_clear_error();
+                                        (void)BIO_reset(in);
+                                        if ((xtmp=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL)
+                                                {       
+                                                BIO_printf(bio_err,"unable to load EC parameters from file\n");
+                                                goto end;
+                                                }
+
+                                        if ((dtmp=X509_get_pubkey(xtmp))==NULL)
+                                                goto end;
+                                        if (dtmp->type == EVP_PKEY_EC)
+                                                ec_params = EC_KEY_dup(dtmp->pkey.ec);
+                                        EVP_PKEY_free(dtmp);
+                                        X509_free(xtmp);
+                                        if (ec_params == NULL)
+                                                {
+                                                BIO_printf(bio_err,"Certificate does not contain EC parameters\n");
+                                                goto end;
+                                                }
+                                        }
+                                else
+                                        {
+                                        if (EC_KEY_set_group(ec_params, group) == 0)
+                                                goto end;
+                                        EC_GROUP_free(group);
+                                        }
+
+                                BIO_free(in);
+                                in=NULL;
+                                newkey = EC_GROUP_get_degree(EC_KEY_get0_group(ec_params));
+                                }
+                        else
+#endif
 #ifndef OPENSSL_NO_DH
                                 if (strncmp("dh:",p,4) == 0)
                                 {
@@ -342,7 +406,9 @@ int MAIN(int argc, char **argv)
                                 }
                         else
 #endif
-                                pkey_type=TYPE_RSA;
+                                {
+                                goto bad;
+                                }
 
                         newreq=1;
                         }
@@ -387,6 +453,8 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         subj= *(++argv);
                         }
+                else if (strcmp(*argv,"-multivalue-rdn") == 0)
+                        multirdn=1;
                 else if (strcmp(*argv,"-days") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -452,9 +520,13 @@ bad:
                 BIO_printf(bio_err,"                the random number generator\n");
                 BIO_printf(bio_err," -newkey rsa:bits generate a new RSA key of 'bits' in size\n");
                 BIO_printf(bio_err," -newkey dsa:file generate a new DSA key, parameters taken from CA in 'file'\n");
+#ifndef OPENSSL_NO_ECDSA
+                BIO_printf(bio_err," -newkey ec:file generate a new EC key, parameters taken from CA in 'file'\n");
+#endif
                 BIO_printf(bio_err," -[digest]      Digest to sign with (md5, sha1, md2, mdc2, md4)\n");
                 BIO_printf(bio_err," -config file   request template file.\n");
                 BIO_printf(bio_err," -subj arg      set or modify request subject\n");
+                BIO_printf(bio_err," -multivalue-rdn enable support for multivalued RDNs\n");
                 BIO_printf(bio_err," -new           new request.\n");
                 BIO_printf(bio_err," -batch         do not ask anything during request generation\n");
                 BIO_printf(bio_err," -x509          output a x509 structure instead of a cert. req.\n");
@@ -647,7 +719,7 @@ bad:
                            message */
                         goto end;
                         }
-                if (EVP_PKEY_type(pkey->type) == EVP_PKEY_DSA)
+                else
                         {
                         char *randfile = NCONF_get_string(req_conf,SECTION,"RANDFILE");
                         if (randfile == NULL)
@@ -658,6 +730,9 @@ bad:
 
         if (newreq && (pkey == NULL))
                 {
+#ifndef OPENSSL_NO_RSA
+                BN_GENCB cb;
+#endif
                 char *randfile = NCONF_get_string(req_conf,SECTION,"RANDFILE");
                 if (randfile == NULL)
                         ERR_clear_error();
@@ -671,24 +746,33 @@ bad:
                                 newkey=DEFAULT_KEY_LENGTH;
                         }
 
-                if (newkey < MIN_KEY_LENGTH)
+                if (newkey < MIN_KEY_LENGTH && (pkey_type == TYPE_RSA || pkey_type == TYPE_DSA))
                         {
                         BIO_printf(bio_err,"private key length is too short,\n");
-                        BIO_printf(bio_err,"it needs to be at least %d bits, not %d\n",MIN_KEY_LENGTH,newkey);
+                        BIO_printf(bio_err,"it needs to be at least %d bits, not %ld\n",MIN_KEY_LENGTH,newkey);
                         goto end;
                         }
-                BIO_printf(bio_err,"Generating a %d bit %s private key\n",
-                        newkey,(pkey_type == TYPE_RSA)?"RSA":"DSA");
+                BIO_printf(bio_err,"Generating a %ld bit %s private key\n",
+                        newkey,(pkey_type == TYPE_RSA)?"RSA":
+                        (pkey_type == TYPE_DSA)?"DSA":"EC");
 
                 if ((pkey=EVP_PKEY_new()) == NULL) goto end;
 
 #ifndef OPENSSL_NO_RSA
+                BN_GENCB_set(&cb, req_cb, bio_err);
                 if (pkey_type == TYPE_RSA)
                         {
-                        if (!EVP_PKEY_assign_RSA(pkey,
-                                RSA_generate_key(newkey,0x10001,
-                                        req_cb,bio_err)))
+                        RSA *rsa = RSA_new();
+                        BIGNUM *bn = BN_new();
+                        if(!bn || !rsa || !BN_set_word(bn, 0x10001) ||
+                                        !RSA_generate_key_ex(rsa, newkey, bn, &cb) ||
+                                        !EVP_PKEY_assign_RSA(pkey, rsa))
+                                {
+                                if(bn) BN_free(bn);
+                                if(rsa) RSA_free(rsa);
                                 goto end;
+                                }
+                        BN_free(bn);
                         }
                 else
 #endif
@@ -700,6 +784,15 @@ bad:
                         dsa_params=NULL;
                         }
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                        if (pkey_type == TYPE_EC)
+                        {
+                        if (!EC_KEY_generate_key(ec_params)) goto end;
+                        if (!EVP_PKEY_assign_EC_KEY(pkey, ec_params)) 
+                                goto end;
+                        ec_params = NULL;
+                        }
+#endif
 
                 app_RAND_write_file(randfile, bio_err);
 
@@ -806,6 +899,10 @@ loop:
                 if (pkey->type == EVP_PKEY_DSA)
                         digest=EVP_dss1();
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                if (pkey->type == EVP_PKEY_EC)
+                        digest=EVP_ecdsa();
+#endif
                 if (req == NULL)
                         {
                         req=X509_REQ_new();
@@ -814,7 +911,7 @@ loop:
                                 goto end;
                                 }
 
-                        i=make_REQ(req,pkey,subj,!x509, chtype);
+                        i=make_REQ(req,pkey,subj,multirdn,!x509, chtype);
                         subj=NULL; /* done processing '-subj' option */
                         if ((kludge > 0) && !sk_X509_ATTRIBUTE_num(req->req_info->attributes))
                                 {
@@ -909,7 +1006,7 @@ loop:
                         print_name(bio_err, "old subject=", X509_REQ_get_subject_name(req), nmflag);
                         }
 
-                if (build_subject(req, subj, chtype) == 0)
+                if (build_subject(req, subj, chtype, multirdn) == 0)
                         {
                         BIO_printf(bio_err, "ERROR: cannot modify subject\n");
                         ex=1;
@@ -1093,12 +1190,15 @@ end:
 #ifndef OPENSSL_NO_DSA
         if (dsa_params != NULL) DSA_free(dsa_params);
 #endif
+#ifndef OPENSSL_NO_ECDSA
+        if (ec_params != NULL) EC_KEY_free(ec_params);
+#endif
         apps_shutdown();
         OPENSSL_EXIT(ex);
         }
 
-static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs,
-                        unsigned long chtype)
+static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int multirdn,
+                        int attribs, unsigned long chtype)
         {
         int ret=0,i;
         char no_prompt = 0;
@@ -1148,7 +1248,7 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int attribs,
         else 
                 {
                 if (subj)
-                        i = build_subject(req, subj, chtype);
+                        i = build_subject(req, subj, chtype, multirdn);
                 else
                         i = prompt_info(req, dn_sk, dn_sect, attr_sk, attr_sect, attribs, chtype);
                 }
@@ -1165,11 +1265,11 @@ err:
  * subject is expected to be in the format /type0=value0/type1=value1/type2=...
  * where characters may be escaped by \
  */
-static int build_subject(X509_REQ *req, char *subject, unsigned long chtype)
+static int build_subject(X509_REQ *req, char *subject, unsigned long chtype, int multirdn)
         {
         X509_NAME *n;
 
-        if (!(n = do_subject(subject, chtype)))
+        if (!(n = parse_name(subject, chtype, multirdn)))
                 return 0;
 
         if (!X509_REQ_set_subject_name(req, n))
@@ -1190,9 +1290,10 @@ static int prompt_info(X509_REQ *req,
         int i;
         char *p,*q;
         char buf[100];
-        int nid;
+        int nid, mval;
         long n_min,n_max;
-        char *type,*def,*value;
+        char *type, *value;
+        const char *def;
         CONF_VALUE *v;
         X509_NAME *subj;
         subj = X509_REQ_get_subject_name(req);
@@ -1233,10 +1334,17 @@ start:		for (;;)
                                         if(*p) type = p;
                                         break;
                                 }
+                        if (*type == '+')
+                                {
+                                mval = -1;
+                                type++;
+                                }
+                        else
+                                mval = 0;
                         /* If OBJ not recognised ignore it */
                         if ((nid=OBJ_txt2nid(type)) == NID_undef) goto start;
                         if (BIO_snprintf(buf,sizeof buf,"%s_default",v->name)
-                                >= sizeof buf)
+                                >= (int)sizeof(buf))
                            {
                            BIO_printf(bio_err,"Name '%s' too long\n",v->name);
                            return 0;
@@ -1270,7 +1378,7 @@ start:		for (;;)
                                 }
 
                         if (!add_DN_object(subj,v->value,def,value,nid,
-                                n_min,n_max, chtype))
+                                n_min,n_max, chtype, mval))
                                 return 0;
                         }
                 if (X509_NAME_entry_count(subj) == 0)
@@ -1301,7 +1409,7 @@ start2:			for (;;)
                                         goto start2;
 
                                 if (BIO_snprintf(buf,sizeof buf,"%s_default",type)
-                                        >= sizeof buf)
+                                        >= (int)sizeof(buf))
                                    {
                                    BIO_printf(bio_err,"Name '%s' too long\n",v->name);
                                    return 0;
@@ -1360,6 +1468,7 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk,
 
         for (i = 0; i < sk_CONF_VALUE_num(dn_sk); i++)
                 {
+                int mval;
                 v=sk_CONF_VALUE_value(dn_sk,i);
                 p=q=NULL;
                 type=v->name;
@@ -1376,8 +1485,19 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk,
                                 if(*p) type = p;
                                 break;
                         }
+#ifndef CHARSET_EBCDIC
+                if (*p == '+')
+#else
+                if (*p == os_toascii['+'])
+#endif
+                        {
+                        p++;
+                        mval = -1;
+                        }
+                else
+                        mval = 0;
                 if (!X509_NAME_add_entry_by_txt(subj,type, chtype,
-                                (unsigned char *) v->value,-1,-1,0)) return 0;
+                                (unsigned char *) v->value,-1,-1,mval)) return 0;
 
                 }
 
@@ -1399,8 +1519,8 @@ static int auto_info(X509_REQ *req, STACK_OF(CONF_VALUE) *dn_sk,
         }
 
 
-static int add_DN_object(X509_NAME *n, char *text, char *def, char *value,
-             int nid, int n_min, int n_max, unsigned long chtype)
+static int add_DN_object(X509_NAME *n, char *text, const char *def, char *value,
+             int nid, int n_min, int n_max, unsigned long chtype, int mval)
         {
         int i,ret=0;
         MS_STATIC char buf[1024];
@@ -1449,14 +1569,14 @@ start:
 #endif
         if(!req_check_len(i, n_min, n_max)) goto start;
         if (!X509_NAME_add_entry_by_NID(n,nid, chtype,
-                                (unsigned char *) buf, -1,-1,0)) goto err;
+                                (unsigned char *) buf, -1,-1,mval)) goto err;
         ret=1;
 err:
         return(ret);
         }
 
-static int add_attribute_object(X509_REQ *req, char *text,
-                                char *def, char *value, int nid, int n_min,
+static int add_attribute_object(X509_REQ *req, char *text, const char *def,
+                                char *value, int nid, int n_min,
                                 int n_max, unsigned long chtype)
         {
         int i;
@@ -1520,7 +1640,7 @@ err:
         }
 
 #ifndef OPENSSL_NO_RSA
-static void MS_CALLBACK req_cb(int p, int n, void *arg)
+static int MS_CALLBACK req_cb(int p, int n, BN_GENCB *cb)
         {
         char c='*';
 
@@ -1528,11 +1648,12 @@ static void MS_CALLBACK req_cb(int p, int n, void *arg)
         if (p == 1) c='+';
         if (p == 2) c='*';
         if (p == 3) c='\n';
-        BIO_write((BIO *)arg,&c,1);
-        (void)BIO_flush((BIO *)arg);
+        BIO_write(cb->arg,&c,1);
+        (void)BIO_flush(cb->arg);
 #ifdef LINT
         p=n;
 #endif
+        return 1;
         }
 #endif
 
@@ -1552,10 +1673,10 @@ static int req_check_len(int len, int n_min, int n_max)
         }
 
 /* Check if the end of a string matches 'end' */
-static int check_end(char *str, char *end)
+static int check_end(const char *str, const char *end)
 {
         int elen, slen; 
-        char *tmp;
+        const char *tmp;
         elen = strlen(end);
         slen = strlen(str);
         if(elen > slen) return 1;
diff --git a/src/lib/libssl/src/apps/rsa.c b/src/lib/libssl/src/apps/rsa.c
index 0acdb08b24..930f1f038a 100644
--- a/src/lib/libssl/src/apps/rsa.c
+++ b/src/lib/libssl/src/apps/rsa.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/opensslconf.h>
 #ifndef OPENSSL_NO_RSA
 #include <stdio.h>
 #include <stdlib.h>
@@ -68,6 +69,7 @@
 #include <openssl/evp.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
+#include <openssl/bn.h>
 
 #undef PROG
 #define PROG    rsa_main
@@ -79,9 +81,13 @@
  * -des         - encrypt output if PEM format with DES in cbc mode
  * -des3        - encrypt output if PEM format
  * -idea        - encrypt output if PEM format
+ * -seed        - encrypt output if PEM format
  * -aes128      - encrypt output if PEM format
  * -aes192      - encrypt output if PEM format
  * -aes256      - encrypt output if PEM format
+ * -camellia128 - encrypt output if PEM format
+ * -camellia192 - encrypt output if PEM format
+ * -camellia256 - encrypt output if PEM format
  * -text        - print a text version
  * -modulus     - print the RSA key modulus
  * -check       - verify key consistency
@@ -206,10 +212,17 @@ bad:
 #ifndef OPENSSL_NO_IDEA
                 BIO_printf(bio_err," -idea           encrypt PEM output with cbc idea\n");
 #endif
+#ifndef OPENSSL_NO_SEED
+                BIO_printf(bio_err," -seed           encrypt PEM output with cbc seed\n");
+#endif
 #ifndef OPENSSL_NO_AES
                 BIO_printf(bio_err," -aes128, -aes192, -aes256\n");
                 BIO_printf(bio_err,"                 encrypt PEM output with cbc aes\n");
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+                BIO_printf(bio_err," -camellia128, -camellia192, -camellia256\n");
+                BIO_printf(bio_err,"                 encrypt PEM output with cbc camellia\n");
+#endif
                 BIO_printf(bio_err," -text           print the key in text\n");
                 BIO_printf(bio_err," -noout          don't print key out\n");
                 BIO_printf(bio_err," -modulus        print the RSA key modulus\n");
@@ -307,7 +320,7 @@ bad:
                         BIO_printf(out,"RSA key ok\n");
                 else if (r == 0)
                         {
-                        long err;
+                        unsigned long err;
 
                         while ((err = ERR_peek_error()) != 0 &&
                                 ERR_GET_LIB(err) == ERR_LIB_RSA &&
diff --git a/src/lib/libssl/src/apps/rsautl.c b/src/lib/libssl/src/apps/rsautl.c
index bdfbe31c14..f3c458ed27 100644
--- a/src/lib/libssl/src/apps/rsautl.c
+++ b/src/lib/libssl/src/apps/rsautl.c
@@ -3,7 +3,7 @@
  * project 2000.
  */
 /* ====================================================================
- * Copyright (c) 2000-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -56,12 +56,14 @@
  *
  */
 
+#include <openssl/opensslconf.h>
 #ifndef OPENSSL_NO_RSA
 
 #include "apps.h"
 #include <string.h>
 #include <openssl/err.h>
 #include <openssl/pem.h>
+#include <openssl/rsa.h>
 
 #define RSA_SIGN        1
 #define RSA_VERIFY      2
@@ -117,24 +119,36 @@ int MAIN(int argc, char **argv)
         while(argc >= 1)
         {
                 if (!strcmp(*argv,"-in")) {
-                        if (--argc < 1) badarg = 1;
-                        infile= *(++argv);
+                        if (--argc < 1)
+                                badarg = 1;
+                        else
+                                infile= *(++argv);
                 } else if (!strcmp(*argv,"-out")) {
-                        if (--argc < 1) badarg = 1;
-                        outfile= *(++argv);
+                        if (--argc < 1)
+                                badarg = 1;
+                        else
+                                outfile= *(++argv);
                 } else if(!strcmp(*argv, "-inkey")) {
-                        if (--argc < 1) badarg = 1;
-                        keyfile = *(++argv);
+                        if (--argc < 1)
+                                badarg = 1;
+                        else
+                                keyfile = *(++argv);
                 } else if (!strcmp(*argv,"-passin")) {
-                        if (--argc < 1) badarg = 1;
-                        passargin= *(++argv);
+                        if (--argc < 1)
+                                badarg = 1;
+                        else
+                                passargin= *(++argv);
                 } else if (strcmp(*argv,"-keyform") == 0) {
-                        if (--argc < 1) badarg = 1;
-                        keyform=str2fmt(*(++argv));
+                        if (--argc < 1)
+                                badarg = 1;
+                        else
+                                keyform=str2fmt(*(++argv));
 #ifndef OPENSSL_NO_ENGINE
                 } else if(!strcmp(*argv, "-engine")) {
-                        if (--argc < 1) badarg = 1;
-                        engine = *(++argv);
+                        if (--argc < 1)
+                                badarg = 1;
+                        else
+                                engine = *(++argv);
 #endif
                 } else if(!strcmp(*argv, "-pubin")) {
                         key_type = KEY_PUBKEY;
diff --git a/src/lib/libssl/src/apps/s_apps.h b/src/lib/libssl/src/apps/s_apps.h
index 48e7dbaddc..023faa8467 100644
--- a/src/lib/libssl/src/apps/s_apps.h
+++ b/src/lib/libssl/src/apps/s_apps.h
@@ -108,8 +108,9 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
-
+#if !defined(OPENSSL_SYS_NETWARE)  /* conflicts with winsock2 stuff on netware */
 #include <sys/types.h>
+#endif
 #include <openssl/opensslconf.h>
 
 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
@@ -147,22 +148,26 @@ typedef fd_mask fd_set;
 #define PORT_STR        "4433"
 #define PROTOCOL        "tcp"
 
-int do_server(int port, int *ret, int (*cb) (), char *context);
+int do_server(int port, int type, int *ret, int (*cb) (char *hostname, int s, unsigned char *context), unsigned char *context);
 #ifdef HEADER_X509_H
 int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 #endif
 #ifdef HEADER_SSL_H
 int set_cert_stuff(SSL_CTX *ctx, char *cert_file, char *key_file);
+int set_cert_key_stuff(SSL_CTX *ctx, X509 *cert, EVP_PKEY *key);
 #endif
-int init_client(int *sock, char *server, char *port, int af);
+int init_client(int *sock, char *server, int port, int type, int af);
 int should_retry(int i);
 int extract_port(char *str, short *port_ptr);
 int extract_host_port(char *str,char **host_ptr,unsigned char *ip,char **p);
 
-long MS_CALLBACK bio_dump_cb(BIO *bio, int cmd, const char *argp,
+long MS_CALLBACK bio_dump_callback(BIO *bio, int cmd, const char *argp,
         int argi, long argl, long ret);
 
 #ifdef HEADER_SSL_H
 void MS_CALLBACK apps_ssl_info_callback(const SSL *s, int where, int ret);
 void MS_CALLBACK msg_cb(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg);
+void MS_CALLBACK tlsext_cb(SSL *s, int client_server, int type,
+                                        unsigned char *data, int len,
+                                        void *arg);
 #endif
diff --git a/src/lib/libssl/src/apps/s_cb.c b/src/lib/libssl/src/apps/s_cb.c
index 675527df1f..a512589e8c 100644
--- a/src/lib/libssl/src/apps/s_cb.c
+++ b/src/lib/libssl/src/apps/s_cb.c
@@ -229,8 +229,36 @@ int set_cert_stuff(SSL_CTX *ctx, char *cert_file, char *key_file)
         return(1);
         }
 
-long MS_CALLBACK bio_dump_cb(BIO *bio, int cmd, const char *argp, int argi,
-             long argl, long ret)
+int set_cert_key_stuff(SSL_CTX *ctx, X509 *cert, EVP_PKEY *key)
+        {
+        if (cert ==  NULL)
+                return 1;
+        if (SSL_CTX_use_certificate(ctx,cert) <= 0)
+                {
+                BIO_printf(bio_err,"error setting certificate\n");
+                ERR_print_errors(bio_err);
+                return 0;
+                }
+        if (SSL_CTX_use_PrivateKey(ctx,key) <= 0)
+                {
+                BIO_printf(bio_err,"error setting private key\n");
+                ERR_print_errors(bio_err);
+                return 0;
+                }
+
+                
+                /* Now we know that a key and cert have been set against
+                 * the SSL context */
+        if (!SSL_CTX_check_private_key(ctx))
+                {
+                BIO_printf(bio_err,"Private key does not match the certificate public key\n");
+                return 0;
+                }
+        return 1;
+        }
+
+long MS_CALLBACK bio_dump_callback(BIO *bio, int cmd, const char *argp,
+        int argi, long argl, long ret)
         {
         BIO *out;
 
@@ -239,15 +267,15 @@ long MS_CALLBACK bio_dump_cb(BIO *bio, int cmd, const char *argp, int argi,
 
         if (cmd == (BIO_CB_READ|BIO_CB_RETURN))
                 {
-                BIO_printf(out,"read from %08X [%08lX] (%d bytes => %ld (0x%X))\n",
-                        bio,argp,argi,ret,ret);
+                BIO_printf(out,"read from %p [%p] (%d bytes => %ld (0x%lX))\n",
+                        (void *)bio,argp,argi,ret,ret);
                 BIO_dump(out,argp,(int)ret);
                 return(ret);
                 }
         else if (cmd == (BIO_CB_WRITE|BIO_CB_RETURN))
                 {
-                BIO_printf(out,"write to %08X [%08lX] (%d bytes => %ld (0x%X))\n",
-                        bio,argp,argi,ret,ret);
+                BIO_printf(out,"write to %p [%p] (%d bytes => %ld (0x%lX))\n",
+                        (void *)bio,argp,argi,ret,ret);
                 BIO_dump(out,argp,(int)ret);
                 }
         return(ret);
@@ -255,7 +283,7 @@ long MS_CALLBACK bio_dump_cb(BIO *bio, int cmd, const char *argp, int argi,
 
 void MS_CALLBACK apps_ssl_info_callback(const SSL *s, int where, int ret)
         {
-        char *str;
+        const char *str;
         int w;
 
         w=where& ~SSL_ST_MASK;
@@ -318,14 +346,14 @@ void MS_CALLBACK msg_cb(int write_p, int version, int content_type, const void *
 
                 if (len > 0)
                         {
-                        switch (((unsigned char*)buf)[0])
+                        switch (((const unsigned char*)buf)[0])
                                 {
                                 case 0:
                                         str_details1 = ", ERROR:";
                                         str_details2 = " ???";
                                         if (len >= 3)
                                                 {
-                                                unsigned err = (((unsigned char*)buf)[1]<<8) + ((unsigned char*)buf)[2];
+                                                unsigned err = (((const unsigned char*)buf)[1]<<8) + ((const unsigned char*)buf)[2];
                                                 
                                                 switch (err)
                                                         {
@@ -394,7 +422,7 @@ void MS_CALLBACK msg_cb(int write_p, int version, int content_type, const void *
                         
                         if (len == 2)
                                 {
-                                switch (((unsigned char*)buf)[0])
+                                switch (((const unsigned char*)buf)[0])
                                         {
                                 case 1:
                                         str_details1 = ", warning";
@@ -405,7 +433,7 @@ void MS_CALLBACK msg_cb(int write_p, int version, int content_type, const void *
                                         }
 
                                 str_details2 = " ???";
-                                switch (((unsigned char*)buf)[1])
+                                switch (((const unsigned char*)buf)[1])
                                         {
                                 case 0:
                                         str_details2 = " close_notify";
@@ -486,7 +514,7 @@ void MS_CALLBACK msg_cb(int write_p, int version, int content_type, const void *
 
                         if (len > 0)
                                 {
-                                switch (((unsigned char*)buf)[0])
+                                switch (((const unsigned char*)buf)[0])
                                         {
                                 case 0:
                                         str_details1 = ", HelloRequest";
@@ -539,11 +567,70 @@ void MS_CALLBACK msg_cb(int write_p, int version, int content_type, const void *
                         {
                         if (i % 16 == 0 && i > 0)
                                 BIO_printf(bio, "\n   ");
-                        BIO_printf(bio, " %02x", ((unsigned char*)buf)[i]);
+                        BIO_printf(bio, " %02x", ((const unsigned char*)buf)[i]);
                         }
                 if (i < len)
                         BIO_printf(bio, " ...");
                 BIO_printf(bio, "\n");
                 }
-        BIO_flush(bio);
+        (void)BIO_flush(bio);
+        }
+
+void MS_CALLBACK tlsext_cb(SSL *s, int client_server, int type,
+                                        unsigned char *data, int len,
+                                        void *arg)
+        {
+        BIO *bio = arg;
+        char *extname;
+
+        switch(type)
+                {
+                case TLSEXT_TYPE_server_name:
+                extname = "server name";
+                break;
+
+                case TLSEXT_TYPE_max_fragment_length:
+                extname = "max fragment length";
+                break;
+
+                case TLSEXT_TYPE_client_certificate_url:
+                extname = "client certificate URL";
+                break;
+
+                case TLSEXT_TYPE_trusted_ca_keys:
+                extname = "trusted CA keys";
+                break;
+
+                case TLSEXT_TYPE_truncated_hmac:
+                extname = "truncated HMAC";
+                break;
+
+                case TLSEXT_TYPE_status_request:
+                extname = "status request";
+                break;
+
+                case TLSEXT_TYPE_elliptic_curves:
+                extname = "elliptic curves";
+                break;
+
+                case TLSEXT_TYPE_ec_point_formats:
+                extname = "EC point formats";
+                break;
+
+                case TLSEXT_TYPE_session_ticket:
+                extname = "server ticket";
+                break;
+
+
+                default:
+                extname = "unknown";
+                break;
+
+                }
+        
+        BIO_printf(bio, "TLS %s extension \"%s\" (id=%d), len=%d\n",
+                        client_server ? "server": "client",
+                        extname, type, len);
+        BIO_dump(bio, (char *)data, len);
+        (void)BIO_flush(bio);
         }
diff --git a/src/lib/libssl/src/apps/s_client.c b/src/lib/libssl/src/apps/s_client.c
index 78bc10d315..f01017ba48 100644
--- a/src/lib/libssl/src/apps/s_client.c
+++ b/src/lib/libssl/src/apps/s_client.c
@@ -136,7 +136,9 @@ typedef unsigned int u_int;
 #include <openssl/err.h>
 #include <openssl/pem.h>
 #include <openssl/rand.h>
+#include <openssl/ocsp.h>
 #include "s_apps.h"
+#include "timeouts.h"
 
 #ifdef OPENSSL_SYS_WINCE
 /* Windows CE incorrectly defines fileno as returning void*, so to avoid problems below... */
@@ -172,11 +174,18 @@ static int c_nbio=0;
 #endif
 static int c_Pause=0;
 static int c_debug=0;
+#ifndef OPENSSL_NO_TLSEXT
+static int c_tlsextdebug=0;
+static int c_status_req=0;
+#endif
 static int c_msg=0;
 static int c_showcerts=0;
 
 static void sc_usage(void);
 static void print_stuff(BIO *berr,SSL *con,int full);
+#ifndef OPENSSL_NO_TLSEXT
+static int ocsp_resp_cb(SSL *s, void *arg);
+#endif
 static BIO *bio_c_out=NULL;
 static int c_quiet=0;
 static int c_ign_eof=0;
@@ -191,10 +200,13 @@ static void sc_usage(void)
         BIO_printf(bio_err," -port port     - use -connect instead\n");
         BIO_printf(bio_err," -connect host:port - who to connect to (default is %s:%s)\n",SSL_HOST_NAME,PORT_STR);
 
-        BIO_printf(bio_err," -verify arg   - turn on peer certificate verification\n");
+        BIO_printf(bio_err," -verify depth - turn on peer certificate verification\n");
         BIO_printf(bio_err," -cert arg     - certificate file to use, PEM format assumed\n");
-        BIO_printf(bio_err," -key arg      - Private key file to use, PEM format assumed, in cert file if\n");
+        BIO_printf(bio_err," -certform arg - certificate format (PEM or DER) PEM default\n");
+        BIO_printf(bio_err," -key arg      - Private key file to use, in cert file if\n");
         BIO_printf(bio_err,"                 not specified but cert file is.\n");
+        BIO_printf(bio_err," -keyform arg  - key format (PEM or DER) PEM default\n");
+        BIO_printf(bio_err," -pass arg     - private key file pass phrase source\n");
         BIO_printf(bio_err," -CApath arg   - PEM format directory of CA's\n");
         BIO_printf(bio_err," -CAfile arg   - PEM format file of CA's\n");
         BIO_printf(bio_err," -reconnect    - Drop and re-make the connection with the same Session-ID\n");
@@ -216,6 +228,8 @@ static void sc_usage(void)
         BIO_printf(bio_err," -ssl2         - just use SSLv2\n");
         BIO_printf(bio_err," -ssl3         - just use SSLv3\n");
         BIO_printf(bio_err," -tls1         - just use TLSv1\n");
+        BIO_printf(bio_err," -dtls1        - just use DTLSv1\n");    
+        BIO_printf(bio_err," -mtu          - set the MTU\n");
         BIO_printf(bio_err," -no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol\n");
         BIO_printf(bio_err," -bugs         - Switch on all SSL implementation bug workarounds\n");
         BIO_printf(bio_err," -serverpref   - Use server's cipher preferences (only SSLv2)\n");
@@ -224,13 +238,50 @@ static void sc_usage(void)
         BIO_printf(bio_err," -starttls prot - use the STARTTLS command before starting TLS\n");
         BIO_printf(bio_err,"                 for those protocols that support it, where\n");
         BIO_printf(bio_err,"                 'prot' defines which one to assume.  Currently,\n");
-        BIO_printf(bio_err,"                 only \"smtp\" and \"pop3\" are supported.\n");
+        BIO_printf(bio_err,"                 only \"smtp\", \"pop3\", \"imap\", and \"ftp\" are supported.\n");
 #ifndef OPENSSL_NO_ENGINE
         BIO_printf(bio_err," -engine id    - Initialise and use the specified engine\n");
 #endif
         BIO_printf(bio_err," -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
+        BIO_printf(bio_err," -sess_out arg - file to write SSL session to\n");
+        BIO_printf(bio_err," -sess_in arg  - file to read SSL session from\n");
+#ifndef OPENSSL_NO_TLSEXT
+        BIO_printf(bio_err," -servername host  - Set TLS extension servername in ClientHello\n");
+        BIO_printf(bio_err," -tlsextdebug      - hex dump of all TLS extensions received\n");
+        BIO_printf(bio_err," -status           - request certificate status from server\n");
+        BIO_printf(bio_err," -no_ticket        - disable use of RFC4507bis session tickets\n");
+#endif
+        }
+
+#ifndef OPENSSL_NO_TLSEXT
 
+/* This is a context that we pass to callbacks */
+typedef struct tlsextctx_st {
+   BIO * biodebug;
+   int ack;
+} tlsextctx;
+
+
+static int MS_CALLBACK ssl_servername_cb(SSL *s, int *ad, void *arg)
+        {
+        tlsextctx * p = (tlsextctx *) arg;
+        const char * hn= SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
+        if (SSL_get_servername_type(s) != -1) 
+                p->ack = !SSL_session_reused(s) && hn != NULL;
+        else 
+                BIO_printf(bio_err,"Can't use SSL_get_servername\n");
+        
+        return SSL_TLSEXT_ERR_OK;
         }
+#endif
+enum
+{
+        PROTO_OFF       = 0,
+        PROTO_SMTP,
+        PROTO_POP3,
+        PROTO_IMAP,
+        PROTO_FTP
+};
 
 int MAIN(int, char **);
 
@@ -243,31 +294,52 @@ int MAIN(int argc, char **argv)
         char *cbuf=NULL,*sbuf=NULL,*mbuf=NULL;
         int cbuf_len,cbuf_off;
         int sbuf_len,sbuf_off;
-        int mbuf_len,mbuf_off;
+        int mbuf_len;
         fd_set readfds,writefds;
         char *port=PORT_STR;
         int full_log=1;
         char *host=SSL_HOST_NAME;
         char *cert_file=NULL,*key_file=NULL;
+        int cert_format = FORMAT_PEM, key_format = FORMAT_PEM;
+        char *passarg = NULL, *pass = NULL;
+        X509 *cert = NULL;
+        EVP_PKEY *key = NULL;
         char *CApath=NULL,*CAfile=NULL,*cipher=NULL;
         int reconnect=0,badop=0,verify=SSL_VERIFY_NONE,bugs=0;
         int crlf=0;
         int write_tty,read_tty,write_ssl,read_ssl,tty_on,ssl_pending;
         SSL_CTX *ctx=NULL;
         int ret=1,in_init=1,i,nbio_test=0;
-        int starttls_proto = 0;
+        int starttls_proto = PROTO_OFF;
         int prexit = 0, vflags = 0;
         SSL_METHOD *meth=NULL;
+#ifdef sock_type
+#undef sock_type
+#endif
+        int sock_type=SOCK_STREAM;
         BIO *sbio;
         char *inrand=NULL;
+        int mbuf_len=0;
 #ifndef OPENSSL_NO_ENGINE
         char *engine_id=NULL;
         ENGINE *e=NULL;
 #endif
-#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
+#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE)
         struct timeval tv;
 #endif
 
+#ifndef OPENSSL_NO_TLSEXT
+        char *servername = NULL; 
+        tlsextctx tlsextcbp = 
+        {NULL,0};
+#endif
+        char *sess_in = NULL;
+        char *sess_out = NULL;
+        struct sockaddr peer;
+        int peerlen = sizeof(peer);
+        int enable_timeouts = 0 ;
+        long mtu = 0;
+
 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
         meth=SSLv23_client_method();
 #elif !defined(OPENSSL_NO_SSL3)
@@ -337,6 +409,21 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         cert_file= *(++argv);
                         }
+                else if (strcmp(*argv,"-sess_out") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        sess_out = *(++argv);
+                        }
+                else if (strcmp(*argv,"-sess_in") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        sess_in = *(++argv);
+                        }
+                else if (strcmp(*argv,"-certform") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        cert_format = str2fmt(*(++argv));
+                        }
                 else if (strcmp(*argv,"-crl_check") == 0)
                         vflags |= X509_V_FLAG_CRL_CHECK;
                 else if (strcmp(*argv,"-crl_check_all") == 0)
@@ -356,8 +443,14 @@ int MAIN(int argc, char **argv)
                         c_Pause=1;
                 else if (strcmp(*argv,"-debug") == 0)
                         c_debug=1;
+#ifndef OPENSSL_NO_TLSEXT
+                else if (strcmp(*argv,"-tlsextdebug") == 0)
+                        c_tlsextdebug=1;
+                else if (strcmp(*argv,"-status") == 0)
+                        c_status_req=1;
+#endif
 #ifdef WATT32
-                else if (strcmp(*argv,"-wdebug") == 0)
+                else if (strcmp(*argv,"-wdebug") == 0)
                         dbug_init();
 #endif
                 else if (strcmp(*argv,"-msg") == 0)
@@ -380,8 +473,32 @@ int MAIN(int argc, char **argv)
                 else if (strcmp(*argv,"-tls1") == 0)
                         meth=TLSv1_client_method();
 #endif
+#ifndef OPENSSL_NO_DTLS1
+                else if (strcmp(*argv,"-dtls1") == 0)
+                        {
+                        meth=DTLSv1_client_method();
+                        sock_type=SOCK_DGRAM;
+                        }
+                else if (strcmp(*argv,"-timeout") == 0)
+                        enable_timeouts=1;
+                else if (strcmp(*argv,"-mtu") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        mtu = atol(*(++argv));
+                        }
+#endif
                 else if (strcmp(*argv,"-bugs") == 0)
                         bugs=1;
+                else if (strcmp(*argv,"-keyform") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        key_format = str2fmt(*(++argv));
+                        }
+                else if (strcmp(*argv,"-pass") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passarg = *(++argv);
+                        }
                 else if (strcmp(*argv,"-key") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -407,6 +524,10 @@ int MAIN(int argc, char **argv)
                         off|=SSL_OP_NO_SSLv3;
                 else if (strcmp(*argv,"-no_ssl2") == 0)
                         off|=SSL_OP_NO_SSLv2;
+#ifndef OPENSSL_NO_TLSEXT
+                else if (strcmp(*argv,"-no_ticket") == 0)
+                        { off|=SSL_OP_NO_TICKET; }
+#endif
                 else if (strcmp(*argv,"-serverpref") == 0)
                         off|=SSL_OP_CIPHER_SERVER_PREFERENCE;
                 else if (strcmp(*argv,"-cipher") == 0)
@@ -423,9 +544,13 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         ++argv;
                         if (strcmp(*argv,"smtp") == 0)
-                                starttls_proto = 1;
+                                starttls_proto = PROTO_SMTP;
                         else if (strcmp(*argv,"pop3") == 0)
-                                starttls_proto = 2;
+                                starttls_proto = PROTO_POP3;
+                        else if (strcmp(*argv,"imap") == 0)
+                                starttls_proto = PROTO_IMAP;
+                        else if (strcmp(*argv,"ftp") == 0)
+                                starttls_proto = PROTO_FTP;
                         else
                                 goto bad;
                         }
@@ -443,6 +568,14 @@ int MAIN(int argc, char **argv)
                         }
                 else if (strcmp(*argv,"-4") == 0) { af = AF_INET;}
                 else if (strcmp(*argv,"-6") == 0) { af = AF_INET6;}
+#ifndef OPENSSL_NO_TLSEXT
+                else if (strcmp(*argv,"-servername") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        servername= *(++argv);
+                        /* meth=TLSv1_client_method(); */
+                        }
+#endif
                 else
                         {
                         BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -465,6 +598,42 @@ bad:
 #ifndef OPENSSL_NO_ENGINE
         e = setup_engine(bio_err, engine_id, 1);
 #endif
+        if (!app_passwd(bio_err, passarg, NULL, &pass, NULL))
+                {
+                BIO_printf(bio_err, "Error getting password\n");
+                goto end;
+                }
+
+        if (key_file == NULL)
+                key_file = cert_file;
+
+
+        if (key_file)
+
+                {
+
+                key = load_key(bio_err, key_file, key_format, 0, pass, e,
+                               "client certificate private key file");
+                if (!key)
+                        {
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+
+                }
+
+        if (cert_file)
+
+                {
+                cert = load_cert(bio_err,cert_file,cert_format,
+                                NULL, e, "client certificate file");
+
+                if (!cert)
+                        {
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+                }
 
         if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL
                 && !RAND_status())
@@ -499,6 +668,10 @@ bad:
                 SSL_CTX_set_options(ctx,SSL_OP_ALL|off);
         else
                 SSL_CTX_set_options(ctx,off);
+        /* DTLS: partial reads end up discarding unread UDP bytes :-( 
+         * Setting read ahead solves this problem.
+         */
+        if (sock_type == SOCK_DGRAM) SSL_CTX_set_read_ahead(ctx, 1);
 
         if (state) SSL_CTX_set_info_callback(ctx,apps_ssl_info_callback);
         if (cipher != NULL)
@@ -513,7 +686,7 @@ bad:
 #endif
 
         SSL_CTX_set_verify(ctx,verify,verify_callback);
-        if (!set_cert_stuff(ctx,cert_file,key_file))
+        if (!set_cert_key_stuff(ctx,cert,key))
                 goto end;
 
         if ((!SSL_CTX_load_verify_locations(ctx,CAfile,CApath)) ||
@@ -526,8 +699,51 @@ bad:
 
         store = SSL_CTX_get_cert_store(ctx);
         X509_STORE_set_flags(store, vflags);
+#ifndef OPENSSL_NO_TLSEXT
+        if (servername != NULL)
+                {
+                tlsextcbp.biodebug = bio_err;
+                SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
+                SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);
+                }
+#endif
 
         con=SSL_new(ctx);
+        if (sess_in)
+                {
+                SSL_SESSION *sess;
+                BIO *stmp = BIO_new_file(sess_in, "r");
+                if (!stmp)
+                        {
+                        BIO_printf(bio_err, "Can't open session file %s\n",
+                                                sess_in);
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+                sess = PEM_read_bio_SSL_SESSION(stmp, NULL, 0, NULL);
+                BIO_free(stmp);
+                if (!sess)
+                        {
+                        BIO_printf(bio_err, "Can't open session file %s\n",
+                                                sess_in);
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+                SSL_set_session(con, sess);
+                SSL_SESSION_free(sess);
+                }
+#ifndef OPENSSL_NO_TLSEXT
+        if (servername != NULL)
+                {
+                if (!SSL_set_tlsext_host_name(con,servername))
+                        {
+                        BIO_printf(bio_err,"Unable to set TLS servername extension.\n");
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+                }
+#endif
+
 #ifndef OPENSSL_NO_KRB5
         if (con  &&  (con->kssl_ctx = kssl_ctx_new()) != NULL)
                 {
@@ -538,7 +754,7 @@ bad:
 
 re_start:
 
-        if (init_client(&s,host,port,af) == 0)
+        if (init_client(&s,host,port,sock_type,af) == 0)
                 {
                 BIO_printf(bio_err,"connect:errno=%d\n",get_last_socket_error());
                 SHUTDOWN(s);
@@ -559,7 +775,46 @@ re_start:
                 }
 #endif                                              
         if (c_Pause & 0x01) con->debug=1;
-        sbio=BIO_new_socket(s,BIO_NOCLOSE);
+
+        if ( SSL_version(con) == DTLS1_VERSION)
+                {
+                struct timeval timeout;
+
+                sbio=BIO_new_dgram(s,BIO_NOCLOSE);
+                if (getsockname(s, &peer, (void *)&peerlen) < 0)
+                        {
+                        BIO_printf(bio_err, "getsockname:errno=%d\n",
+                                get_last_socket_error());
+                        SHUTDOWN(s);
+                        goto end;
+                        }
+
+                (void)BIO_ctrl_set_connected(sbio, 1, &peer);
+
+                if ( enable_timeouts)
+                        {
+                        timeout.tv_sec = 0;
+                        timeout.tv_usec = DGRAM_RCV_TIMEOUT;
+                        BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_RECV_TIMEOUT, 0, &timeout);
+                        
+                        timeout.tv_sec = 0;
+                        timeout.tv_usec = DGRAM_SND_TIMEOUT;
+                        BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout);
+                        }
+
+                if ( mtu > 0)
+                        {
+                        SSL_set_options(con, SSL_OP_NO_QUERY_MTU);
+                        SSL_set_mtu(con, mtu);
+                        }
+                else
+                        /* want to do MTU discovery */
+                        BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL);
+                }
+        else
+                sbio=BIO_new_socket(s,BIO_NOCLOSE);
+
+
 
         if (nbio_test)
                 {
@@ -572,14 +827,38 @@ re_start:
         if (c_debug)
                 {
                 con->debug=1;
-                BIO_set_callback(sbio,bio_dump_cb);
-                BIO_set_callback_arg(sbio,bio_c_out);
+                BIO_set_callback(sbio,bio_dump_callback);
+                BIO_set_callback_arg(sbio,(char *)bio_c_out);
                 }
         if (c_msg)
                 {
                 SSL_set_msg_callback(con, msg_cb);
                 SSL_set_msg_callback_arg(con, bio_c_out);
                 }
+#ifndef OPENSSL_NO_TLSEXT
+        if (c_tlsextdebug)
+                {
+                SSL_set_tlsext_debug_callback(con, tlsext_cb);
+                SSL_set_tlsext_debug_arg(con, bio_c_out);
+                }
+        if (c_status_req)
+                {
+                SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp);
+                SSL_CTX_set_tlsext_status_cb(ctx, ocsp_resp_cb);
+                SSL_CTX_set_tlsext_status_arg(ctx, bio_c_out);
+#if 0
+{
+STACK_OF(OCSP_RESPID) *ids = sk_OCSP_RESPID_new_null();
+OCSP_RESPID *id = OCSP_RESPID_new();
+id->value.byKey = ASN1_OCTET_STRING_new();
+id->type = V_OCSP_RESPID_KEY;
+ASN1_STRING_set(id->value.byKey, "Hello World", -1);
+sk_OCSP_RESPID_push(ids, id);
+SSL_set_tlsext_status_ids(con, ids);
+}
+#endif
+                }
+#endif
 
         SSL_set_bio(con,sbio,sbio);
         SSL_set_connect_state(con);
@@ -598,28 +877,47 @@ re_start:
         sbuf_len=0;
         sbuf_off=0;
         mbuf_len=0;
-        mbuf_off=0;
 
         /* This is an ugly hack that does a lot of assumptions */
-        if (starttls_proto == 1)
+        /* We do have to handle multi-line responses which may come
+           in a single packet or not. We therefore have to use
+           BIO_gets() which does need a buffering BIO. So during
+           the initial chitchat we do push a buffering BIO into the
+           chain that is removed again later on to not disturb the
+           rest of the s_client operation. */
+        if (starttls_proto == PROTO_SMTP)
                 {
-                mbuf_off = mbuf_len = BIO_read(sbio,mbuf,BUFSIZZ);
-                if (mbuf_len == -1)
+                int foundit=0;
+                BIO *fbio = BIO_new(BIO_f_buffer());
+                BIO_push(fbio, sbio);
+                /* wait for multi-line response to end from SMTP */
+                do
                         {
-                        BIO_printf(bio_err,"BIO_read failed\n");
-                        goto end;
+                        mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ);
                         }
-                BIO_printf(sbio,"EHLO some.host.name\r\n");
-                mbuf_len = BIO_read(sbio,mbuf + mbuf_off,BUFSIZZ - mbuf_off);
-                if (mbuf_len == -1)
+                while (mbuf_len>3 && mbuf[3]=='-');
+                /* STARTTLS command requires EHLO... */
+                BIO_printf(fbio,"EHLO openssl.client.net\r\n");
+                (void)BIO_flush(fbio);
+                /* wait for multi-line response to end EHLO SMTP response */
+                do
                         {
-                        BIO_printf(bio_err,"BIO_read failed\n");
-                        goto end;
+                        mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ);
+                        if (strstr(mbuf,"STARTTLS"))
+                                foundit=1;
                         }
+                while (mbuf_len>3 && mbuf[3]=='-');
+                (void)BIO_flush(fbio);
+                BIO_pop(fbio);
+                BIO_free(fbio);
+                if (!foundit)
+                        BIO_printf(bio_err,
+                                   "didn't found starttls in server response,"
+                                   " try anyway...\n");
                 BIO_printf(sbio,"STARTTLS\r\n");
                 BIO_read(sbio,sbuf,BUFSIZZ);
                 }
-        if (starttls_proto == 2)
+        else if (starttls_proto == PROTO_POP3)
                 {
                 mbuf_len = BIO_read(sbio,mbuf,BUFSIZZ);
                 if (mbuf_len == -1)
@@ -630,8 +928,49 @@ re_start:
                 BIO_printf(sbio,"STLS\r\n");
                 BIO_read(sbio,sbuf,BUFSIZZ);
                 }
-
-        mbuf[mbuf_off + mbuf_len] = '\0';
+        else if (starttls_proto == PROTO_IMAP)
+                {
+                int foundit=0;
+                BIO *fbio = BIO_new(BIO_f_buffer());
+                BIO_push(fbio, sbio);
+                BIO_gets(fbio,mbuf,BUFSIZZ);
+                /* STARTTLS command requires CAPABILITY... */
+                BIO_printf(fbio,". CAPABILITY\r\n");
+                (void)BIO_flush(fbio);
+                /* wait for multi-line CAPABILITY response */
+                do
+                        {
+                        mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ);
+                        if (strstr(mbuf,"STARTTLS"))
+                                foundit=1;
+                        }
+                while (mbuf_len>3 && mbuf[0]!='.');
+                (void)BIO_flush(fbio);
+                BIO_pop(fbio);
+                BIO_free(fbio);
+                if (!foundit)
+                        BIO_printf(bio_err,
+                                   "didn't found STARTTLS in server response,"
+                                   " try anyway...\n");
+                BIO_printf(sbio,". STARTTLS\r\n");
+                BIO_read(sbio,sbuf,BUFSIZZ);
+                }
+        else if (starttls_proto == PROTO_FTP)
+                {
+                BIO *fbio = BIO_new(BIO_f_buffer());
+                BIO_push(fbio, sbio);
+                /* wait for multi-line response to end from FTP */
+                do
+                        {
+                        mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ);
+                        }
+                while (mbuf_len>3 && mbuf[3]=='-');
+                (void)BIO_flush(fbio);
+                BIO_pop(fbio);
+                BIO_free(fbio);
+                BIO_printf(sbio,"AUTH TLS\r\n");
+                BIO_read(sbio,sbuf,BUFSIZZ);
+                }
 
         for (;;)
                 {
@@ -649,6 +988,17 @@ re_start:
                         if (in_init)
                                 {
                                 in_init=0;
+                                if (sess_out)
+                                        {
+                                        BIO *stmp = BIO_new_file(sess_out, "w");
+                                        if (stmp)
+                                                {
+                                                PEM_write_bio_SSL_SESSION(stmp, SSL_get_session(con));
+                                                BIO_free(stmp);
+                                                }
+                                        else 
+                                                BIO_printf(bio_err, "Error writing session file %s\n", sess_out);
+                                        }
                                 print_stuff(bio_c_out,con,full_log);
                                 if (full_log > 0) full_log--;
 
@@ -656,7 +1006,7 @@ re_start:
                                         {
                                         BIO_printf(bio_err,"%s",mbuf);
                                         /* We don't need to know any more */
-                                        starttls_proto = 0;
+                                        starttls_proto = PROTO_OFF;
                                         }
 
                                 if (reconnect)
@@ -675,7 +1025,7 @@ re_start:
 
                 if (!ssl_pending)
                         {
-#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS)
+#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_NETWARE)
                         if (tty_on)
                                 {
                                 if (read_tty)  FD_SET(fileno(stdin),&readfds);
@@ -725,6 +1075,16 @@ re_start:
                                 } else  i=select(width,(void *)&readfds,(void *)&writefds,
                                          NULL,NULL);
                         }
+#elif defined(OPENSSL_SYS_NETWARE)
+                        if(!write_tty) {
+                                if(read_tty) {
+                                        tv.tv_sec = 1;
+                                        tv.tv_usec = 0;
+                                        i=select(width,(void *)&readfds,(void *)&writefds,
+                                                NULL,&tv);
+                                } else  i=select(width,(void *)&readfds,(void *)&writefds,
+                                        NULL,NULL);
+                        }
 #else
                         i=select(width,(void *)&readfds,(void *)&writefds,
                                  NULL,NULL);
@@ -805,7 +1165,7 @@ re_start:
                                 goto shut;
                                 }
                         }
-#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
+#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE)
                 /* Assume Windows/DOS can always write */
                 else if (!ssl_pending && write_tty)
 #else
@@ -892,6 +1252,8 @@ printf("read=%d pending=%d peek=%d\n",k,SSL_pending(con),SSL_peek(con,zbuf,10240
 #else
                 else if ((_kbhit()) || (WAIT_OBJECT_0 == WaitForSingleObject(GetStdHandle(STD_INPUT_HANDLE), 0)))
 #endif
+#elif defined (OPENSSL_SYS_NETWARE)
+        else if (_kbhit())
 #else
                 else if (FD_ISSET(fileno(stdin),&readfds))
 #endif
@@ -955,6 +1317,12 @@ end:
         if (con != NULL) SSL_free(con);
         if (con2 != NULL) SSL_free(con2);
         if (ctx != NULL) SSL_CTX_free(ctx);
+        if (cert)
+                X509_free(cert);
+        if (key)
+                EVP_PKEY_free(key);
+        if (pass)
+                OPENSSL_free(pass);
         if (cbuf != NULL) { OPENSSL_cleanse(cbuf,BUFSIZZ); OPENSSL_free(cbuf); }
         if (sbuf != NULL) { OPENSSL_cleanse(sbuf,BUFSIZZ); OPENSSL_free(sbuf); }
         if (mbuf != NULL) { OPENSSL_cleanse(mbuf,BUFSIZZ); OPENSSL_free(mbuf); }
@@ -972,13 +1340,16 @@ static void print_stuff(BIO *bio, SSL *s, int full)
         {
         X509 *peer=NULL;
         char *p;
-        static char *space="                ";
+        static const char *space="                ";
         char buf[BUFSIZ];
         STACK_OF(X509) *sk;
         STACK_OF(X509_NAME) *sk2;
         SSL_CIPHER *c;
         X509_NAME *xn;
         int j,i;
+#ifndef OPENSSL_NO_COMP
+        const COMP_METHOD *comp, *expansion;
+#endif
 
         if (full)
                 {
@@ -1081,11 +1452,47 @@ static void print_stuff(BIO *bio, SSL *s, int full)
                                                          EVP_PKEY_bits(pktmp));
                 EVP_PKEY_free(pktmp);
         }
+#ifndef OPENSSL_NO_COMP
+        comp=SSL_get_current_compression(s);
+        expansion=SSL_get_current_expansion(s);
+        BIO_printf(bio,"Compression: %s\n",
+                comp ? SSL_COMP_get_name(comp) : "NONE");
+        BIO_printf(bio,"Expansion: %s\n",
+                expansion ? SSL_COMP_get_name(expansion) : "NONE");
+#endif
         SSL_SESSION_print(bio,SSL_get_session(s));
         BIO_printf(bio,"---\n");
         if (peer != NULL)
                 X509_free(peer);
         /* flush, or debugging output gets mixed with http response */
-        BIO_flush(bio);
+        (void)BIO_flush(bio);
         }
 
+#ifndef OPENSSL_NO_TLSEXT
+
+static int ocsp_resp_cb(SSL *s, void *arg)
+        {
+        const unsigned char *p;
+        int len;
+        OCSP_RESPONSE *rsp;
+        len = SSL_get_tlsext_status_ocsp_resp(s, &p);
+        BIO_puts(arg, "OCSP response: ");
+        if (!p)
+                {
+                BIO_puts(arg, "no response sent\n");
+                return 1;
+                }
+        rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
+        if (!rsp)
+                {
+                BIO_puts(arg, "response parse error\n");
+                BIO_dump_indent(arg, (char *)p, len, 4);
+                return 0;
+                }
+        BIO_puts(arg, "\n======================================\n");
+        OCSP_RESPONSE_print(arg, rsp, 0);
+        BIO_puts(arg, "======================================\n");
+        OCSP_RESPONSE_free(rsp);
+        return 1;
+        }
+#endif  /* ndef OPENSSL_NO_TLSEXT */
diff --git a/src/lib/libssl/src/apps/s_server.c b/src/lib/libssl/src/apps/s_server.c
index ff4ab6ef28..7919c437c6 100644
--- a/src/lib/libssl/src/apps/s_server.c
+++ b/src/lib/libssl/src/apps/s_server.c
@@ -108,18 +108,33 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
+
+/* Until the key-gen callbacks are modified to use newer prototypes, we allow
+ * deprecated functions for openssl-internal code */
+#ifdef OPENSSL_NO_DEPRECATED
+#undef OPENSSL_NO_DEPRECATED
+#endif
 
 #include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/types.h>
+
 #include <sys/stat.h>
 #include <openssl/e_os2.h>
 #ifdef OPENSSL_NO_STDIO
 #define APPS_WIN16
 #endif
 
+#if !defined(OPENSSL_SYS_NETWARE)  /* conflicts with winsock2 stuff on netware */
+#include <sys/types.h>
+#endif
+
 /* With IPv6, it looks like Digital has mixed up the proper order of
    recursive header file inclusion, resulting in the compiler complaining
    that u_int isn't defined, but only if _POSIX_C_SOURCE is defined, which
@@ -138,7 +153,15 @@ typedef unsigned int u_int;
 #include <openssl/x509.h>
 #include <openssl/ssl.h>
 #include <openssl/rand.h>
+#include <openssl/ocsp.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
 #include "s_apps.h"
+#include "timeouts.h"
 
 #ifdef OPENSSL_SYS_WINCE
 /* Windows CE incorrectly defines fileno as returning void*, so to avoid problems below... */
@@ -165,9 +188,10 @@ static void print_stats(BIO *bp,SSL_CTX *ctx);
 static int generate_session_id(const SSL *ssl, unsigned char *id,
                                 unsigned int *id_len);
 #ifndef OPENSSL_NO_DH
-static DH *load_dh_param(char *dhfile);
+static DH *load_dh_param(const char *dhfile);
 static DH *get_dh512(void);
 #endif
+
 #ifdef MONOLITH
 static void s_server_init(void);
 #endif
@@ -206,6 +230,7 @@ static DH *get_dh512(void)
         }
 #endif
 
+
 /* static int load_CA(SSL_CTX *ctx, char *file);*/
 
 #undef BUFSIZZ
@@ -214,6 +239,9 @@ static int bufsize=BUFSIZZ;
 static int accept_socket= -1;
 
 #define TEST_CERT       "server.pem"
+#ifndef OPENSSL_NO_TLSEXT
+#define TEST_CERT2      "server2.pem"
+#endif
 #undef PROG
 #define PROG            s_server_main
 
@@ -222,7 +250,10 @@ extern int verify_depth;
 static char *cipher=NULL;
 static int s_server_verify=SSL_VERIFY_NONE;
 static int s_server_session_id_context = 1; /* anything will do */
-static char *s_cert_file=TEST_CERT,*s_key_file=NULL;
+static const char *s_cert_file=TEST_CERT,*s_key_file=NULL;
+#ifndef OPENSSL_NO_TLSEXT
+static const char *s_cert_file2=TEST_CERT2,*s_key_file2=NULL;
+#endif
 static char *s_dcert_file=NULL,*s_dkey_file=NULL;
 #ifdef FIONBIO
 static int s_nbio=0;
@@ -230,10 +261,18 @@ static int s_nbio=0;
 static int s_nbio_test=0;
 int s_crlf=0;
 static SSL_CTX *ctx=NULL;
+#ifndef OPENSSL_NO_TLSEXT
+static SSL_CTX *ctx2=NULL;
+#endif
 static int www=0;
 
 static BIO *bio_s_out=NULL;
 static int s_debug=0;
+#ifndef OPENSSL_NO_TLSEXT
+static int s_tlsextdebug=0;
+static int s_tlsextstatus=0;
+static int cert_status_cb(SSL *s, void *arg);
+#endif
 static int s_msg=0;
 static int s_quiet=0;
 
@@ -243,6 +282,14 @@ static char *engine_id=NULL;
 #endif
 static const char *session_id_prefix=NULL;
 
+static int enable_timeouts = 0;
+#ifdef mtu
+#undef mtu
+#endif
+static long mtu;
+static int cert_chain = 0;
+
+
 #ifdef MONOLITH
 static void s_server_init(void)
         {
@@ -253,6 +300,11 @@ static void s_server_init(void)
         s_dkey_file=NULL;
         s_cert_file=TEST_CERT;
         s_key_file=NULL;
+#ifndef OPENSSL_NO_TLSEXT
+        s_cert_file2=TEST_CERT2;
+        s_key_file2=NULL;
+        ctx2=NULL;
+#endif
 #ifdef FIONBIO
         s_nbio=0;
 #endif
@@ -279,14 +331,30 @@ static void sv_usage(void)
         BIO_printf(bio_err," -context arg  - set session ID context\n");
         BIO_printf(bio_err," -verify arg   - turn on peer certificate verification\n");
         BIO_printf(bio_err," -Verify arg   - turn on peer certificate verification, must have a cert.\n");
-        BIO_printf(bio_err," -cert arg     - certificate file to use, PEM format assumed\n");
+        BIO_printf(bio_err," -cert arg     - certificate file to use\n");
         BIO_printf(bio_err,"                 (default is %s)\n",TEST_CERT);
-        BIO_printf(bio_err," -key arg      - Private Key file to use, PEM format assumed, in cert file if\n");
+        BIO_printf(bio_err," -crl_check    - check the peer certificate has not been revoked by its CA.\n" \
+                           "                 The CRL(s) are appended to the certificate file\n");
+        BIO_printf(bio_err," -crl_check_all - check the peer certificate has not been revoked by its CA\n" \
+                           "                 or any other CRL in the CA chain. CRL(s) are appened to the\n" \
+                           "                 the certificate file.\n");
+        BIO_printf(bio_err," -certform arg - certificate format (PEM or DER) PEM default\n");
+        BIO_printf(bio_err," -key arg      - Private Key file to use, in cert file if\n");
         BIO_printf(bio_err,"                 not specified (default is %s)\n",TEST_CERT);
+        BIO_printf(bio_err," -keyform arg  - key format (PEM, DER or ENGINE) PEM default\n");
+        BIO_printf(bio_err," -pass arg     - private key file pass phrase source\n");
         BIO_printf(bio_err," -dcert arg    - second certificate file to use (usually for DSA)\n");
+        BIO_printf(bio_err," -dcertform x  - second certificate format (PEM or DER) PEM default\n");
         BIO_printf(bio_err," -dkey arg     - second private key file to use (usually for DSA)\n");
+        BIO_printf(bio_err," -dkeyform arg - second key format (PEM, DER or ENGINE) PEM default\n");
+        BIO_printf(bio_err," -dpass arg    - second private key file pass phrase source\n");
         BIO_printf(bio_err," -dhparam arg  - DH parameter file to use, in cert file if not specified\n");
         BIO_printf(bio_err,"                 or a default set of parameters is used\n");
+#ifndef OPENSSL_NO_ECDH
+        BIO_printf(bio_err," -named_curve arg  - Elliptic curve name to use for ephemeral ECDH keys.\n" \
+                           "                 Use \"openssl ecparam -list_curves\" for all names\n" \
+                           "                 (default is sect163r2).\n");
+#endif
 #ifdef FIONBIO
         BIO_printf(bio_err," -nbio         - Run with non-blocking IO\n");
 #endif
@@ -305,12 +373,19 @@ static void sv_usage(void)
         BIO_printf(bio_err," -ssl2         - Just talk SSLv2\n");
         BIO_printf(bio_err," -ssl3         - Just talk SSLv3\n");
         BIO_printf(bio_err," -tls1         - Just talk TLSv1\n");
+        BIO_printf(bio_err," -dtls1        - Just talk DTLSv1\n");
+        BIO_printf(bio_err," -timeout      - Enable timeouts\n");
+        BIO_printf(bio_err," -mtu          - Set MTU\n");
+        BIO_printf(bio_err," -chain        - Read a certificate chain\n");
         BIO_printf(bio_err," -no_ssl2      - Just disable SSLv2\n");
         BIO_printf(bio_err," -no_ssl3      - Just disable SSLv3\n");
         BIO_printf(bio_err," -no_tls1      - Just disable TLSv1\n");
 #ifndef OPENSSL_NO_DH
         BIO_printf(bio_err," -no_dhe       - Disable ephemeral DH\n");
 #endif
+#ifndef OPENSSL_NO_ECDH
+        BIO_printf(bio_err," -no_ecdhe     - Disable ephemeral ECDH\n");
+#endif
         BIO_printf(bio_err," -bugs         - Turn on SSL bug compatibility\n");
         BIO_printf(bio_err," -www          - Respond to a 'GET /' with a status page\n");
         BIO_printf(bio_err," -WWW          - Respond to a 'GET /<path> HTTP/1.0' with file ./<path>\n");
@@ -321,6 +396,16 @@ static void sv_usage(void)
 #endif
         BIO_printf(bio_err," -id_prefix arg - Generate SSL/TLS session IDs prefixed by 'arg'\n");
         BIO_printf(bio_err," -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
+#ifndef OPENSSL_NO_TLSEXT
+        BIO_printf(bio_err," -servername host - servername for HostName TLS extension\n");
+        BIO_printf(bio_err," -servername_fatal - on mismatch send fatal alert (default warning alert)\n");
+        BIO_printf(bio_err," -cert2 arg    - certificate file to use for servername\n");
+        BIO_printf(bio_err,"                 (default is %s)\n",TEST_CERT2);
+        BIO_printf(bio_err," -key2 arg     - Private Key file to use for servername, in cert file if\n");
+        BIO_printf(bio_err,"                 not specified (default is %s)\n",TEST_CERT2);
+        BIO_printf(bio_err," -tlsextdebug  - hex dump of all TLS extensions received\n");
+        BIO_printf(bio_err," -no_ticket    - disable use of RFC4507bis session tickets\n");
+#endif
         }
 
 static int local_argc=0;
@@ -476,6 +561,185 @@ static int ebcdic_puts(BIO *bp, const char *str)
 }
 #endif
 
+#ifndef OPENSSL_NO_TLSEXT
+
+/* This is a context that we pass to callbacks */
+typedef struct tlsextctx_st {
+   char * servername;
+   BIO * biodebug;
+   int extension_error;
+} tlsextctx;
+
+
+static int MS_CALLBACK ssl_servername_cb(SSL *s, int *ad, void *arg)
+        {
+        tlsextctx * p = (tlsextctx *) arg;
+        const char * servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
+        if (servername && p->biodebug) 
+                BIO_printf(p->biodebug,"Hostname in TLS extension: \"%s\"\n",servername);
+        
+        if (!p->servername)
+                return SSL_TLSEXT_ERR_NOACK;
+        
+        if (servername)
+                {
+                if (strcmp(servername,p->servername)) 
+                        return p->extension_error;
+                if (ctx2)
+                        {
+                        BIO_printf(p->biodebug,"Swiching server context.\n");
+                        SSL_set_SSL_CTX(s,ctx2);
+                        }     
+                }
+        return SSL_TLSEXT_ERR_OK;
+}
+
+/* Structure passed to cert status callback */
+
+typedef struct tlsextstatusctx_st {
+   /* Default responder to use */
+   char *host, *path, *port;
+   int use_ssl;
+   int timeout;
+   BIO *err;
+   int verbose;
+} tlsextstatusctx;
+
+static tlsextstatusctx tlscstatp = {NULL, NULL, NULL, 0, -1, NULL, 0};
+
+/* Certificate Status callback. This is called when a client includes a
+ * certificate status request extension.
+ *
+ * This is a simplified version. It examines certificates each time and
+ * makes one OCSP responder query for each request.
+ *
+ * A full version would store details such as the OCSP certificate IDs and
+ * minimise the number of OCSP responses by caching them until they were
+ * considered "expired".
+ */
+
+static int cert_status_cb(SSL *s, void *arg)
+        {
+        tlsextstatusctx *srctx = arg;
+        BIO *err = srctx->err;
+        char *host, *port, *path;
+        int use_ssl;
+        unsigned char *rspder = NULL;
+        int rspderlen;
+        STACK *aia = NULL;
+        X509 *x = NULL;
+        X509_STORE_CTX inctx;
+        X509_OBJECT obj;
+        OCSP_REQUEST *req = NULL;
+        OCSP_RESPONSE *resp = NULL;
+        OCSP_CERTID *id = NULL;
+        STACK_OF(X509_EXTENSION) *exts;
+        int ret = SSL_TLSEXT_ERR_NOACK;
+        int i;
+#if 0
+STACK_OF(OCSP_RESPID) *ids;
+SSL_get_tlsext_status_ids(s, &ids);
+BIO_printf(err, "cert_status: received %d ids\n", sk_OCSP_RESPID_num(ids));
+#endif
+        if (srctx->verbose)
+                BIO_puts(err, "cert_status: callback called\n");
+        /* Build up OCSP query from server certificate */
+        x = SSL_get_certificate(s);
+        aia = X509_get1_ocsp(x);
+        if (aia)
+                {
+                if (!OCSP_parse_url(sk_value(aia, 0),
+                        &host, &port, &path, &use_ssl))
+                        {
+                        BIO_puts(err, "cert_status: can't parse AIA URL\n");
+                        goto err;
+                        }
+                if (srctx->verbose)
+                        BIO_printf(err, "cert_status: AIA URL: %s\n",
+                                        sk_value(aia, 0));
+                }
+        else
+                {
+                if (!srctx->host)
+                        {
+                        BIO_puts(srctx->err, "cert_status: no AIA and no default responder URL\n");
+                        goto done;
+                        }
+                host = srctx->host;
+                path = srctx->path;
+                port = srctx->port;
+                use_ssl = srctx->use_ssl;
+                }
+                
+        if (!X509_STORE_CTX_init(&inctx,
+                                SSL_CTX_get_cert_store(SSL_get_SSL_CTX(s)),
+                                NULL, NULL))
+                goto err;
+        if (X509_STORE_get_by_subject(&inctx,X509_LU_X509,
+                                X509_get_issuer_name(x),&obj) <= 0)
+                {
+                BIO_puts(err, "cert_status: Can't retrieve issuer certificate.\n");
+                X509_STORE_CTX_cleanup(&inctx);
+                goto done;
+                }
+        req = OCSP_REQUEST_new();
+        if (!req)
+                goto err;
+        id = OCSP_cert_to_id(NULL, x, obj.data.x509);
+        X509_free(obj.data.x509);
+        X509_STORE_CTX_cleanup(&inctx);
+        if (!id)
+                goto err;
+        if (!OCSP_request_add0_id(req, id))
+                goto err;
+        id = NULL;
+        /* Add any extensions to the request */
+        SSL_get_tlsext_status_exts(s, &exts);
+        for (i = 0; i < sk_X509_EXTENSION_num(exts); i++)
+                {
+                X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
+                if (!OCSP_REQUEST_add_ext(req, ext, -1))
+                        goto err;
+                }
+        resp = process_responder(err, req, host, path, port, use_ssl,
+                                        srctx->timeout);
+        if (!resp)
+                {
+                BIO_puts(err, "cert_status: error querying responder\n");
+                goto done;
+                }
+        rspderlen = i2d_OCSP_RESPONSE(resp, &rspder);
+        if (rspderlen <= 0)
+                goto err;
+        SSL_set_tlsext_status_ocsp_resp(s, rspder, rspderlen);
+        if (srctx->verbose)
+                {
+                BIO_puts(err, "cert_status: ocsp response sent:\n");
+                OCSP_RESPONSE_print(err, resp, 2);
+                }
+        ret = SSL_TLSEXT_ERR_OK;
+        done:
+        if (ret != SSL_TLSEXT_ERR_OK)
+                ERR_print_errors(err);
+        if (aia)
+                {
+                OPENSSL_free(host);
+                OPENSSL_free(path);
+                OPENSSL_free(port);
+                X509_email_free(aia);
+                }
+        if (id)
+                OCSP_CERTID_free(id);
+        if (req)
+                OCSP_REQUEST_free(req);
+        if (resp)
+                OCSP_RESPONSE_free(resp);
+        return ret;
+        err:
+        ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+        goto done;
+        }
+#endif
 int MAIN(int, char **);
 
 int MAIN(int argc, char *argv[])
@@ -484,18 +748,36 @@ int MAIN(int argc, char *argv[])
         int vflags = 0;
         short port=PORT;
         char *CApath=NULL,*CAfile=NULL;
-        char *context = NULL;
+        unsigned char *context = NULL;
         char *dhfile = NULL;
+#ifndef OPENSSL_NO_ECDH
+        char *named_curve = NULL;
+#endif
         int badop=0,bugs=0;
         int ret=1;
         int off=0;
-        int no_tmp_rsa=0,no_dhe=0,nocert=0;
+        int no_tmp_rsa=0,no_dhe=0,no_ecdhe=0,nocert=0;
         int state=0;
         SSL_METHOD *meth=NULL;
+        int socket_type=SOCK_STREAM;
 #ifndef OPENSSL_NO_ENGINE
         ENGINE *e=NULL;
 #endif
         char *inrand=NULL;
+        int s_cert_format = FORMAT_PEM, s_key_format = FORMAT_PEM;
+        char *passarg = NULL, *pass = NULL;
+        char *dpassarg = NULL, *dpass = NULL;
+        int s_dcert_format = FORMAT_PEM, s_dkey_format = FORMAT_PEM;
+        X509 *s_cert = NULL, *s_dcert = NULL;
+        EVP_PKEY *s_key = NULL, *s_dkey = NULL;
+#ifndef OPENSSL_NO_TLSEXT
+        EVP_PKEY *s_key2 = NULL;
+        X509 *s_cert2 = NULL;
+#endif
+
+#ifndef OPENSSL_NO_TLSEXT
+        tlsextctx tlsextcbp = {NULL, NULL, SSL_TLSEXT_ERR_ALERT_WARNING};
+#endif
 
 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
         meth=SSLv23_server_method();
@@ -555,28 +837,65 @@ int MAIN(int argc, char *argv[])
                 else if (strcmp(*argv,"-context") == 0)
                         {
                         if (--argc < 1) goto bad;
-                        context= *(++argv);
+                        context= (unsigned char *)*(++argv);
                         }
                 else if (strcmp(*argv,"-cert") == 0)
                         {
                         if (--argc < 1) goto bad;
                         s_cert_file= *(++argv);
                         }
+                else if (strcmp(*argv,"-certform") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        s_cert_format = str2fmt(*(++argv));
+                        }
                 else if (strcmp(*argv,"-key") == 0)
                         {
                         if (--argc < 1) goto bad;
                         s_key_file= *(++argv);
                         }
+                else if (strcmp(*argv,"-keyform") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        s_key_format = str2fmt(*(++argv));
+                        }
+                else if (strcmp(*argv,"-pass") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        passarg = *(++argv);
+                        }
                 else if (strcmp(*argv,"-dhparam") == 0)
                         {
                         if (--argc < 1) goto bad;
                         dhfile = *(++argv);
                         }
+#ifndef OPENSSL_NO_ECDH         
+                else if (strcmp(*argv,"-named_curve") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        named_curve = *(++argv);
+                        }
+#endif
+                else if (strcmp(*argv,"-dcertform") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        s_dcert_format = str2fmt(*(++argv));
+                        }
                 else if (strcmp(*argv,"-dcert") == 0)
                         {
                         if (--argc < 1) goto bad;
                         s_dcert_file= *(++argv);
                         }
+                else if (strcmp(*argv,"-dkeyform") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        s_dkey_format = str2fmt(*(++argv));
+                        }
+                else if (strcmp(*argv,"-dpass") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        dpassarg = *(++argv);
+                        }
                 else if (strcmp(*argv,"-dkey") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -595,7 +914,7 @@ int MAIN(int argc, char *argv[])
                         {
                         vflags |= X509_V_FLAG_CRL_CHECK;
                         }
-                else if (strcmp(*argv,"-crl_check") == 0)
+                else if (strcmp(*argv,"-crl_check_all") == 0)
                         {
                         vflags |= X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL;
                         }
@@ -624,6 +943,37 @@ int MAIN(int argc, char *argv[])
                         }
                 else if (strcmp(*argv,"-debug") == 0)
                         { s_debug=1; }
+#ifndef OPENSSL_NO_TLSEXT
+                else if (strcmp(*argv,"-tlsextdebug") == 0)
+                        s_tlsextdebug=1;
+                else if (strcmp(*argv,"-status") == 0)
+                        s_tlsextstatus=1;
+                else if (strcmp(*argv,"-status_verbose") == 0)
+                        {
+                        s_tlsextstatus=1;
+                        tlscstatp.verbose = 1;
+                        }
+                else if (!strcmp(*argv, "-status_timeout"))
+                        {
+                        s_tlsextstatus=1;
+                        if (--argc < 1) goto bad;
+                        tlscstatp.timeout = atoi(*(++argv));
+                        }
+                else if (!strcmp(*argv, "-status_url"))
+                        {
+                        s_tlsextstatus=1;
+                        if (--argc < 1) goto bad;
+                        if (!OCSP_parse_url(*(++argv),
+                                        &tlscstatp.host,
+                                        &tlscstatp.port,
+                                        &tlscstatp.path,
+                                        &tlscstatp.use_ssl))
+                                {
+                                BIO_printf(bio_err, "Error parsing URL\n");
+                                goto bad;
+                                }
+                        }
+#endif
                 else if (strcmp(*argv,"-msg") == 0)
                         { s_msg=1; }
                 else if (strcmp(*argv,"-hack") == 0)
@@ -640,6 +990,8 @@ int MAIN(int argc, char *argv[])
                         { no_tmp_rsa=1; }
                 else if (strcmp(*argv,"-no_dhe") == 0)
                         { no_dhe=1; }
+                else if (strcmp(*argv,"-no_ecdhe") == 0)
+                        { no_ecdhe=1; }
                 else if (strcmp(*argv,"-www") == 0)
                         { www=1; }
                 else if (strcmp(*argv,"-WWW") == 0)
@@ -652,6 +1004,10 @@ int MAIN(int argc, char *argv[])
                         { off|=SSL_OP_NO_SSLv3; }
                 else if (strcmp(*argv,"-no_tls1") == 0)
                         { off|=SSL_OP_NO_TLSv1; }
+#ifndef OPENSSL_NO_TLSEXT
+                else if (strcmp(*argv,"-no_ticket") == 0)
+                        { off|=SSL_OP_NO_TICKET; }
+#endif
 #ifndef OPENSSL_NO_SSL2
                 else if (strcmp(*argv,"-ssl2") == 0)
                         { meth=SSLv2_server_method(); }
@@ -664,6 +1020,22 @@ int MAIN(int argc, char *argv[])
                 else if (strcmp(*argv,"-tls1") == 0)
                         { meth=TLSv1_server_method(); }
 #endif
+#ifndef OPENSSL_NO_DTLS1
+                else if (strcmp(*argv,"-dtls1") == 0)
+                        { 
+                        meth=DTLSv1_server_method();
+                        socket_type = SOCK_DGRAM;
+                        }
+                else if (strcmp(*argv,"-timeout") == 0)
+                        enable_timeouts = 1;
+                else if (strcmp(*argv,"-mtu") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        mtu = atol(*(++argv));
+                        }
+                else if (strcmp(*argv, "-chain") == 0)
+                        cert_chain = 1;
+#endif
                 else if (strcmp(*argv, "-id_prefix") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -681,6 +1053,25 @@ int MAIN(int argc, char *argv[])
                         if (--argc < 1) goto bad;
                         inrand= *(++argv);
                         }
+#ifndef OPENSSL_NO_TLSEXT
+                else if (strcmp(*argv,"-servername") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        tlsextcbp.servername= *(++argv);
+                        }
+                else if (strcmp(*argv,"-servername_fatal") == 0)
+                        { tlsextcbp.extension_error = SSL_TLSEXT_ERR_ALERT_FATAL; }
+                else if (strcmp(*argv,"-cert2") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        s_cert_file2= *(++argv);
+                        }
+                else if (strcmp(*argv,"-key2") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        s_key_file2= *(++argv);
+                        }
+#endif
                 else
                         {
                         BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -704,6 +1095,87 @@ bad:
         e = setup_engine(bio_err, engine_id, 1);
 #endif
 
+        if (!app_passwd(bio_err, passarg, dpassarg, &pass, &dpass))
+                {
+                BIO_printf(bio_err, "Error getting password\n");
+                goto end;
+                }
+
+
+        if (s_key_file == NULL)
+                s_key_file = s_cert_file;
+#ifndef OPENSSL_NO_TLSEXT
+        if (s_key_file2 == NULL)
+                s_key_file2 = s_cert_file2;
+#endif
+
+        if (nocert == 0)
+                {
+                s_key = load_key(bio_err, s_key_file, s_key_format, 0, pass, e,
+                       "server certificate private key file");
+                if (!s_key)
+                        {
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+
+                s_cert = load_cert(bio_err,s_cert_file,s_cert_format,
+                        NULL, e, "server certificate file");
+
+                if (!s_cert)
+                        {
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+
+#ifndef OPENSSL_NO_TLSEXT
+                if (tlsextcbp.servername) 
+                        {
+                        s_key2 = load_key(bio_err, s_key_file2, s_key_format, 0, pass, e,
+                                "second server certificate private key file");
+                        if (!s_key2)
+                                {
+                                ERR_print_errors(bio_err);
+                                goto end;
+                                }
+                        
+                        s_cert2 = load_cert(bio_err,s_cert_file2,s_cert_format,
+                                NULL, e, "second server certificate file");
+                        
+                        if (!s_cert2)
+                                {
+                                ERR_print_errors(bio_err);
+                                goto end;
+                                }
+                        }
+#endif
+                }
+        if (s_dcert_file)
+                {
+
+                if (s_dkey_file == NULL)
+                        s_dkey_file = s_dcert_file;
+
+                s_dkey = load_key(bio_err, s_dkey_file, s_dkey_format,
+                                0, dpass, e,
+                               "second certificate private key file");
+                if (!s_dkey)
+                        {
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+
+                s_dcert = load_cert(bio_err,s_dcert_file,s_dcert_format,
+                                NULL, e, "second server certificate file");
+
+                if (!s_dcert)
+                        {
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+
+                }
+
         if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL
                 && !RAND_status())
                 {
@@ -726,7 +1198,7 @@ bad:
                         }
                 }
 
-#if !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_DSA)
+#if !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
         if (nocert)
 #endif
                 {
@@ -734,6 +1206,10 @@ bad:
                 s_key_file=NULL;
                 s_dcert_file=NULL;
                 s_dkey_file=NULL;
+#ifndef OPENSSL_NO_TLSEXT
+                s_cert_file2=NULL;
+                s_key_file2=NULL;
+#endif
                 }
 
         ctx=SSL_CTX_new(meth);
@@ -762,6 +1238,10 @@ bad:
         if (bugs) SSL_CTX_set_options(ctx,SSL_OP_ALL);
         if (hack) SSL_CTX_set_options(ctx,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
         SSL_CTX_set_options(ctx,off);
+        /* DTLS: partial reads end up discarding unread UDP bytes :-( 
+         * Setting read ahead solves this problem.
+         */
+        if (socket_type == SOCK_DGRAM) SSL_CTX_set_read_ahead(ctx, 1);
 
         if (state) SSL_CTX_set_info_callback(ctx,apps_ssl_info_callback);
 
@@ -788,6 +1268,62 @@ bad:
                 }
         store = SSL_CTX_get_cert_store(ctx);
         X509_STORE_set_flags(store, vflags);
+#ifndef OPENSSL_NO_TLSEXT
+        if (s_cert2)
+                {
+                ctx2=SSL_CTX_new(meth);
+                if (ctx2 == NULL)
+                        {
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+                }
+        
+        if (ctx2)
+                {
+                BIO_printf(bio_s_out,"Setting secondary ctx parameters\n");
+
+                if (session_id_prefix)
+                        {
+                        if(strlen(session_id_prefix) >= 32)
+                                BIO_printf(bio_err,
+                                        "warning: id_prefix is too long, only one new session will be possible\n");
+                        else if(strlen(session_id_prefix) >= 16)
+                                BIO_printf(bio_err,
+                                        "warning: id_prefix is too long if you use SSLv2\n");
+                        if(!SSL_CTX_set_generate_session_id(ctx2, generate_session_id))
+                                {
+                                BIO_printf(bio_err,"error setting 'id_prefix'\n");
+                                ERR_print_errors(bio_err);
+                                goto end;
+                                }
+                        BIO_printf(bio_err,"id_prefix '%s' set.\n", session_id_prefix);
+                        }
+                SSL_CTX_set_quiet_shutdown(ctx2,1);
+                if (bugs) SSL_CTX_set_options(ctx2,SSL_OP_ALL);
+                if (hack) SSL_CTX_set_options(ctx2,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
+                SSL_CTX_set_options(ctx2,off);
+
+                /* DTLS: partial reads end up discarding unread UDP bytes :-( 
+                 * Setting read ahead solves this problem.
+                 */
+                if (socket_type == SOCK_DGRAM) SSL_CTX_set_read_ahead(ctx2, 1);
+
+
+                if (state) SSL_CTX_set_info_callback(ctx2,apps_ssl_info_callback);
+
+                SSL_CTX_sess_set_cache_size(ctx2,128);
+
+                if ((!SSL_CTX_load_verify_locations(ctx2,CAfile,CApath)) ||
+                        (!SSL_CTX_set_default_verify_paths(ctx2)))
+                        {
+                        ERR_print_errors(bio_err);
+                        }
+                store = SSL_CTX_get_cert_store(ctx2);
+                X509_STORE_set_flags(store, vflags);
+                }
+#endif 
+
 
 #ifndef OPENSSL_NO_DH
         if (!no_dhe)
@@ -811,22 +1347,99 @@ bad:
                 (void)BIO_flush(bio_s_out);
 
                 SSL_CTX_set_tmp_dh(ctx,dh);
+#ifndef OPENSSL_NO_TLSEXT
+                if (ctx2)
+                        {
+                        if (!dhfile)
+                                { 
+                                DH *dh2=load_dh_param(s_cert_file2);
+                                if (dh2 != NULL)
+                                        {
+                                        BIO_printf(bio_s_out,"Setting temp DH parameters\n");
+                                        (void)BIO_flush(bio_s_out);
+
+                                        DH_free(dh);
+                                        dh = dh2;
+                                        }
+                                }
+                        SSL_CTX_set_tmp_dh(ctx2,dh);
+                        }
+#endif
                 DH_free(dh);
                 }
 #endif
+
+#ifndef OPENSSL_NO_ECDH
+        if (!no_ecdhe)
+                {
+                EC_KEY *ecdh=NULL;
+
+                if (named_curve)
+                        {
+                        int nid = OBJ_sn2nid(named_curve);
+
+                        if (nid == 0)
+                                {
+                                BIO_printf(bio_err, "unknown curve name (%s)\n", 
+                                        named_curve);
+                                goto end;
+                                }
+                        ecdh = EC_KEY_new_by_curve_name(nid);
+                        if (ecdh == NULL)
+                                {
+                                BIO_printf(bio_err, "unable to create curve (%s)\n", 
+                                        named_curve);
+                                goto end;
+                                }
+                        }
+
+                if (ecdh != NULL)
+                        {
+                        BIO_printf(bio_s_out,"Setting temp ECDH parameters\n");
+                        }
+                else
+                        {
+                        BIO_printf(bio_s_out,"Using default temp ECDH parameters\n");
+                        ecdh = EC_KEY_new_by_curve_name(NID_sect163r2);
+                        if (ecdh == NULL) 
+                                {
+                                BIO_printf(bio_err, "unable to create curve (sect163r2)\n");
+                                goto end;
+                                }
+                        }
+                (void)BIO_flush(bio_s_out);
+
+                SSL_CTX_set_tmp_ecdh(ctx,ecdh);
+#ifndef OPENSSL_NO_TLSEXT
+                if (ctx2) 
+                        SSL_CTX_set_tmp_ecdh(ctx2,ecdh);
+#endif
+                EC_KEY_free(ecdh);
+                }
+#endif
         
-        if (!set_cert_stuff(ctx,s_cert_file,s_key_file))
+        if (!set_cert_key_stuff(ctx,s_cert,s_key))
                 goto end;
-        if (s_dcert_file != NULL)
+#ifndef OPENSSL_NO_TLSEXT
+        if (ctx2 && !set_cert_key_stuff(ctx2,s_cert2,s_key2))
+                goto end; 
+#endif
+        if (s_dcert != NULL)
                 {
-                if (!set_cert_stuff(ctx,s_dcert_file,s_dkey_file))
+                if (!set_cert_key_stuff(ctx,s_dcert,s_dkey))
                         goto end;
                 }
 
 #ifndef OPENSSL_NO_RSA
 #if 1
         if (!no_tmp_rsa)
+                {
                 SSL_CTX_set_tmp_rsa_callback(ctx,tmp_rsa_cb);
+#ifndef OPENSSL_NO_TLSEXT
+                if (ctx2) 
+                        SSL_CTX_set_tmp_rsa_callback(ctx2,tmp_rsa_cb);
+#endif  
+                }
 #else
         if (!no_tmp_rsa && SSL_CTX_need_tmp_RSA(ctx))
                 {
@@ -842,6 +1455,16 @@ bad:
                         ERR_print_errors(bio_err);
                         goto end;
                         }
+#ifndef OPENSSL_NO_TLSEXT
+                        if (ctx2)
+                                {
+                                if (!SSL_CTX_set_tmp_rsa(ctx2,rsa))
+                                        {
+                                        ERR_print_errors(bio_err);
+                                        goto end;
+                                        }
+                                }
+#endif
                 RSA_free(rsa);
                 BIO_printf(bio_s_out,"\n");
                 }
@@ -853,26 +1476,72 @@ bad:
                 BIO_printf(bio_err,"error setting cipher list\n");
                 ERR_print_errors(bio_err);
                 goto end;
+#ifndef OPENSSL_NO_TLSEXT
+                if (ctx2 && !SSL_CTX_set_cipher_list(ctx2,cipher))
+                        {
+                        BIO_printf(bio_err,"error setting cipher list\n");
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
+#endif
         }
         SSL_CTX_set_verify(ctx,s_server_verify,verify_callback);
         SSL_CTX_set_session_id_context(ctx,(void*)&s_server_session_id_context,
                 sizeof s_server_session_id_context);
 
+#ifndef OPENSSL_NO_TLSEXT
+        if (ctx2)
+                {
+                SSL_CTX_set_verify(ctx2,s_server_verify,verify_callback);
+                SSL_CTX_set_session_id_context(ctx2,(void*)&s_server_session_id_context,
+                        sizeof s_server_session_id_context);
+
+                tlsextcbp.biodebug = bio_s_out;
+                SSL_CTX_set_tlsext_servername_callback(ctx2, ssl_servername_cb);
+                SSL_CTX_set_tlsext_servername_arg(ctx2, &tlsextcbp);
+                SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
+                SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);
+                }
+#endif
         if (CAfile != NULL)
-            SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile));
-
+                {
+                SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile));
+#ifndef OPENSSL_NO_TLSEXT
+                if (ctx2) 
+                        SSL_CTX_set_client_CA_list(ctx2,SSL_load_client_CA_file(CAfile));
+#endif
+                }
         BIO_printf(bio_s_out,"ACCEPT\n");
         if (www)
-                do_server(port,&accept_socket,www_body, context);
+                do_server(port,socket_type,&accept_socket,www_body, context);
         else
-                do_server(port,&accept_socket,sv_body, context);
+                do_server(port,socket_type,&accept_socket,sv_body, context);
         print_stats(bio_s_out,ctx);
         ret=0;
 end:
         if (ctx != NULL) SSL_CTX_free(ctx);
+        if (s_cert)
+                X509_free(s_cert);
+        if (s_dcert)
+                X509_free(s_dcert);
+        if (s_key)
+                EVP_PKEY_free(s_key);
+        if (s_dkey)
+                EVP_PKEY_free(s_dkey);
+        if (pass)
+                OPENSSL_free(pass);
+        if (dpass)
+                OPENSSL_free(dpass);
+#ifndef OPENSSL_NO_TLSEXT
+        if (ctx2 != NULL) SSL_CTX_free(ctx2);
+        if (s_cert2)
+                X509_free(s_cert2);
+        if (s_key2)
+                EVP_PKEY_free(s_key2);
+#endif
         if (bio_s_out != NULL)
                 {
-                BIO_free(bio_s_out);
+        BIO_free(bio_s_out);
                 bio_s_out=NULL;
                 }
         apps_shutdown();
@@ -883,23 +1552,23 @@ static void print_stats(BIO *bio, SSL_CTX *ssl_ctx)
         {
         BIO_printf(bio,"%4ld items in the session cache\n",
                 SSL_CTX_sess_number(ssl_ctx));
-        BIO_printf(bio,"%4d client connects (SSL_connect())\n",
+        BIO_printf(bio,"%4ld client connects (SSL_connect())\n",
                 SSL_CTX_sess_connect(ssl_ctx));
-        BIO_printf(bio,"%4d client renegotiates (SSL_connect())\n",
+        BIO_printf(bio,"%4ld client renegotiates (SSL_connect())\n",
                 SSL_CTX_sess_connect_renegotiate(ssl_ctx));
-        BIO_printf(bio,"%4d client connects that finished\n",
+        BIO_printf(bio,"%4ld client connects that finished\n",
                 SSL_CTX_sess_connect_good(ssl_ctx));
-        BIO_printf(bio,"%4d server accepts (SSL_accept())\n",
+        BIO_printf(bio,"%4ld server accepts (SSL_accept())\n",
                 SSL_CTX_sess_accept(ssl_ctx));
-        BIO_printf(bio,"%4d server renegotiates (SSL_accept())\n",
+        BIO_printf(bio,"%4ld server renegotiates (SSL_accept())\n",
                 SSL_CTX_sess_accept_renegotiate(ssl_ctx));
-        BIO_printf(bio,"%4d server accepts that finished\n",
+        BIO_printf(bio,"%4ld server accepts that finished\n",
                 SSL_CTX_sess_accept_good(ssl_ctx));
-        BIO_printf(bio,"%4d session cache hits\n",SSL_CTX_sess_hits(ssl_ctx));
-        BIO_printf(bio,"%4d session cache misses\n",SSL_CTX_sess_misses(ssl_ctx));
-        BIO_printf(bio,"%4d session cache timeouts\n",SSL_CTX_sess_timeouts(ssl_ctx));
-        BIO_printf(bio,"%4d callback cache hits\n",SSL_CTX_sess_cb_hits(ssl_ctx));
-        BIO_printf(bio,"%4d cache full overflows (%d allowed)\n",
+        BIO_printf(bio,"%4ld session cache hits\n",SSL_CTX_sess_hits(ssl_ctx));
+        BIO_printf(bio,"%4ld session cache misses\n",SSL_CTX_sess_misses(ssl_ctx));
+        BIO_printf(bio,"%4ld session cache timeouts\n",SSL_CTX_sess_timeouts(ssl_ctx));
+        BIO_printf(bio,"%4ld callback cache hits\n",SSL_CTX_sess_cb_hits(ssl_ctx));
+        BIO_printf(bio,"%4ld cache full overflows (%ld allowed)\n",
                 SSL_CTX_sess_cache_full(ssl_ctx),
                 SSL_CTX_sess_get_cache_size(ssl_ctx));
         }
@@ -913,7 +1582,7 @@ static int sv_body(char *hostname, int s, unsigned char *context)
         unsigned long l;
         SSL *con=NULL;
         BIO *sbio;
-#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
+#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE)
         struct timeval tv;
 #endif
 
@@ -936,6 +1605,19 @@ static int sv_body(char *hostname, int s, unsigned char *context)
 
         if (con == NULL) {
                 con=SSL_new(ctx);
+#ifndef OPENSSL_NO_TLSEXT
+        if (s_tlsextdebug)
+                {
+                SSL_set_tlsext_debug_callback(con, tlsext_cb);
+                SSL_set_tlsext_debug_arg(con, bio_s_out);
+                }
+        if (s_tlsextstatus)
+                {
+                SSL_CTX_set_tlsext_status_cb(ctx, cert_status_cb);
+                tlscstatp.err = bio_err;
+                SSL_CTX_set_tlsext_status_arg(ctx, &tlscstatp);
+                }
+#endif
 #ifndef OPENSSL_NO_KRB5
                 if ((con->kssl_ctx = kssl_ctx_new()) != NULL)
                         {
@@ -951,7 +1633,39 @@ static int sv_body(char *hostname, int s, unsigned char *context)
         }
         SSL_clear(con);
 
-        sbio=BIO_new_socket(s,BIO_NOCLOSE);
+        if (SSL_version(con) == DTLS1_VERSION)
+                {
+                struct timeval timeout;
+
+                sbio=BIO_new_dgram(s,BIO_NOCLOSE);
+
+                if ( enable_timeouts)
+                        {
+                        timeout.tv_sec = 0;
+                        timeout.tv_usec = DGRAM_RCV_TIMEOUT;
+                        BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_RECV_TIMEOUT, 0, &timeout);
+                        
+                        timeout.tv_sec = 0;
+                        timeout.tv_usec = DGRAM_SND_TIMEOUT;
+                        BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout);
+                        }
+
+                
+                if ( mtu > 0)
+                        {
+                        SSL_set_options(con, SSL_OP_NO_QUERY_MTU);
+                        SSL_set_mtu(con, mtu);
+                        }
+                else
+                        /* want to do MTU discovery */
+                        BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL);
+
+        /* turn on cookie exchange */
+        SSL_set_options(con, SSL_OP_COOKIE_EXCHANGE);
+                }
+        else
+                sbio=BIO_new_socket(s,BIO_NOCLOSE);
+
         if (s_nbio_test)
                 {
                 BIO *test;
@@ -966,14 +1680,21 @@ static int sv_body(char *hostname, int s, unsigned char *context)
         if (s_debug)
                 {
                 con->debug=1;
-                BIO_set_callback(SSL_get_rbio(con),bio_dump_cb);
-                BIO_set_callback_arg(SSL_get_rbio(con),bio_s_out);
+                BIO_set_callback(SSL_get_rbio(con),bio_dump_callback);
+                BIO_set_callback_arg(SSL_get_rbio(con),(char *)bio_s_out);
                 }
         if (s_msg)
                 {
                 SSL_set_msg_callback(con, msg_cb);
                 SSL_set_msg_callback_arg(con, bio_s_out);
                 }
+#ifndef OPENSSL_NO_TLSEXT
+        if (s_tlsextdebug)
+                {
+                SSL_set_tlsext_debug_callback(con, tlsext_cb);
+                SSL_set_tlsext_debug_arg(con, bio_s_out);
+                }
+#endif
 
         width=s+1;
         for (;;)
@@ -987,7 +1708,7 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                 if (!read_from_sslcon)
                         {
                         FD_ZERO(&readfds);
-#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS)
+#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_NETWARE)
                         FD_SET(fileno(stdin),&readfds);
 #endif
                         FD_SET(s,&readfds);
@@ -997,7 +1718,7 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                          * the compiler: if you do have a cast then you can either
                          * go for (int *) or (void *).
                          */
-#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
+#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE)
                         /* Under DOS (non-djgpp) and Windows we can't select on stdin: only
                          * on sockets. As a workaround we timeout the select every
                          * second and check for any keypress. In a proper Windows
@@ -1057,7 +1778,8 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                                 if ((i <= 0) || (buf[0] == 'q'))
                                         {
                                         BIO_printf(bio_s_out,"DONE\n");
-                                        SHUTDOWN(s);
+                                        if (SSL_version(con) != DTLS1_VERSION)
+                        SHUTDOWN(s);
         /*                              close_accept_socket();
                                         ret= -11;*/
                                         goto err;
@@ -1086,7 +1808,7 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                                         }
                                 if (buf[0] == 'P')
                                         {
-                                        static char *str="Lets print some clear text\n";
+                                        static const char *str="Lets print some clear text\n";
                                         BIO_write(SSL_get_wbio(con),str,strlen(str));
                                         }
                                 if (buf[0] == 'S')
@@ -1270,7 +1992,7 @@ static int init_ssl_connection(SSL *con)
         }
 
 #ifndef OPENSSL_NO_DH
-static DH *load_dh_param(char *dhfile)
+static DH *load_dh_param(const char *dhfile)
         {
         DH *ret=NULL;
         BIO *bio;
@@ -1338,6 +2060,13 @@ static int www_body(char *hostname, int s, unsigned char *context)
         if (!BIO_set_write_buffer_size(io,bufsize)) goto err;
 
         if ((con=SSL_new(ctx)) == NULL) goto err;
+#ifndef OPENSSL_NO_TLSEXT
+                if (s_tlsextdebug)
+                        {
+                        SSL_set_tlsext_debug_callback(con, tlsext_cb);
+                        SSL_set_tlsext_debug_arg(con, bio_s_out);
+                        }
+#endif
 #ifndef OPENSSL_NO_KRB5
         if ((con->kssl_ctx = kssl_ctx_new()) != NULL)
                 {
@@ -1369,8 +2098,8 @@ static int www_body(char *hostname, int s, unsigned char *context)
         if (s_debug)
                 {
                 con->debug=1;
-                BIO_set_callback(SSL_get_rbio(con),bio_dump_cb);
-                BIO_set_callback_arg(SSL_get_rbio(con),bio_s_out);
+                BIO_set_callback(SSL_get_rbio(con),bio_dump_callback);
+                BIO_set_callback_arg(SSL_get_rbio(con),(char *)bio_s_out);
                 }
         if (s_msg)
                 {
@@ -1417,7 +2146,9 @@ static int www_body(char *hostname, int s, unsigned char *context)
                         else
                                 {
                                 BIO_printf(bio_s_out,"read R BLOCK\n");
-#if !defined(OPENSSL_SYS_MSDOS) && !defined(__DJGPP__)
+#if defined(OPENSSL_SYS_NETWARE)
+            delay(1000);
+#elif !defined(OPENSSL_SYS_MSDOS) && !defined(__DJGPP__)
                                 sleep(1);
 #endif
                                 continue;
@@ -1436,7 +2167,7 @@ static int www_body(char *hostname, int s, unsigned char *context)
                         char *p;
                         X509 *peer;
                         STACK_OF(SSL_CIPHER) *sk;
-                        static char *space="                          ";
+                        static const char *space="                          ";
 
                         BIO_puts(io,"HTTP/1.0 200 ok\r\nContent-type: text/html\r\n\r\n");
                         BIO_puts(io,"<HTML><BODY BGCOLOR=\"#ffffff\">\n");
@@ -1516,7 +2247,7 @@ static int www_body(char *hostname, int s, unsigned char *context)
                         {
                         BIO *file;
                         char *p,*e;
-                        static char *text="HTTP/1.0 200 ok\r\nContent-type: text/plain\r\n\r\n";
+                        static const char *text="HTTP/1.0 200 ok\r\nContent-type: text/plain\r\n\r\n";
 
                         /* skip the '/' */
                         p= &(buf[5]);
@@ -1692,21 +2423,30 @@ err:
 #ifndef OPENSSL_NO_RSA
 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
         {
+        BIGNUM *bn = NULL;
         static RSA *rsa_tmp=NULL;
 
-        if (rsa_tmp == NULL)
+        if (!rsa_tmp && ((bn = BN_new()) == NULL))
+                BIO_printf(bio_err,"Allocation error in generating RSA key\n");
+        if (!rsa_tmp && bn)
                 {
                 if (!s_quiet)
                         {
                         BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
                         (void)BIO_flush(bio_err);
                         }
-                rsa_tmp=RSA_generate_key(keylength,RSA_F4,NULL,NULL);
+                if(!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) ||
+                                !RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL))
+                        {
+                        if(rsa_tmp) RSA_free(rsa_tmp);
+                        rsa_tmp = NULL;
+                        }
                 if (!s_quiet)
                         {
                         BIO_printf(bio_err,"\n");
                         (void)BIO_flush(bio_err);
                         }
+                BN_free(bn);
                 }
         return(rsa_tmp);
         }
diff --git a/src/lib/libssl/src/apps/s_socket.c b/src/lib/libssl/src/apps/s_socket.c
index d9fad2d1d7..981650bddd 100644
--- a/src/lib/libssl/src/apps/s_socket.c
+++ b/src/lib/libssl/src/apps/s_socket.c
@@ -62,8 +62,6 @@
 #include <errno.h>
 #include <signal.h>
 
-#include <openssl/e_os2.h>
-
 /* With IPv6, it looks like Digital has mixed up the proper order of
    recursive header file inclusion, resulting in the compiler complaining
    that u_int isn't defined, but only if _POSIX_C_SOURCE is defined, which
@@ -81,13 +79,25 @@ typedef unsigned int u_int;
 #include "s_apps.h"
 #include <openssl/ssl.h>
 
+#ifdef FLAT_INC
+#include "e_os.h"
+#else
+#include "../e_os.h"
+#endif
+
+#ifndef OPENSSL_NO_SOCK
+
+#if defined(OPENSSL_SYS_NETWARE) && defined(NETWARE_BSDSOCK)
+#include "netdb.h"
+#endif
+
 static struct hostent *GetHostByName(char *name);
-#ifdef OPENSSL_SYS_WINDOWS
+#if defined(OPENSSL_SYS_WINDOWS) || (defined(OPENSSL_SYS_NETWARE) && !defined(NETWARE_BSDSOCK))
 static void ssl_sock_cleanup(void);
 #endif
 static int ssl_sock_init(void);
-static int init_server(int *sock, int port);
-static int init_server_long(int *sock, int port,char *ip);
+static int init_server(int *sock, int port, int type);
+static int init_server_long(int *sock, int port,char *ip, int type);
 static int do_accept(int acc_sock, int *sock, char **host);
 
 #ifdef OPENSSL_SYS_WIN16
@@ -96,6 +106,10 @@ static int do_accept(int acc_sock, int *sock, char **host);
 #define SOCKET_PROTOCOL IPPROTO_TCP
 #endif
 
+#if defined(OPENSSL_SYS_NETWARE) && !defined(NETWARE_BSDSOCK)
+static int wsa_init_done=0;
+#endif
+
 #ifdef OPENSSL_SYS_WINDOWS
 static struct WSAData wsa_state;
 static int wsa_init_done=0;
@@ -144,6 +158,15 @@ static void ssl_sock_cleanup(void)
                 WSACleanup();
                 }
         }
+#elif defined(OPENSSL_SYS_NETWARE) && !defined(NETWARE_BSDSOCK)
+static void sock_cleanup(void)
+    {
+    if (wsa_init_done)
+        {
+        wsa_init_done=0;
+                WSACleanup();
+                }
+        }
 #endif
 
 static int ssl_sock_init(void)
@@ -178,20 +201,43 @@ static int ssl_sock_init(void)
                 SetWindowLong(topWnd,GWL_WNDPROC,(LONG)lpTopHookProc);
 #endif /* OPENSSL_SYS_WIN16 */
                 }
+#elif defined(OPENSSL_SYS_NETWARE) && !defined(NETWARE_BSDSOCK)
+   WORD wVerReq;
+   WSADATA wsaData;
+   int err;
+
+   if (!wsa_init_done)
+      {
+   
+# ifdef SIGINT
+      signal(SIGINT,(void (*)(int))sock_cleanup);
+# endif
+
+      wsa_init_done=1;
+      wVerReq = MAKEWORD( 2, 0 );
+      err = WSAStartup(wVerReq,&wsaData);
+      if (err != 0)
+         {
+         BIO_printf(bio_err,"unable to start WINSOCK2, error code=%d\n",err);
+         return(0);
+         }
+      }
 #endif /* OPENSSL_SYS_WINDOWS */
         return(1);
         }
 
-int init_client(int *sock, char *host, char *port, int af)
+int init_client(int *sock, char *host, int port, int type, int af)
         {
         struct addrinfo hints, *ai_top, *ai;
         int i, s;
+        char port_s[NI_MAXSERV];
 
         memset(&hints, '\0', sizeof(hints));
         hints.ai_family = af;
-        hints.ai_socktype = SOCK_STREAM;
+        hints.ai_socktype = type;
 
-        if ((i = getaddrinfo(host, port, &hints, &ai_top)) != 0 ||
+        snprintf(port_s, sizeof(port_s), "%d", port);
+        if ((i = getaddrinfo(host, port_s, &hints, &ai_top)) != 0 ||
             ai_top == NULL || ai_top->ai_addr == NULL)
                 {
                 BIO_printf(bio_err,"getaddrinfo: %s\n", gai_strerror(i));
@@ -203,9 +249,12 @@ int init_client(int *sock, char *host, char *port, int af)
                 s=socket(ai->ai_addr->sa_family, SOCK_STREAM, SOCKET_PROTOCOL);
                 if (s == INVALID_SOCKET) { continue; }
 #ifndef OPENSSL_SYS_MPE
+        if (type == SOCK_STREAM)
+                {
                 i=0;
                 i=setsockopt(s,SOL_SOCKET,SO_KEEPALIVE,(char *)&i,sizeof(i));
-                if (i == -1) { close(s); continue; }
+                if (i < 0) { perror("keepalive"); return(0); }
+                }
 #endif
                 if ((i = connect(s, ai->ai_addr, ai->ai_addr->sa_len)) == 0)
                         { *sock=s; freeaddrinfo(ai_top); return (1);}
@@ -219,30 +268,36 @@ int init_client(int *sock, char *host, char *port, int af)
         return(0);
         }
 
-int do_server(int port, int *ret, int (*cb)(), char *context)
+int do_server(int port, int type, int *ret, int (*cb)(char *hostname, int s, unsigned char *context), unsigned char *context)
         {
         int sock;
-        char *name;
+        char *name = NULL;
         int accept_socket;
         int i;
 
-        if (!init_server(&accept_socket,port)) return(0);
+        if (!init_server(&accept_socket,port,type)) return(0);
 
         if (ret != NULL)
                 {
                 *ret=accept_socket;
                 /* return(1);*/
                 }
-        for (;;)
-                {
-                if (do_accept(accept_socket,&sock,&name) == 0)
+        for (;;)
+                {
+                if (type==SOCK_STREAM)
                         {
-                        SHUTDOWN(accept_socket);
-                        return(0);
+                        if (do_accept(accept_socket,&sock,&name) == 0)
+                                {
+                                SHUTDOWN(accept_socket);
+                                return(0);
+                                }
                         }
+                else
+                        sock = accept_socket;
                 i=(*cb)(name,sock, context);
                 if (name != NULL) OPENSSL_free(name);
-                SHUTDOWN2(sock);
+                if (type==SOCK_STREAM)
+                        SHUTDOWN2(sock);
                 if (i < 0)
                         {
                         SHUTDOWN2(accept_socket);
@@ -251,7 +306,7 @@ int do_server(int port, int *ret, int (*cb)(), char *context)
                 }
         }
 
-static int init_server_long(int *sock, int port, char *ip)
+static int init_server_long(int *sock, int port, char *ip, int type)
         {
         int ret=0;
         struct sockaddr_in server;
@@ -271,7 +326,11 @@ static int init_server_long(int *sock, int port, char *ip)
 #else
                 memcpy(&server.sin_addr,ip,4);
 #endif
-        s=socket(AF_INET,SOCK_STREAM,SOCKET_PROTOCOL);
+        
+                if (type == SOCK_STREAM)
+                        s=socket(AF_INET,SOCK_STREAM,SOCKET_PROTOCOL);
+                else /* type == SOCK_DGRAM */
+                        s=socket(AF_INET, SOCK_DGRAM,IPPROTO_UDP);
 
         if (s == INVALID_SOCKET) goto err;
 #if defined SOL_SOCKET && defined SO_REUSEADDR
@@ -289,7 +348,7 @@ static int init_server_long(int *sock, int port, char *ip)
                 goto err;
                 }
         /* Make it 128 for linux */
-        if (listen(s,128) == -1) goto err;
+        if (type==SOCK_STREAM && listen(s,128) == -1) goto err;
         i=0;
         *sock=s;
         ret=1;
@@ -301,9 +360,9 @@ err:
         return(ret);
         }
 
-static int init_server(int *sock, int port)
+static int init_server(int *sock, int port, int type)
         {
-        return(init_server_long(sock, port, NULL));
+        return(init_server_long(sock, port, NULL, type));
         }
 
 static int do_accept(int acc_sock, int *sock, char **host)
@@ -330,7 +389,7 @@ redoit:
         ret=accept(acc_sock,(struct sockaddr *)&from,(void *)&len);
         if (ret == INVALID_SOCKET)
                 {
-#ifdef OPENSSL_SYS_WINDOWS
+#if defined(OPENSSL_SYS_WINDOWS) || (defined(OPENSSL_SYS_NETWARE) && !defined(NETWARE_BSDSOCK))
                 i=WSAGetLastError();
                 BIO_printf(bio_err,"accept error %d\n",i);
 #else
@@ -495,3 +554,5 @@ static struct hostent *GetHostByName(char *name)
                 return(ret);
                 }
         }
+
+#endif
diff --git a/src/lib/libssl/src/apps/s_time.c b/src/lib/libssl/src/apps/s_time.c
index 7d47057465..904945e1a8 100644
--- a/src/lib/libssl/src/apps/s_time.c
+++ b/src/lib/libssl/src/apps/s_time.c
@@ -85,7 +85,7 @@
 #include OPENSSL_UNISTD
 #endif
 
-#if !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_VXWORKS) && (!defined(OPENSSL_SYS_VMS) || defined(__DECC))
+#if !defined(OPENSSL_SYS_NETWARE) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_VXWORKS) && (!defined(OPENSSL_SYS_VMS) || defined(__DECC))
 #define TIMES
 #endif
 
@@ -105,7 +105,7 @@
 #undef TIMES
 #endif
 
-#if !defined(TIMES) && !defined(OPENSSL_SYS_VXWORKS)
+#if !defined(TIMES) && !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_NETWARE)
 #include <sys/timeb.h>
 #endif
 
@@ -384,6 +384,20 @@ static double tm_Time_F(int s)
                 ret=((double)(tend.tms_utime-tstart.tms_utime))/HZ;
                 return((ret == 0.0)?1e-6:ret);
         }
+#elif defined(OPENSSL_SYS_NETWARE)
+    static clock_t tstart,tend;
+
+    if (s == START)
+    {
+        tstart=clock();
+        return(0);
+    }
+    else
+    {
+        tend=clock();
+        ret=(double)((double)(tend)-(double)(tstart));
+        return((ret < 0.001)?0.001:ret);
+    }
 #elif defined(OPENSSL_SYS_VXWORKS)
         {
         static unsigned long tick_start, tick_end;
diff --git a/src/lib/libssl/src/apps/sess_id.c b/src/lib/libssl/src/apps/sess_id.c
index d91d84d220..b99179f276 100644
--- a/src/lib/libssl/src/apps/sess_id.c
+++ b/src/lib/libssl/src/apps/sess_id.c
@@ -69,7 +69,7 @@
 #undef PROG
 #define PROG    sess_id_main
 
-static char *sess_id_usage[]={
+static const char *sess_id_usage[]={
 "usage: sess_id args\n",
 "\n",
 " -inform arg     - input format - default PEM (DER or PEM)\n",
@@ -95,7 +95,7 @@ int MAIN(int argc, char **argv)
         int informat,outformat;
         char *infile=NULL,*outfile=NULL,*context=NULL;
         int cert=0,noout=0,text=0;
-        char **pp;
+        const char **pp;
 
         apps_startup();
 
@@ -241,7 +241,7 @@ bad:
         if (!noout && !cert)
                 {
                 if      (outformat == FORMAT_ASN1)
-                        i=(int)i2d_SSL_SESSION_bio(out,x);
+                        i=i2d_SSL_SESSION_bio(out,x);
                 else if (outformat == FORMAT_PEM)
                         i=PEM_write_bio_SSL_SESSION(out,x);
                 else    {
diff --git a/src/lib/libssl/src/apps/smime.c b/src/lib/libssl/src/apps/smime.c
index 51bc893ffa..ce8a1cbecb 100644
--- a/src/lib/libssl/src/apps/smime.c
+++ b/src/lib/libssl/src/apps/smime.c
@@ -1,9 +1,9 @@
 /* smime.c */
 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
- * project 1999.
+ * project.
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -64,10 +64,13 @@
 #include <openssl/crypto.h>
 #include <openssl/pem.h>
 #include <openssl/err.h>
+#include <openssl/x509_vfy.h>
+#include <openssl/x509v3.h>
 
 #undef PROG
 #define PROG smime_main
 static int save_certs(char *signerfile, STACK_OF(X509) *signers);
+static int smime_cb(int ok, X509_STORE_CTX *ctx);
 
 #define SMIME_OP        0x10
 #define SMIME_ENCRYPT   (1 | SMIME_OP)
@@ -79,12 +82,12 @@ static int save_certs(char *signerfile, STACK_OF(X509) *signers);
 int MAIN(int, char **);
 
 int MAIN(int argc, char **argv)
-{
+        {
         ENGINE *e = NULL;
         int operation = 0;
         int ret = 0;
         char **args;
-        char *inmode = "r", *outmode = "w";
+        const char *inmode = "r", *outmode = "w";
         char *infile = NULL, *outfile = NULL;
         char *signerfile = NULL, *recipfile = NULL;
         char *certfile = NULL, *keyfile = NULL, *contfile=NULL;
@@ -96,7 +99,7 @@ int MAIN(int argc, char **argv)
         STACK_OF(X509) *encerts = NULL, *other = NULL;
         BIO *in = NULL, *out = NULL, *indata = NULL;
         int badarg = 0;
-        int flags = PKCS7_DETACHED, store_flags = 0;
+        int flags = PKCS7_DETACHED;
         char *to = NULL, *from = NULL, *subject = NULL;
         char *CAfile = NULL, *CApath = NULL;
         char *passargin = NULL, *passin = NULL;
@@ -108,30 +111,44 @@ int MAIN(int argc, char **argv)
         char *engine=NULL;
 #endif
 
+        X509_VERIFY_PARAM *vpm = NULL;
+
         args = argv + 1;
         ret = 1;
 
         apps_startup();
 
         if (bio_err == NULL)
+                {
                 if ((bio_err = BIO_new(BIO_s_file())) != NULL)
                         BIO_set_fp(bio_err, stderr, BIO_NOCLOSE|BIO_FP_TEXT);
+                }
 
         if (!load_config(bio_err, NULL))
                 goto end;
 
-        while (!badarg && *args && *args[0] == '-') {
-                if (!strcmp (*args, "-encrypt")) operation = SMIME_ENCRYPT;
-                else if (!strcmp (*args, "-decrypt")) operation = SMIME_DECRYPT;
-                else if (!strcmp (*args, "-sign")) operation = SMIME_SIGN;
-                else if (!strcmp (*args, "-verify")) operation = SMIME_VERIFY;
-                else if (!strcmp (*args, "-pk7out")) operation = SMIME_PK7OUT;
+        while (!badarg && *args && *args[0] == '-')
+                {
+                if (!strcmp (*args, "-encrypt"))
+                        operation = SMIME_ENCRYPT;
+                else if (!strcmp (*args, "-decrypt"))
+                        operation = SMIME_DECRYPT;
+                else if (!strcmp (*args, "-sign"))
+                        operation = SMIME_SIGN;
+                else if (!strcmp (*args, "-verify"))
+                        operation = SMIME_VERIFY;
+                else if (!strcmp (*args, "-pk7out"))
+                        operation = SMIME_PK7OUT;
 #ifndef OPENSSL_NO_DES
                 else if (!strcmp (*args, "-des3")) 
                                 cipher = EVP_des_ede3_cbc();
                 else if (!strcmp (*args, "-des")) 
                                 cipher = EVP_des_cbc();
 #endif
+#ifndef OPENSSL_NO_SEED
+                else if (!strcmp (*args, "-seed")) 
+                                cipher = EVP_seed_cbc();
+#endif
 #ifndef OPENSSL_NO_RC2
                 else if (!strcmp (*args, "-rc2-40")) 
                                 cipher = EVP_rc2_40_cbc();
@@ -148,6 +165,14 @@ int MAIN(int argc, char **argv)
                 else if (!strcmp(*args,"-aes256"))
                                 cipher = EVP_aes_256_cbc();
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+                else if (!strcmp(*args,"-camellia128"))
+                                cipher = EVP_camellia_128_cbc();
+                else if (!strcmp(*args,"-camellia192"))
+                                cipher = EVP_camellia_192_cbc();
+                else if (!strcmp(*args,"-camellia256"))
+                                cipher = EVP_camellia_256_cbc();
+#endif
                 else if (!strcmp (*args, "-text")) 
                                 flags |= PKCS7_TEXT;
                 else if (!strcmp (*args, "-nointern")) 
@@ -172,127 +197,225 @@ int MAIN(int argc, char **argv)
                                 flags |= PKCS7_NOOLDMIMETYPE;
                 else if (!strcmp (*args, "-crlfeol"))
                                 flags |= PKCS7_CRLFEOL;
-                else if (!strcmp (*args, "-crl_check"))
-                                store_flags |= X509_V_FLAG_CRL_CHECK;
-                else if (!strcmp (*args, "-crl_check_all"))
-                                store_flags |= X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL;
-                else if (!strcmp(*args,"-rand")) {
-                        if (args[1]) {
+                else if (!strcmp(*args,"-rand"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 inrand = *args;
-                        } else badarg = 1;
+                                }
+                        else
+                                badarg = 1;
                         need_rand = 1;
+                        }
 #ifndef OPENSSL_NO_ENGINE
-                } else if (!strcmp(*args,"-engine")) {
-                        if (args[1]) {
+                else if (!strcmp(*args,"-engine"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 engine = *args;
-                        } else badarg = 1;
+                                }
+                        else badarg = 1;
+                        }
 #endif
-                } else if (!strcmp(*args,"-passin")) {
-                        if (args[1]) {
+                else if (!strcmp(*args,"-passin"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 passargin = *args;
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-to")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (!strcmp (*args, "-to"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 to = *args;
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-from")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (!strcmp (*args, "-from"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 from = *args;
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-subject")) {
-                        if (args[1]) {
+                                }
+                        else badarg = 1;
+                        }
+                else if (!strcmp (*args, "-subject"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 subject = *args;
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-signer")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (!strcmp (*args, "-signer"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 signerfile = *args;
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-recip")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (!strcmp (*args, "-recip"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 recipfile = *args;
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-inkey")) {
-                        if (args[1]) {
+                                }
+                        else badarg = 1;
+                        }
+                else if (!strcmp (*args, "-inkey"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 keyfile = *args;
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-keyform")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                }
+                else if (!strcmp (*args, "-keyform"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 keyform = str2fmt(*args);
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-certfile")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (!strcmp (*args, "-certfile"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 certfile = *args;
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-CAfile")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (!strcmp (*args, "-CAfile"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 CAfile = *args;
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-CApath")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (!strcmp (*args, "-CApath"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 CApath = *args;
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-in")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (!strcmp (*args, "-in"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 infile = *args;
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-inform")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (!strcmp (*args, "-inform"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 informat = str2fmt(*args);
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-outform")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (!strcmp (*args, "-outform"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 outformat = str2fmt(*args);
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-out")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (!strcmp (*args, "-out"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 outfile = *args;
-                        } else badarg = 1;
-                } else if (!strcmp (*args, "-content")) {
-                        if (args[1]) {
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (!strcmp (*args, "-content"))
+                        {
+                        if (args[1])
+                                {
                                 args++;
                                 contfile = *args;
-                        } else badarg = 1;
-                } else badarg = 1;
+                                }
+                        else
+                                badarg = 1;
+                        }
+                else if (args_verify(&args, NULL, &badarg, bio_err, &vpm))
+                        continue;
+                else
+                        badarg = 1;
                 args++;
-        }
+                }
 
-        if(operation == SMIME_SIGN) {
-                if(!signerfile) {
+
+        if (operation == SMIME_SIGN)
+                {
+                if (!signerfile)
+                        {
                         BIO_printf(bio_err, "No signer certificate specified\n");
                         badarg = 1;
-                }
+                        }
                 need_rand = 1;
-        } else if(operation == SMIME_DECRYPT) {
-                if(!recipfile) {
-                        BIO_printf(bio_err, "No recipient certificate and key specified\n");
+                }
+        else if (operation == SMIME_DECRYPT)
+                {
+                if (!recipfile && !keyfile)
+                        {
+                        BIO_printf(bio_err, "No recipient certificate or key specified\n");
                         badarg = 1;
+                        }
                 }
-        } else if(operation == SMIME_ENCRYPT) {
-                if(!*args) {
+        else if (operation == SMIME_ENCRYPT)
+                {
+                if (!*args)
+                        {
                         BIO_printf(bio_err, "No recipient(s) certificate(s) specified\n");
                         badarg = 1;
-                }
+                        }
                 need_rand = 1;
-        } else if(!operation) badarg = 1;
+                }
+        else if (!operation)
+                badarg = 1;
 
-        if (badarg) {
+        if (badarg)
+                {
                 BIO_printf (bio_err, "Usage smime [options] cert.pem ...\n");
                 BIO_printf (bio_err, "where options are\n");
                 BIO_printf (bio_err, "-encrypt       encrypt message\n");
@@ -304,6 +427,9 @@ int MAIN(int argc, char **argv)
                 BIO_printf (bio_err, "-des3          encrypt with triple DES\n");
                 BIO_printf (bio_err, "-des           encrypt with DES\n");
 #endif
+#ifndef OPENSSL_NO_SEED
+                BIO_printf (bio_err, "-seed          encrypt with SEED\n");
+#endif
 #ifndef OPENSSL_NO_RC2
                 BIO_printf (bio_err, "-rc2-40        encrypt with RC2-40 (default)\n");
                 BIO_printf (bio_err, "-rc2-64        encrypt with RC2-64\n");
@@ -313,6 +439,10 @@ int MAIN(int argc, char **argv)
                 BIO_printf (bio_err, "-aes128, -aes192, -aes256\n");
                 BIO_printf (bio_err, "               encrypt PEM output with cbc aes\n");
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+                BIO_printf (bio_err, "-camellia128, -camellia192, -camellia256\n");
+                BIO_printf (bio_err, "               encrypt PEM output with cbc camellia\n");
+#endif
                 BIO_printf (bio_err, "-nointern      don't search certificates in message for signer\n");
                 BIO_printf (bio_err, "-nosigs        don't verify message signature\n");
                 BIO_printf (bio_err, "-noverify      don't verify signers certificate\n");
@@ -347,121 +477,155 @@ int MAIN(int argc, char **argv)
                 BIO_printf(bio_err,  "               the random number generator\n");
                 BIO_printf (bio_err, "cert.pem       recipient certificate(s) for encryption\n");
                 goto end;
-        }
+                }
 
 #ifndef OPENSSL_NO_ENGINE
         e = setup_engine(bio_err, engine, 0);
 #endif
 
-        if(!app_passwd(bio_err, passargin, NULL, &passin, NULL)) {
+        if (!app_passwd(bio_err, passargin, NULL, &passin, NULL))
+                {
                 BIO_printf(bio_err, "Error getting password\n");
                 goto end;
-        }
+                }
 
-        if (need_rand) {
+        if (need_rand)
+                {
                 app_RAND_load_file(NULL, bio_err, (inrand != NULL));
                 if (inrand != NULL)
                         BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
                                 app_RAND_load_files(inrand));
-        }
+                }
 
         ret = 2;
 
-        if(operation != SMIME_SIGN) flags &= ~PKCS7_DETACHED;
+        if (operation != SMIME_SIGN)
+                flags &= ~PKCS7_DETACHED;
 
-        if(operation & SMIME_OP) {
-                if(flags & PKCS7_BINARY) inmode = "rb";
-                if(outformat == FORMAT_ASN1) outmode = "wb";
-        } else {
-                if(flags & PKCS7_BINARY) outmode = "wb";
-                if(informat == FORMAT_ASN1) inmode = "rb";
-        }
+        if (operation & SMIME_OP)
+                {
+                if (flags & PKCS7_BINARY)
+                        inmode = "rb";
+                if (outformat == FORMAT_ASN1)
+                        outmode = "wb";
+                }
+        else
+                {
+                if (flags & PKCS7_BINARY)
+                        outmode = "wb";
+                if (informat == FORMAT_ASN1)
+                        inmode = "rb";
+                }
 
-        if(operation == SMIME_ENCRYPT) {
-                if (!cipher) {
+        if (operation == SMIME_ENCRYPT)
+                {
+                if (!cipher)
+                        {
 #ifndef OPENSSL_NO_RC2                  
                         cipher = EVP_rc2_40_cbc();
 #else
                         BIO_printf(bio_err, "No cipher selected\n");
                         goto end;
 #endif
-                }
+                        }
                 encerts = sk_X509_new_null();
-                while (*args) {
-                        if(!(cert = load_cert(bio_err,*args,FORMAT_PEM,
-                                NULL, e, "recipient certificate file"))) {
+                while (*args)
+                        {
+                        if (!(cert = load_cert(bio_err,*args,FORMAT_PEM,
+                                NULL, e, "recipient certificate file")))
+                                {
 #if 0                           /* An appropriate message is already printed */
                                 BIO_printf(bio_err, "Can't read recipient certificate file %s\n", *args);
 #endif
                                 goto end;
-                        }
+                                }
                         sk_X509_push(encerts, cert);
                         cert = NULL;
                         args++;
+                        }
                 }
-        }
 
-        if(signerfile && (operation == SMIME_SIGN)) {
-                if(!(signer = load_cert(bio_err,signerfile,FORMAT_PEM, NULL,
-                        e, "signer certificate"))) {
+        if (signerfile && (operation == SMIME_SIGN))
+                {
+                if (!(signer = load_cert(bio_err,signerfile,FORMAT_PEM, NULL,
+                        e, "signer certificate")))
+                        {
 #if 0                   /* An appropri message has already been printed */
                         BIO_printf(bio_err, "Can't read signer certificate file %s\n", signerfile);
 #endif
                         goto end;
+                        }
                 }
-        }
 
-        if(certfile) {
-                if(!(other = load_certs(bio_err,certfile,FORMAT_PEM, NULL,
-                        e, "certificate file"))) {
+        if (certfile)
+                {
+                if (!(other = load_certs(bio_err,certfile,FORMAT_PEM, NULL,
+                        e, "certificate file")))
+                        {
 #if 0                   /* An appropriate message has already been printed */
                         BIO_printf(bio_err, "Can't read certificate file %s\n", certfile);
 #endif
                         ERR_print_errors(bio_err);
                         goto end;
+                        }
                 }
-        }
 
-        if(recipfile && (operation == SMIME_DECRYPT)) {
-                if(!(recip = load_cert(bio_err,recipfile,FORMAT_PEM,NULL,
-                        e, "recipient certificate file"))) {
+        if (recipfile && (operation == SMIME_DECRYPT))
+                {
+                if (!(recip = load_cert(bio_err,recipfile,FORMAT_PEM,NULL,
+                        e, "recipient certificate file")))
+                        {
 #if 0                   /* An appropriate message has alrady been printed */
                         BIO_printf(bio_err, "Can't read recipient certificate file %s\n", recipfile);
 #endif
                         ERR_print_errors(bio_err);
                         goto end;
+                        }
                 }
-        }
 
-        if(operation == SMIME_DECRYPT) {
-                if(!keyfile) keyfile = recipfile;
-        } else if(operation == SMIME_SIGN) {
-                if(!keyfile) keyfile = signerfile;
-        } else keyfile = NULL;
+        if (operation == SMIME_DECRYPT)
+                {
+                if (!keyfile)
+                        keyfile = recipfile;
+                }
+        else if (operation == SMIME_SIGN)
+                {
+                if (!keyfile)
+                        keyfile = signerfile;
+                }
+        else keyfile = NULL;
 
-        if(keyfile) {
+        if (keyfile)
+                {
                 key = load_key(bio_err, keyfile, keyform, 0, passin, e,
                                "signing key file");
-                if (!key) {
+                if (!key)
                         goto end;
-                }
-        }
+                }
 
-        if (infile) {
-                if (!(in = BIO_new_file(infile, inmode))) {
+        if (infile)
+                {
+                if (!(in = BIO_new_file(infile, inmode)))
+                        {
                         BIO_printf (bio_err,
                                  "Can't open input file %s\n", infile);
                         goto end;
+                        }
                 }
-        } else in = BIO_new_fp(stdin, BIO_NOCLOSE);
+        else
+                in = BIO_new_fp(stdin, BIO_NOCLOSE);
 
-        if (outfile) {
-                if (!(out = BIO_new_file(outfile, outmode))) {
+        if (outfile)
+                {
+                if (!(out = BIO_new_file(outfile, outmode)))
+                        {
                         BIO_printf (bio_err,
                                  "Can't open output file %s\n", outfile);
                         goto end;
+                        }
                 }
-        } else {
+        else
+                {
                 out = BIO_new_fp(stdout, BIO_NOCLOSE);
 #ifdef OPENSSL_SYS_VMS
                 {
@@ -469,100 +633,127 @@ int MAIN(int argc, char **argv)
                     out = BIO_push(tmpbio, out);
                 }
 #endif
-        }
+                }
 
-        if(operation == SMIME_VERIFY) {
-                if(!(store = setup_verify(bio_err, CAfile, CApath))) goto end;
-                X509_STORE_set_flags(store, store_flags);
-        }
+        if (operation == SMIME_VERIFY)
+                {
+                if (!(store = setup_verify(bio_err, CAfile, CApath)))
+                        goto end;
+                X509_STORE_set_verify_cb_func(store, smime_cb);
+                if (vpm)
+                        X509_STORE_set1_param(store, vpm);
+                }
 
 
         ret = 3;
 
-        if(operation == SMIME_ENCRYPT) {
+        if (operation == SMIME_ENCRYPT)
                 p7 = PKCS7_encrypt(encerts, in, cipher, flags);
-        } else if(operation == SMIME_SIGN) {
+        else if (operation == SMIME_SIGN)
+                {
+                /* If detached data and SMIME output enable partial
+                 * signing.
+                 */
+                if ((flags & PKCS7_DETACHED) && (outformat == FORMAT_SMIME))
+                        flags |= PKCS7_STREAM;
                 p7 = PKCS7_sign(signer, key, other, in, flags);
-                if (BIO_reset(in) != 0 && (flags & PKCS7_DETACHED)) {
-                  BIO_printf(bio_err, "Can't rewind input file\n");
-                  goto end;
                 }
-        } else {
-                if(informat == FORMAT_SMIME) 
+        else
+                {
+                if (informat == FORMAT_SMIME) 
                         p7 = SMIME_read_PKCS7(in, &indata);
-                else if(informat == FORMAT_PEM) 
+                else if (informat == FORMAT_PEM) 
                         p7 = PEM_read_bio_PKCS7(in, NULL, NULL, NULL);
-                else if(informat == FORMAT_ASN1) 
+                else if (informat == FORMAT_ASN1) 
                         p7 = d2i_PKCS7_bio(in, NULL);
-                else {
+                else
+                        {
                         BIO_printf(bio_err, "Bad input format for PKCS#7 file\n");
                         goto end;
-                }
+                        }
 
-                if(!p7) {
+                if (!p7)
+                        {
                         BIO_printf(bio_err, "Error reading S/MIME message\n");
                         goto end;
-                }
-                if(contfile) {
+                        }
+                if (contfile)
+                        {
                         BIO_free(indata);
-                        if(!(indata = BIO_new_file(contfile, "rb"))) {
+                        if (!(indata = BIO_new_file(contfile, "rb")))
+                                {
                                 BIO_printf(bio_err, "Can't read content file %s\n", contfile);
                                 goto end;
+                                }
                         }
                 }
-        }
 
-        if(!p7) {
+        if (!p7)
+                {
                 BIO_printf(bio_err, "Error creating PKCS#7 structure\n");
                 goto end;
-        }
+                }
 
         ret = 4;
-        if(operation == SMIME_DECRYPT) {
-                if(!PKCS7_decrypt(p7, key, recip, out, flags)) {
+        if (operation == SMIME_DECRYPT)
+                {
+                if (!PKCS7_decrypt(p7, key, recip, out, flags))
+                        {
                         BIO_printf(bio_err, "Error decrypting PKCS#7 structure\n");
                         goto end;
+                        }
                 }
-        } else if(operation == SMIME_VERIFY) {
+        else if (operation == SMIME_VERIFY)
+                {
                 STACK_OF(X509) *signers;
-                if(PKCS7_verify(p7, other, store, indata, out, flags)) {
+                if (PKCS7_verify(p7, other, store, indata, out, flags))
                         BIO_printf(bio_err, "Verification successful\n");
-                } else {
+                else
+                        {
                         BIO_printf(bio_err, "Verification failure\n");
                         goto end;
-                }
+                        }
                 signers = PKCS7_get0_signers(p7, other, flags);
-                if(!save_certs(signerfile, signers)) {
+                if (!save_certs(signerfile, signers))
+                        {
                         BIO_printf(bio_err, "Error writing signers to %s\n",
                                                                 signerfile);
                         ret = 5;
                         goto end;
-                }
+                        }
                 sk_X509_free(signers);
-        } else if(operation == SMIME_PK7OUT) {
+                }
+        else if (operation == SMIME_PK7OUT)
                 PEM_write_bio_PKCS7(out, p7);
-        } else {
-                if(to) BIO_printf(out, "To: %s\n", to);
-                if(from) BIO_printf(out, "From: %s\n", from);
-                if(subject) BIO_printf(out, "Subject: %s\n", subject);
-                if(outformat == FORMAT_SMIME) 
+        else
+                {
+                if (to)
+                        BIO_printf(out, "To: %s\n", to);
+                if (from)
+                        BIO_printf(out, "From: %s\n", from);
+                if (subject)
+                        BIO_printf(out, "Subject: %s\n", subject);
+                if (outformat == FORMAT_SMIME) 
                         SMIME_write_PKCS7(out, p7, in, flags);
-                else if(outformat == FORMAT_PEM) 
+                else if (outformat == FORMAT_PEM) 
                         PEM_write_bio_PKCS7(out,p7);
-                else if(outformat == FORMAT_ASN1) 
+                else if (outformat == FORMAT_ASN1) 
                         i2d_PKCS7_bio(out,p7);
-                else {
+                else
+                        {
                         BIO_printf(bio_err, "Bad output format for PKCS#7 file\n");
                         goto end;
+                        }
                 }
-        }
         ret = 0;
 end:
         if (need_rand)
                 app_RAND_write_file(NULL, bio_err);
-        if(ret) ERR_print_errors(bio_err);
+        if (ret) ERR_print_errors(bio_err);
         sk_X509_pop_free(encerts, X509_free);
         sk_X509_pop_free(other, X509_free);
+        if (vpm)
+                X509_VERIFY_PARAM_free(vpm);
         X509_STORE_free(store);
         X509_free(cert);
         X509_free(recip);
@@ -572,20 +763,39 @@ end:
         BIO_free(in);
         BIO_free(indata);
         BIO_free_all(out);
-        if(passin) OPENSSL_free(passin);
+        if (passin) OPENSSL_free(passin);
         return (ret);
 }
 
 static int save_certs(char *signerfile, STACK_OF(X509) *signers)
-{
+        {
         int i;
         BIO *tmp;
-        if(!signerfile) return 1;
+        if (!signerfile)
+                return 1;
         tmp = BIO_new_file(signerfile, "w");
-        if(!tmp) return 0;
+        if (!tmp) return 0;
         for(i = 0; i < sk_X509_num(signers); i++)
                 PEM_write_bio_X509(tmp, sk_X509_value(signers, i));
         BIO_free(tmp);
         return 1;
-}
+        }
         
+
+/* Minimal callback just to output policy info (if any) */
+
+static int smime_cb(int ok, X509_STORE_CTX *ctx)
+        {
+        int error;
+
+        error = X509_STORE_CTX_get_error(ctx);
+
+        if ((error != X509_V_ERR_NO_EXPLICIT_POLICY)
+                && ((error != X509_V_OK) || (ok != 2)))
+                return ok;
+
+        policies_print(NULL, ctx);
+
+        return ok;
+
+        }
diff --git a/src/lib/libssl/src/apps/speed.c b/src/lib/libssl/src/apps/speed.c
index 2fc327c375..8a1974f5fe 100644
--- a/src/lib/libssl/src/apps/speed.c
+++ b/src/lib/libssl/src/apps/speed.c
@@ -55,6 +55,19 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * The ECDH and ECDSA speed test software is originally written by 
+ * Sumit Gupta of Sun Microsystems Laboratories.
+ *
+ */
 
 /* most of this code has been pilfered from my libdes speed.c program */
 
@@ -64,6 +77,8 @@
 #define SECONDS         3       
 #define RSA_SECONDS     10
 #define DSA_SECONDS     10
+#define ECDSA_SECONDS   10
+#define ECDH_SECONDS    10
 
 /* 11-Sep-92 Andrew Daviel   Support for Silicon Graphics IRIX added */
 /* 06-Apr-92 Luke Brennan    Support for VMS and add extra signal calls */
@@ -73,7 +88,7 @@
 
 #include <stdio.h>
 #include <stdlib.h>
-#include <signal.h>
+
 #include <string.h>
 #include <math.h>
 #include "apps.h"
@@ -89,6 +104,10 @@
 #include OPENSSL_UNISTD
 #endif
 
+#ifndef OPENSSL_SYS_NETWARE
+#include <signal.h>
+#endif
+
 #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(OPENSSL_SYS_MACOSX)
 # define USE_TOD
 #elif !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_VXWORKS) && (!defined(OPENSSL_SYS_VMS) || defined(__DECC))
@@ -98,6 +117,12 @@
 # define TIMEB
 #endif
 
+#if defined(OPENSSL_SYS_NETWARE)
+#undef TIMES
+#undef TIMEB
+#include <time.h>
+#endif
+
 #ifndef _IRIX
 # include <time.h>
 #endif
@@ -122,7 +147,7 @@
 #include <sys/timeb.h>
 #endif
 
-#if !defined(TIMES) && !defined(TIMEB) && !defined(USE_TOD) && !defined(OPENSSL_SYS_VXWORKS)
+#if !defined(TIMES) && !defined(TIMEB) && !defined(USE_TOD) && !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_NETWARE)
 #error "It seems neither struct tms nor struct timeb is supported in this platform!"
 #endif
 
@@ -132,12 +157,16 @@
 #include <sys/param.h>
 #endif
 
+#include <openssl/bn.h>
 #ifndef OPENSSL_NO_DES
 #include <openssl/des.h>
 #endif
 #ifndef OPENSSL_NO_AES
 #include <openssl/aes.h>
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+#include <openssl/camellia.h>
+#endif
 #ifndef OPENSSL_NO_MD2
 #include <openssl/md2.h>
 #endif
@@ -172,6 +201,9 @@
 #ifndef OPENSSL_NO_IDEA
 #include <openssl/idea.h>
 #endif
+#ifndef OPENSSL_NO_SEED
+#include <openssl/seed.h>
+#endif
 #ifndef OPENSSL_NO_BF
 #include <openssl/blowfish.h>
 #endif
@@ -184,14 +216,31 @@
 #endif
 #include <openssl/x509.h>
 #ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
 #include "./testdsa.h"
 #endif
+#ifndef OPENSSL_NO_ECDSA
+#include <openssl/ecdsa.h>
+#endif
+#ifndef OPENSSL_NO_ECDH
+#include <openssl/ecdh.h>
+#endif
+
+/*
+ * The following "HZ" timing stuff should be sync'd up with the code in
+ * crypto/tmdiff.[ch]. That appears to try to do the same job, though I think
+ * this code is more up to date than libcrypto's so there may be features to
+ * migrate over first. This is used in two places further down AFAICS. 
+ * The point is that nothing in openssl actually *uses* that tmdiff stuff, so
+ * either speed.c should be using it or it should go because it's obviously not
+ * useful enough. Anyone want to do a janitorial job on this?
+ */
 
 /* The following if from times(3) man page.  It may need to be changed */
 #ifndef HZ
 # if defined(_SC_CLK_TCK) \
      && (!defined(OPENSSL_SYS_VMS) || __CTRL_VER >= 70000000)
-#  define HZ ((double)sysconf(_SC_CLK_TCK))
+#  define HZ sysconf(_SC_CLK_TCK)
 # else
 #  ifndef CLK_TCK
 #   ifndef _BSD_CLK_TCK_ /* FreeBSD hack */
@@ -205,7 +254,7 @@
 # endif
 #endif
 
-#if !defined(OPENSSL_SYS_VMS) && !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MACINTOSH_CLASSIC) && !defined(OPENSSL_SYS_OS2)
+#if !defined(OPENSSL_SYS_VMS) && !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MACINTOSH_CLASSIC) && !defined(OPENSSL_SYS_OS2) && !defined(OPENSSL_SYS_NETWARE)
 # define HAVE_FORK 1
 #endif
 
@@ -219,25 +268,44 @@ static int usertime=1;
 
 static double Time_F(int s);
 static void print_message(const char *s,long num,int length);
-static void pkey_print_message(char *str,char *str2,long num,int bits,int sec);
+static void pkey_print_message(const char *str, const char *str2,
+        long num, int bits, int sec);
 static void print_result(int alg,int run_no,int count,double time_used);
 #ifdef HAVE_FORK
 static int do_multi(int multi);
 #endif
 
-#define ALGOR_NUM       19
+#define ALGOR_NUM       28
 #define SIZE_NUM        5
 #define RSA_NUM         4
 #define DSA_NUM         3
+
+#define EC_NUM       16
+#define MAX_ECDH_SIZE 256
+
 static const char *names[ALGOR_NUM]={
   "md2","mdc2","md4","md5","hmac(md5)","sha1","rmd160","rc4",
-  "des cbc","des ede3","idea cbc",
+  "des cbc","des ede3","idea cbc","seed cbc",
   "rc2 cbc","rc5-32/12 cbc","blowfish cbc","cast cbc",
-  "aes-128 cbc","aes-192 cbc","aes-256 cbc"};
+  "aes-128 cbc","aes-192 cbc","aes-256 cbc",
+  "camellia-128 cbc","camellia-192 cbc","camellia-256 cbc",
+  "evp","sha256","sha512",
+  "aes-128 ige","aes-192 ige","aes-256 ige"};
 static double results[ALGOR_NUM][SIZE_NUM];
 static int lengths[SIZE_NUM]={16,64,256,1024,8*1024};
 static double rsa_results[RSA_NUM][2];
 static double dsa_results[DSA_NUM][2];
+#ifndef OPENSSL_NO_ECDSA
+static double ecdsa_results[EC_NUM][2];
+#endif
+#ifndef OPENSSL_NO_ECDH
+static double ecdh_results[EC_NUM][1];
+#endif
+
+#if defined(OPENSSL_NO_DSA) && !(defined(OPENSSL_NO_ECDSA) && defined(OPENSSL_NO_ECDH))
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+static int rnd_fake = 0;
+#endif
 
 #ifdef SIGALRM
 #if defined(__STDC__) || defined(sgi) || defined(_AIX)
@@ -260,13 +328,39 @@ static SIGRETTYPE sig_done(int sig)
 #define START   0
 #define STOP    1
 
+#if defined(OPENSSL_SYS_NETWARE)
+
+   /* for NetWare the best we can do is use clock() which returns the
+    * time, in hundredths of a second, since the NLM began executing
+   */
+static double Time_F(int s)
+        {
+        double ret;
+
+   static clock_t tstart,tend;
+
+   if (s == START)
+   {
+      tstart=clock();
+      return(0);
+   }
+   else
+   {
+      tend=clock();
+      ret=(double)((double)(tend)-(double)(tstart));
+      return((ret < 0.001)?0.001:ret);
+   }
+   }
+
+#else
+
 static double Time_F(int s)
         {
         double ret;
 
 #ifdef USE_TOD
         if(usertime)
-            {
+                {
                 static struct rusage tstart,tend;
 
                 getrusage_used = 1;
@@ -321,7 +415,8 @@ static double Time_F(int s)
                 else
                         {
                         times(&tend);
-                        ret=((double)(tend.tms_utime-tstart.tms_utime))/HZ;
+                        ret = HZ;
+                        ret=(double)(tend.tms_utime-tstart.tms_utime) / ret;
                         return((ret < 1e-3)?1e-3:ret);
                         }
                 }
@@ -367,6 +462,25 @@ static double Time_F(int s)
 # endif
 #endif
         }
+#endif /* if defined(OPENSSL_SYS_NETWARE) */
+
+
+#ifndef OPENSSL_NO_ECDH
+static const int KDF1_SHA1_len = 20;
+static void *KDF1_SHA1(const void *in, size_t inlen, void *out, size_t *outlen)
+        {
+#ifndef OPENSSL_NO_SHA
+        if (*outlen < SHA_DIGEST_LENGTH)
+                return NULL;
+        else
+                *outlen = SHA_DIGEST_LENGTH;
+        return SHA1(in, inlen, out);
+#else
+        return NULL;
+#endif  /* OPENSSL_NO_SHA */
+        }
+#endif  /* OPENSSL_NO_ECDH */
+
 
 int MAIN(int, char **);
 
@@ -401,6 +515,12 @@ int MAIN(int argc, char **argv)
 #endif
 #ifndef OPENSSL_NO_SHA
         unsigned char sha[SHA_DIGEST_LENGTH];
+#ifndef OPENSSL_NO_SHA256
+        unsigned char sha256[SHA256_DIGEST_LENGTH];
+#endif
+#ifndef OPENSSL_NO_SHA512
+        unsigned char sha512[SHA512_DIGEST_LENGTH];
+#endif
 #endif
 #ifndef OPENSSL_NO_RIPEMD
         unsigned char rmd160[RIPEMD160_DIGEST_LENGTH];
@@ -417,6 +537,9 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_IDEA
         IDEA_KEY_SCHEDULE idea_ks;
 #endif
+#ifndef OPENSSL_NO_SEED
+        SEED_KEY_SCHEDULE seed_ks;
+#endif
 #ifndef OPENSSL_NO_BF
         BF_KEY bf_ks;
 #endif
@@ -426,6 +549,7 @@ int MAIN(int argc, char **argv)
         static const unsigned char key16[16]=
                 {0x12,0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0,
                  0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0,0x12};
+#ifndef OPENSSL_NO_AES
         static const unsigned char key24[24]=
                 {0x12,0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0,
                  0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0,0x12,
@@ -435,13 +559,25 @@ int MAIN(int argc, char **argv)
                  0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0,0x12,
                  0x56,0x78,0x9a,0xbc,0xde,0xf0,0x12,0x34,
                  0x78,0x9a,0xbc,0xde,0xf0,0x12,0x34,0x56};
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+        static const unsigned char ckey24[24]=
+                {0x12,0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0,
+                 0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0,0x12,
+                 0x56,0x78,0x9a,0xbc,0xde,0xf0,0x12,0x34};
+        static const unsigned char ckey32[32]=
+                {0x12,0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0,
+                 0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0,0x12,
+                 0x56,0x78,0x9a,0xbc,0xde,0xf0,0x12,0x34,
+                 0x78,0x9a,0xbc,0xde,0xf0,0x12,0x34,0x56};
+#endif
 #ifndef OPENSSL_NO_AES
 #define MAX_BLOCK_SIZE 128
 #else
 #define MAX_BLOCK_SIZE 64
 #endif
         unsigned char DES_iv[8];
-        unsigned char iv[MAX_BLOCK_SIZE/8];
+        unsigned char iv[2*MAX_BLOCK_SIZE/8];
 #ifndef OPENSSL_NO_DES
         DES_cblock *buf_as_des_cblock = NULL;
         static DES_cblock key ={0x12,0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0};
@@ -454,6 +590,9 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_AES
         AES_KEY aes_ks1, aes_ks2, aes_ks3;
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+        CAMELLIA_KEY camellia_ks1, camellia_ks2, camellia_ks3;
+#endif
 #define D_MD2           0
 #define D_MDC2          1
 #define D_MD4           2
@@ -465,14 +604,23 @@ int MAIN(int argc, char **argv)
 #define D_CBC_DES       8
 #define D_EDE3_DES      9
 #define D_CBC_IDEA      10
-#define D_CBC_RC2       11
-#define D_CBC_RC5       12
-#define D_CBC_BF        13
-#define D_CBC_CAST      14
-#define D_CBC_128_AES   15
-#define D_CBC_192_AES   16
-#define D_CBC_256_AES   17
-#define D_EVP           18
+#define D_CBC_SEED      11
+#define D_CBC_RC2       12
+#define D_CBC_RC5       13
+#define D_CBC_BF        14
+#define D_CBC_CAST      15
+#define D_CBC_128_AES   16
+#define D_CBC_192_AES   17
+#define D_CBC_256_AES   18
+#define D_CBC_128_CML   19 
+#define D_CBC_192_CML   20
+#define D_CBC_256_CML   21 
+#define D_EVP           22
+#define D_SHA256        23      
+#define D_SHA512        24
+#define D_IGE_128_AES   25
+#define D_IGE_192_AES   26
+#define D_IGE_256_AES   27
         double d=0.0;
         long c[ALGOR_NUM][SIZE_NUM];
 #define R_DSA_512       0
@@ -482,6 +630,24 @@ int MAIN(int argc, char **argv)
 #define R_RSA_1024      1
 #define R_RSA_2048      2
 #define R_RSA_4096      3
+
+#define R_EC_P160    0
+#define R_EC_P192    1  
+#define R_EC_P224    2
+#define R_EC_P256    3
+#define R_EC_P384    4
+#define R_EC_P521    5
+#define R_EC_K163    6
+#define R_EC_K233    7
+#define R_EC_K283    8
+#define R_EC_K409    9
+#define R_EC_K571    10
+#define R_EC_B163    11
+#define R_EC_B233    12
+#define R_EC_B283    13
+#define R_EC_B409    14
+#define R_EC_B571    15
+
 #ifndef OPENSSL_NO_RSA
         RSA *rsa_key[RSA_NUM];
         long rsa_c[RSA_NUM][2];
@@ -497,8 +663,87 @@ int MAIN(int argc, char **argv)
         long dsa_c[DSA_NUM][2];
         static unsigned int dsa_bits[DSA_NUM]={512,1024,2048};
 #endif
+#ifndef OPENSSL_NO_EC
+        /* We only test over the following curves as they are representative, 
+         * To add tests over more curves, simply add the curve NID
+         * and curve name to the following arrays and increase the 
+         * EC_NUM value accordingly. 
+         */
+        static unsigned int test_curves[EC_NUM] = 
+        {       
+        /* Prime Curves */
+        NID_secp160r1,
+        NID_X9_62_prime192v1,
+        NID_secp224r1,
+        NID_X9_62_prime256v1,
+        NID_secp384r1,
+        NID_secp521r1,
+        /* Binary Curves */
+        NID_sect163k1,
+        NID_sect233k1,
+        NID_sect283k1,
+        NID_sect409k1,
+        NID_sect571k1,
+        NID_sect163r2,
+        NID_sect233r1,
+        NID_sect283r1,
+        NID_sect409r1,
+        NID_sect571r1
+        }; 
+        static const char * test_curves_names[EC_NUM] = 
+        {
+        /* Prime Curves */
+        "secp160r1",
+        "nistp192",
+        "nistp224",
+        "nistp256",
+        "nistp384",
+        "nistp521",
+        /* Binary Curves */
+        "nistk163",
+        "nistk233",
+        "nistk283",
+        "nistk409",
+        "nistk571",
+        "nistb163",
+        "nistb233",
+        "nistb283",
+        "nistb409",
+        "nistb571"
+        };
+        static int test_curves_bits[EC_NUM] =
+        {
+        160, 192, 224, 256, 384, 521,
+        163, 233, 283, 409, 571,
+        163, 233, 283, 409, 571
+        };
+
+#endif
+
+#ifndef OPENSSL_NO_ECDSA
+        unsigned char ecdsasig[256];
+        unsigned int ecdsasiglen;
+        EC_KEY *ecdsa[EC_NUM];
+        long ecdsa_c[EC_NUM][2];
+#endif
+
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *ecdh_a[EC_NUM], *ecdh_b[EC_NUM];
+        unsigned char secret_a[MAX_ECDH_SIZE], secret_b[MAX_ECDH_SIZE];
+        int secret_size_a, secret_size_b;
+        int ecdh_checks = 0;
+        int secret_idx = 0;
+        long ecdh_c[EC_NUM][2];
+#endif
+
         int rsa_doit[RSA_NUM];
         int dsa_doit[DSA_NUM];
+#ifndef OPENSSL_NO_ECDSA
+        int ecdsa_doit[EC_NUM];
+#endif
+#ifndef OPENSSL_NO_ECDH
+        int ecdh_doit[EC_NUM];
+#endif
         int doit[ALGOR_NUM];
         int pr_header=0;
         const EVP_CIPHER *evp_cipher=NULL;
@@ -517,6 +762,17 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_DSA
         memset(dsa_key,0,sizeof(dsa_key));
 #endif
+#ifndef OPENSSL_NO_ECDSA
+        for (i=0; i<EC_NUM; i++) ecdsa[i] = NULL;
+#endif
+#ifndef OPENSSL_NO_ECDH
+        for (i=0; i<EC_NUM; i++)
+                {
+                ecdh_a[i] = NULL;
+                ecdh_b[i] = NULL;
+                }
+#endif
+
 
         if (bio_err == NULL)
                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
@@ -555,6 +811,15 @@ int MAIN(int argc, char **argv)
                 rsa_doit[i]=0;
         for (i=0; i<DSA_NUM; i++)
                 dsa_doit[i]=0;
+#ifndef OPENSSL_NO_ECDSA
+        for (i=0; i<EC_NUM; i++)
+                ecdsa_doit[i]=0;
+#endif
+#ifndef OPENSSL_NO_ECDH
+        for (i=0; i<EC_NUM; i++)
+                ecdh_doit[i]=0;
+#endif
+
         
         j=0;
         argc--;
@@ -662,9 +927,19 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_SHA
                         if (strcmp(*argv,"sha1") == 0) doit[D_SHA1]=1;
                 else
-                        if (strcmp(*argv,"sha") == 0) doit[D_SHA1]=1;
+                        if (strcmp(*argv,"sha") == 0)   doit[D_SHA1]=1,
+                                                        doit[D_SHA256]=1,
+                                                        doit[D_SHA512]=1;
+                else
+#ifndef OPENSSL_NO_SHA256
+                        if (strcmp(*argv,"sha256") == 0) doit[D_SHA256]=1;
                 else
 #endif
+#ifndef OPENSSL_NO_SHA512
+                        if (strcmp(*argv,"sha512") == 0) doit[D_SHA512]=1;
+                else
+#endif
+#endif
 #ifndef OPENSSL_NO_RIPEMD
                         if (strcmp(*argv,"ripemd") == 0) doit[D_RMD160]=1;
                 else
@@ -686,6 +961,15 @@ int MAIN(int argc, char **argv)
                         if (strcmp(*argv,"aes-128-cbc") == 0) doit[D_CBC_128_AES]=1;
                 else    if (strcmp(*argv,"aes-192-cbc") == 0) doit[D_CBC_192_AES]=1;
                 else    if (strcmp(*argv,"aes-256-cbc") == 0) doit[D_CBC_256_AES]=1;
+                else    if (strcmp(*argv,"aes-128-ige") == 0) doit[D_IGE_128_AES]=1;
+                else    if (strcmp(*argv,"aes-192-ige") == 0) doit[D_IGE_192_AES]=1;
+                else    if (strcmp(*argv,"aes-256-ige") == 0) doit[D_IGE_256_AES]=1;
+                else
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+                        if (strcmp(*argv,"camellia-128-cbc") == 0) doit[D_CBC_128_CML]=1;
+                else    if (strcmp(*argv,"camellia-192-cbc") == 0) doit[D_CBC_192_CML]=1;
+                else    if (strcmp(*argv,"camellia-256-cbc") == 0) doit[D_CBC_256_CML]=1;
                 else
 #endif
 #ifndef OPENSSL_NO_RSA
@@ -729,6 +1013,11 @@ int MAIN(int argc, char **argv)
                 else if (strcmp(*argv,"idea") == 0) doit[D_CBC_IDEA]=1;
                 else
 #endif
+#ifndef OPENSSL_NO_SEED
+                     if (strcmp(*argv,"seed-cbc") == 0) doit[D_CBC_SEED]=1;
+                else if (strcmp(*argv,"seed") == 0) doit[D_CBC_SEED]=1;
+                else
+#endif
 #ifndef OPENSSL_NO_BF
                      if (strcmp(*argv,"bf-cbc") == 0) doit[D_CBC_BF]=1;
                 else if (strcmp(*argv,"blowfish") == 0) doit[D_CBC_BF]=1;
@@ -758,6 +1047,15 @@ int MAIN(int argc, char **argv)
                         }
                 else
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+                        if (strcmp(*argv,"camellia") == 0)
+                        {
+                        doit[D_CBC_128_CML]=1;
+                        doit[D_CBC_192_CML]=1;
+                        doit[D_CBC_256_CML]=1;
+                        }
+                else
+#endif
 #ifndef OPENSSL_NO_RSA
                         if (strcmp(*argv,"rsa") == 0)
                         {
@@ -777,6 +1075,54 @@ int MAIN(int argc, char **argv)
                         }
                 else
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                     if (strcmp(*argv,"ecdsap160") == 0) ecdsa_doit[R_EC_P160]=2;
+                else if (strcmp(*argv,"ecdsap192") == 0) ecdsa_doit[R_EC_P192]=2;
+                else if (strcmp(*argv,"ecdsap224") == 0) ecdsa_doit[R_EC_P224]=2;
+                else if (strcmp(*argv,"ecdsap256") == 0) ecdsa_doit[R_EC_P256]=2;
+                else if (strcmp(*argv,"ecdsap384") == 0) ecdsa_doit[R_EC_P384]=2;
+                else if (strcmp(*argv,"ecdsap521") == 0) ecdsa_doit[R_EC_P521]=2;
+                else if (strcmp(*argv,"ecdsak163") == 0) ecdsa_doit[R_EC_K163]=2;
+                else if (strcmp(*argv,"ecdsak233") == 0) ecdsa_doit[R_EC_K233]=2;
+                else if (strcmp(*argv,"ecdsak283") == 0) ecdsa_doit[R_EC_K283]=2;
+                else if (strcmp(*argv,"ecdsak409") == 0) ecdsa_doit[R_EC_K409]=2;
+                else if (strcmp(*argv,"ecdsak571") == 0) ecdsa_doit[R_EC_K571]=2;
+                else if (strcmp(*argv,"ecdsab163") == 0) ecdsa_doit[R_EC_B163]=2;
+                else if (strcmp(*argv,"ecdsab233") == 0) ecdsa_doit[R_EC_B233]=2;
+                else if (strcmp(*argv,"ecdsab283") == 0) ecdsa_doit[R_EC_B283]=2;
+                else if (strcmp(*argv,"ecdsab409") == 0) ecdsa_doit[R_EC_B409]=2;
+                else if (strcmp(*argv,"ecdsab571") == 0) ecdsa_doit[R_EC_B571]=2;
+                else if (strcmp(*argv,"ecdsa") == 0)
+                        {
+                        for (i=0; i < EC_NUM; i++)
+                                ecdsa_doit[i]=1;
+                        }
+                else
+#endif
+#ifndef OPENSSL_NO_ECDH
+                     if (strcmp(*argv,"ecdhp160") == 0) ecdh_doit[R_EC_P160]=2;
+                else if (strcmp(*argv,"ecdhp192") == 0) ecdh_doit[R_EC_P192]=2;
+                else if (strcmp(*argv,"ecdhp224") == 0) ecdh_doit[R_EC_P224]=2;
+                else if (strcmp(*argv,"ecdhp256") == 0) ecdh_doit[R_EC_P256]=2;
+                else if (strcmp(*argv,"ecdhp384") == 0) ecdh_doit[R_EC_P384]=2;
+                else if (strcmp(*argv,"ecdhp521") == 0) ecdh_doit[R_EC_P521]=2;
+                else if (strcmp(*argv,"ecdhk163") == 0) ecdh_doit[R_EC_K163]=2;
+                else if (strcmp(*argv,"ecdhk233") == 0) ecdh_doit[R_EC_K233]=2;
+                else if (strcmp(*argv,"ecdhk283") == 0) ecdh_doit[R_EC_K283]=2;
+                else if (strcmp(*argv,"ecdhk409") == 0) ecdh_doit[R_EC_K409]=2;
+                else if (strcmp(*argv,"ecdhk571") == 0) ecdh_doit[R_EC_K571]=2;
+                else if (strcmp(*argv,"ecdhb163") == 0) ecdh_doit[R_EC_B163]=2;
+                else if (strcmp(*argv,"ecdhb233") == 0) ecdh_doit[R_EC_B233]=2;
+                else if (strcmp(*argv,"ecdhb283") == 0) ecdh_doit[R_EC_B283]=2;
+                else if (strcmp(*argv,"ecdhb409") == 0) ecdh_doit[R_EC_B409]=2;
+                else if (strcmp(*argv,"ecdhb571") == 0) ecdh_doit[R_EC_B571]=2;
+                else if (strcmp(*argv,"ecdh") == 0)
+                        {
+                        for (i=0; i < EC_NUM; i++)
+                                ecdh_doit[i]=1;
+                        }
+                else
+#endif
                         {
                         BIO_printf(bio_err,"Error: bad option or value\n");
                         BIO_printf(bio_err,"\n");
@@ -799,6 +1145,12 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_SHA1
                         BIO_printf(bio_err,"sha1     ");
 #endif
+#ifndef OPENSSL_NO_SHA256
+                        BIO_printf(bio_err,"sha256   ");
+#endif
+#ifndef OPENSSL_NO_SHA512
+                        BIO_printf(bio_err,"sha512   ");
+#endif
 #ifndef OPENSSL_NO_RIPEMD160
                         BIO_printf(bio_err,"rmd160");
 #endif
@@ -811,6 +1163,9 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_IDEA
                         BIO_printf(bio_err,"idea-cbc ");
 #endif
+#ifndef OPENSSL_NO_SEED
+                        BIO_printf(bio_err,"seed-cbc ");
+#endif
 #ifndef OPENSSL_NO_RC2
                         BIO_printf(bio_err,"rc2-cbc  ");
 #endif
@@ -820,7 +1175,7 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_BF
                         BIO_printf(bio_err,"bf-cbc");
 #endif
-#if !defined(OPENSSL_NO_IDEA) || !defined(OPENSSL_NO_RC2) || \
+#if !defined(OPENSSL_NO_IDEA) || !defined(OPENSSL_NO_SEED) || !defined(OPENSSL_NO_RC2) || \
     !defined(OPENSSL_NO_BF) || !defined(OPENSSL_NO_RC5)
                         BIO_printf(bio_err,"\n");
 #endif
@@ -829,6 +1184,11 @@ int MAIN(int argc, char **argv)
 #endif
 #ifndef OPENSSL_NO_AES
                         BIO_printf(bio_err,"aes-128-cbc aes-192-cbc aes-256-cbc ");
+                        BIO_printf(bio_err,"aes-128-ige aes-192-ige aes-256-ige ");
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+                        BIO_printf(bio_err,"\n");
+                        BIO_printf(bio_err,"camellia-128-cbc camellia-192-cbc camellia-256-cbc ");
 #endif
 #ifndef OPENSSL_NO_RC4
                         BIO_printf(bio_err,"rc4");
@@ -842,10 +1202,25 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_DSA
                         BIO_printf(bio_err,"dsa512   dsa1024  dsa2048\n");
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                        BIO_printf(bio_err,"ecdsap160 ecdsap192 ecdsap224 ecdsap256 ecdsap384 ecdsap521\n");
+                        BIO_printf(bio_err,"ecdsak163 ecdsak233 ecdsak283 ecdsak409 ecdsak571\n");
+                        BIO_printf(bio_err,"ecdsab163 ecdsab233 ecdsab283 ecdsab409 ecdsab571\n");
+                        BIO_printf(bio_err,"ecdsa\n");
+#endif
+#ifndef OPENSSL_NO_ECDH
+                        BIO_printf(bio_err,"ecdhp160  ecdhp192  ecdhp224  ecdhp256  ecdhp384  ecdhp521\n");
+                        BIO_printf(bio_err,"ecdhk163  ecdhk233  ecdhk283  ecdhk409  ecdhk571\n");
+                        BIO_printf(bio_err,"ecdhb163  ecdhb233  ecdhb283  ecdhb409  ecdhb571\n");
+                        BIO_printf(bio_err,"ecdh\n");
+#endif
 
 #ifndef OPENSSL_NO_IDEA
                         BIO_printf(bio_err,"idea     ");
 #endif
+#ifndef OPENSSL_NO_SEED
+                        BIO_printf(bio_err,"seed     ");
+#endif
 #ifndef OPENSSL_NO_RC2
                         BIO_printf(bio_err,"rc2      ");
 #endif
@@ -855,15 +1230,19 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_AES
                         BIO_printf(bio_err,"aes      ");
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+                        BIO_printf(bio_err,"camellia ");
+#endif
 #ifndef OPENSSL_NO_RSA
                         BIO_printf(bio_err,"rsa      ");
 #endif
 #ifndef OPENSSL_NO_BF
                         BIO_printf(bio_err,"blowfish");
 #endif
-#if !defined(OPENSSL_NO_IDEA) || !defined(OPENSSL_NO_RC2) || \
-    !defined(OPENSSL_NO_DES) || !defined(OPENSSL_NO_RSA) || \
-    !defined(OPENSSL_NO_BF) || !defined(OPENSSL_NO_AES)
+#if !defined(OPENSSL_NO_IDEA) || !defined(OPENSSL_NO_SEED) || \
+    !defined(OPENSSL_NO_RC2) || !defined(OPENSSL_NO_DES) || \
+    !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_BF) || \
+    !defined(OPENSSL_NO_AES) || !defined(OPENSSL_NO_CAMELLIA)
                         BIO_printf(bio_err,"\n");
 #endif
 
@@ -957,9 +1336,17 @@ int MAIN(int argc, char **argv)
         AES_set_encrypt_key(key24,192,&aes_ks2);
         AES_set_encrypt_key(key32,256,&aes_ks3);
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+        Camellia_set_key(key16,128,&camellia_ks1);
+        Camellia_set_key(ckey24,192,&camellia_ks2);
+        Camellia_set_key(ckey32,256,&camellia_ks3);
+#endif
 #ifndef OPENSSL_NO_IDEA
         idea_set_encrypt_key(key16,&idea_ks);
 #endif
+#ifndef OPENSSL_NO_SEED
+        SEED_set_key(key16,&seed_ks);
+#endif
 #ifndef OPENSSL_NO_RC4
         RC4_set_key(&rc4_ks,16,key16);
 #endif
@@ -983,10 +1370,10 @@ int MAIN(int argc, char **argv)
         BIO_printf(bio_err,"First we calculate the approximate speed ...\n");
         count=10;
         do      {
-                long i;
+                long it;
                 count*=2;
                 Time_F(START);
-                for (i=count; i; i--)
+                for (it=count; it; it--)
                         DES_ecb_encrypt(buf_as_des_cblock,buf_as_des_cblock,
                                 &sch,DES_ENCRYPT);
                 d=Time_F(STOP);
@@ -1003,6 +1390,7 @@ int MAIN(int argc, char **argv)
         c[D_CBC_DES][0]=count;
         c[D_EDE3_DES][0]=count/3;
         c[D_CBC_IDEA][0]=count;
+        c[D_CBC_SEED][0]=count;
         c[D_CBC_RC2][0]=count;
         c[D_CBC_RC5][0]=count;
         c[D_CBC_BF][0]=count;
@@ -1010,6 +1398,14 @@ int MAIN(int argc, char **argv)
         c[D_CBC_128_AES][0]=count;
         c[D_CBC_192_AES][0]=count;
         c[D_CBC_256_AES][0]=count;
+        c[D_CBC_128_CML][0]=count;
+        c[D_CBC_192_CML][0]=count;
+        c[D_CBC_256_CML][0]=count;
+        c[D_SHA256][0]=count;
+        c[D_SHA512][0]=count;
+        c[D_IGE_128_AES][0]=count;
+        c[D_IGE_192_AES][0]=count;
+        c[D_IGE_256_AES][0]=count;
 
         for (i=1; i<SIZE_NUM; i++)
                 {
@@ -1020,6 +1416,8 @@ int MAIN(int argc, char **argv)
                 c[D_HMAC][i]=c[D_HMAC][0]*4*lengths[0]/lengths[i];
                 c[D_SHA1][i]=c[D_SHA1][0]*4*lengths[0]/lengths[i];
                 c[D_RMD160][i]=c[D_RMD160][0]*4*lengths[0]/lengths[i];
+                c[D_SHA256][i]=c[D_SHA256][0]*4*lengths[0]/lengths[i];
+                c[D_SHA512][i]=c[D_SHA512][0]*4*lengths[0]/lengths[i];
                 }
         for (i=1; i<SIZE_NUM; i++)
                 {
@@ -1031,6 +1429,7 @@ int MAIN(int argc, char **argv)
                 c[D_CBC_DES][i]=c[D_CBC_DES][i-1]*l0/l1;
                 c[D_EDE3_DES][i]=c[D_EDE3_DES][i-1]*l0/l1;
                 c[D_CBC_IDEA][i]=c[D_CBC_IDEA][i-1]*l0/l1;
+                c[D_CBC_SEED][i]=c[D_CBC_SEED][i-1]*l0/l1;
                 c[D_CBC_RC2][i]=c[D_CBC_RC2][i-1]*l0/l1;
                 c[D_CBC_RC5][i]=c[D_CBC_RC5][i-1]*l0/l1;
                 c[D_CBC_BF][i]=c[D_CBC_BF][i-1]*l0/l1;
@@ -1038,6 +1437,12 @@ int MAIN(int argc, char **argv)
                 c[D_CBC_128_AES][i]=c[D_CBC_128_AES][i-1]*l0/l1;
                 c[D_CBC_192_AES][i]=c[D_CBC_192_AES][i-1]*l0/l1;
                 c[D_CBC_256_AES][i]=c[D_CBC_256_AES][i-1]*l0/l1;
+                c[D_CBC_128_CML][i]=c[D_CBC_128_CML][i-1]*l0/l1;
+                c[D_CBC_192_CML][i]=c[D_CBC_192_CML][i-1]*l0/l1;
+                c[D_CBC_256_CML][i]=c[D_CBC_256_CML][i-1]*l0/l1;
+                c[D_IGE_128_AES][i]=c[D_IGE_128_AES][i-1]*l0/l1;
+                c[D_IGE_192_AES][i]=c[D_IGE_192_AES][i-1]*l0/l1;
+                c[D_IGE_256_AES][i]=c[D_IGE_256_AES][i-1]*l0/l1;
                 }
 #ifndef OPENSSL_NO_RSA
         rsa_c[R_RSA_512][0]=count/2000;
@@ -1079,6 +1484,114 @@ int MAIN(int argc, char **argv)
                 }
 #endif
 
+#ifndef OPENSSL_NO_ECDSA
+        ecdsa_c[R_EC_P160][0]=count/1000;
+        ecdsa_c[R_EC_P160][1]=count/1000/2;
+        for (i=R_EC_P192; i<=R_EC_P521; i++)
+                {
+                ecdsa_c[i][0]=ecdsa_c[i-1][0]/2;
+                ecdsa_c[i][1]=ecdsa_c[i-1][1]/2;
+                if ((ecdsa_doit[i] <= 1) && (ecdsa_c[i][0] == 0))
+                        ecdsa_doit[i]=0;
+                else
+                        {
+                        if (ecdsa_c[i] == 0)
+                                {
+                                ecdsa_c[i][0]=1;
+                                ecdsa_c[i][1]=1;
+                                }
+                        }
+                }
+        ecdsa_c[R_EC_K163][0]=count/1000;
+        ecdsa_c[R_EC_K163][1]=count/1000/2;
+        for (i=R_EC_K233; i<=R_EC_K571; i++)
+                {
+                ecdsa_c[i][0]=ecdsa_c[i-1][0]/2;
+                ecdsa_c[i][1]=ecdsa_c[i-1][1]/2;
+                if ((ecdsa_doit[i] <= 1) && (ecdsa_c[i][0] == 0))
+                        ecdsa_doit[i]=0;
+                else
+                        {
+                        if (ecdsa_c[i] == 0)
+                                {
+                                ecdsa_c[i][0]=1;
+                                ecdsa_c[i][1]=1;
+                                }
+                        }
+                }
+        ecdsa_c[R_EC_B163][0]=count/1000;
+        ecdsa_c[R_EC_B163][1]=count/1000/2;
+        for (i=R_EC_B233; i<=R_EC_B571; i++)
+                {
+                ecdsa_c[i][0]=ecdsa_c[i-1][0]/2;
+                ecdsa_c[i][1]=ecdsa_c[i-1][1]/2;
+                if ((ecdsa_doit[i] <= 1) && (ecdsa_c[i][0] == 0))
+                        ecdsa_doit[i]=0;
+                else
+                        {
+                        if (ecdsa_c[i] == 0)
+                                {
+                                ecdsa_c[i][0]=1;
+                                ecdsa_c[i][1]=1;
+                                }
+                        }
+                }
+#endif
+
+#ifndef OPENSSL_NO_ECDH
+        ecdh_c[R_EC_P160][0]=count/1000;
+        ecdh_c[R_EC_P160][1]=count/1000;
+        for (i=R_EC_P192; i<=R_EC_P521; i++)
+                {
+                ecdh_c[i][0]=ecdh_c[i-1][0]/2;
+                ecdh_c[i][1]=ecdh_c[i-1][1]/2;
+                if ((ecdh_doit[i] <= 1) && (ecdh_c[i][0] == 0))
+                        ecdh_doit[i]=0;
+                else
+                        {
+                        if (ecdh_c[i] == 0)
+                                {
+                                ecdh_c[i][0]=1;
+                                ecdh_c[i][1]=1;
+                                }
+                        }
+                }
+        ecdh_c[R_EC_K163][0]=count/1000;
+        ecdh_c[R_EC_K163][1]=count/1000;
+        for (i=R_EC_K233; i<=R_EC_K571; i++)
+                {
+                ecdh_c[i][0]=ecdh_c[i-1][0]/2;
+                ecdh_c[i][1]=ecdh_c[i-1][1]/2;
+                if ((ecdh_doit[i] <= 1) && (ecdh_c[i][0] == 0))
+                        ecdh_doit[i]=0;
+                else
+                        {
+                        if (ecdh_c[i] == 0)
+                                {
+                                ecdh_c[i][0]=1;
+                                ecdh_c[i][1]=1;
+                                }
+                        }
+                }
+        ecdh_c[R_EC_B163][0]=count/1000;
+        ecdh_c[R_EC_B163][1]=count/1000;
+        for (i=R_EC_B233; i<=R_EC_B571; i++)
+                {
+                ecdh_c[i][0]=ecdh_c[i-1][0]/2;
+                ecdh_c[i][1]=ecdh_c[i-1][1]/2;
+                if ((ecdh_doit[i] <= 1) && (ecdh_c[i][0] == 0))
+                        ecdh_doit[i]=0;
+                else
+                        {
+                        if (ecdh_c[i] == 0)
+                                {
+                                ecdh_c[i][0]=1;
+                                ecdh_c[i][1]=1;
+                                }
+                        }
+                }
+#endif
+
 #define COND(d) (count < (d))
 #define COUNT(d) (d)
 #else
@@ -1188,6 +1701,37 @@ int MAIN(int argc, char **argv)
                         print_result(D_SHA1,j,count,d);
                         }
                 }
+
+#ifndef OPENSSL_NO_SHA256
+        if (doit[D_SHA256])
+                {
+                for (j=0; j<SIZE_NUM; j++)
+                        {
+                        print_message(names[D_SHA256],c[D_SHA256][j],lengths[j]);
+                        Time_F(START);
+                        for (count=0,run=1; COND(c[D_SHA256][j]); count++)
+                                SHA256(buf,lengths[j],sha256);
+                        d=Time_F(STOP);
+                        print_result(D_SHA256,j,count,d);
+                        }
+                }
+#endif
+
+#ifndef OPENSSL_NO_SHA512
+        if (doit[D_SHA512])
+                {
+                for (j=0; j<SIZE_NUM; j++)
+                        {
+                        print_message(names[D_SHA512],c[D_SHA512][j],lengths[j]);
+                        Time_F(START);
+                        for (count=0,run=1; COND(c[D_SHA512][j]); count++)
+                                SHA512(buf,lengths[j],sha512);
+                        d=Time_F(STOP);
+                        print_result(D_SHA512,j,count,d);
+                        }
+                }
+#endif
+
 #endif
 #ifndef OPENSSL_NO_RIPEMD
         if (doit[D_RMD160])
@@ -1292,6 +1836,93 @@ int MAIN(int argc, char **argv)
                         }
                 }
 
+        if (doit[D_IGE_128_AES])
+                {
+                for (j=0; j<SIZE_NUM; j++)
+                        {
+                        print_message(names[D_IGE_128_AES],c[D_IGE_128_AES][j],lengths[j]);
+                        Time_F(START);
+                        for (count=0,run=1; COND(c[D_IGE_128_AES][j]); count++)
+                                AES_ige_encrypt(buf,buf2,
+                                        (unsigned long)lengths[j],&aes_ks1,
+                                        iv,AES_ENCRYPT);
+                        d=Time_F(STOP);
+                        print_result(D_IGE_128_AES,j,count,d);
+                        }
+                }
+        if (doit[D_IGE_192_AES])
+                {
+                for (j=0; j<SIZE_NUM; j++)
+                        {
+                        print_message(names[D_IGE_192_AES],c[D_IGE_192_AES][j],lengths[j]);
+                        Time_F(START);
+                        for (count=0,run=1; COND(c[D_IGE_192_AES][j]); count++)
+                                AES_ige_encrypt(buf,buf2,
+                                        (unsigned long)lengths[j],&aes_ks2,
+                                        iv,AES_ENCRYPT);
+                        d=Time_F(STOP);
+                        print_result(D_IGE_192_AES,j,count,d);
+                        }
+                }
+        if (doit[D_IGE_256_AES])
+                {
+                for (j=0; j<SIZE_NUM; j++)
+                        {
+                        print_message(names[D_IGE_256_AES],c[D_IGE_256_AES][j],lengths[j]);
+                        Time_F(START);
+                        for (count=0,run=1; COND(c[D_IGE_256_AES][j]); count++)
+                                AES_ige_encrypt(buf,buf2,
+                                        (unsigned long)lengths[j],&aes_ks3,
+                                        iv,AES_ENCRYPT);
+                        d=Time_F(STOP);
+                        print_result(D_IGE_256_AES,j,count,d);
+                        }
+                }
+#endif
+#ifndef OPENSSL_NO_CAMELLIA
+        if (doit[D_CBC_128_CML])
+                {
+                for (j=0; j<SIZE_NUM; j++)
+                        {
+                        print_message(names[D_CBC_128_CML],c[D_CBC_128_CML][j],lengths[j]);
+                        Time_F(START);
+                        for (count=0,run=1; COND(c[D_CBC_128_CML][j]); count++)
+                                Camellia_cbc_encrypt(buf,buf,
+                                        (unsigned long)lengths[j],&camellia_ks1,
+                                        iv,CAMELLIA_ENCRYPT);
+                        d=Time_F(STOP);
+                        print_result(D_CBC_128_CML,j,count,d);
+                        }
+                }
+        if (doit[D_CBC_192_CML])
+                {
+                for (j=0; j<SIZE_NUM; j++)
+                        {
+                        print_message(names[D_CBC_192_CML],c[D_CBC_192_CML][j],lengths[j]);
+                        Time_F(START);
+                        for (count=0,run=1; COND(c[D_CBC_192_CML][j]); count++)
+                                Camellia_cbc_encrypt(buf,buf,
+                                        (unsigned long)lengths[j],&camellia_ks2,
+                                        iv,CAMELLIA_ENCRYPT);
+                        d=Time_F(STOP);
+                        print_result(D_CBC_192_CML,j,count,d);
+                        }
+                }
+        if (doit[D_CBC_256_CML])
+                {
+                for (j=0; j<SIZE_NUM; j++)
+                        {
+                        print_message(names[D_CBC_256_CML],c[D_CBC_256_CML][j],lengths[j]);
+                        Time_F(START);
+                        for (count=0,run=1; COND(c[D_CBC_256_CML][j]); count++)
+                                Camellia_cbc_encrypt(buf,buf,
+                                        (unsigned long)lengths[j],&camellia_ks3,
+                                        iv,CAMELLIA_ENCRYPT);
+                        d=Time_F(STOP);
+                        print_result(D_CBC_256_CML,j,count,d);
+                        }
+                }
+
 #endif
 #ifndef OPENSSL_NO_IDEA
         if (doit[D_CBC_IDEA])
@@ -1309,6 +1940,21 @@ int MAIN(int argc, char **argv)
                         }
                 }
 #endif
+#ifndef OPENSSL_NO_SEED
+        if (doit[D_CBC_SEED])
+                {
+                for (j=0; j<SIZE_NUM; j++)
+                        {
+                        print_message(names[D_CBC_SEED],c[D_CBC_SEED][j],lengths[j]);
+                        Time_F(START);
+                        for (count=0,run=1; COND(c[D_CBC_SEED][j]); count++)
+                                SEED_cbc_encrypt(buf,buf,
+                                        (unsigned long)lengths[j],&seed_ks,iv,1);
+                        d=Time_F(STOP);
+                        print_result(D_CBC_SEED,j,count,d);
+                        }
+                }
+#endif
 #ifndef OPENSSL_NO_RC2
         if (doit[D_CBC_RC2])
                 {
@@ -1605,6 +2251,217 @@ int MAIN(int argc, char **argv)
                 }
         if (rnd_fake) RAND_cleanup();
 #endif
+
+#ifndef OPENSSL_NO_ECDSA
+        if (RAND_status() != 1) 
+                {
+                RAND_seed(rnd_seed, sizeof rnd_seed);
+                rnd_fake = 1;
+                }
+        for (j=0; j<EC_NUM; j++) 
+                {
+                int ret;
+
+                if (!ecdsa_doit[j]) continue; /* Ignore Curve */ 
+                ecdsa[j] = EC_KEY_new_by_curve_name(test_curves[j]);
+                if (ecdsa[j] == NULL) 
+                        {
+                        BIO_printf(bio_err,"ECDSA failure.\n");
+                        ERR_print_errors(bio_err);
+                        rsa_count=1;
+                        } 
+                else 
+                        {
+#if 1
+                        EC_KEY_precompute_mult(ecdsa[j], NULL);
+#endif
+                        /* Perform ECDSA signature test */
+                        EC_KEY_generate_key(ecdsa[j]);
+                        ret = ECDSA_sign(0, buf, 20, ecdsasig, 
+                                &ecdsasiglen, ecdsa[j]);
+                        if (ret == 0) 
+                                {
+                                BIO_printf(bio_err,"ECDSA sign failure.  No ECDSA sign will be done.\n");
+                                ERR_print_errors(bio_err);
+                                rsa_count=1;
+                                } 
+                        else 
+                                {
+                                pkey_print_message("sign","ecdsa",
+                                        ecdsa_c[j][0], 
+                                        test_curves_bits[j],
+                                        ECDSA_SECONDS);
+
+                                Time_F(START);
+                                for (count=0,run=1; COND(ecdsa_c[j][0]);
+                                        count++) 
+                                        {
+                                        ret=ECDSA_sign(0, buf, 20, 
+                                                ecdsasig, &ecdsasiglen,
+                                                ecdsa[j]);
+                                        if (ret == 0) 
+                                                {
+                                                BIO_printf(bio_err, "ECDSA sign failure\n");
+                                                ERR_print_errors(bio_err);
+                                                count=1;
+                                                break;
+                                                }
+                                        }
+                                d=Time_F(STOP);
+
+                                BIO_printf(bio_err, mr ? "+R5:%ld:%d:%.2f\n" :
+                                        "%ld %d bit ECDSA signs in %.2fs \n", 
+                                        count, test_curves_bits[j], d);
+                                ecdsa_results[j][0]=d/(double)count;
+                                rsa_count=count;
+                                }
+
+                        /* Perform ECDSA verification test */
+                        ret=ECDSA_verify(0, buf, 20, ecdsasig, 
+                                ecdsasiglen, ecdsa[j]);
+                        if (ret != 1) 
+                                {
+                                BIO_printf(bio_err,"ECDSA verify failure.  No ECDSA verify will be done.\n");
+                                ERR_print_errors(bio_err);
+                                ecdsa_doit[j] = 0;
+                                } 
+                        else 
+                                {
+                                pkey_print_message("verify","ecdsa",
+                                ecdsa_c[j][1],
+                                test_curves_bits[j],
+                                ECDSA_SECONDS);
+                                Time_F(START);
+                                for (count=0,run=1; COND(ecdsa_c[j][1]); count++) 
+                                        {
+                                        ret=ECDSA_verify(0, buf, 20, ecdsasig, ecdsasiglen, ecdsa[j]);
+                                        if (ret != 1) 
+                                                {
+                                                BIO_printf(bio_err, "ECDSA verify failure\n");
+                                                ERR_print_errors(bio_err);
+                                                count=1;
+                                                break;
+                                                }
+                                        }
+                                d=Time_F(STOP);
+                                BIO_printf(bio_err, mr? "+R6:%ld:%d:%.2f\n"
+                                                : "%ld %d bit ECDSA verify in %.2fs\n",
+                                count, test_curves_bits[j], d);
+                                ecdsa_results[j][1]=d/(double)count;
+                                }
+
+                        if (rsa_count <= 1) 
+                                {
+                                /* if longer than 10s, don't do any more */
+                                for (j++; j<EC_NUM; j++)
+                                ecdsa_doit[j]=0;
+                                }
+                        }
+                }
+        if (rnd_fake) RAND_cleanup();
+#endif
+
+#ifndef OPENSSL_NO_ECDH
+        if (RAND_status() != 1)
+                {
+                RAND_seed(rnd_seed, sizeof rnd_seed);
+                rnd_fake = 1;
+                }
+        for (j=0; j<EC_NUM; j++)
+                {
+                if (!ecdh_doit[j]) continue;
+                ecdh_a[j] = EC_KEY_new_by_curve_name(test_curves[j]);
+                ecdh_b[j] = EC_KEY_new_by_curve_name(test_curves[j]);
+                if ((ecdh_a[j] == NULL) || (ecdh_b[j] == NULL))
+                        {
+                        BIO_printf(bio_err,"ECDH failure.\n");
+                        ERR_print_errors(bio_err);
+                        rsa_count=1;
+                        }
+                else
+                        {
+                        /* generate two ECDH key pairs */
+                        if (!EC_KEY_generate_key(ecdh_a[j]) ||
+                                !EC_KEY_generate_key(ecdh_b[j]))
+                                {
+                                BIO_printf(bio_err,"ECDH key generation failure.\n");
+                                ERR_print_errors(bio_err);
+                                rsa_count=1;            
+                                }
+                        else
+                                {
+                                /* If field size is not more than 24 octets, then use SHA-1 hash of result;
+                                 * otherwise, use result (see section 4.8 of draft-ietf-tls-ecc-03.txt).
+                                 */
+                                int field_size, outlen;
+                                void *(*kdf)(const void *in, size_t inlen, void *out, size_t *xoutlen);
+                                field_size = EC_GROUP_get_degree(EC_KEY_get0_group(ecdh_a[j]));
+                                if (field_size <= 24 * 8)
+                                        {
+                                        outlen = KDF1_SHA1_len;
+                                        kdf = KDF1_SHA1;
+                                        }
+                                else
+                                        {
+                                        outlen = (field_size+7)/8;
+                                        kdf = NULL;
+                                        }
+                                secret_size_a = ECDH_compute_key(secret_a, outlen,
+                                        EC_KEY_get0_public_key(ecdh_b[j]),
+                                        ecdh_a[j], kdf);
+                                secret_size_b = ECDH_compute_key(secret_b, outlen,
+                                        EC_KEY_get0_public_key(ecdh_a[j]),
+                                        ecdh_b[j], kdf);
+                                if (secret_size_a != secret_size_b) 
+                                        ecdh_checks = 0;
+                                else
+                                        ecdh_checks = 1;
+
+                                for (secret_idx = 0; 
+                                    (secret_idx < secret_size_a)
+                                        && (ecdh_checks == 1);
+                                    secret_idx++)
+                                        {
+                                        if (secret_a[secret_idx] != secret_b[secret_idx])
+                                        ecdh_checks = 0;
+                                        }
+
+                                if (ecdh_checks == 0)
+                                        {
+                                        BIO_printf(bio_err,"ECDH computations don't match.\n");
+                                        ERR_print_errors(bio_err);
+                                        rsa_count=1;            
+                                        }
+
+                                pkey_print_message("","ecdh",
+                                ecdh_c[j][0], 
+                                test_curves_bits[j],
+                                ECDH_SECONDS);
+                                Time_F(START);
+                                for (count=0,run=1; COND(ecdh_c[j][0]); count++)
+                                        {
+                                        ECDH_compute_key(secret_a, outlen,
+                                        EC_KEY_get0_public_key(ecdh_b[j]),
+                                        ecdh_a[j], kdf);
+                                        }
+                                d=Time_F(STOP);
+                                BIO_printf(bio_err, mr ? "+R7:%ld:%d:%.2f\n" :"%ld %d-bit ECDH ops in %.2fs\n",
+                                count, test_curves_bits[j], d);
+                                ecdh_results[j][0]=d/(double)count;
+                                rsa_count=count;
+                                }
+                        }
+
+
+                if (rsa_count <= 1)
+                        {
+                        /* if longer than 10s, don't do any more */
+                        for (j++; j<EC_NUM; j++)
+                        ecdh_doit[j]=0;
+                        }
+                }
+        if (rnd_fake) RAND_cleanup();
+#endif
 #ifdef HAVE_FORK
 show_res:
 #endif
@@ -1645,7 +2502,10 @@ show_res:
 #endif
 #ifdef HZ
 #define as_string(s) (#s)
-                printf("HZ=%g", (double)HZ);
+                {
+                double dbl = HZ;
+                printf("HZ=%g", dbl);
+                }
 # ifdef _SC_CLK_TCK
                 printf(" [sysconf value]");
 # endif
@@ -1730,7 +2590,57 @@ show_res:
                                 1.0/dsa_results[k][0],1.0/dsa_results[k][1]);
                 }
 #endif
+#ifndef OPENSSL_NO_ECDSA
+        j=1;
+        for (k=0; k<EC_NUM; k++)
+                {
+                if (!ecdsa_doit[k]) continue;
+                if (j && !mr)
+                        {
+                        printf("%30ssign    verify    sign/s verify/s\n"," ");
+                        j=0;
+                        }
+
+                if (mr)
+                        fprintf(stdout,"+F4:%u:%u:%f:%f\n", 
+                                k, test_curves_bits[k],
+                                ecdsa_results[k][0],ecdsa_results[k][1]);
+                else
+                        fprintf(stdout,
+                                "%4u bit ecdsa (%s) %8.4fs %8.4fs %8.1f %8.1f\n", 
+                                test_curves_bits[k],
+                                test_curves_names[k],
+                                ecdsa_results[k][0],ecdsa_results[k][1], 
+                                1.0/ecdsa_results[k][0],1.0/ecdsa_results[k][1]);
+                }
+#endif
+
+
+#ifndef OPENSSL_NO_ECDH
+        j=1;
+        for (k=0; k<EC_NUM; k++)
+                {
+                if (!ecdh_doit[k]) continue;
+                if (j && !mr)
+                        {
+                        printf("%30sop      op/s\n"," ");
+                        j=0;
+                        }
+                if (mr)
+                        fprintf(stdout,"+F5:%u:%u:%f:%f\n",
+                                k, test_curves_bits[k],
+                                ecdh_results[k][0], 1.0/ecdh_results[k][0]);
+
+                else
+                        fprintf(stdout,"%4u bit ecdh (%s) %8.4fs %8.1f\n",
+                                test_curves_bits[k],
+                                test_curves_names[k],
+                                ecdh_results[k][0], 1.0/ecdh_results[k][0]);
+                }
+#endif
+
         mret=0;
+
 end:
         ERR_print_errors(bio_err);
         if (buf != NULL) OPENSSL_free(buf);
@@ -1745,6 +2655,22 @@ end:
                 if (dsa_key[i] != NULL)
                         DSA_free(dsa_key[i]);
 #endif
+
+#ifndef OPENSSL_NO_ECDSA
+        for (i=0; i<EC_NUM; i++)
+                if (ecdsa[i] != NULL)
+                        EC_KEY_free(ecdsa[i]);
+#endif
+#ifndef OPENSSL_NO_ECDH
+        for (i=0; i<EC_NUM; i++)
+        {
+                if (ecdh_a[i] != NULL)
+                        EC_KEY_free(ecdh_a[i]);
+                if (ecdh_b[i] != NULL)
+                        EC_KEY_free(ecdh_b[i]);
+        }
+#endif
+
         apps_shutdown();
         OPENSSL_EXIT(mret);
         }
@@ -1766,8 +2692,8 @@ static void print_message(const char *s, long num, int length)
 #endif
         }
 
-static void pkey_print_message(char *str, char *str2, long num, int bits,
-             int tm)
+static void pkey_print_message(const char *str, const char *str2, long num,
+        int bits, int tm)
         {
 #ifdef SIGALRM
         BIO_printf(bio_err,mr ? "+DTP:%d:%s:%s:%d\n"
@@ -1786,11 +2712,12 @@ static void pkey_print_message(char *str, char *str2, long num, int bits,
 
 static void print_result(int alg,int run_no,int count,double time_used)
         {
-        BIO_printf(bio_err,mr ? "+R:%ld:%s:%f\n"
-                   : "%ld %s's in %.2fs\n",count,names[alg],time_used);
+        BIO_printf(bio_err,mr ? "+R:%d:%s:%f\n"
+                   : "%d %s's in %.2fs\n",count,names[alg],time_used);
         results[alg][run_no]=((double)count)/time_used*lengths[run_no];
         }
 
+#ifdef HAVE_FORK
 static char *sstrsep(char **string, const char *delim)
     {
     char isdelim[256];
@@ -1822,7 +2749,6 @@ static char *sstrsep(char **string, const char *delim)
     return token;
     }
 
-#ifdef HAVE_FORK
 static int do_multi(int multi)
         {
         int n;
@@ -1946,6 +2872,49 @@ static int do_multi(int multi)
                                 else
                                         dsa_results[k][1]=d;
                                 }
+#ifndef OPENSSL_NO_ECDSA
+                        else if(!strncmp(buf,"+F4:",4))
+                                {
+                                int k;
+                                double d;
+                                
+                                p=buf+4;
+                                k=atoi(sstrsep(&p,sep));
+                                sstrsep(&p,sep);
+
+                                d=atof(sstrsep(&p,sep));
+                                if(n)
+                                        ecdsa_results[k][0]=1/(1/ecdsa_results[k][0]+1/d);
+                                else
+                                        ecdsa_results[k][0]=d;
+
+                                d=atof(sstrsep(&p,sep));
+                                if(n)
+                                        ecdsa_results[k][1]=1/(1/ecdsa_results[k][1]+1/d);
+                                else
+                                        ecdsa_results[k][1]=d;
+                                }
+#endif 
+
+#ifndef OPENSSL_NO_ECDH
+                        else if(!strncmp(buf,"+F5:",4))
+                                {
+                                int k;
+                                double d;
+                                
+                                p=buf+4;
+                                k=atoi(sstrsep(&p,sep));
+                                sstrsep(&p,sep);
+
+                                d=atof(sstrsep(&p,sep));
+                                if(n)
+                                        ecdh_results[k][0]=1/(1/ecdh_results[k][0]+1/d);
+                                else
+                                        ecdh_results[k][0]=d;
+
+                                }
+#endif
+
                         else if(!strncmp(buf,"+H:",3))
                                 {
                                 }
diff --git a/src/lib/libssl/src/apps/spkac.c b/src/lib/libssl/src/apps/spkac.c
index 47ee53f1ee..0191d0a783 100644
--- a/src/lib/libssl/src/apps/spkac.c
+++ b/src/lib/libssl/src/apps/spkac.c
@@ -87,7 +87,8 @@ int MAIN(int argc, char **argv)
         int verify=0,noout=0,pubkey=0;
         char *infile = NULL,*outfile = NULL,*prog;
         char *passargin = NULL, *passin = NULL;
-        char *spkac = "SPKAC", *spksect = "default", *spkstr = NULL;
+        const char *spkac = "SPKAC", *spksect = "default";
+        char *spkstr = NULL;
         char *challenge = NULL, *keyfile = NULL;
         CONF *conf = NULL;
         NETSCAPE_SPKI *spki = NULL;
@@ -200,7 +201,7 @@ bad:
                 }
                 spki = NETSCAPE_SPKI_new();
                 if(challenge) ASN1_STRING_set(spki->spkac->challenge,
-                                                 challenge, strlen(challenge));
+                                                 challenge, (int)strlen(challenge));
                 NETSCAPE_SPKI_set_pubkey(spki, pkey);
                 NETSCAPE_SPKI_sign(spki, pkey, EVP_md5());
                 spkstr = NETSCAPE_SPKI_b64_encode(spki);
diff --git a/src/lib/libssl/src/apps/verify.c b/src/lib/libssl/src/apps/verify.c
index d73280cdd0..9ff32cb068 100644
--- a/src/lib/libssl/src/apps/verify.c
+++ b/src/lib/libssl/src/apps/verify.c
@@ -79,13 +79,14 @@ int MAIN(int, char **);
 int MAIN(int argc, char **argv)
         {
         ENGINE *e = NULL;
-        int i,ret=1;
+        int i,ret=1, badarg = 0;
         int purpose = -1;
         char *CApath=NULL,*CAfile=NULL;
         char *untfile = NULL, *trustfile = NULL;
         STACK_OF(X509) *untrusted = NULL, *trusted = NULL;
         X509_STORE *cert_ctx=NULL;
         X509_LOOKUP *lookup=NULL;
+        X509_VERIFY_PARAM *vpm = NULL;
 #ifndef OPENSSL_NO_ENGINE
         char *engine=NULL;
 #endif
@@ -121,18 +122,12 @@ int MAIN(int argc, char **argv)
                                 if (argc-- < 1) goto end;
                                 CAfile= *(++argv);
                                 }
-                        else if (strcmp(*argv,"-purpose") == 0)
+                        else if (args_verify(&argv, &argc, &badarg, bio_err,
+                                                                        &vpm))
                                 {
-                                X509_PURPOSE *xptmp;
-                                if (argc-- < 1) goto end;
-                                i = X509_PURPOSE_get_by_sname(*(++argv));
-                                if(i < 0)
-                                        {
-                                        BIO_printf(bio_err, "unrecognized purpose\n");
+                                if (badarg)
                                         goto end;
-                                        }
-                                xptmp = X509_PURPOSE_get0(i);
-                                purpose = X509_PURPOSE_get_id(xptmp);
+                                continue;
                                 }
                         else if (strcmp(*argv,"-untrusted") == 0)
                                 {
@@ -153,14 +148,6 @@ int MAIN(int argc, char **argv)
 #endif
                         else if (strcmp(*argv,"-help") == 0)
                                 goto end;
-                        else if (strcmp(*argv,"-ignore_critical") == 0)
-                                vflags |= X509_V_FLAG_IGNORE_CRITICAL;
-                        else if (strcmp(*argv,"-issuer_checks") == 0)
-                                vflags |= X509_V_FLAG_CB_ISSUER_CHECK;
-                        else if (strcmp(*argv,"-crl_check") == 0)
-                                vflags |= X509_V_FLAG_CRL_CHECK;
-                        else if (strcmp(*argv,"-crl_check_all") == 0)
-                                vflags |= X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL;
                         else if (strcmp(*argv,"-verbose") == 0)
                                 v_verbose=1;
                         else if (argv[0][0] == '-')
@@ -178,6 +165,9 @@ int MAIN(int argc, char **argv)
         e = setup_engine(bio_err, engine, 0);
 #endif
 
+        if (vpm)
+                X509_STORE_set1_param(cert_ctx, vpm);
+
         lookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_file());
         if (lookup == NULL) abort();
         if (CAfile) {
@@ -238,6 +228,7 @@ end:
                                                                 X509_PURPOSE_get0_name(ptmp));
                 }
         }
+        if (vpm) X509_VERIFY_PARAM_free(vpm);
         if (cert_ctx != NULL) X509_STORE_free(cert_ctx);
         sk_X509_pop_free(untrusted, X509_free);
         sk_X509_pop_free(trusted, X509_free);
@@ -339,10 +330,13 @@ static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx)
 
         if (!ok)
                 {
-                X509_NAME_oneline(
+                if (ctx->current_cert)
+                        {
+                        X509_NAME_oneline(
                                 X509_get_subject_name(ctx->current_cert),buf,
                                 sizeof buf);
-                printf("%s\n",buf);
+                        printf("%s\n",buf);
+                        }
                 printf("error %d at %d depth lookup:%s\n",ctx->error,
                         ctx->error_depth,
                         X509_verify_cert_error_string(ctx->error));
@@ -361,7 +355,14 @@ static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx)
                 if (ctx->error == X509_V_ERR_CRL_HAS_EXPIRED) ok=1;
                 if (ctx->error == X509_V_ERR_CRL_NOT_YET_VALID) ok=1;
                 if (ctx->error == X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION) ok=1;
+
+                if (ctx->error == X509_V_ERR_NO_EXPLICIT_POLICY)
+                        policies_print(NULL, ctx);
+                return ok;
+
                 }
+        if ((ctx->error == X509_V_OK) && (ok == 2))
+                policies_print(NULL, ctx);
         if (!v_verbose)
                 ERR_clear_error();
         return(ok);
diff --git a/src/lib/libssl/src/apps/version.c b/src/lib/libssl/src/apps/version.c
index 0843b67565..69ef3e1bad 100644
--- a/src/lib/libssl/src/apps/version.c
+++ b/src/lib/libssl/src/apps/version.c
@@ -115,6 +115,7 @@
 #include "apps.h"
 #include <openssl/evp.h>
 #include <openssl/crypto.h>
+#include <openssl/bn.h>
 #ifndef OPENSSL_NO_MD2
 # include <openssl/md2.h>
 #endif
@@ -172,7 +173,19 @@ int MAIN(int argc, char **argv)
                         }
                 }
 
-        if (version) printf("%s\n",SSLeay_version(SSLEAY_VERSION));
+        if (version)
+                {
+                if (SSLeay() == SSLEAY_VERSION_NUMBER)
+                        {
+                        printf("%s\n",SSLeay_version(SSLEAY_VERSION));
+                        }
+                else
+                        {
+                        printf("%s (Library: %s)\n",
+                                OPENSSL_VERSION_TEXT,
+                                SSLeay_version(SSLEAY_VERSION));
+                        }
+                }
         if (date)    printf("%s\n",SSLeay_version(SSLEAY_BUILT_ON));
         if (platform) printf("%s\n",SSLeay_version(SSLEAY_PLATFORM));
         if (options) 
diff --git a/src/lib/libssl/src/apps/x509.c b/src/lib/libssl/src/apps/x509.c
index e7115cac67..f6938356f8 100644
--- a/src/lib/libssl/src/apps/x509.c
+++ b/src/lib/libssl/src/apps/x509.c
@@ -73,6 +73,12 @@
 #include <openssl/x509v3.h>
 #include <openssl/objects.h>
 #include <openssl/pem.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
 
 #undef PROG
 #define PROG x509_main
@@ -81,7 +87,7 @@
 #define POSTFIX ".srl"
 #define DEF_DAYS        30
 
-static char *x509_usage[]={
+static const char *x509_usage[]={
 "usage: x509 args\n",
 " -inform arg     - input format - default PEM (one of DER, NET or PEM)\n",
 " -outform arg    - output format - default PEM (one of DER, NET or PEM)\n",
@@ -92,7 +98,9 @@ static char *x509_usage[]={
 " -out arg        - output file - default stdout\n",
 " -passin arg     - private key password source\n",
 " -serial         - print serial number value\n",
-" -hash           - print hash value\n",
+" -subject_hash   - print subject hash value\n",
+" -issuer_hash    - print issuer hash value\n",
+" -hash           - synonym for -subject_hash\n",
 " -subject        - print subject DN\n",
 " -issuer         - print issuer DN\n",
 " -email          - print email address(es)\n",
@@ -106,6 +114,7 @@ static char *x509_usage[]={
 " -alias          - output certificate alias\n",
 " -noout          - no certificate output\n",
 " -ocspid         - print OCSP hash values for the subject name and public key\n",
+" -ocspurl        - print OCSP Responder URL(s)\n",
 " -trustout       - output a \"trusted\" certificate\n",
 " -clrtrust       - clear all trusted purposes\n",
 " -clrreject      - clear all rejected purposes\n",
@@ -167,19 +176,21 @@ int MAIN(int argc, char **argv)
         char *infile=NULL,*outfile=NULL,*keyfile=NULL,*CAfile=NULL;
         char *CAkeyfile=NULL,*CAserial=NULL;
         char *alias=NULL;
-        int text=0,serial=0,hash=0,subject=0,issuer=0,startdate=0,enddate=0;
-        int next_serial=0,ocspid=0;
+        int text=0,serial=0,subject=0,issuer=0,startdate=0,enddate=0;
+        int next_serial=0;
+        int subject_hash=0,issuer_hash=0,ocspid=0;
         int noout=0,sign_flag=0,CA_flag=0,CA_createserial=0,email=0;
+        int ocsp_uri=0;
         int trustout=0,clrtrust=0,clrreject=0,aliasout=0,clrext=0;
         int C=0;
         int x509req=0,days=DEF_DAYS,modulus=0,pubkey=0;
         int pprint = 0;
-        char **pp;
+        const char **pp;
         X509_STORE *ctx=NULL;
         X509_REQ *rq=NULL;
         int fingerprint=0;
         char buf[256];
-        const EVP_MD *md_alg,*digest;
+        const EVP_MD *md_alg,*digest=EVP_sha1();
         CONF *extconf = NULL;
         char *extsect = NULL, *extfile = NULL, *passin = NULL, *passargin = NULL;
         int need_rand = 0;
@@ -216,13 +227,6 @@ int MAIN(int argc, char **argv)
         if (ctx == NULL) goto end;
         X509_STORE_set_verify_cb_func(ctx,callb);
 
-#ifdef  OPENSSL_FIPS
-        if (FIPS_mode())
-                digest = EVP_sha1();
-        else
-#endif
-                digest = EVP_md5();
-
         argc--;
         argv++;
         num=0;
@@ -376,6 +380,8 @@ int MAIN(int argc, char **argv)
                         C= ++num;
                 else if (strcmp(*argv,"-email") == 0)
                         email= ++num;
+                else if (strcmp(*argv,"-ocsp_uri") == 0)
+                        ocsp_uri= ++num;
                 else if (strcmp(*argv,"-serial") == 0)
                         serial= ++num;
                 else if (strcmp(*argv,"-next_serial") == 0)
@@ -388,8 +394,11 @@ int MAIN(int argc, char **argv)
                         x509req= ++num;
                 else if (strcmp(*argv,"-text") == 0)
                         text= ++num;
-                else if (strcmp(*argv,"-hash") == 0)
-                        hash= ++num;
+                else if (strcmp(*argv,"-hash") == 0
+                        || strcmp(*argv,"-subject_hash") == 0)
+                        subject_hash= ++num;
+                else if (strcmp(*argv,"-issuer_hash") == 0)
+                        issuer_hash= ++num;
                 else if (strcmp(*argv,"-subject") == 0)
                         subject= ++num;
                 else if (strcmp(*argv,"-issuer") == 0)
@@ -704,7 +713,8 @@ bad:
                         else if (serial == i)
                                 {
                                 BIO_printf(STDout,"serial=");
-                                i2a_ASN1_INTEGER(STDout,x->cert_info->serialNumber);
+                                i2a_ASN1_INTEGER(STDout,
+                                        X509_get_serialNumber(x));
                                 BIO_printf(STDout,"\n");
                                 }
                         else if (next_serial == i)
@@ -725,11 +735,14 @@ bad:
                                 ASN1_INTEGER_free(ser);
                                 BIO_puts(out, "\n");
                                 }
-                        else if (email == i) 
+                        else if ((email == i) || (ocsp_uri == i))
                                 {
                                 int j;
                                 STACK *emlst;
-                                emlst = X509_get1_email(x);
+                                if (email == i)
+                                        emlst = X509_get1_email(x);
+                                else
+                                        emlst = X509_get1_ocsp(x);
                                 for (j = 0; j < sk_num(emlst); j++)
                                         BIO_printf(STDout, "%s\n", sk_value(emlst, j));
                                 X509_email_free(emlst);
@@ -741,10 +754,14 @@ bad:
                                 if (alstr) BIO_printf(STDout,"%s\n", alstr);
                                 else BIO_puts(STDout,"<No Alias>\n");
                                 }
-                        else if (hash == i)
+                        else if (subject_hash == i)
                                 {
                                 BIO_printf(STDout,"%08lx\n",X509_subject_name_hash(x));
                                 }
+                        else if (issuer_hash == i)
+                                {
+                                BIO_printf(STDout,"%08lx\n",X509_issuer_name_hash(x));
+                                }
                         else if (pprint == i)
                                 {
                                 X509_PURPOSE *ptmp;
@@ -906,6 +923,10 @@ bad:
                                 if (Upkey->type == EVP_PKEY_DSA)
                                         digest=EVP_dss1();
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                                if (Upkey->type == EVP_PKEY_EC)
+                                        digest=EVP_ecdsa();
+#endif
 
                                 assert(need_rand);
                                 if (!sign(x,Upkey,days,clrext,digest,
@@ -926,6 +947,10 @@ bad:
                                 if (CApkey->type == EVP_PKEY_DSA)
                                         digest=EVP_dss1();
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                                if (CApkey->type == EVP_PKEY_EC)
+                                        digest = EVP_ecdsa();
+#endif
                                 
                                 assert(need_rand);
                                 if (!x509_certify(ctx,CAfile,digest,x,xca,
@@ -957,6 +982,10 @@ bad:
                                 if (pk->type == EVP_PKEY_DSA)
                                         digest=EVP_dss1();
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                                if (pk->type == EVP_PKEY_EC)
+                                        digest=EVP_ecdsa();
+#endif
 
                                 rq=X509_to_X509_REQ(x,pk,digest);
                                 EVP_PKEY_free(pk);
@@ -1020,8 +1049,7 @@ bad:
                 ah.data=(char *)x;
                 ah.meth=X509_asn1_meth();
 
-                /* no macro for this one yet */
-                i=ASN1_i2d_bio(i2d_ASN1_HEADER,out,(unsigned char *)&ah);
+                i=ASN1_i2d_bio_of(ASN1_HEADER,i2d_ASN1_HEADER,out,&ah);
                 }
         else    {
                 BIO_printf(bio_err,"bad output format specified for outfile\n");
diff --git a/src/lib/libssl/src/config b/src/lib/libssl/src/config
index c2f504f59e..dde9275b76 100644
--- a/src/lib/libssl/src/config
+++ b/src/lib/libssl/src/config
@@ -54,22 +54,6 @@ SYSTEM=`(uname -s) 2>/dev/null`  || SYSTEM="unknown"
 VERSION=`(uname -v) 2>/dev/null` || VERSION="unknown"
 
 
-
- 
-
-# Check for VC++ presence first.
-#
-#if [ "x$MSVCDIR" != "x" -o "x$VCINSTALLDIR" != "x" ]; then
-#       perl Configure VC-WIN32 $*
-#       cmd /c ms\\do_masm.bat
-#       perl util/mk1mf.pl VC-WIN32-GMAKE >mak.tmp
-#       rm Makefile
-#       mv mak.tmp Makefile
-#       echo "Configured for VC++ using GNU make"
-#       exit 0
-#fi
-#
-
 # Now test for ISC and SCO, since it is has a braindamaged uname.
 #
 # We need to work around FreeBSD 1.1.5.1 
@@ -98,9 +82,9 @@ if [ "x$XREL" != "x" ]; then
                 esac
                 ;;
             4.2)
-                echo "i386-whatever-unixware1"; exit 0
+                echo "whatever-whatever-unixware1"; exit 0
                 ;;
-            5)
+            5*)
                 case "x${VERSION}" in
                     # We hardcode i586 in place of ${MACHINE} for the
                     # following reason. The catch is that even though Pentium
@@ -109,8 +93,7 @@ if [ "x$XREL" != "x" ]; then
                     # with i386 is that it makes ./config pass 386 to
                     # ./Configure, which in turn makes make generate
                     # inefficient SHA-1 (for this moment) code.
-                    x7*)  echo "i586-sco-unixware7";           exit 0 ;;
-                    x8*)  echo "i586-unkn-OpenUNIX${VERSION}"; exit 0 ;;
+                    x[678]*)  echo "i586-sco-unixware7"; exit 0 ;;
                 esac
                 ;;
         esac
@@ -354,11 +337,7 @@ case "${SYSTEM}:${RELEASE}:${VERSION}:${MACHINE}" in
         ;;
 
     MINGW*)
-        echo "${MACHINE}-whatever-mingw"; echo 0;
-        # Save fipslib path so VC++ build can find it
-        (cd /usr/local/ssl/lib ; pwd -W ) > util/fipslib_path.txt
-        # Extract _chkstk.o so VC++ can use it, to avoid __alloca link error
-        (cd ms ; ar x `gcc -print-libgcc-file-name` _chkstk.o)
+        echo "${MACHINE}-whatever-mingw"; exit 0;
         ;;
     CYGWIN*)
         case "$RELEASE" in
@@ -472,8 +451,6 @@ if [ "$SYSTEM" = "SunOS" ]; then
       echo "         patch #107357-01 or later applied."
       sleep 5
     fi
-  elif [ "$CC" = "cc" -a $CCVER -gt 0 ]; then
-    CC=sc3
   fi
 fi
 
@@ -539,36 +516,23 @@ case "$GUESSOS" in
         #fi
         OUT="irix-mips3-$CC"
         ;;
+  ppc-apple-rhapsody) OUT="rhapsody-ppc-cc" ;;
+  ppc-apple-darwin*) OUT="darwin-ppc-cc" ;;
+  i386-apple-darwin*) OUT="darwin-i386-cc" ;;
   alpha-*-linux2)
-        ISA=`awk '/cpu model/{print$4}' /proc/cpuinfo`
+        ISA=`awk '/cpu model/{print$4;exit(0);}' /proc/cpuinfo`
         case ${ISA:-generic} in
-        *[67])  OUT="linux-alpha+bwx-$CC" ;;
+        *[678]) OUT="linux-alpha+bwx-$CC" ;;
         *)      OUT="linux-alpha-$CC" ;;
         esac
         if [ "$CC" = "gcc" ]; then
             case ${ISA:-generic} in
             EV5|EV45)           options="$options -mcpu=ev5";;
             EV56|PCA56)         options="$options -mcpu=ev56";;
-            EV6|EV67|PCA57)     options="$options -mcpu=ev6";;
+            *)                  options="$options -mcpu=ev6";;
             esac
         fi
         ;;
-  mips-*-linux?)
-          cat >dummy.c <<EOF
-#include <stdio.h>  /* for printf() prototype */
-        int main (argc, argv) int argc; char *argv[]; {
-#ifdef __MIPSEB__
-  printf ("linux-%s\n", argv[1]);
-#endif
-#ifdef __MIPSEL__
-  printf ("linux-%sel\n", argv[1]);
-#endif
-  return 0;
-}
-EOF
-        ${CC} -o dummy dummy.c && OUT=`./dummy ${MACHINE}`
-        rm dummy dummy.c
-        ;;
   ppc64-*-linux2)
         echo "WARNING! If you wish to build 64-bit library, then you have to"
         echo "         invoke './Configure linux-ppc64' *manually*."
@@ -579,11 +543,7 @@ EOF
         OUT="linux-ppc"
         ;;
   ppc-*-linux2) OUT="linux-ppc" ;;
-  m68k-*-linux*) OUT="linux-m68k" ;;
   ia64-*-linux?) OUT="linux-ia64" ;;
-  ppc-apple-rhapsody) OUT="rhapsody-ppc-cc" ;;
-  ppc-apple-darwin*) OUT="darwin-ppc-cc" ;;
-  i386-apple-darwin*) OUT="darwin-i386-cc" ;;
   sparc64-*-linux2)
         echo "WARNING! If you *know* that your GNU C supports 64-bit/V9 ABI"
         echo "         and wish to build 64-bit library, then you have to"
@@ -594,16 +554,18 @@ EOF
         fi
         OUT="linux-sparcv9" ;;
   sparc-*-linux2)
-        KARCH=`awk '/^type/{print$3}' /proc/cpuinfo`
+        KARCH=`awk '/^type/{print$3;exit(0);}' /proc/cpuinfo`
         case ${KARCH:-sun4} in
         sun4u*) OUT="linux-sparcv9" ;;
         sun4m)  OUT="linux-sparcv8" ;;
         sun4d)  OUT="linux-sparcv8" ;;
-        *)      OUT="linux-sparcv7" ;;
+        *)      OUT="linux-generic32"; options="$options -DB_ENDIAN" ;;
         esac ;;
-  parisc-*-linux2)
-        CPUARCH=`awk '/cpu family/{print substr($5,1,3)}' /proc/cpuinfo`
-        CPUSCHEDULE=`awk '/^cpu.[       ]: PA/{print substr($3,3)}' /proc/cpuinfo`
+  parisc*-*-linux2)
+        # 64-bit builds under parisc64 linux are not supported and
+        # compiler is expected to generate 32-bit objects...
+        CPUARCH=`awk '/cpu family/{print substr($5,1,3); exit(0);}' /proc/cpuinfo`
+        CPUSCHEDULE=`awk '/^cpu.[       ]*: PA/{print substr($3,3); exit(0);}' /proc/cpuinfo`
 
         # ??TODO ??  Model transformations
         # 0. CPU Architecture for the 1.1 processor has letter suffixes. We strip that off
@@ -616,31 +578,34 @@ EOF
         #         PA8500   -> 8000   (2.0)
         #         PA8600   -> 8000   (2.0)
 
-        CPUSCHEDULE=`echo $CPUSCHEDULE|sed -e 's/7300LC/7100LC/' -e 's/8?00/8000/'`
+        CPUSCHEDULE=`echo $CPUSCHEDULE|sed -e 's/7300LC/7100LC/' -e 's/8.00/8000/'`
         # Finish Model transformations
 
-        options="$options -mschedule=$CPUSCHEDULE -march=$CPUARCH"
-        OUT="linux-parisc" ;;
-  arm*b-*-linux2) OUT="linux-elf-arm"; options="$options -DB_ENDIAN" ;;
-  arm*l-*-linux2) OUT="linux-elf-arm"; options="$options -DL_ENDIAN" ;;
-  arm*-*-linux2)  OUT="linux-elf-arm" ;;
-  s390-*-linux2) OUT="linux-s390" ;;
-  s390x-*-linux?) OUT="linux-s390x" ;;
+        options="$options -DB_ENDIAN -mschedule=$CPUSCHEDULE -march=$CPUARCH"
+        OUT="linux-generic32" ;;
+  arm*b-*-linux2) OUT="linux-generic32"; options="$options -DB_ENDIAN" ;;
+  arm*l-*-linux2) OUT="linux-generic32"; options="$options -DL_ENDIAN" ;;
+  sh*b-*-linux2) OUT="linux-generic32"; options="$options -DB_ENDIAN" ;;
+  sh*-*-linux2)  OUT="linux-generic32"; options="$options -DL_ENDIAN" ;;
+  m68k*-*-linux2) OUT="linux-generic32"; options="$options -DB_ENDIAN" ;;
+  s390-*-linux2) OUT="linux-generic32"; options="$options -DB_ENDIAN -DNO_ASM" ;;
+  s390x-*-linux2) OUT="linux-generic64"; options="$options -DB_ENDIAN" ;;
   x86_64-*-linux?) OUT="linux-x86_64" ;;
-  *-*-linux2) OUT="linux-elf"
+  *86-*-linux2) OUT="linux-elf"
         if [ "$GCCVER" -gt 28 ]; then
           if grep '^model.*Pentium' /proc/cpuinfo >/dev/null ; then
-            OUT="linux-pentium"
+            options="$options -march=pentium"
           fi
           if grep '^model.*Pentium Pro' /proc/cpuinfo >/dev/null ; then
-            OUT="linux-ppro"
+            options="$options -march=pentiumpro"
           fi
           if grep '^model.*K6' /proc/cpuinfo >/dev/null ; then
-            OUT="linux-k6"
+            options="$options -march=k6"
           fi
         fi ;;
   *-*-linux1) OUT="linux-aout" ;;
-  sun4u*-*-solaris2)
+  *-*-linux2) OUT="linux-generic32" ;;
+  sun4[uv]*-*-solaris2)
         OUT="solaris-sparcv9-$CC"
         ISA64=`(isalist) 2>/dev/null | grep sparcv9`
         if [ "$ISA64" != "" ]; then
@@ -683,48 +648,43 @@ EOF
             OUT="solaris64-x86_64-$CC"
         else
             OUT="solaris-x86-$CC"
+            if [ `uname -r | sed -e 's/5\.//'` -lt 10 ]; then
+                options="$options no-sse2"
+            fi
         fi
         ;;
-  *-*-sunos4) OUT="sunos-$CC" ;;
-  alpha*-*-freebsd*) OUT="FreeBSD-alpha" ;;
-  sparc64-*-freebsd*) OUT="FreeBSD-sparc64" ;;
-  ia64-*-freebsd*) OUT="FreeBSD-ia64" ;;
-  *-freebsd[3-9]*) OUT="FreeBSD-elf" ;;
-  *-freebsd[1-2]*) OUT="FreeBSD" ;;
-  *86*-*-netbsd) OUT="NetBSD-x86" ;;
-  sun3*-*-netbsd) OUT="NetBSD-m68" ;;
-  *-*-netbsd) OUT="NetBSD-sparc" ;;
-  alpha*-*-openbsd) OUT="OpenBSD-alpha" ;;
-  *86*-*-openbsd) OUT="OpenBSD-i386" ;;
-  m68k*-*-openbsd) OUT="OpenBSD-m68k" ;;
-  m88k*-*-openbsd) OUT="OpenBSD-m88k" ;;
-  mips*-*-openbsd) OUT="OpenBSD-mips" ;;
-  pmax*-*-openbsd) OUT="OpenBSD-mips" ;;
-  powerpc*-*-openbsd) OUT="OpenBSD-powerpc" ;;
-  sparc64*-*-openbsd) OUT="OpenBSD-sparc64" ;;
-  sparc*-*-openbsd) OUT="OpenBSD-sparc" ;;
-  vax*-*-openbsd) OUT="OpenBSD-vax" ;;
-  hppa*-*-openbsd) OUT="OpenBSD-hppa" ;;
-  *-*-openbsd) OUT="OpenBSD" ;;
-  *86*-*-bsdi4) OUT="bsdi-elf-gcc" ;;
-  *-*-osf) OUT="alphaold-cc" ;;
-  *-*-tru64) OUT="alpha-cc" ;;
-  *-*-OpenUNIX*)
+  *-*-sunos4)           OUT="sunos-$CC" ;;
+
+  *86*-*-bsdi4)         OUT="BSD-x86-elf"; options="$options no-sse2 -ldl" ;;
+  alpha*-*-*bsd*)       OUT="BSD-generic64"; options="$options -DL_ENDIAN" ;;
+  powerpc64-*-*bsd*)    OUT="BSD-generic64"; options="$options -DB_ENDIAN" ;;
+  sparc64-*-*bsd*)      OUT="BSD-sparc64" ;;
+  ia64-*-*bsd*)         OUT="BSD-ia64" ;;
+  amd64-*-*bsd*)        OUT="BSD-x86_64" ;;
+  *86*-*-*bsd*)         # mimic ld behaviour when it's looking for libc...
+                        if [ -L /usr/lib/libc.so ]; then        # [Free|Net]BSD
+                            libc=/usr/lib/libc.so
+                        else                                    # OpenBSD
+                            # ld searches for highest libc.so.* and so do we
+                            libc=`(ls /usr/lib/libc.so.* | tail -1) 2>/dev/null`
+                        fi
+                        case "`(file -L $libc) 2>/dev/null`" in
+                        *ELF*)  OUT="BSD-x86-elf" ;;
+                        *)      OUT="BSD-x86"; options="$options no-sse2" ;;
+                        esac ;;
+  *-*-*bsd*)            OUT="BSD-generic32" ;;
+
+  *-*-osf)              OUT="osf1-alpha-cc" ;;
+  *-*-tru64)            OUT="tru64-alpha-cc" ;;
+  *-*-[Uu]nix[Ww]are7)
         if [ "$CC" = "gcc" ]; then
-          OUT="OpenUNIX-8-gcc" 
+          OUT="unixware-7-gcc" ; options="$options no-sse2"
         else    
-          OUT="OpenUNIX-8" 
+          OUT="unixware-7" ; options="$options no-sse2 -D__i386__"
         fi
         ;;
-  *-*-unixware7) OUT="unixware-7" ;;
-  *-*-UnixWare7) OUT="unixware-7" ;;
-  *-*-Unixware7) OUT="unixware-7" ;;
-  *-*-unixware20*) OUT="unixware-2.0" ;;
-  *-*-unixware21*) OUT="unixware-2.1" ;;
-  *-*-UnixWare20*) OUT="unixware-2.0" ;;
-  *-*-UnixWare21*) OUT="unixware-2.1" ;;
-  *-*-Unixware20*) OUT="unixware-2.0" ;;
-  *-*-Unixware21*) OUT="unixware-2.1" ;;
+  *-*-[Uu]nix[Ww]are20*) OUT="unixware-2.0"; options="$options no-sse2 no-sha512" ;;
+  *-*-[Uu]nix[Ww]are21*) OUT="unixware-2.1"; options="$options no-sse2 no-sha512" ;;
   *-*-vos)
         options="$options no-threads no-shared no-asm no-dso"
         EXE=".pm"
@@ -733,15 +693,8 @@ EOF
   RM*-siemens-sysv4) OUT="ReliantUNIX" ;;
   *-siemens-sysv4) OUT="SINIX" ;;
   *-hpux1*)
-        if [ $CC = "gcc" ];
-        then
-          if [ $GCC_BITS = "64" ]; then
+        if [ $CC = "gcc" -a $GCC_BITS = "64" ]; then
             OUT="hpux64-parisc2-gcc"
-          else
-            OUT="hpux-parisc-gcc"
-          fi
-        else
-          OUT="hpux-parisc-$CC"
         fi
         KERNEL_BITS=`(getconf KERNEL_BITS) 2>/dev/null`
         KERNEL_BITS=${KERNEL_BITS:-32}
@@ -758,9 +711,7 @@ EOF
              fi
              OUT="hpux64-ia64-cc"
         elif [ $CPU_VERSION -ge 532 ]; then     # PA-RISC 2.x CPU
-             if [ "$CC" = "cc" ]; then
-                OUT="hpux-parisc2-cc" # can't we have hpux-parisc2-gcc?
-             fi
+             OUT=${OUT:-"hpux-parisc2-${CC}"}
              if [ $KERNEL_BITS -eq 64 -a "$CC" = "cc" ]; then
                 echo "WARNING! If you wish to build 64-bit library then you have to"
                 echo "         invoke './Configure hpux64-parisc2-cc' *manually*."
@@ -770,9 +721,9 @@ EOF
                 fi
              fi
         elif [ $CPU_VERSION -ge 528 ]; then     # PA-RISC 1.1+ CPU
-             :
+             OUT="hpux-parisc-${CC}"
         elif [ $CPU_VERSION -ge 523 ]; then     # PA-RISC 1.0 CPU
-             :
+             OUT="hpux-parisc-${CC}"
         else                                    # Motorola(?) CPU
              OUT="hpux-$CC"
         fi
@@ -798,6 +749,11 @@ EOF
                 fi
             fi
         fi
+        if (lsattr -E -O -l `lsdev -c processor|awk '{print$1;exit}'` | grep -i powerpc) >/dev/null 2>&1; then
+            :   # this applies even to Power3 and later, as they return PowerPC_POWER[345]
+        else
+            options="$options no-asm"
+        fi
         ;;
   # these are all covered by the catchall below
   # *-dgux) OUT="dgux" ;;
@@ -822,12 +778,13 @@ esac
 #  options="$options -DATALLA"
 #fi
 
-# gcc < 2.8 does not support -mcpu=ultrasparc
+# gcc < 2.8 does not support -march=ultrasparc
 if [ "$OUT" = solaris-sparcv9-gcc -a $GCCVER -lt 28 ]
 then
-  echo "WARNING! Do consider upgrading to gcc-2.8 or later."
+  echo "WARNING! Falling down to 'solaris-sparcv8-gcc'."
+  echo "         Upgrade to gcc-2.8 or later."
   sleep 5
-  OUT=solaris-sparcv9-gcc27
+  OUT=solaris-sparcv8-gcc
 fi
 if [ "$OUT" = "linux-sparcv9" -a $GCCVER -lt 28 ]
 then
@@ -841,7 +798,7 @@ case "$GUESSOS" in
   i386-*) options="$options 386" ;;
 esac
 
-for i in bf cast des dh dsa ec hmac idea md2 md5 mdc2 rc2 rc4 rc5 aes ripemd rsa sha
+for i in aes bf camellia cast des dh dsa ec hmac idea md2 md5 mdc2 rc2 rc4 rc5 ripemd rsa seed sha
 do
   if [ ! -d crypto/$i ]
   then
diff --git a/src/lib/libssl/src/crypto/aes/aes.h b/src/lib/libssl/src/crypto/aes/aes.h
index 8a3ea0b883..baf0222d49 100644
--- a/src/lib/libssl/src/crypto/aes/aes.h
+++ b/src/lib/libssl/src/crypto/aes/aes.h
@@ -52,7 +52,7 @@
 #ifndef HEADER_AES_H
 #define HEADER_AES_H
 
-#include <openssl/e_os2.h>
+#include <openssl/opensslconf.h>
 
 #ifdef OPENSSL_NO_AES
 #error AES is disabled.
@@ -66,17 +66,17 @@
 #define AES_MAXNR 14
 #define AES_BLOCK_SIZE 16
 
-#if defined(OPENSSL_FIPS)
-#define FIPS_AES_SIZE_T int
-#endif
-
 #ifdef  __cplusplus
 extern "C" {
 #endif
 
 /* This should be a hidden type, but EVP requires that the size be known */
 struct aes_key_st {
+#ifdef AES_LONG
     unsigned long rd_key[4 *(AES_MAXNR + 1)];
+#else
+    unsigned int rd_key[4 *(AES_MAXNR + 1)];
+#endif
     int rounds;
 };
 typedef struct aes_key_st AES_KEY;
@@ -119,6 +119,23 @@ void AES_ctr128_encrypt(const unsigned char *in, unsigned char *out,
         unsigned char ecount_buf[AES_BLOCK_SIZE],
         unsigned int *num);
 
+/* For IGE, see also http://www.links.org/files/openssl-ige.pdf */
+/* NB: the IV is _two_ blocks long */
+void AES_ige_encrypt(const unsigned char *in, unsigned char *out,
+                     const unsigned long length, const AES_KEY *key,
+                     unsigned char *ivec, const int enc);
+/* NB: the IV is _four_ blocks long */
+void AES_bi_ige_encrypt(const unsigned char *in, unsigned char *out,
+                        const unsigned long length, const AES_KEY *key,
+                        const AES_KEY *key2, const unsigned char *ivec,
+                        const int enc);
+
+int AES_wrap_key(AES_KEY *key, const unsigned char *iv,
+                unsigned char *out,
+                const unsigned char *in, unsigned int inlen);
+int AES_unwrap_key(AES_KEY *key, const unsigned char *iv,
+                unsigned char *out,
+                const unsigned char *in, unsigned int inlen);
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/aes/aes_cbc.c b/src/lib/libssl/src/crypto/aes/aes_cbc.c
index 373864cd4b..d2ba6bcdb4 100644
--- a/src/lib/libssl/src/crypto/aes/aes_cbc.c
+++ b/src/lib/libssl/src/crypto/aes/aes_cbc.c
@@ -59,7 +59,6 @@
 #include <openssl/aes.h>
 #include "aes_locl.h"
 
-#if !defined(OPENSSL_FIPS_AES_ASM)
 void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
                      const unsigned long length, const AES_KEY *key,
                      unsigned char *ivec, const int enc) {
@@ -130,4 +129,3 @@ void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
                 }
         }
 }
-#endif
diff --git a/src/lib/libssl/src/crypto/aes/aes_core.c b/src/lib/libssl/src/crypto/aes/aes_core.c
index ed566a8123..3a80e18b0a 100644
--- a/src/lib/libssl/src/crypto/aes/aes_core.c
+++ b/src/lib/libssl/src/crypto/aes/aes_core.c
@@ -37,23 +37,19 @@
 
 #include <stdlib.h>
 #include <openssl/aes.h>
-#include <openssl/fips.h>
 #include "aes_locl.h"
 
-#ifndef OPENSSL_FIPS
-
 /*
 Te0[x] = S [x].[02, 01, 01, 03];
 Te1[x] = S [x].[03, 02, 01, 01];
 Te2[x] = S [x].[01, 03, 02, 01];
 Te3[x] = S [x].[01, 01, 03, 02];
-Te4[x] = S [x].[01, 01, 01, 01];
 
 Td0[x] = Si[x].[0e, 09, 0d, 0b];
 Td1[x] = Si[x].[0b, 0e, 09, 0d];
 Td2[x] = Si[x].[0d, 0b, 0e, 09];
 Td3[x] = Si[x].[09, 0d, 0b, 0e];
-Td4[x] = Si[x].[01, 01, 01, 01];
+Td4[x] = Si[x].[01];
 */
 
 static const u32 Te0[256] = {
@@ -255,7 +251,6 @@ static const u32 Te2[256] = {
     0xb0cb7bb0U, 0x54fca854U, 0xbbd66dbbU, 0x163a2c16U,
 };
 static const u32 Te3[256] = {
-
     0x6363a5c6U, 0x7c7c84f8U, 0x777799eeU, 0x7b7b8df6U,
     0xf2f20dffU, 0x6b6bbdd6U, 0x6f6fb1deU, 0xc5c55491U,
     0x30305060U, 0x01010302U, 0x6767a9ceU, 0x2b2b7d56U,
@@ -321,72 +316,7 @@ static const u32 Te3[256] = {
     0x4141c382U, 0x9999b029U, 0x2d2d775aU, 0x0f0f111eU,
     0xb0b0cb7bU, 0x5454fca8U, 0xbbbbd66dU, 0x16163a2cU,
 };
-static const u32 Te4[256] = {
-    0x63636363U, 0x7c7c7c7cU, 0x77777777U, 0x7b7b7b7bU,
-    0xf2f2f2f2U, 0x6b6b6b6bU, 0x6f6f6f6fU, 0xc5c5c5c5U,
-    0x30303030U, 0x01010101U, 0x67676767U, 0x2b2b2b2bU,
-    0xfefefefeU, 0xd7d7d7d7U, 0xababababU, 0x76767676U,
-    0xcacacacaU, 0x82828282U, 0xc9c9c9c9U, 0x7d7d7d7dU,
-    0xfafafafaU, 0x59595959U, 0x47474747U, 0xf0f0f0f0U,
-    0xadadadadU, 0xd4d4d4d4U, 0xa2a2a2a2U, 0xafafafafU,
-    0x9c9c9c9cU, 0xa4a4a4a4U, 0x72727272U, 0xc0c0c0c0U,
-    0xb7b7b7b7U, 0xfdfdfdfdU, 0x93939393U, 0x26262626U,
-    0x36363636U, 0x3f3f3f3fU, 0xf7f7f7f7U, 0xccccccccU,
-    0x34343434U, 0xa5a5a5a5U, 0xe5e5e5e5U, 0xf1f1f1f1U,
-    0x71717171U, 0xd8d8d8d8U, 0x31313131U, 0x15151515U,
-    0x04040404U, 0xc7c7c7c7U, 0x23232323U, 0xc3c3c3c3U,
-    0x18181818U, 0x96969696U, 0x05050505U, 0x9a9a9a9aU,
-    0x07070707U, 0x12121212U, 0x80808080U, 0xe2e2e2e2U,
-    0xebebebebU, 0x27272727U, 0xb2b2b2b2U, 0x75757575U,
-    0x09090909U, 0x83838383U, 0x2c2c2c2cU, 0x1a1a1a1aU,
-    0x1b1b1b1bU, 0x6e6e6e6eU, 0x5a5a5a5aU, 0xa0a0a0a0U,
-    0x52525252U, 0x3b3b3b3bU, 0xd6d6d6d6U, 0xb3b3b3b3U,
-    0x29292929U, 0xe3e3e3e3U, 0x2f2f2f2fU, 0x84848484U,
-    0x53535353U, 0xd1d1d1d1U, 0x00000000U, 0xededededU,
-    0x20202020U, 0xfcfcfcfcU, 0xb1b1b1b1U, 0x5b5b5b5bU,
-    0x6a6a6a6aU, 0xcbcbcbcbU, 0xbebebebeU, 0x39393939U,
-    0x4a4a4a4aU, 0x4c4c4c4cU, 0x58585858U, 0xcfcfcfcfU,
-    0xd0d0d0d0U, 0xefefefefU, 0xaaaaaaaaU, 0xfbfbfbfbU,
-    0x43434343U, 0x4d4d4d4dU, 0x33333333U, 0x85858585U,
-    0x45454545U, 0xf9f9f9f9U, 0x02020202U, 0x7f7f7f7fU,
-    0x50505050U, 0x3c3c3c3cU, 0x9f9f9f9fU, 0xa8a8a8a8U,
-    0x51515151U, 0xa3a3a3a3U, 0x40404040U, 0x8f8f8f8fU,
-    0x92929292U, 0x9d9d9d9dU, 0x38383838U, 0xf5f5f5f5U,
-    0xbcbcbcbcU, 0xb6b6b6b6U, 0xdadadadaU, 0x21212121U,
-    0x10101010U, 0xffffffffU, 0xf3f3f3f3U, 0xd2d2d2d2U,
-    0xcdcdcdcdU, 0x0c0c0c0cU, 0x13131313U, 0xececececU,
-    0x5f5f5f5fU, 0x97979797U, 0x44444444U, 0x17171717U,
-    0xc4c4c4c4U, 0xa7a7a7a7U, 0x7e7e7e7eU, 0x3d3d3d3dU,
-    0x64646464U, 0x5d5d5d5dU, 0x19191919U, 0x73737373U,
-    0x60606060U, 0x81818181U, 0x4f4f4f4fU, 0xdcdcdcdcU,
-    0x22222222U, 0x2a2a2a2aU, 0x90909090U, 0x88888888U,
-    0x46464646U, 0xeeeeeeeeU, 0xb8b8b8b8U, 0x14141414U,
-    0xdedededeU, 0x5e5e5e5eU, 0x0b0b0b0bU, 0xdbdbdbdbU,
-    0xe0e0e0e0U, 0x32323232U, 0x3a3a3a3aU, 0x0a0a0a0aU,
-    0x49494949U, 0x06060606U, 0x24242424U, 0x5c5c5c5cU,
-    0xc2c2c2c2U, 0xd3d3d3d3U, 0xacacacacU, 0x62626262U,
-    0x91919191U, 0x95959595U, 0xe4e4e4e4U, 0x79797979U,
-    0xe7e7e7e7U, 0xc8c8c8c8U, 0x37373737U, 0x6d6d6d6dU,
-    0x8d8d8d8dU, 0xd5d5d5d5U, 0x4e4e4e4eU, 0xa9a9a9a9U,
-    0x6c6c6c6cU, 0x56565656U, 0xf4f4f4f4U, 0xeaeaeaeaU,
-    0x65656565U, 0x7a7a7a7aU, 0xaeaeaeaeU, 0x08080808U,
-    0xbabababaU, 0x78787878U, 0x25252525U, 0x2e2e2e2eU,
-    0x1c1c1c1cU, 0xa6a6a6a6U, 0xb4b4b4b4U, 0xc6c6c6c6U,
-    0xe8e8e8e8U, 0xddddddddU, 0x74747474U, 0x1f1f1f1fU,
-    0x4b4b4b4bU, 0xbdbdbdbdU, 0x8b8b8b8bU, 0x8a8a8a8aU,
-    0x70707070U, 0x3e3e3e3eU, 0xb5b5b5b5U, 0x66666666U,
-    0x48484848U, 0x03030303U, 0xf6f6f6f6U, 0x0e0e0e0eU,
-    0x61616161U, 0x35353535U, 0x57575757U, 0xb9b9b9b9U,
-    0x86868686U, 0xc1c1c1c1U, 0x1d1d1d1dU, 0x9e9e9e9eU,
-    0xe1e1e1e1U, 0xf8f8f8f8U, 0x98989898U, 0x11111111U,
-    0x69696969U, 0xd9d9d9d9U, 0x8e8e8e8eU, 0x94949494U,
-    0x9b9b9b9bU, 0x1e1e1e1eU, 0x87878787U, 0xe9e9e9e9U,
-    0xcecececeU, 0x55555555U, 0x28282828U, 0xdfdfdfdfU,
-    0x8c8c8c8cU, 0xa1a1a1a1U, 0x89898989U, 0x0d0d0d0dU,
-    0xbfbfbfbfU, 0xe6e6e6e6U, 0x42424242U, 0x68686868U,
-    0x41414141U, 0x99999999U, 0x2d2d2d2dU, 0x0f0f0f0fU,
-    0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
-};
+
 static const u32 Td0[256] = {
     0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
     0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
@@ -540,7 +470,6 @@ static const u32 Td2[256] = {
     0xf4cd65daU, 0xbed50605U, 0x621fd134U, 0xfe8ac4a6U,
     0x539d342eU, 0x55a0a2f3U, 0xe132058aU, 0xeb75a4f6U,
     0xec390b83U, 0xefaa4060U, 0x9f065e71U, 0x1051bd6eU,
-
     0x8af93e21U, 0x063d96ddU, 0x05aedd3eU, 0xbd464de6U,
     0x8db59154U, 0x5d0571c4U, 0xd46f0406U, 0x15ff6050U,
     0xfb241998U, 0xe997d6bdU, 0x43cc8940U, 0x9e7767d9U,
@@ -652,71 +581,39 @@ static const u32 Td3[256] = {
     0xa8017139U, 0x0cb3de08U, 0xb4e49cd8U, 0x56c19064U,
     0xcb84617bU, 0x32b670d5U, 0x6c5c7448U, 0xb85742d0U,
 };
-static const u32 Td4[256] = {
-    0x52525252U, 0x09090909U, 0x6a6a6a6aU, 0xd5d5d5d5U,
-    0x30303030U, 0x36363636U, 0xa5a5a5a5U, 0x38383838U,
-    0xbfbfbfbfU, 0x40404040U, 0xa3a3a3a3U, 0x9e9e9e9eU,
-    0x81818181U, 0xf3f3f3f3U, 0xd7d7d7d7U, 0xfbfbfbfbU,
-    0x7c7c7c7cU, 0xe3e3e3e3U, 0x39393939U, 0x82828282U,
-    0x9b9b9b9bU, 0x2f2f2f2fU, 0xffffffffU, 0x87878787U,
-    0x34343434U, 0x8e8e8e8eU, 0x43434343U, 0x44444444U,
-    0xc4c4c4c4U, 0xdedededeU, 0xe9e9e9e9U, 0xcbcbcbcbU,
-    0x54545454U, 0x7b7b7b7bU, 0x94949494U, 0x32323232U,
-    0xa6a6a6a6U, 0xc2c2c2c2U, 0x23232323U, 0x3d3d3d3dU,
-    0xeeeeeeeeU, 0x4c4c4c4cU, 0x95959595U, 0x0b0b0b0bU,
-    0x42424242U, 0xfafafafaU, 0xc3c3c3c3U, 0x4e4e4e4eU,
-    0x08080808U, 0x2e2e2e2eU, 0xa1a1a1a1U, 0x66666666U,
-    0x28282828U, 0xd9d9d9d9U, 0x24242424U, 0xb2b2b2b2U,
-    0x76767676U, 0x5b5b5b5bU, 0xa2a2a2a2U, 0x49494949U,
-    0x6d6d6d6dU, 0x8b8b8b8bU, 0xd1d1d1d1U, 0x25252525U,
-    0x72727272U, 0xf8f8f8f8U, 0xf6f6f6f6U, 0x64646464U,
-    0x86868686U, 0x68686868U, 0x98989898U, 0x16161616U,
-    0xd4d4d4d4U, 0xa4a4a4a4U, 0x5c5c5c5cU, 0xccccccccU,
-    0x5d5d5d5dU, 0x65656565U, 0xb6b6b6b6U, 0x92929292U,
-    0x6c6c6c6cU, 0x70707070U, 0x48484848U, 0x50505050U,
-    0xfdfdfdfdU, 0xededededU, 0xb9b9b9b9U, 0xdadadadaU,
-    0x5e5e5e5eU, 0x15151515U, 0x46464646U, 0x57575757U,
-    0xa7a7a7a7U, 0x8d8d8d8dU, 0x9d9d9d9dU, 0x84848484U,
-    0x90909090U, 0xd8d8d8d8U, 0xababababU, 0x00000000U,
-    0x8c8c8c8cU, 0xbcbcbcbcU, 0xd3d3d3d3U, 0x0a0a0a0aU,
-    0xf7f7f7f7U, 0xe4e4e4e4U, 0x58585858U, 0x05050505U,
-    0xb8b8b8b8U, 0xb3b3b3b3U, 0x45454545U, 0x06060606U,
-    0xd0d0d0d0U, 0x2c2c2c2cU, 0x1e1e1e1eU, 0x8f8f8f8fU,
-    0xcacacacaU, 0x3f3f3f3fU, 0x0f0f0f0fU, 0x02020202U,
-    0xc1c1c1c1U, 0xafafafafU, 0xbdbdbdbdU, 0x03030303U,
-    0x01010101U, 0x13131313U, 0x8a8a8a8aU, 0x6b6b6b6bU,
-    0x3a3a3a3aU, 0x91919191U, 0x11111111U, 0x41414141U,
-    0x4f4f4f4fU, 0x67676767U, 0xdcdcdcdcU, 0xeaeaeaeaU,
-    0x97979797U, 0xf2f2f2f2U, 0xcfcfcfcfU, 0xcecececeU,
-    0xf0f0f0f0U, 0xb4b4b4b4U, 0xe6e6e6e6U, 0x73737373U,
-    0x96969696U, 0xacacacacU, 0x74747474U, 0x22222222U,
-    0xe7e7e7e7U, 0xadadadadU, 0x35353535U, 0x85858585U,
-    0xe2e2e2e2U, 0xf9f9f9f9U, 0x37373737U, 0xe8e8e8e8U,
-    0x1c1c1c1cU, 0x75757575U, 0xdfdfdfdfU, 0x6e6e6e6eU,
-    0x47474747U, 0xf1f1f1f1U, 0x1a1a1a1aU, 0x71717171U,
-    0x1d1d1d1dU, 0x29292929U, 0xc5c5c5c5U, 0x89898989U,
-    0x6f6f6f6fU, 0xb7b7b7b7U, 0x62626262U, 0x0e0e0e0eU,
-    0xaaaaaaaaU, 0x18181818U, 0xbebebebeU, 0x1b1b1b1bU,
-    0xfcfcfcfcU, 0x56565656U, 0x3e3e3e3eU, 0x4b4b4b4bU,
-    0xc6c6c6c6U, 0xd2d2d2d2U, 0x79797979U, 0x20202020U,
-    0x9a9a9a9aU, 0xdbdbdbdbU, 0xc0c0c0c0U, 0xfefefefeU,
-    0x78787878U, 0xcdcdcdcdU, 0x5a5a5a5aU, 0xf4f4f4f4U,
-    0x1f1f1f1fU, 0xddddddddU, 0xa8a8a8a8U, 0x33333333U,
-    0x88888888U, 0x07070707U, 0xc7c7c7c7U, 0x31313131U,
-    0xb1b1b1b1U, 0x12121212U, 0x10101010U, 0x59595959U,
-    0x27272727U, 0x80808080U, 0xececececU, 0x5f5f5f5fU,
-    0x60606060U, 0x51515151U, 0x7f7f7f7fU, 0xa9a9a9a9U,
-    0x19191919U, 0xb5b5b5b5U, 0x4a4a4a4aU, 0x0d0d0d0dU,
-    0x2d2d2d2dU, 0xe5e5e5e5U, 0x7a7a7a7aU, 0x9f9f9f9fU,
-    0x93939393U, 0xc9c9c9c9U, 0x9c9c9c9cU, 0xefefefefU,
-    0xa0a0a0a0U, 0xe0e0e0e0U, 0x3b3b3b3bU, 0x4d4d4d4dU,
-    0xaeaeaeaeU, 0x2a2a2a2aU, 0xf5f5f5f5U, 0xb0b0b0b0U,
-    0xc8c8c8c8U, 0xebebebebU, 0xbbbbbbbbU, 0x3c3c3c3cU,
-    0x83838383U, 0x53535353U, 0x99999999U, 0x61616161U,
-    0x17171717U, 0x2b2b2b2bU, 0x04040404U, 0x7e7e7e7eU,
-    0xbabababaU, 0x77777777U, 0xd6d6d6d6U, 0x26262626U,
-    0xe1e1e1e1U, 0x69696969U, 0x14141414U, 0x63636363U,
-    0x55555555U, 0x21212121U, 0x0c0c0c0cU, 0x7d7d7d7dU,
+static const u8 Td4[256] = {
+    0x52U, 0x09U, 0x6aU, 0xd5U, 0x30U, 0x36U, 0xa5U, 0x38U,
+    0xbfU, 0x40U, 0xa3U, 0x9eU, 0x81U, 0xf3U, 0xd7U, 0xfbU,
+    0x7cU, 0xe3U, 0x39U, 0x82U, 0x9bU, 0x2fU, 0xffU, 0x87U,
+    0x34U, 0x8eU, 0x43U, 0x44U, 0xc4U, 0xdeU, 0xe9U, 0xcbU,
+    0x54U, 0x7bU, 0x94U, 0x32U, 0xa6U, 0xc2U, 0x23U, 0x3dU,
+    0xeeU, 0x4cU, 0x95U, 0x0bU, 0x42U, 0xfaU, 0xc3U, 0x4eU,
+    0x08U, 0x2eU, 0xa1U, 0x66U, 0x28U, 0xd9U, 0x24U, 0xb2U,
+    0x76U, 0x5bU, 0xa2U, 0x49U, 0x6dU, 0x8bU, 0xd1U, 0x25U,
+    0x72U, 0xf8U, 0xf6U, 0x64U, 0x86U, 0x68U, 0x98U, 0x16U,
+    0xd4U, 0xa4U, 0x5cU, 0xccU, 0x5dU, 0x65U, 0xb6U, 0x92U,
+    0x6cU, 0x70U, 0x48U, 0x50U, 0xfdU, 0xedU, 0xb9U, 0xdaU,
+    0x5eU, 0x15U, 0x46U, 0x57U, 0xa7U, 0x8dU, 0x9dU, 0x84U,
+    0x90U, 0xd8U, 0xabU, 0x00U, 0x8cU, 0xbcU, 0xd3U, 0x0aU,
+    0xf7U, 0xe4U, 0x58U, 0x05U, 0xb8U, 0xb3U, 0x45U, 0x06U,
+    0xd0U, 0x2cU, 0x1eU, 0x8fU, 0xcaU, 0x3fU, 0x0fU, 0x02U,
+    0xc1U, 0xafU, 0xbdU, 0x03U, 0x01U, 0x13U, 0x8aU, 0x6bU,
+    0x3aU, 0x91U, 0x11U, 0x41U, 0x4fU, 0x67U, 0xdcU, 0xeaU,
+    0x97U, 0xf2U, 0xcfU, 0xceU, 0xf0U, 0xb4U, 0xe6U, 0x73U,
+    0x96U, 0xacU, 0x74U, 0x22U, 0xe7U, 0xadU, 0x35U, 0x85U,
+    0xe2U, 0xf9U, 0x37U, 0xe8U, 0x1cU, 0x75U, 0xdfU, 0x6eU,
+    0x47U, 0xf1U, 0x1aU, 0x71U, 0x1dU, 0x29U, 0xc5U, 0x89U,
+    0x6fU, 0xb7U, 0x62U, 0x0eU, 0xaaU, 0x18U, 0xbeU, 0x1bU,
+    0xfcU, 0x56U, 0x3eU, 0x4bU, 0xc6U, 0xd2U, 0x79U, 0x20U,
+    0x9aU, 0xdbU, 0xc0U, 0xfeU, 0x78U, 0xcdU, 0x5aU, 0xf4U,
+    0x1fU, 0xddU, 0xa8U, 0x33U, 0x88U, 0x07U, 0xc7U, 0x31U,
+    0xb1U, 0x12U, 0x10U, 0x59U, 0x27U, 0x80U, 0xecU, 0x5fU,
+    0x60U, 0x51U, 0x7fU, 0xa9U, 0x19U, 0xb5U, 0x4aU, 0x0dU,
+    0x2dU, 0xe5U, 0x7aU, 0x9fU, 0x93U, 0xc9U, 0x9cU, 0xefU,
+    0xa0U, 0xe0U, 0x3bU, 0x4dU, 0xaeU, 0x2aU, 0xf5U, 0xb0U,
+    0xc8U, 0xebU, 0xbbU, 0x3cU, 0x83U, 0x53U, 0x99U, 0x61U,
+    0x17U, 0x2bU, 0x04U, 0x7eU, 0xbaU, 0x77U, 0xd6U, 0x26U,
+    0xe1U, 0x69U, 0x14U, 0x63U, 0x55U, 0x21U, 0x0cU, 0x7dU,
 };
 static const u32 rcon[] = {
         0x01000000, 0x02000000, 0x04000000, 0x08000000,
@@ -756,10 +653,10 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
                 while (1) {
                         temp  = rk[3];
                         rk[4] = rk[0] ^
-                                (Te4[(temp >> 16) & 0xff] & 0xff000000) ^
-                                (Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
-                                (Te4[(temp      ) & 0xff] & 0x0000ff00) ^
-                                (Te4[(temp >> 24)       ] & 0x000000ff) ^
+                                (Te2[(temp >> 16) & 0xff] & 0xff000000) ^
+                                (Te3[(temp >>  8) & 0xff] & 0x00ff0000) ^
+                                (Te0[(temp      ) & 0xff] & 0x0000ff00) ^
+                                (Te1[(temp >> 24)       ] & 0x000000ff) ^
                                 rcon[i];
                         rk[5] = rk[1] ^ rk[4];
                         rk[6] = rk[2] ^ rk[5];
@@ -776,10 +673,10 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
                 while (1) {
                         temp = rk[ 5];
                         rk[ 6] = rk[ 0] ^
-                                (Te4[(temp >> 16) & 0xff] & 0xff000000) ^
-                                (Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
-                                (Te4[(temp      ) & 0xff] & 0x0000ff00) ^
-                                (Te4[(temp >> 24)       ] & 0x000000ff) ^
+                                (Te2[(temp >> 16) & 0xff] & 0xff000000) ^
+                                (Te3[(temp >>  8) & 0xff] & 0x00ff0000) ^
+                                (Te0[(temp      ) & 0xff] & 0x0000ff00) ^
+                                (Te1[(temp >> 24)       ] & 0x000000ff) ^
                                 rcon[i];
                         rk[ 7] = rk[ 1] ^ rk[ 6];
                         rk[ 8] = rk[ 2] ^ rk[ 7];
@@ -798,10 +695,10 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
                 while (1) {
                         temp = rk[ 7];
                         rk[ 8] = rk[ 0] ^
-                                (Te4[(temp >> 16) & 0xff] & 0xff000000) ^
-                                (Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
-                                (Te4[(temp      ) & 0xff] & 0x0000ff00) ^
-                                (Te4[(temp >> 24)       ] & 0x000000ff) ^
+                                (Te2[(temp >> 16) & 0xff] & 0xff000000) ^
+                                (Te3[(temp >>  8) & 0xff] & 0x00ff0000) ^
+                                (Te0[(temp      ) & 0xff] & 0x0000ff00) ^
+                                (Te1[(temp >> 24)       ] & 0x000000ff) ^
                                 rcon[i];
                         rk[ 9] = rk[ 1] ^ rk[ 8];
                         rk[10] = rk[ 2] ^ rk[ 9];
@@ -811,10 +708,10 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
                         }
                         temp = rk[11];
                         rk[12] = rk[ 4] ^
-                                (Te4[(temp >> 24)       ] & 0xff000000) ^
-                                (Te4[(temp >> 16) & 0xff] & 0x00ff0000) ^
-                                (Te4[(temp >>  8) & 0xff] & 0x0000ff00) ^
-                                (Te4[(temp      ) & 0xff] & 0x000000ff);
+                                (Te2[(temp >> 24)       ] & 0xff000000) ^
+                                (Te3[(temp >> 16) & 0xff] & 0x00ff0000) ^
+                                (Te0[(temp >>  8) & 0xff] & 0x0000ff00) ^
+                                (Te1[(temp      ) & 0xff] & 0x000000ff);
                         rk[13] = rk[ 5] ^ rk[12];
                         rk[14] = rk[ 6] ^ rk[13];
                         rk[15] = rk[ 7] ^ rk[14];
@@ -853,29 +750,30 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
         for (i = 1; i < (key->rounds); i++) {
                 rk += 4;
                 rk[0] =
-                        Td0[Te4[(rk[0] >> 24)       ] & 0xff] ^
-                        Td1[Te4[(rk[0] >> 16) & 0xff] & 0xff] ^
-                        Td2[Te4[(rk[0] >>  8) & 0xff] & 0xff] ^
-                        Td3[Te4[(rk[0]      ) & 0xff] & 0xff];
+                        Td0[Te1[(rk[0] >> 24)       ] & 0xff] ^
+                        Td1[Te1[(rk[0] >> 16) & 0xff] & 0xff] ^
+                        Td2[Te1[(rk[0] >>  8) & 0xff] & 0xff] ^
+                        Td3[Te1[(rk[0]      ) & 0xff] & 0xff];
                 rk[1] =
-                        Td0[Te4[(rk[1] >> 24)       ] & 0xff] ^
-                        Td1[Te4[(rk[1] >> 16) & 0xff] & 0xff] ^
-                        Td2[Te4[(rk[1] >>  8) & 0xff] & 0xff] ^
-                        Td3[Te4[(rk[1]      ) & 0xff] & 0xff];
+                        Td0[Te1[(rk[1] >> 24)       ] & 0xff] ^
+                        Td1[Te1[(rk[1] >> 16) & 0xff] & 0xff] ^
+                        Td2[Te1[(rk[1] >>  8) & 0xff] & 0xff] ^
+                        Td3[Te1[(rk[1]      ) & 0xff] & 0xff];
                 rk[2] =
-                        Td0[Te4[(rk[2] >> 24)       ] & 0xff] ^
-                        Td1[Te4[(rk[2] >> 16) & 0xff] & 0xff] ^
-                        Td2[Te4[(rk[2] >>  8) & 0xff] & 0xff] ^
-                        Td3[Te4[(rk[2]      ) & 0xff] & 0xff];
+                        Td0[Te1[(rk[2] >> 24)       ] & 0xff] ^
+                        Td1[Te1[(rk[2] >> 16) & 0xff] & 0xff] ^
+                        Td2[Te1[(rk[2] >>  8) & 0xff] & 0xff] ^
+                        Td3[Te1[(rk[2]      ) & 0xff] & 0xff];
                 rk[3] =
-                        Td0[Te4[(rk[3] >> 24)       ] & 0xff] ^
-                        Td1[Te4[(rk[3] >> 16) & 0xff] & 0xff] ^
-                        Td2[Te4[(rk[3] >>  8) & 0xff] & 0xff] ^
-                        Td3[Te4[(rk[3]      ) & 0xff] & 0xff];
+                        Td0[Te1[(rk[3] >> 24)       ] & 0xff] ^
+                        Td1[Te1[(rk[3] >> 16) & 0xff] & 0xff] ^
+                        Td2[Te1[(rk[3] >>  8) & 0xff] & 0xff] ^
+                        Td3[Te1[(rk[3]      ) & 0xff] & 0xff];
         }
         return 0;
 }
 
+#ifndef AES_ASM
 /*
  * Encrypt a single block
  * in and out can overlap
@@ -1038,31 +936,31 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
          * map cipher state to byte array block:
          */
         s0 =
-                (Te4[(t0 >> 24)       ] & 0xff000000) ^
-                (Te4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
-                (Te4[(t2 >>  8) & 0xff] & 0x0000ff00) ^
-                (Te4[(t3      ) & 0xff] & 0x000000ff) ^
+                (Te2[(t0 >> 24)       ] & 0xff000000) ^
+                (Te3[(t1 >> 16) & 0xff] & 0x00ff0000) ^
+                (Te0[(t2 >>  8) & 0xff] & 0x0000ff00) ^
+                (Te1[(t3      ) & 0xff] & 0x000000ff) ^
                 rk[0];
         PUTU32(out     , s0);
         s1 =
-                (Te4[(t1 >> 24)       ] & 0xff000000) ^
-                (Te4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
-                (Te4[(t3 >>  8) & 0xff] & 0x0000ff00) ^
-                (Te4[(t0      ) & 0xff] & 0x000000ff) ^
+                (Te2[(t1 >> 24)       ] & 0xff000000) ^
+                (Te3[(t2 >> 16) & 0xff] & 0x00ff0000) ^
+                (Te0[(t3 >>  8) & 0xff] & 0x0000ff00) ^
+                (Te1[(t0      ) & 0xff] & 0x000000ff) ^
                 rk[1];
         PUTU32(out +  4, s1);
         s2 =
-                (Te4[(t2 >> 24)       ] & 0xff000000) ^
-                (Te4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
-                (Te4[(t0 >>  8) & 0xff] & 0x0000ff00) ^
-                (Te4[(t1      ) & 0xff] & 0x000000ff) ^
+                (Te2[(t2 >> 24)       ] & 0xff000000) ^
+                (Te3[(t3 >> 16) & 0xff] & 0x00ff0000) ^
+                (Te0[(t0 >>  8) & 0xff] & 0x0000ff00) ^
+                (Te1[(t1      ) & 0xff] & 0x000000ff) ^
                 rk[2];
         PUTU32(out +  8, s2);
         s3 =
-                (Te4[(t3 >> 24)       ] & 0xff000000) ^
-                (Te4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
-                (Te4[(t1 >>  8) & 0xff] & 0x0000ff00) ^
-                (Te4[(t2      ) & 0xff] & 0x000000ff) ^
+                (Te2[(t3 >> 24)       ] & 0xff000000) ^
+                (Te3[(t0 >> 16) & 0xff] & 0x00ff0000) ^
+                (Te0[(t1 >>  8) & 0xff] & 0x0000ff00) ^
+                (Te1[(t2      ) & 0xff] & 0x000000ff) ^
                 rk[3];
         PUTU32(out + 12, s3);
 }
@@ -1229,33 +1127,33 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
          * map cipher state to byte array block:
          */
         s0 =
-                (Td4[(t0 >> 24)       ] & 0xff000000) ^
-                (Td4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
-                (Td4[(t2 >>  8) & 0xff] & 0x0000ff00) ^
-                (Td4[(t1      ) & 0xff] & 0x000000ff) ^
+                (Td4[(t0 >> 24)       ] << 24) ^
+                (Td4[(t3 >> 16) & 0xff] << 16) ^
+                (Td4[(t2 >>  8) & 0xff] <<  8) ^
+                (Td4[(t1      ) & 0xff])       ^
                 rk[0];
         PUTU32(out     , s0);
         s1 =
-                (Td4[(t1 >> 24)       ] & 0xff000000) ^
-                (Td4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
-                (Td4[(t3 >>  8) & 0xff] & 0x0000ff00) ^
-                (Td4[(t2      ) & 0xff] & 0x000000ff) ^
+                (Td4[(t1 >> 24)       ] << 24) ^
+                (Td4[(t0 >> 16) & 0xff] << 16) ^
+                (Td4[(t3 >>  8) & 0xff] <<  8) ^
+                (Td4[(t2      ) & 0xff])       ^
                 rk[1];
         PUTU32(out +  4, s1);
         s2 =
-                (Td4[(t2 >> 24)       ] & 0xff000000) ^
-                (Td4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
-                (Td4[(t0 >>  8) & 0xff] & 0x0000ff00) ^
-                (Td4[(t3      ) & 0xff] & 0x000000ff) ^
+                (Td4[(t2 >> 24)       ] << 24) ^
+                (Td4[(t1 >> 16) & 0xff] << 16) ^
+                (Td4[(t0 >>  8) & 0xff] <<  8) ^
+                (Td4[(t3      ) & 0xff])       ^
                 rk[2];
         PUTU32(out +  8, s2);
         s3 =
-                (Td4[(t3 >> 24)       ] & 0xff000000) ^
-                (Td4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
-                (Td4[(t1 >>  8) & 0xff] & 0x0000ff00) ^
-                (Td4[(t0      ) & 0xff] & 0x000000ff) ^
+                (Td4[(t3 >> 24)       ] << 24) ^
+                (Td4[(t2 >> 16) & 0xff] << 16) ^
+                (Td4[(t1 >>  8) & 0xff] <<  8) ^
+                (Td4[(t0      ) & 0xff])       ^
                 rk[3];
         PUTU32(out + 12, s3);
 }
 
-#endif /* ndef OPENSSL_FIPS */
+#endif /* AES_ASM */
diff --git a/src/lib/libssl/src/crypto/aes/aes_locl.h b/src/lib/libssl/src/crypto/aes/aes_locl.h
index 4184729e34..054b442d41 100644
--- a/src/lib/libssl/src/crypto/aes/aes_locl.h
+++ b/src/lib/libssl/src/crypto/aes/aes_locl.h
@@ -62,7 +62,7 @@
 #include <stdlib.h>
 #include <string.h>
 
-#if defined(_MSC_VER) && !defined(_M_IA64) && !defined(OPENSSL_SYS_WINCE)
+#if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_AMD64) || defined(_M_X64))
 # define SWAP(x) (_lrotl(x, 8) & 0x00ff00ff | _lrotr(x, 8) & 0xff00ff00)
 # define GETU32(p) SWAP(*((u32 *)(p)))
 # define PUTU32(ct, st) { *((u32 *)(ct)) = SWAP((st)); }
@@ -71,7 +71,11 @@
 # define PUTU32(ct, st) { (ct)[0] = (u8)((st) >> 24); (ct)[1] = (u8)((st) >> 16); (ct)[2] = (u8)((st) >>  8); (ct)[3] = (u8)(st); }
 #endif
 
+#ifdef AES_LONG
 typedef unsigned long u32;
+#else
+typedef unsigned int u32;
+#endif
 typedef unsigned short u16;
 typedef unsigned char u8;
 
diff --git a/src/lib/libssl/src/crypto/aes/aes_misc.c b/src/lib/libssl/src/crypto/aes/aes_misc.c
index 090def25d5..4fead1b4c7 100644
--- a/src/lib/libssl/src/crypto/aes/aes_misc.c
+++ b/src/lib/libssl/src/crypto/aes/aes_misc.c
@@ -53,7 +53,7 @@
 #include <openssl/aes.h>
 #include "aes_locl.h"
 
-const char *AES_version="AES" OPENSSL_VERSION_PTEXT;
+const char AES_version[]="AES" OPENSSL_VERSION_PTEXT;
 
 const char *AES_options(void) {
 #ifdef FULL_UNROLL
diff --git a/src/lib/libssl/src/crypto/aes/asm/aes-586.pl b/src/lib/libssl/src/crypto/aes/asm/aes-586.pl
index 688fda21ff..89fa261794 100644
--- a/src/lib/libssl/src/crypto/aes/asm/aes-586.pl
+++ b/src/lib/libssl/src/crypto/aes/asm/aes-586.pl
@@ -6,7 +6,7 @@
 # forms are granted according to the OpenSSL license.
 # ====================================================================
 #
-# Version 2.0.
+# Version 3.6.
 #
 # You might fail to appreciate this module performance from the first
 # try. If compared to "vanilla" linux-ia32-icc target, i.e. considered
@@ -46,43 +46,68 @@
 # Instruction Level Parallelism, and it indeed resulted in up to 15%
 # better performance on most recent µ-archs...
 #
-# Current ECB performance numbers for 128-bit key in cycles per byte
-# [measure commonly used by AES benchmarkers] are:
+# Third version adds AES_cbc_encrypt implementation, which resulted in
+# up to 40% performance imrovement of CBC benchmark results. 40% was
+# observed on P4 core, where "overall" imrovement coefficient, i.e. if
+# compared to PIC generated by GCC and in CBC mode, was observed to be
+# as large as 4x:-) CBC performance is virtually identical to ECB now
+# and on some platforms even better, e.g. 17.6 "small" cycles/byte on
+# Opteron, because certain function prologues and epilogues are
+# effectively taken out of the loop...
 #
-#               small footprint         fully unrolled
-# P4[-3]        23[24]                  22[23]
-# AMD K8        19                      18
-# PIII          26(*)                   23
-# Pentium       63(*)                   52
+# Version 3.2 implements compressed tables and prefetch of these tables
+# in CBC[!] mode. Former means that 3/4 of table references are now
+# misaligned, which unfortunately has negative impact on elder IA-32
+# implementations, Pentium suffered 30% penalty, PIII - 10%.
+#
+# Version 3.3 avoids L1 cache aliasing between stack frame and
+# S-boxes, and 3.4 - L1 cache aliasing even between key schedule. The
+# latter is achieved by copying the key schedule to controlled place in
+# stack. This unfortunately has rather strong impact on small block CBC
+# performance, ~2x deterioration on 16-byte block if compared to 3.3.
+#
+# Version 3.5 checks if there is L1 cache aliasing between user-supplied
+# key schedule and S-boxes and abstains from copying the former if
+# there is no. This allows end-user to consciously retain small block
+# performance by aligning key schedule in specific manner.
 #
-# (*)   Performance difference between small footprint code and fully
-#       unrolled in more commonly used CBC mode is not as big, 7% for
-#       PIII and 15% for Pentium, which I consider tolerable.
+# Version 3.6 compresses Td4 to 256 bytes and prefetches it in ECB.
+#
+# Current ECB performance numbers for 128-bit key in CPU cycles per
+# processed byte [measure commonly used by AES benchmarkers] are:
+#
+#               small footprint         fully unrolled
+# P4            24                      22
+# AMD K8        20                      19
+# PIII          25                      23
+# Pentium       81                      78
 
 push(@INC,"perlasm","../../perlasm");
 require "x86asm.pl";
 
 &asm_init($ARGV[0],"aes-586.pl",$ARGV[$#ARGV] eq "386");
 
-$small_footprint=1;     # $small_footprint=1 code is ~5% slower [on
-                        # recent µ-archs], but ~5 times smaller!
-                        # I favor compact code, because it minimizes
-                        # cache contention...
-$vertical_spin=0;       # shift "verticaly" defaults to 0, because of
-                        # its proof-of-concept status, see below...
-
 $s0="eax";
 $s1="ebx";
 $s2="ecx";
 $s3="edx";
-$key="esi";
-$acc="edi";
+$key="edi";
+$acc="esi";
+
+$compromise=0;          # $compromise=128 abstains from copying key
+                        # schedule to stack when encrypting inputs
+                        # shorter than 128 bytes at the cost of
+                        # risksing aliasing with S-boxes. In return
+                        # you get way better, up to +70%, small block
+                        # performance.
+$small_footprint=1;     # $small_footprint=1 code is ~5% slower [on
+                        # recent µ-archs], but ~5 times smaller!
+                        # I favor compact code to minimize cache
+                        # contention and in hope to "collect" 5% back
+                        # in real-life applications...
+$vertical_spin=0;       # shift "verticaly" defaults to 0, because of
+                        # its proof-of-concept status...
 
-if ($vertical_spin) {
-        # I need high parts of volatile registers to be accessible...
-        $s1="esi";      $key="ebx";
-        $s2="edi";      $acc="ecx";
-}
 # Note that there is no decvert(), as well as last encryption round is
 # performed with "horizontal" shifts. This is because this "vertical"
 # implementation [one which groups shifts on a given $s[i] to form a
@@ -98,55 +123,55 @@ sub encvert()
   my $v0 = $acc, $v1 = $key;
 
         &mov    ($v0,$s[3]);                            # copy s3
-        &mov    (&DWP(0,"esp"),$s[2]);                  # save s2
+        &mov    (&DWP(4,"esp"),$s[2]);                  # save s2
         &mov    ($v1,$s[0]);                            # copy s0
-        &mov    (&DWP(4,"esp"),$s[1]);                  # save s1
+        &mov    (&DWP(8,"esp"),$s[1]);                  # save s1
 
         &movz   ($s[2],&HB($s[0]));
         &and    ($s[0],0xFF);
-        &mov    ($s[0],&DWP(1024*0,$te,$s[0],4));       # s0>>0
+        &mov    ($s[0],&DWP(0,$te,$s[0],8));            # s0>>0
         &shr    ($v1,16);
-        &mov    ($s[3],&DWP(1024*1,$te,$s[2],4));       # s0>>8
+        &mov    ($s[3],&DWP(3,$te,$s[2],8));            # s0>>8
         &movz   ($s[1],&HB($v1));
         &and    ($v1,0xFF);
-        &mov    ($s[2],&DWP(1024*2,$te,$v1,4));         # s0>>16
+        &mov    ($s[2],&DWP(2,$te,$v1,8));              # s0>>16
          &mov   ($v1,$v0);
-        &mov    ($s[1],&DWP(1024*3,$te,$s[1],4));       # s0>>24
+        &mov    ($s[1],&DWP(1,$te,$s[1],8));            # s0>>24
 
         &and    ($v0,0xFF);
-        &xor    ($s[3],&DWP(1024*0,$te,$v0,4));         # s3>>0
+        &xor    ($s[3],&DWP(0,$te,$v0,8));              # s3>>0
         &movz   ($v0,&HB($v1));
         &shr    ($v1,16);
-        &xor    ($s[2],&DWP(1024*1,$te,$v0,4));         # s3>>8
+        &xor    ($s[2],&DWP(3,$te,$v0,8));              # s3>>8
         &movz   ($v0,&HB($v1));
         &and    ($v1,0xFF);
-        &xor    ($s[1],&DWP(1024*2,$te,$v1,4));         # s3>>16
-         &mov   ($v1,&DWP(0,"esp"));                    # restore s2
-        &xor    ($s[0],&DWP(1024*3,$te,$v0,4));         # s3>>24
+        &xor    ($s[1],&DWP(2,$te,$v1,8));              # s3>>16
+         &mov   ($v1,&DWP(4,"esp"));                    # restore s2
+        &xor    ($s[0],&DWP(1,$te,$v0,8));              # s3>>24
 
         &mov    ($v0,$v1);
         &and    ($v1,0xFF);
-        &xor    ($s[2],&DWP(1024*0,$te,$v1,4));         # s2>>0
+        &xor    ($s[2],&DWP(0,$te,$v1,8));              # s2>>0
         &movz   ($v1,&HB($v0));
         &shr    ($v0,16);
-        &xor    ($s[1],&DWP(1024*1,$te,$v1,4));         # s2>>8
+        &xor    ($s[1],&DWP(3,$te,$v1,8));              # s2>>8
         &movz   ($v1,&HB($v0));
         &and    ($v0,0xFF);
-        &xor    ($s[0],&DWP(1024*2,$te,$v0,4));         # s2>>16
-         &mov   ($v0,&DWP(4,"esp"));                    # restore s1
-        &xor    ($s[3],&DWP(1024*3,$te,$v1,4));         # s2>>24
+        &xor    ($s[0],&DWP(2,$te,$v0,8));              # s2>>16
+         &mov   ($v0,&DWP(8,"esp"));                    # restore s1
+        &xor    ($s[3],&DWP(1,$te,$v1,8));              # s2>>24
 
         &mov    ($v1,$v0);
         &and    ($v0,0xFF);
-        &xor    ($s[1],&DWP(1024*0,$te,$v0,4));         # s1>>0
+        &xor    ($s[1],&DWP(0,$te,$v0,8));              # s1>>0
         &movz   ($v0,&HB($v1));
         &shr    ($v1,16);
-        &xor    ($s[0],&DWP(1024*1,$te,$v0,4));         # s1>>8
+        &xor    ($s[0],&DWP(3,$te,$v0,8));              # s1>>8
         &movz   ($v0,&HB($v1));
         &and    ($v1,0xFF);
-        &xor    ($s[3],&DWP(1024*2,$te,$v1,4));         # s1>>16
+        &xor    ($s[3],&DWP(2,$te,$v1,8));              # s1>>16
          &mov   ($key,&DWP(12,"esp"));                  # reincarnate v1 as key
-        &xor    ($s[2],&DWP(1024*3,$te,$v0,4));         # s1>>24
+        &xor    ($s[2],&DWP(1,$te,$v0,8));              # s1>>24
 }
 
 sub encstep()
@@ -160,25 +185,25 @@ sub encstep()
                         &and    ($out,0xFF);                    }
         if ($i==1)  {   &shr    ($s[0],16);                     }#%ebx[1]
         if ($i==2)  {   &shr    ($s[0],24);                     }#%ecx[2]
-                        &mov    ($out,&DWP(1024*0,$te,$out,4));
+                        &mov    ($out,&DWP(0,$te,$out,8));
 
         if ($i==3)  {   $tmp=$s[1];                             }##%eax
                         &movz   ($tmp,&HB($s[1]));
-                        &xor    ($out,&DWP(1024*1,$te,$tmp,4));
+                        &xor    ($out,&DWP(3,$te,$tmp,8));
 
-        if ($i==3)  {   $tmp=$s[2]; &mov ($s[1],&DWP(0,"esp")); }##%ebx
+        if ($i==3)  {   $tmp=$s[2]; &mov ($s[1],&DWP(4,"esp")); }##%ebx
         else        {   &mov    ($tmp,$s[2]);
                         &shr    ($tmp,16);                      }
         if ($i==2)  {   &and    ($s[1],0xFF);                   }#%edx[2]
                         &and    ($tmp,0xFF);
-                        &xor    ($out,&DWP(1024*2,$te,$tmp,4));
+                        &xor    ($out,&DWP(2,$te,$tmp,8));
 
-        if ($i==3)  {   $tmp=$s[3]; &mov ($s[2],&DWP(4,"esp")); }##%ecx
+        if ($i==3)  {   $tmp=$s[3]; &mov ($s[2],&DWP(8,"esp")); }##%ecx
         elsif($i==2){   &movz   ($tmp,&HB($s[3]));              }#%ebx[2]
         else        {   &mov    ($tmp,$s[3]); 
                         &shr    ($tmp,24)                       }
-                        &xor    ($out,&DWP(1024*3,$te,$tmp,4));
-        if ($i<2)   {   &mov    (&DWP(4*$i,"esp"),$out);        }
+                        &xor    ($out,&DWP(1,$te,$tmp,8));
+        if ($i<2)   {   &mov    (&DWP(4+4*$i,"esp"),$out);      }
         if ($i==3)  {   &mov    ($s[3],$acc);                   }
                         &comment();
 }
@@ -193,60 +218,49 @@ sub enclast()
                         &and    ($out,0xFF);
         if ($i==1)  {   &shr    ($s[0],16);                     }#%ebx[1]
         if ($i==2)  {   &shr    ($s[0],24);                     }#%ecx[2]
-                        &mov    ($out,&DWP(1024*0,$te,$out,4));
+                        &mov    ($out,&DWP(2,$te,$out,8));
                         &and    ($out,0x000000ff);
 
         if ($i==3)  {   $tmp=$s[1];                             }##%eax
                         &movz   ($tmp,&HB($s[1]));
-                        &mov    ($tmp,&DWP(0,$te,$tmp,4));
+                        &mov    ($tmp,&DWP(0,$te,$tmp,8));
                         &and    ($tmp,0x0000ff00);
                         &xor    ($out,$tmp);
 
-        if ($i==3)  {   $tmp=$s[2]; &mov ($s[1],&DWP(0,"esp")); }##%ebx
+        if ($i==3)  {   $tmp=$s[2]; &mov ($s[1],&DWP(4,"esp")); }##%ebx
         else        {   mov     ($tmp,$s[2]);
                         &shr    ($tmp,16);                      }
         if ($i==2)  {   &and    ($s[1],0xFF);                   }#%edx[2]
                         &and    ($tmp,0xFF);
-                        &mov    ($tmp,&DWP(0,$te,$tmp,4));
+                        &mov    ($tmp,&DWP(0,$te,$tmp,8));
                         &and    ($tmp,0x00ff0000);
                         &xor    ($out,$tmp);
 
-        if ($i==3)  {   $tmp=$s[3]; &mov ($s[2],&DWP(4,"esp")); }##%ecx
+        if ($i==3)  {   $tmp=$s[3]; &mov ($s[2],&DWP(8,"esp")); }##%ecx
         elsif($i==2){   &movz   ($tmp,&HB($s[3]));              }#%ebx[2]
         else        {   &mov    ($tmp,$s[3]);
                         &shr    ($tmp,24);                      }
-                        &mov    ($tmp,&DWP(0,$te,$tmp,4));
+                        &mov    ($tmp,&DWP(2,$te,$tmp,8));
                         &and    ($tmp,0xff000000);
                         &xor    ($out,$tmp);
-        if ($i<2)   {   &mov    (&DWP(4*$i,"esp"),$out);        }
+        if ($i<2)   {   &mov    (&DWP(4+4*$i,"esp"),$out);      }
         if ($i==3)  {   &mov    ($s[3],$acc);                   }
 }
 
-# void AES_encrypt (const void *inp,void *out,const AES_KEY *key);
-&public_label("AES_Te");
-&function_begin("AES_encrypt");
-        &mov    ($acc,&wparam(0));              # load inp
-        &mov    ($key,&wparam(2));              # load key
-
-        &call   (&label("pic_point"));          # make it PIC!
-        &set_label("pic_point");
-        &blindpop("ebp");
-        &lea    ("ebp",&DWP(&label("AES_Te")."-".&label("pic_point"),"ebp"));
+sub _data_word() { my $i; while(defined($i=shift)) { &data_word($i,$i); } }
 
-        # allocate aligned stack frame
-        &mov    ($s0,"esp");
-        &sub    ("esp",20);
-        &and    ("esp",-16);
+&public_label("AES_Te");
+&function_begin_B("_x86_AES_encrypt");
+        if ($vertical_spin) {
+                # I need high parts of volatile registers to be accessible...
+                &exch   ($s1="edi",$key="ebx");
+                &mov    ($s2="esi",$acc="ecx");
+        }
 
+        # note that caller is expected to allocate stack frame for me!
         &mov    (&DWP(12,"esp"),$key);          # save key
-        &mov    (&DWP(16,"esp"),$s0);           # save %esp
 
-        &mov    ($s0,&DWP(0,$acc));             # load input data
-        &mov    ($s1,&DWP(4,$acc));
-        &mov    ($s2,&DWP(8,$acc));
-        &mov    ($s3,&DWP(12,$acc));
-
-        &xor    ($s0,&DWP(0,$key));
+        &xor    ($s0,&DWP(0,$key));             # xor with key
         &xor    ($s1,&DWP(4,$key));
         &xor    ($s2,&DWP(8,$key));
         &xor    ($s3,&DWP(12,$key));
@@ -256,7 +270,7 @@ sub enclast()
         if ($small_footprint) {
             &lea        ($acc,&DWP(-2,$acc,$acc));
             &lea        ($acc,&DWP(0,$key,$acc,8));
-            &mov        (&DWP(8,"esp"),$acc);   # end of key schedule
+            &mov        (&DWP(16,"esp"),$acc);  # end of key schedule
             &align      (4);
             &set_label("loop");
                 if ($vertical_spin) {
@@ -267,12 +281,12 @@ sub enclast()
                     &encstep(2,"ebp",$s2,$s3,$s0,$s1);
                     &encstep(3,"ebp",$s3,$s0,$s1,$s2);
                 }
-                &add    ($key,16);                      # advance rd_key
+                &add    ($key,16);              # advance rd_key
                 &xor    ($s0,&DWP(0,$key));
                 &xor    ($s1,&DWP(4,$key));
                 &xor    ($s2,&DWP(8,$key));
                 &xor    ($s3,&DWP(12,$key));
-            &cmp        ($key,&DWP(8,"esp"));
+            &cmp        ($key,&DWP(16,"esp"));
             &mov        (&DWP(12,"esp"),$key);
             &jb         (&label("loop"));
         }
@@ -298,7 +312,7 @@ sub enclast()
                 &xor    ($s3,&DWP(16*$i+12,$key));
             }
             &add        ($key,32);
-            &mov        (&DWP(12,"esp"),$key);          # advance rd_key
+            &mov        (&DWP(12,"esp"),$key);  # advance rd_key
         &set_label("12rounds");
             for ($i=1;$i<3;$i++) {
                 if ($vertical_spin) {
@@ -315,7 +329,7 @@ sub enclast()
                 &xor    ($s3,&DWP(16*$i+12,$key));
             }
             &add        ($key,32);
-            &mov        (&DWP(12,"esp"),$key);          # advance rd_key
+            &mov        (&DWP(12,"esp"),$key);  # advance rd_key
         &set_label("10rounds");
             for ($i=1;$i<10;$i++) {
                 if ($vertical_spin) {
@@ -333,375 +347,129 @@ sub enclast()
             }
         }
 
-        &add    ("ebp",4*1024);                 # skip to Te4
         if ($vertical_spin) {
             # "reincarnate" some registers for "horizontal" spin...
-            &mov        ($s1="ebx",$key="esi");
-            &mov        ($s2="ecx",$acc="edi");
+            &mov        ($s1="ebx",$key="edi");
+            &mov        ($s2="ecx",$acc="esi");
         }
         &enclast(0,"ebp",$s0,$s1,$s2,$s3);
         &enclast(1,"ebp",$s1,$s2,$s3,$s0);
         &enclast(2,"ebp",$s2,$s3,$s0,$s1);
         &enclast(3,"ebp",$s3,$s0,$s1,$s2);
 
-        &mov    ("esp",&DWP(16,"esp"));         # restore %esp
         &add    ($key,$small_footprint?16:160);
         &xor    ($s0,&DWP(0,$key));
         &xor    ($s1,&DWP(4,$key));
         &xor    ($s2,&DWP(8,$key));
         &xor    ($s3,&DWP(12,$key));
 
-        &mov    ($acc,&wparam(1));              # load out
-        &mov    (&DWP(0,$acc),$s0);             # write output data
-        &mov    (&DWP(4,$acc),$s1);
-        &mov    (&DWP(8,$acc),$s2);
-        &mov    (&DWP(12,$acc),$s3);
-
-        &pop    ("edi");
-        &pop    ("esi");
-        &pop    ("ebx");
-        &pop    ("ebp");
         &ret    ();
 
 &set_label("AES_Te",64);        # Yes! I keep it in the code segment!
-        &data_word(0xa56363c6, 0x847c7cf8, 0x997777ee, 0x8d7b7bf6);
-        &data_word(0x0df2f2ff, 0xbd6b6bd6, 0xb16f6fde, 0x54c5c591);
-        &data_word(0x50303060, 0x03010102, 0xa96767ce, 0x7d2b2b56);
-        &data_word(0x19fefee7, 0x62d7d7b5, 0xe6abab4d, 0x9a7676ec);
-        &data_word(0x45caca8f, 0x9d82821f, 0x40c9c989, 0x877d7dfa);
-        &data_word(0x15fafaef, 0xeb5959b2, 0xc947478e, 0x0bf0f0fb);
-        &data_word(0xecadad41, 0x67d4d4b3, 0xfda2a25f, 0xeaafaf45);
-        &data_word(0xbf9c9c23, 0xf7a4a453, 0x967272e4, 0x5bc0c09b);
-        &data_word(0xc2b7b775, 0x1cfdfde1, 0xae93933d, 0x6a26264c);
-        &data_word(0x5a36366c, 0x413f3f7e, 0x02f7f7f5, 0x4fcccc83);
-        &data_word(0x5c343468, 0xf4a5a551, 0x34e5e5d1, 0x08f1f1f9);
-        &data_word(0x937171e2, 0x73d8d8ab, 0x53313162, 0x3f15152a);
-        &data_word(0x0c040408, 0x52c7c795, 0x65232346, 0x5ec3c39d);
-        &data_word(0x28181830, 0xa1969637, 0x0f05050a, 0xb59a9a2f);
-        &data_word(0x0907070e, 0x36121224, 0x9b80801b, 0x3de2e2df);
-        &data_word(0x26ebebcd, 0x6927274e, 0xcdb2b27f, 0x9f7575ea);
-        &data_word(0x1b090912, 0x9e83831d, 0x742c2c58, 0x2e1a1a34);
-        &data_word(0x2d1b1b36, 0xb26e6edc, 0xee5a5ab4, 0xfba0a05b);
-        &data_word(0xf65252a4, 0x4d3b3b76, 0x61d6d6b7, 0xceb3b37d);
-        &data_word(0x7b292952, 0x3ee3e3dd, 0x712f2f5e, 0x97848413);
-        &data_word(0xf55353a6, 0x68d1d1b9, 0x00000000, 0x2cededc1);
-        &data_word(0x60202040, 0x1ffcfce3, 0xc8b1b179, 0xed5b5bb6);
-        &data_word(0xbe6a6ad4, 0x46cbcb8d, 0xd9bebe67, 0x4b393972);
-        &data_word(0xde4a4a94, 0xd44c4c98, 0xe85858b0, 0x4acfcf85);
-        &data_word(0x6bd0d0bb, 0x2aefefc5, 0xe5aaaa4f, 0x16fbfbed);
-        &data_word(0xc5434386, 0xd74d4d9a, 0x55333366, 0x94858511);
-        &data_word(0xcf45458a, 0x10f9f9e9, 0x06020204, 0x817f7ffe);
-        &data_word(0xf05050a0, 0x443c3c78, 0xba9f9f25, 0xe3a8a84b);
-        &data_word(0xf35151a2, 0xfea3a35d, 0xc0404080, 0x8a8f8f05);
-        &data_word(0xad92923f, 0xbc9d9d21, 0x48383870, 0x04f5f5f1);
-        &data_word(0xdfbcbc63, 0xc1b6b677, 0x75dadaaf, 0x63212142);
-        &data_word(0x30101020, 0x1affffe5, 0x0ef3f3fd, 0x6dd2d2bf);
-        &data_word(0x4ccdcd81, 0x140c0c18, 0x35131326, 0x2fececc3);
-        &data_word(0xe15f5fbe, 0xa2979735, 0xcc444488, 0x3917172e);
-        &data_word(0x57c4c493, 0xf2a7a755, 0x827e7efc, 0x473d3d7a);
-        &data_word(0xac6464c8, 0xe75d5dba, 0x2b191932, 0x957373e6);
-        &data_word(0xa06060c0, 0x98818119, 0xd14f4f9e, 0x7fdcdca3);
-        &data_word(0x66222244, 0x7e2a2a54, 0xab90903b, 0x8388880b);
-        &data_word(0xca46468c, 0x29eeeec7, 0xd3b8b86b, 0x3c141428);
-        &data_word(0x79dedea7, 0xe25e5ebc, 0x1d0b0b16, 0x76dbdbad);
-        &data_word(0x3be0e0db, 0x56323264, 0x4e3a3a74, 0x1e0a0a14);
-        &data_word(0xdb494992, 0x0a06060c, 0x6c242448, 0xe45c5cb8);
-        &data_word(0x5dc2c29f, 0x6ed3d3bd, 0xefacac43, 0xa66262c4);
-        &data_word(0xa8919139, 0xa4959531, 0x37e4e4d3, 0x8b7979f2);
-        &data_word(0x32e7e7d5, 0x43c8c88b, 0x5937376e, 0xb76d6dda);
-        &data_word(0x8c8d8d01, 0x64d5d5b1, 0xd24e4e9c, 0xe0a9a949);
-        &data_word(0xb46c6cd8, 0xfa5656ac, 0x07f4f4f3, 0x25eaeacf);
-        &data_word(0xaf6565ca, 0x8e7a7af4, 0xe9aeae47, 0x18080810);
-        &data_word(0xd5baba6f, 0x887878f0, 0x6f25254a, 0x722e2e5c);
-        &data_word(0x241c1c38, 0xf1a6a657, 0xc7b4b473, 0x51c6c697);
-        &data_word(0x23e8e8cb, 0x7cdddda1, 0x9c7474e8, 0x211f1f3e);
-        &data_word(0xdd4b4b96, 0xdcbdbd61, 0x868b8b0d, 0x858a8a0f);
-        &data_word(0x907070e0, 0x423e3e7c, 0xc4b5b571, 0xaa6666cc);
-        &data_word(0xd8484890, 0x05030306, 0x01f6f6f7, 0x120e0e1c);
-        &data_word(0xa36161c2, 0x5f35356a, 0xf95757ae, 0xd0b9b969);
-        &data_word(0x91868617, 0x58c1c199, 0x271d1d3a, 0xb99e9e27);
-        &data_word(0x38e1e1d9, 0x13f8f8eb, 0xb398982b, 0x33111122);
-        &data_word(0xbb6969d2, 0x70d9d9a9, 0x898e8e07, 0xa7949433);
-        &data_word(0xb69b9b2d, 0x221e1e3c, 0x92878715, 0x20e9e9c9);
-        &data_word(0x49cece87, 0xff5555aa, 0x78282850, 0x7adfdfa5);
-        &data_word(0x8f8c8c03, 0xf8a1a159, 0x80898909, 0x170d0d1a);
-        &data_word(0xdabfbf65, 0x31e6e6d7, 0xc6424284, 0xb86868d0);
-        &data_word(0xc3414182, 0xb0999929, 0x772d2d5a, 0x110f0f1e);
-        &data_word(0xcbb0b07b, 0xfc5454a8, 0xd6bbbb6d, 0x3a16162c);
-#Te1:
-        &data_word(0x6363c6a5, 0x7c7cf884, 0x7777ee99, 0x7b7bf68d);
-        &data_word(0xf2f2ff0d, 0x6b6bd6bd, 0x6f6fdeb1, 0xc5c59154);
-        &data_word(0x30306050, 0x01010203, 0x6767cea9, 0x2b2b567d);
-        &data_word(0xfefee719, 0xd7d7b562, 0xabab4de6, 0x7676ec9a);
-        &data_word(0xcaca8f45, 0x82821f9d, 0xc9c98940, 0x7d7dfa87);
-        &data_word(0xfafaef15, 0x5959b2eb, 0x47478ec9, 0xf0f0fb0b);
-        &data_word(0xadad41ec, 0xd4d4b367, 0xa2a25ffd, 0xafaf45ea);
-        &data_word(0x9c9c23bf, 0xa4a453f7, 0x7272e496, 0xc0c09b5b);
-        &data_word(0xb7b775c2, 0xfdfde11c, 0x93933dae, 0x26264c6a);
-        &data_word(0x36366c5a, 0x3f3f7e41, 0xf7f7f502, 0xcccc834f);
-        &data_word(0x3434685c, 0xa5a551f4, 0xe5e5d134, 0xf1f1f908);
-        &data_word(0x7171e293, 0xd8d8ab73, 0x31316253, 0x15152a3f);
-        &data_word(0x0404080c, 0xc7c79552, 0x23234665, 0xc3c39d5e);
-        &data_word(0x18183028, 0x969637a1, 0x05050a0f, 0x9a9a2fb5);
-        &data_word(0x07070e09, 0x12122436, 0x80801b9b, 0xe2e2df3d);
-        &data_word(0xebebcd26, 0x27274e69, 0xb2b27fcd, 0x7575ea9f);
-        &data_word(0x0909121b, 0x83831d9e, 0x2c2c5874, 0x1a1a342e);
-        &data_word(0x1b1b362d, 0x6e6edcb2, 0x5a5ab4ee, 0xa0a05bfb);
-        &data_word(0x5252a4f6, 0x3b3b764d, 0xd6d6b761, 0xb3b37dce);
-        &data_word(0x2929527b, 0xe3e3dd3e, 0x2f2f5e71, 0x84841397);
-        &data_word(0x5353a6f5, 0xd1d1b968, 0x00000000, 0xededc12c);
-        &data_word(0x20204060, 0xfcfce31f, 0xb1b179c8, 0x5b5bb6ed);
-        &data_word(0x6a6ad4be, 0xcbcb8d46, 0xbebe67d9, 0x3939724b);
-        &data_word(0x4a4a94de, 0x4c4c98d4, 0x5858b0e8, 0xcfcf854a);
-        &data_word(0xd0d0bb6b, 0xefefc52a, 0xaaaa4fe5, 0xfbfbed16);
-        &data_word(0x434386c5, 0x4d4d9ad7, 0x33336655, 0x85851194);
-        &data_word(0x45458acf, 0xf9f9e910, 0x02020406, 0x7f7ffe81);
-        &data_word(0x5050a0f0, 0x3c3c7844, 0x9f9f25ba, 0xa8a84be3);
-        &data_word(0x5151a2f3, 0xa3a35dfe, 0x404080c0, 0x8f8f058a);
-        &data_word(0x92923fad, 0x9d9d21bc, 0x38387048, 0xf5f5f104);
-        &data_word(0xbcbc63df, 0xb6b677c1, 0xdadaaf75, 0x21214263);
-        &data_word(0x10102030, 0xffffe51a, 0xf3f3fd0e, 0xd2d2bf6d);
-        &data_word(0xcdcd814c, 0x0c0c1814, 0x13132635, 0xececc32f);
-        &data_word(0x5f5fbee1, 0x979735a2, 0x444488cc, 0x17172e39);
-        &data_word(0xc4c49357, 0xa7a755f2, 0x7e7efc82, 0x3d3d7a47);
-        &data_word(0x6464c8ac, 0x5d5dbae7, 0x1919322b, 0x7373e695);
-        &data_word(0x6060c0a0, 0x81811998, 0x4f4f9ed1, 0xdcdca37f);
-        &data_word(0x22224466, 0x2a2a547e, 0x90903bab, 0x88880b83);
-        &data_word(0x46468cca, 0xeeeec729, 0xb8b86bd3, 0x1414283c);
-        &data_word(0xdedea779, 0x5e5ebce2, 0x0b0b161d, 0xdbdbad76);
-        &data_word(0xe0e0db3b, 0x32326456, 0x3a3a744e, 0x0a0a141e);
-        &data_word(0x494992db, 0x06060c0a, 0x2424486c, 0x5c5cb8e4);
-        &data_word(0xc2c29f5d, 0xd3d3bd6e, 0xacac43ef, 0x6262c4a6);
-        &data_word(0x919139a8, 0x959531a4, 0xe4e4d337, 0x7979f28b);
-        &data_word(0xe7e7d532, 0xc8c88b43, 0x37376e59, 0x6d6ddab7);
-        &data_word(0x8d8d018c, 0xd5d5b164, 0x4e4e9cd2, 0xa9a949e0);
-        &data_word(0x6c6cd8b4, 0x5656acfa, 0xf4f4f307, 0xeaeacf25);
-        &data_word(0x6565caaf, 0x7a7af48e, 0xaeae47e9, 0x08081018);
-        &data_word(0xbaba6fd5, 0x7878f088, 0x25254a6f, 0x2e2e5c72);
-        &data_word(0x1c1c3824, 0xa6a657f1, 0xb4b473c7, 0xc6c69751);
-        &data_word(0xe8e8cb23, 0xdddda17c, 0x7474e89c, 0x1f1f3e21);
-        &data_word(0x4b4b96dd, 0xbdbd61dc, 0x8b8b0d86, 0x8a8a0f85);
-        &data_word(0x7070e090, 0x3e3e7c42, 0xb5b571c4, 0x6666ccaa);
-        &data_word(0x484890d8, 0x03030605, 0xf6f6f701, 0x0e0e1c12);
-        &data_word(0x6161c2a3, 0x35356a5f, 0x5757aef9, 0xb9b969d0);
-        &data_word(0x86861791, 0xc1c19958, 0x1d1d3a27, 0x9e9e27b9);
-        &data_word(0xe1e1d938, 0xf8f8eb13, 0x98982bb3, 0x11112233);
-        &data_word(0x6969d2bb, 0xd9d9a970, 0x8e8e0789, 0x949433a7);
-        &data_word(0x9b9b2db6, 0x1e1e3c22, 0x87871592, 0xe9e9c920);
-        &data_word(0xcece8749, 0x5555aaff, 0x28285078, 0xdfdfa57a);
-        &data_word(0x8c8c038f, 0xa1a159f8, 0x89890980, 0x0d0d1a17);
-        &data_word(0xbfbf65da, 0xe6e6d731, 0x424284c6, 0x6868d0b8);
-        &data_word(0x414182c3, 0x999929b0, 0x2d2d5a77, 0x0f0f1e11);
-        &data_word(0xb0b07bcb, 0x5454a8fc, 0xbbbb6dd6, 0x16162c3a);
-#Te2:
-        &data_word(0x63c6a563, 0x7cf8847c, 0x77ee9977, 0x7bf68d7b);
-        &data_word(0xf2ff0df2, 0x6bd6bd6b, 0x6fdeb16f, 0xc59154c5);
-        &data_word(0x30605030, 0x01020301, 0x67cea967, 0x2b567d2b);
-        &data_word(0xfee719fe, 0xd7b562d7, 0xab4de6ab, 0x76ec9a76);
-        &data_word(0xca8f45ca, 0x821f9d82, 0xc98940c9, 0x7dfa877d);
-        &data_word(0xfaef15fa, 0x59b2eb59, 0x478ec947, 0xf0fb0bf0);
-        &data_word(0xad41ecad, 0xd4b367d4, 0xa25ffda2, 0xaf45eaaf);
-        &data_word(0x9c23bf9c, 0xa453f7a4, 0x72e49672, 0xc09b5bc0);
-        &data_word(0xb775c2b7, 0xfde11cfd, 0x933dae93, 0x264c6a26);
-        &data_word(0x366c5a36, 0x3f7e413f, 0xf7f502f7, 0xcc834fcc);
-        &data_word(0x34685c34, 0xa551f4a5, 0xe5d134e5, 0xf1f908f1);
-        &data_word(0x71e29371, 0xd8ab73d8, 0x31625331, 0x152a3f15);
-        &data_word(0x04080c04, 0xc79552c7, 0x23466523, 0xc39d5ec3);
-        &data_word(0x18302818, 0x9637a196, 0x050a0f05, 0x9a2fb59a);
-        &data_word(0x070e0907, 0x12243612, 0x801b9b80, 0xe2df3de2);
-        &data_word(0xebcd26eb, 0x274e6927, 0xb27fcdb2, 0x75ea9f75);
-        &data_word(0x09121b09, 0x831d9e83, 0x2c58742c, 0x1a342e1a);
-        &data_word(0x1b362d1b, 0x6edcb26e, 0x5ab4ee5a, 0xa05bfba0);
-        &data_word(0x52a4f652, 0x3b764d3b, 0xd6b761d6, 0xb37dceb3);
-        &data_word(0x29527b29, 0xe3dd3ee3, 0x2f5e712f, 0x84139784);
-        &data_word(0x53a6f553, 0xd1b968d1, 0x00000000, 0xedc12ced);
-        &data_word(0x20406020, 0xfce31ffc, 0xb179c8b1, 0x5bb6ed5b);
-        &data_word(0x6ad4be6a, 0xcb8d46cb, 0xbe67d9be, 0x39724b39);
-        &data_word(0x4a94de4a, 0x4c98d44c, 0x58b0e858, 0xcf854acf);
-        &data_word(0xd0bb6bd0, 0xefc52aef, 0xaa4fe5aa, 0xfbed16fb);
-        &data_word(0x4386c543, 0x4d9ad74d, 0x33665533, 0x85119485);
-        &data_word(0x458acf45, 0xf9e910f9, 0x02040602, 0x7ffe817f);
-        &data_word(0x50a0f050, 0x3c78443c, 0x9f25ba9f, 0xa84be3a8);
-        &data_word(0x51a2f351, 0xa35dfea3, 0x4080c040, 0x8f058a8f);
-        &data_word(0x923fad92, 0x9d21bc9d, 0x38704838, 0xf5f104f5);
-        &data_word(0xbc63dfbc, 0xb677c1b6, 0xdaaf75da, 0x21426321);
-        &data_word(0x10203010, 0xffe51aff, 0xf3fd0ef3, 0xd2bf6dd2);
-        &data_word(0xcd814ccd, 0x0c18140c, 0x13263513, 0xecc32fec);
-        &data_word(0x5fbee15f, 0x9735a297, 0x4488cc44, 0x172e3917);
-        &data_word(0xc49357c4, 0xa755f2a7, 0x7efc827e, 0x3d7a473d);
-        &data_word(0x64c8ac64, 0x5dbae75d, 0x19322b19, 0x73e69573);
-        &data_word(0x60c0a060, 0x81199881, 0x4f9ed14f, 0xdca37fdc);
-        &data_word(0x22446622, 0x2a547e2a, 0x903bab90, 0x880b8388);
-        &data_word(0x468cca46, 0xeec729ee, 0xb86bd3b8, 0x14283c14);
-        &data_word(0xdea779de, 0x5ebce25e, 0x0b161d0b, 0xdbad76db);
-        &data_word(0xe0db3be0, 0x32645632, 0x3a744e3a, 0x0a141e0a);
-        &data_word(0x4992db49, 0x060c0a06, 0x24486c24, 0x5cb8e45c);
-        &data_word(0xc29f5dc2, 0xd3bd6ed3, 0xac43efac, 0x62c4a662);
-        &data_word(0x9139a891, 0x9531a495, 0xe4d337e4, 0x79f28b79);
-        &data_word(0xe7d532e7, 0xc88b43c8, 0x376e5937, 0x6ddab76d);
-        &data_word(0x8d018c8d, 0xd5b164d5, 0x4e9cd24e, 0xa949e0a9);
-        &data_word(0x6cd8b46c, 0x56acfa56, 0xf4f307f4, 0xeacf25ea);
-        &data_word(0x65caaf65, 0x7af48e7a, 0xae47e9ae, 0x08101808);
-        &data_word(0xba6fd5ba, 0x78f08878, 0x254a6f25, 0x2e5c722e);
-        &data_word(0x1c38241c, 0xa657f1a6, 0xb473c7b4, 0xc69751c6);
-        &data_word(0xe8cb23e8, 0xdda17cdd, 0x74e89c74, 0x1f3e211f);
-        &data_word(0x4b96dd4b, 0xbd61dcbd, 0x8b0d868b, 0x8a0f858a);
-        &data_word(0x70e09070, 0x3e7c423e, 0xb571c4b5, 0x66ccaa66);
-        &data_word(0x4890d848, 0x03060503, 0xf6f701f6, 0x0e1c120e);
-        &data_word(0x61c2a361, 0x356a5f35, 0x57aef957, 0xb969d0b9);
-        &data_word(0x86179186, 0xc19958c1, 0x1d3a271d, 0x9e27b99e);
-        &data_word(0xe1d938e1, 0xf8eb13f8, 0x982bb398, 0x11223311);
-        &data_word(0x69d2bb69, 0xd9a970d9, 0x8e07898e, 0x9433a794);
-        &data_word(0x9b2db69b, 0x1e3c221e, 0x87159287, 0xe9c920e9);
-        &data_word(0xce8749ce, 0x55aaff55, 0x28507828, 0xdfa57adf);
-        &data_word(0x8c038f8c, 0xa159f8a1, 0x89098089, 0x0d1a170d);
-        &data_word(0xbf65dabf, 0xe6d731e6, 0x4284c642, 0x68d0b868);
-        &data_word(0x4182c341, 0x9929b099, 0x2d5a772d, 0x0f1e110f);
-        &data_word(0xb07bcbb0, 0x54a8fc54, 0xbb6dd6bb, 0x162c3a16);
-#Te3:
-        &data_word(0xc6a56363, 0xf8847c7c, 0xee997777, 0xf68d7b7b);
-        &data_word(0xff0df2f2, 0xd6bd6b6b, 0xdeb16f6f, 0x9154c5c5);
-        &data_word(0x60503030, 0x02030101, 0xcea96767, 0x567d2b2b);
-        &data_word(0xe719fefe, 0xb562d7d7, 0x4de6abab, 0xec9a7676);
-        &data_word(0x8f45caca, 0x1f9d8282, 0x8940c9c9, 0xfa877d7d);
-        &data_word(0xef15fafa, 0xb2eb5959, 0x8ec94747, 0xfb0bf0f0);
-        &data_word(0x41ecadad, 0xb367d4d4, 0x5ffda2a2, 0x45eaafaf);
-        &data_word(0x23bf9c9c, 0x53f7a4a4, 0xe4967272, 0x9b5bc0c0);
-        &data_word(0x75c2b7b7, 0xe11cfdfd, 0x3dae9393, 0x4c6a2626);
-        &data_word(0x6c5a3636, 0x7e413f3f, 0xf502f7f7, 0x834fcccc);
-        &data_word(0x685c3434, 0x51f4a5a5, 0xd134e5e5, 0xf908f1f1);
-        &data_word(0xe2937171, 0xab73d8d8, 0x62533131, 0x2a3f1515);
-        &data_word(0x080c0404, 0x9552c7c7, 0x46652323, 0x9d5ec3c3);
-        &data_word(0x30281818, 0x37a19696, 0x0a0f0505, 0x2fb59a9a);
-        &data_word(0x0e090707, 0x24361212, 0x1b9b8080, 0xdf3de2e2);
-        &data_word(0xcd26ebeb, 0x4e692727, 0x7fcdb2b2, 0xea9f7575);
-        &data_word(0x121b0909, 0x1d9e8383, 0x58742c2c, 0x342e1a1a);
-        &data_word(0x362d1b1b, 0xdcb26e6e, 0xb4ee5a5a, 0x5bfba0a0);
-        &data_word(0xa4f65252, 0x764d3b3b, 0xb761d6d6, 0x7dceb3b3);
-        &data_word(0x527b2929, 0xdd3ee3e3, 0x5e712f2f, 0x13978484);
-        &data_word(0xa6f55353, 0xb968d1d1, 0x00000000, 0xc12ceded);
-        &data_word(0x40602020, 0xe31ffcfc, 0x79c8b1b1, 0xb6ed5b5b);
-        &data_word(0xd4be6a6a, 0x8d46cbcb, 0x67d9bebe, 0x724b3939);
-        &data_word(0x94de4a4a, 0x98d44c4c, 0xb0e85858, 0x854acfcf);
-        &data_word(0xbb6bd0d0, 0xc52aefef, 0x4fe5aaaa, 0xed16fbfb);
-        &data_word(0x86c54343, 0x9ad74d4d, 0x66553333, 0x11948585);
-        &data_word(0x8acf4545, 0xe910f9f9, 0x04060202, 0xfe817f7f);
-        &data_word(0xa0f05050, 0x78443c3c, 0x25ba9f9f, 0x4be3a8a8);
-        &data_word(0xa2f35151, 0x5dfea3a3, 0x80c04040, 0x058a8f8f);
-        &data_word(0x3fad9292, 0x21bc9d9d, 0x70483838, 0xf104f5f5);
-        &data_word(0x63dfbcbc, 0x77c1b6b6, 0xaf75dada, 0x42632121);
-        &data_word(0x20301010, 0xe51affff, 0xfd0ef3f3, 0xbf6dd2d2);
-        &data_word(0x814ccdcd, 0x18140c0c, 0x26351313, 0xc32fecec);
-        &data_word(0xbee15f5f, 0x35a29797, 0x88cc4444, 0x2e391717);
-        &data_word(0x9357c4c4, 0x55f2a7a7, 0xfc827e7e, 0x7a473d3d);
-        &data_word(0xc8ac6464, 0xbae75d5d, 0x322b1919, 0xe6957373);
-        &data_word(0xc0a06060, 0x19988181, 0x9ed14f4f, 0xa37fdcdc);
-        &data_word(0x44662222, 0x547e2a2a, 0x3bab9090, 0x0b838888);
-        &data_word(0x8cca4646, 0xc729eeee, 0x6bd3b8b8, 0x283c1414);
-        &data_word(0xa779dede, 0xbce25e5e, 0x161d0b0b, 0xad76dbdb);
-        &data_word(0xdb3be0e0, 0x64563232, 0x744e3a3a, 0x141e0a0a);
-        &data_word(0x92db4949, 0x0c0a0606, 0x486c2424, 0xb8e45c5c);
-        &data_word(0x9f5dc2c2, 0xbd6ed3d3, 0x43efacac, 0xc4a66262);
-        &data_word(0x39a89191, 0x31a49595, 0xd337e4e4, 0xf28b7979);
-        &data_word(0xd532e7e7, 0x8b43c8c8, 0x6e593737, 0xdab76d6d);
-        &data_word(0x018c8d8d, 0xb164d5d5, 0x9cd24e4e, 0x49e0a9a9);
-        &data_word(0xd8b46c6c, 0xacfa5656, 0xf307f4f4, 0xcf25eaea);
-        &data_word(0xcaaf6565, 0xf48e7a7a, 0x47e9aeae, 0x10180808);
-        &data_word(0x6fd5baba, 0xf0887878, 0x4a6f2525, 0x5c722e2e);
-        &data_word(0x38241c1c, 0x57f1a6a6, 0x73c7b4b4, 0x9751c6c6);
-        &data_word(0xcb23e8e8, 0xa17cdddd, 0xe89c7474, 0x3e211f1f);
-        &data_word(0x96dd4b4b, 0x61dcbdbd, 0x0d868b8b, 0x0f858a8a);
-        &data_word(0xe0907070, 0x7c423e3e, 0x71c4b5b5, 0xccaa6666);
-        &data_word(0x90d84848, 0x06050303, 0xf701f6f6, 0x1c120e0e);
-        &data_word(0xc2a36161, 0x6a5f3535, 0xaef95757, 0x69d0b9b9);
-        &data_word(0x17918686, 0x9958c1c1, 0x3a271d1d, 0x27b99e9e);
-        &data_word(0xd938e1e1, 0xeb13f8f8, 0x2bb39898, 0x22331111);
-        &data_word(0xd2bb6969, 0xa970d9d9, 0x07898e8e, 0x33a79494);
-        &data_word(0x2db69b9b, 0x3c221e1e, 0x15928787, 0xc920e9e9);
-        &data_word(0x8749cece, 0xaaff5555, 0x50782828, 0xa57adfdf);
-        &data_word(0x038f8c8c, 0x59f8a1a1, 0x09808989, 0x1a170d0d);
-        &data_word(0x65dabfbf, 0xd731e6e6, 0x84c64242, 0xd0b86868);
-        &data_word(0x82c34141, 0x29b09999, 0x5a772d2d, 0x1e110f0f);
-        &data_word(0x7bcbb0b0, 0xa8fc5454, 0x6dd6bbbb, 0x2c3a1616);
-#Te4:
-        &data_word(0x63636363, 0x7c7c7c7c, 0x77777777, 0x7b7b7b7b);
-        &data_word(0xf2f2f2f2, 0x6b6b6b6b, 0x6f6f6f6f, 0xc5c5c5c5);
-        &data_word(0x30303030, 0x01010101, 0x67676767, 0x2b2b2b2b);
-        &data_word(0xfefefefe, 0xd7d7d7d7, 0xabababab, 0x76767676);
-        &data_word(0xcacacaca, 0x82828282, 0xc9c9c9c9, 0x7d7d7d7d);
-        &data_word(0xfafafafa, 0x59595959, 0x47474747, 0xf0f0f0f0);
-        &data_word(0xadadadad, 0xd4d4d4d4, 0xa2a2a2a2, 0xafafafaf);
-        &data_word(0x9c9c9c9c, 0xa4a4a4a4, 0x72727272, 0xc0c0c0c0);
-        &data_word(0xb7b7b7b7, 0xfdfdfdfd, 0x93939393, 0x26262626);
-        &data_word(0x36363636, 0x3f3f3f3f, 0xf7f7f7f7, 0xcccccccc);
-        &data_word(0x34343434, 0xa5a5a5a5, 0xe5e5e5e5, 0xf1f1f1f1);
-        &data_word(0x71717171, 0xd8d8d8d8, 0x31313131, 0x15151515);
-        &data_word(0x04040404, 0xc7c7c7c7, 0x23232323, 0xc3c3c3c3);
-        &data_word(0x18181818, 0x96969696, 0x05050505, 0x9a9a9a9a);
-        &data_word(0x07070707, 0x12121212, 0x80808080, 0xe2e2e2e2);
-        &data_word(0xebebebeb, 0x27272727, 0xb2b2b2b2, 0x75757575);
-        &data_word(0x09090909, 0x83838383, 0x2c2c2c2c, 0x1a1a1a1a);
-        &data_word(0x1b1b1b1b, 0x6e6e6e6e, 0x5a5a5a5a, 0xa0a0a0a0);
-        &data_word(0x52525252, 0x3b3b3b3b, 0xd6d6d6d6, 0xb3b3b3b3);
-        &data_word(0x29292929, 0xe3e3e3e3, 0x2f2f2f2f, 0x84848484);
-        &data_word(0x53535353, 0xd1d1d1d1, 0x00000000, 0xedededed);
-        &data_word(0x20202020, 0xfcfcfcfc, 0xb1b1b1b1, 0x5b5b5b5b);
-        &data_word(0x6a6a6a6a, 0xcbcbcbcb, 0xbebebebe, 0x39393939);
-        &data_word(0x4a4a4a4a, 0x4c4c4c4c, 0x58585858, 0xcfcfcfcf);
-        &data_word(0xd0d0d0d0, 0xefefefef, 0xaaaaaaaa, 0xfbfbfbfb);
-        &data_word(0x43434343, 0x4d4d4d4d, 0x33333333, 0x85858585);
-        &data_word(0x45454545, 0xf9f9f9f9, 0x02020202, 0x7f7f7f7f);
-        &data_word(0x50505050, 0x3c3c3c3c, 0x9f9f9f9f, 0xa8a8a8a8);
-        &data_word(0x51515151, 0xa3a3a3a3, 0x40404040, 0x8f8f8f8f);
-        &data_word(0x92929292, 0x9d9d9d9d, 0x38383838, 0xf5f5f5f5);
-        &data_word(0xbcbcbcbc, 0xb6b6b6b6, 0xdadadada, 0x21212121);
-        &data_word(0x10101010, 0xffffffff, 0xf3f3f3f3, 0xd2d2d2d2);
-        &data_word(0xcdcdcdcd, 0x0c0c0c0c, 0x13131313, 0xecececec);
-        &data_word(0x5f5f5f5f, 0x97979797, 0x44444444, 0x17171717);
-        &data_word(0xc4c4c4c4, 0xa7a7a7a7, 0x7e7e7e7e, 0x3d3d3d3d);
-        &data_word(0x64646464, 0x5d5d5d5d, 0x19191919, 0x73737373);
-        &data_word(0x60606060, 0x81818181, 0x4f4f4f4f, 0xdcdcdcdc);
-        &data_word(0x22222222, 0x2a2a2a2a, 0x90909090, 0x88888888);
-        &data_word(0x46464646, 0xeeeeeeee, 0xb8b8b8b8, 0x14141414);
-        &data_word(0xdededede, 0x5e5e5e5e, 0x0b0b0b0b, 0xdbdbdbdb);
-        &data_word(0xe0e0e0e0, 0x32323232, 0x3a3a3a3a, 0x0a0a0a0a);
-        &data_word(0x49494949, 0x06060606, 0x24242424, 0x5c5c5c5c);
-        &data_word(0xc2c2c2c2, 0xd3d3d3d3, 0xacacacac, 0x62626262);
-        &data_word(0x91919191, 0x95959595, 0xe4e4e4e4, 0x79797979);
-        &data_word(0xe7e7e7e7, 0xc8c8c8c8, 0x37373737, 0x6d6d6d6d);
-        &data_word(0x8d8d8d8d, 0xd5d5d5d5, 0x4e4e4e4e, 0xa9a9a9a9);
-        &data_word(0x6c6c6c6c, 0x56565656, 0xf4f4f4f4, 0xeaeaeaea);
-        &data_word(0x65656565, 0x7a7a7a7a, 0xaeaeaeae, 0x08080808);
-        &data_word(0xbabababa, 0x78787878, 0x25252525, 0x2e2e2e2e);
-        &data_word(0x1c1c1c1c, 0xa6a6a6a6, 0xb4b4b4b4, 0xc6c6c6c6);
-        &data_word(0xe8e8e8e8, 0xdddddddd, 0x74747474, 0x1f1f1f1f);
-        &data_word(0x4b4b4b4b, 0xbdbdbdbd, 0x8b8b8b8b, 0x8a8a8a8a);
-        &data_word(0x70707070, 0x3e3e3e3e, 0xb5b5b5b5, 0x66666666);
-        &data_word(0x48484848, 0x03030303, 0xf6f6f6f6, 0x0e0e0e0e);
-        &data_word(0x61616161, 0x35353535, 0x57575757, 0xb9b9b9b9);
-        &data_word(0x86868686, 0xc1c1c1c1, 0x1d1d1d1d, 0x9e9e9e9e);
-        &data_word(0xe1e1e1e1, 0xf8f8f8f8, 0x98989898, 0x11111111);
-        &data_word(0x69696969, 0xd9d9d9d9, 0x8e8e8e8e, 0x94949494);
-        &data_word(0x9b9b9b9b, 0x1e1e1e1e, 0x87878787, 0xe9e9e9e9);
-        &data_word(0xcececece, 0x55555555, 0x28282828, 0xdfdfdfdf);
-        &data_word(0x8c8c8c8c, 0xa1a1a1a1, 0x89898989, 0x0d0d0d0d);
-        &data_word(0xbfbfbfbf, 0xe6e6e6e6, 0x42424242, 0x68686868);
-        &data_word(0x41414141, 0x99999999, 0x2d2d2d2d, 0x0f0f0f0f);
-        &data_word(0xb0b0b0b0, 0x54545454, 0xbbbbbbbb, 0x16161616);
+        &_data_word(0xa56363c6, 0x847c7cf8, 0x997777ee, 0x8d7b7bf6);
+        &_data_word(0x0df2f2ff, 0xbd6b6bd6, 0xb16f6fde, 0x54c5c591);
+        &_data_word(0x50303060, 0x03010102, 0xa96767ce, 0x7d2b2b56);
+        &_data_word(0x19fefee7, 0x62d7d7b5, 0xe6abab4d, 0x9a7676ec);
+        &_data_word(0x45caca8f, 0x9d82821f, 0x40c9c989, 0x877d7dfa);
+        &_data_word(0x15fafaef, 0xeb5959b2, 0xc947478e, 0x0bf0f0fb);
+        &_data_word(0xecadad41, 0x67d4d4b3, 0xfda2a25f, 0xeaafaf45);
+        &_data_word(0xbf9c9c23, 0xf7a4a453, 0x967272e4, 0x5bc0c09b);
+        &_data_word(0xc2b7b775, 0x1cfdfde1, 0xae93933d, 0x6a26264c);
+        &_data_word(0x5a36366c, 0x413f3f7e, 0x02f7f7f5, 0x4fcccc83);
+        &_data_word(0x5c343468, 0xf4a5a551, 0x34e5e5d1, 0x08f1f1f9);
+        &_data_word(0x937171e2, 0x73d8d8ab, 0x53313162, 0x3f15152a);
+        &_data_word(0x0c040408, 0x52c7c795, 0x65232346, 0x5ec3c39d);
+        &_data_word(0x28181830, 0xa1969637, 0x0f05050a, 0xb59a9a2f);
+        &_data_word(0x0907070e, 0x36121224, 0x9b80801b, 0x3de2e2df);
+        &_data_word(0x26ebebcd, 0x6927274e, 0xcdb2b27f, 0x9f7575ea);
+        &_data_word(0x1b090912, 0x9e83831d, 0x742c2c58, 0x2e1a1a34);
+        &_data_word(0x2d1b1b36, 0xb26e6edc, 0xee5a5ab4, 0xfba0a05b);
+        &_data_word(0xf65252a4, 0x4d3b3b76, 0x61d6d6b7, 0xceb3b37d);
+        &_data_word(0x7b292952, 0x3ee3e3dd, 0x712f2f5e, 0x97848413);
+        &_data_word(0xf55353a6, 0x68d1d1b9, 0x00000000, 0x2cededc1);
+        &_data_word(0x60202040, 0x1ffcfce3, 0xc8b1b179, 0xed5b5bb6);
+        &_data_word(0xbe6a6ad4, 0x46cbcb8d, 0xd9bebe67, 0x4b393972);
+        &_data_word(0xde4a4a94, 0xd44c4c98, 0xe85858b0, 0x4acfcf85);
+        &_data_word(0x6bd0d0bb, 0x2aefefc5, 0xe5aaaa4f, 0x16fbfbed);
+        &_data_word(0xc5434386, 0xd74d4d9a, 0x55333366, 0x94858511);
+        &_data_word(0xcf45458a, 0x10f9f9e9, 0x06020204, 0x817f7ffe);
+        &_data_word(0xf05050a0, 0x443c3c78, 0xba9f9f25, 0xe3a8a84b);
+        &_data_word(0xf35151a2, 0xfea3a35d, 0xc0404080, 0x8a8f8f05);
+        &_data_word(0xad92923f, 0xbc9d9d21, 0x48383870, 0x04f5f5f1);
+        &_data_word(0xdfbcbc63, 0xc1b6b677, 0x75dadaaf, 0x63212142);
+        &_data_word(0x30101020, 0x1affffe5, 0x0ef3f3fd, 0x6dd2d2bf);
+        &_data_word(0x4ccdcd81, 0x140c0c18, 0x35131326, 0x2fececc3);
+        &_data_word(0xe15f5fbe, 0xa2979735, 0xcc444488, 0x3917172e);
+        &_data_word(0x57c4c493, 0xf2a7a755, 0x827e7efc, 0x473d3d7a);
+        &_data_word(0xac6464c8, 0xe75d5dba, 0x2b191932, 0x957373e6);
+        &_data_word(0xa06060c0, 0x98818119, 0xd14f4f9e, 0x7fdcdca3);
+        &_data_word(0x66222244, 0x7e2a2a54, 0xab90903b, 0x8388880b);
+        &_data_word(0xca46468c, 0x29eeeec7, 0xd3b8b86b, 0x3c141428);
+        &_data_word(0x79dedea7, 0xe25e5ebc, 0x1d0b0b16, 0x76dbdbad);
+        &_data_word(0x3be0e0db, 0x56323264, 0x4e3a3a74, 0x1e0a0a14);
+        &_data_word(0xdb494992, 0x0a06060c, 0x6c242448, 0xe45c5cb8);
+        &_data_word(0x5dc2c29f, 0x6ed3d3bd, 0xefacac43, 0xa66262c4);
+        &_data_word(0xa8919139, 0xa4959531, 0x37e4e4d3, 0x8b7979f2);
+        &_data_word(0x32e7e7d5, 0x43c8c88b, 0x5937376e, 0xb76d6dda);
+        &_data_word(0x8c8d8d01, 0x64d5d5b1, 0xd24e4e9c, 0xe0a9a949);
+        &_data_word(0xb46c6cd8, 0xfa5656ac, 0x07f4f4f3, 0x25eaeacf);
+        &_data_word(0xaf6565ca, 0x8e7a7af4, 0xe9aeae47, 0x18080810);
+        &_data_word(0xd5baba6f, 0x887878f0, 0x6f25254a, 0x722e2e5c);
+        &_data_word(0x241c1c38, 0xf1a6a657, 0xc7b4b473, 0x51c6c697);
+        &_data_word(0x23e8e8cb, 0x7cdddda1, 0x9c7474e8, 0x211f1f3e);
+        &_data_word(0xdd4b4b96, 0xdcbdbd61, 0x868b8b0d, 0x858a8a0f);
+        &_data_word(0x907070e0, 0x423e3e7c, 0xc4b5b571, 0xaa6666cc);
+        &_data_word(0xd8484890, 0x05030306, 0x01f6f6f7, 0x120e0e1c);
+        &_data_word(0xa36161c2, 0x5f35356a, 0xf95757ae, 0xd0b9b969);
+        &_data_word(0x91868617, 0x58c1c199, 0x271d1d3a, 0xb99e9e27);
+        &_data_word(0x38e1e1d9, 0x13f8f8eb, 0xb398982b, 0x33111122);
+        &_data_word(0xbb6969d2, 0x70d9d9a9, 0x898e8e07, 0xa7949433);
+        &_data_word(0xb69b9b2d, 0x221e1e3c, 0x92878715, 0x20e9e9c9);
+        &_data_word(0x49cece87, 0xff5555aa, 0x78282850, 0x7adfdfa5);
+        &_data_word(0x8f8c8c03, 0xf8a1a159, 0x80898909, 0x170d0d1a);
+        &_data_word(0xdabfbf65, 0x31e6e6d7, 0xc6424284, 0xb86868d0);
+        &_data_word(0xc3414182, 0xb0999929, 0x772d2d5a, 0x110f0f1e);
+        &_data_word(0xcbb0b07b, 0xfc5454a8, 0xd6bbbb6d, 0x3a16162c);
 #rcon:
         &data_word(0x00000001, 0x00000002, 0x00000004, 0x00000008);
-        &data_word(0x00000010, 0x00000020, 0x00000040, 0x00000080);
-        &data_word(0x0000001b, 0x00000036);
-&function_end_B("AES_encrypt");
+        &data_word(0x00000010, 0x00000020, 0x00000040, 0x00000080);
+        &data_word(0x0000001b, 0x00000036, 0, 0, 0, 0, 0, 0);
+&function_end_B("_x86_AES_encrypt");
 
-#------------------------------------------------------------------#
+# void AES_encrypt (const void *inp,void *out,const AES_KEY *key);
+&public_label("AES_Te");
+&function_begin("AES_encrypt");
+        &mov    ($acc,&wparam(0));              # load inp
+        &mov    ($key,&wparam(2));              # load key
 
-$s0="eax";
-$s1="ebx";
-$s2="ecx";
-$s3="edx";
-$key="edi";
-$acc="esi";
+        &mov    ($s0,"esp");
+        &sub    ("esp",24);
+        &and    ("esp",-64);
+        &add    ("esp",4);
+        &mov    (&DWP(16,"esp"),$s0);
+
+        &call   (&label("pic_point"));          # make it PIC!
+        &set_label("pic_point");
+        &blindpop("ebp");
+        &lea    ("ebp",&DWP(&label("AES_Te")."-".&label("pic_point"),"ebp"));
+
+        &mov    ($s0,&DWP(0,$acc));             # load input data
+        &mov    ($s1,&DWP(4,$acc));
+        &mov    ($s2,&DWP(8,$acc));
+        &mov    ($s3,&DWP(12,$acc));
+
+        &call   ("_x86_AES_encrypt");
+
+        &mov    ("esp",&DWP(16,"esp"));
+
+        &mov    ($acc,&wparam(1));              # load out
+        &mov    (&DWP(0,$acc),$s0);             # write output data
+        &mov    (&DWP(4,$acc),$s1);
+        &mov    (&DWP(8,$acc),$s2);
+        &mov    (&DWP(12,$acc),$s3);
+&function_end("AES_encrypt");
+
+#------------------------------------------------------------------#
 
 sub decstep()
 { my ($i,$td,@s) = @_;
@@ -715,24 +483,24 @@ sub decstep()
         if($i==3)   {   &mov    ($key,&DWP(12,"esp"));          }
         else        {   &mov    ($out,$s[0]);                   }
                         &and    ($out,0xFF);
-                        &mov    ($out,&DWP(1024*0,$td,$out,4));
+                        &mov    ($out,&DWP(0,$td,$out,8));
 
         if ($i==3)  {   $tmp=$s[1];                             }
                         &movz   ($tmp,&HB($s[1]));
-                        &xor    ($out,&DWP(1024*1,$td,$tmp,4));
+                        &xor    ($out,&DWP(3,$td,$tmp,8));
 
         if ($i==3)  {   $tmp=$s[2]; &mov ($s[1],$acc);          }
         else        {   &mov    ($tmp,$s[2]);                   }
                         &shr    ($tmp,16);
                         &and    ($tmp,0xFF);
-                        &xor    ($out,&DWP(1024*2,$td,$tmp,4));
+                        &xor    ($out,&DWP(2,$td,$tmp,8));
 
-        if ($i==3)  {   $tmp=$s[3]; &mov ($s[2],&DWP(4,"esp")); }
+        if ($i==3)  {   $tmp=$s[3]; &mov ($s[2],&DWP(8,"esp")); }
         else        {   &mov    ($tmp,$s[3]);                   }
                         &shr    ($tmp,24);
-                        &xor    ($out,&DWP(1024*3,$td,$tmp,4));
-        if ($i<2)   {   &mov    (&DWP(4*$i,"esp"),$out);        }
-        if ($i==3)  {   &mov    ($s[3],&DWP(0,"esp"));          }
+                        &xor    ($out,&DWP(1,$td,$tmp,8));
+        if ($i<2)   {   &mov    (&DWP(4+4*$i,"esp"),$out);      }
+        if ($i==3)  {   &mov    ($s[3],&DWP(4,"esp"));          }
                         &comment();
 }
 
@@ -744,58 +512,38 @@ sub declast()
         if($i==3)   {   &mov    ($key,&DWP(12,"esp"));          }
         else        {   &mov    ($out,$s[0]);                   }
                         &and    ($out,0xFF);
-                        &mov    ($out,&DWP(0,$td,$out,4));
-                        &and    ($out,0x000000ff);
+                        &movz   ($out,&BP(2048,$td,$out,1));
 
         if ($i==3)  {   $tmp=$s[1];                             }
                         &movz   ($tmp,&HB($s[1]));
-                        &mov    ($tmp,&DWP(0,$td,$tmp,4));
-                        &and    ($tmp,0x0000ff00);
+                        &movz   ($tmp,&BP(2048,$td,$tmp,1));
+                        &shl    ($tmp,8);
                         &xor    ($out,$tmp);
 
         if ($i==3)  {   $tmp=$s[2]; &mov ($s[1],$acc);          }
         else        {   mov     ($tmp,$s[2]);                   }
                         &shr    ($tmp,16);
                         &and    ($tmp,0xFF);
-                        &mov    ($tmp,&DWP(0,$td,$tmp,4));
-                        &and    ($tmp,0x00ff0000);
+                        &movz   ($tmp,&BP(2048,$td,$tmp,1));
+                        &shl    ($tmp,16);
                         &xor    ($out,$tmp);
 
-        if ($i==3)  {   $tmp=$s[3]; &mov ($s[2],&DWP(4,"esp")); }
+        if ($i==3)  {   $tmp=$s[3]; &mov ($s[2],&DWP(8,"esp")); }
         else        {   &mov    ($tmp,$s[3]);                   }
                         &shr    ($tmp,24);
-                        &mov    ($tmp,&DWP(0,$td,$tmp,4));
-                        &and    ($tmp,0xff000000);
+                        &movz   ($tmp,&BP(2048,$td,$tmp,1));
+                        &shl    ($tmp,24);
                         &xor    ($out,$tmp);
-        if ($i<2)   {   &mov    (&DWP(4*$i,"esp"),$out);        }
-        if ($i==3)  {   &mov    ($s[3],&DWP(0,"esp"));          }
+        if ($i<2)   {   &mov    (&DWP(4+4*$i,"esp"),$out);      }
+        if ($i==3)  {   &mov    ($s[3],&DWP(4,"esp"));          }
 }
 
-# void AES_decrypt (const void *inp,void *out,const AES_KEY *key);
 &public_label("AES_Td");
-&function_begin("AES_decrypt");
-        &mov    ($acc,&wparam(0));              # load inp
-        &mov    ($key,&wparam(2));              # load key
-
-        &call   (&label("pic_point"));          # make it PIC!
-        &set_label("pic_point");
-        &blindpop("ebp");
-        &lea    ("ebp",&DWP(&label("AES_Td")."-".&label("pic_point"),"ebp"));
-
-        # allocate aligned stack frame
-        &mov    ($s0,"esp");
-        &sub    ("esp",20);
-        &and    ("esp",-16);
-
+&function_begin_B("_x86_AES_decrypt");
+        # note that caller is expected to allocate stack frame for me!
         &mov    (&DWP(12,"esp"),$key);          # save key
-        &mov    (&DWP(16,"esp"),$s0);           # save %esp
-
-        &mov    ($s0,&DWP(0,$acc));             # load input data
-        &mov    ($s1,&DWP(4,$acc));
-        &mov    ($s2,&DWP(8,$acc));
-        &mov    ($s3,&DWP(12,$acc));
 
-        &xor    ($s0,&DWP(0,$key));
+        &xor    ($s0,&DWP(0,$key));             # xor with key
         &xor    ($s1,&DWP(4,$key));
         &xor    ($s2,&DWP(8,$key));
         &xor    ($s3,&DWP(12,$key));
@@ -805,19 +553,19 @@ sub declast()
         if ($small_footprint) {
             &lea        ($acc,&DWP(-2,$acc,$acc));
             &lea        ($acc,&DWP(0,$key,$acc,8));
-            &mov        (&DWP(8,"esp"),$acc);   # end of key schedule
+            &mov        (&DWP(16,"esp"),$acc);  # end of key schedule
             &align      (4);
             &set_label("loop");
                 &decstep(0,"ebp",$s0,$s3,$s2,$s1);
                 &decstep(1,"ebp",$s1,$s0,$s3,$s2);
                 &decstep(2,"ebp",$s2,$s1,$s0,$s3);
                 &decstep(3,"ebp",$s3,$s2,$s1,$s0);
-                &add    ($key,16);                      # advance rd_key
+                &add    ($key,16);              # advance rd_key
                 &xor    ($s0,&DWP(0,$key));
                 &xor    ($s1,&DWP(4,$key));
                 &xor    ($s2,&DWP(8,$key));
                 &xor    ($s3,&DWP(12,$key));
-            &cmp        ($key,&DWP(8,"esp"));
+            &cmp        ($key,&DWP(16,"esp"));
             &mov        (&DWP(12,"esp"),$key);
             &jb         (&label("loop"));
         }
@@ -839,7 +587,7 @@ sub declast()
                 &xor    ($s3,&DWP(16*$i+12,$key));
             }
             &add        ($key,32);
-            &mov        (&DWP(12,"esp"),$key);          # advance rd_key
+            &mov        (&DWP(12,"esp"),$key);  # advance rd_key
         &set_label("12rounds");
             for ($i=1;$i<3;$i++) {
                 &decstep(0,"ebp",$s0,$s3,$s2,$s1);
@@ -852,7 +600,7 @@ sub declast()
                 &xor    ($s3,&DWP(16*$i+12,$key));
             }
             &add        ($key,32);
-            &mov        (&DWP(12,"esp"),$key);          # advance rd_key
+            &mov        (&DWP(12,"esp"),$key);  # advance rd_key
         &set_label("10rounds");
             for ($i=1;$i<10;$i++) {
                 &decstep(0,"ebp",$s0,$s3,$s2,$s1);
@@ -866,382 +614,627 @@ sub declast()
             }
         }
 
-        &add    ("ebp",4*1024);                 # skip to Te4
         &declast(0,"ebp",$s0,$s3,$s2,$s1);
         &declast(1,"ebp",$s1,$s0,$s3,$s2);
         &declast(2,"ebp",$s2,$s1,$s0,$s3);
         &declast(3,"ebp",$s3,$s2,$s1,$s0);
 
-        &mov    ("esp",&DWP(16,"esp"));         # restore %esp
         &add    ($key,$small_footprint?16:160);
         &xor    ($s0,&DWP(0,$key));
         &xor    ($s1,&DWP(4,$key));
         &xor    ($s2,&DWP(8,$key));
         &xor    ($s3,&DWP(12,$key));
 
-        &mov    ($key,&wparam(1));              # load out
-        &mov    (&DWP(0,$key),$s0);             # write output data
+        &ret    ();
+
+&set_label("AES_Td",64);        # Yes! I keep it in the code segment!
+        &_data_word(0x50a7f451, 0x5365417e, 0xc3a4171a, 0x965e273a);
+        &_data_word(0xcb6bab3b, 0xf1459d1f, 0xab58faac, 0x9303e34b);
+        &_data_word(0x55fa3020, 0xf66d76ad, 0x9176cc88, 0x254c02f5);
+        &_data_word(0xfcd7e54f, 0xd7cb2ac5, 0x80443526, 0x8fa362b5);
+        &_data_word(0x495ab1de, 0x671bba25, 0x980eea45, 0xe1c0fe5d);
+        &_data_word(0x02752fc3, 0x12f04c81, 0xa397468d, 0xc6f9d36b);
+        &_data_word(0xe75f8f03, 0x959c9215, 0xeb7a6dbf, 0xda595295);
+        &_data_word(0x2d83bed4, 0xd3217458, 0x2969e049, 0x44c8c98e);
+        &_data_word(0x6a89c275, 0x78798ef4, 0x6b3e5899, 0xdd71b927);
+        &_data_word(0xb64fe1be, 0x17ad88f0, 0x66ac20c9, 0xb43ace7d);
+        &_data_word(0x184adf63, 0x82311ae5, 0x60335197, 0x457f5362);
+        &_data_word(0xe07764b1, 0x84ae6bbb, 0x1ca081fe, 0x942b08f9);
+        &_data_word(0x58684870, 0x19fd458f, 0x876cde94, 0xb7f87b52);
+        &_data_word(0x23d373ab, 0xe2024b72, 0x578f1fe3, 0x2aab5566);
+        &_data_word(0x0728ebb2, 0x03c2b52f, 0x9a7bc586, 0xa50837d3);
+        &_data_word(0xf2872830, 0xb2a5bf23, 0xba6a0302, 0x5c8216ed);
+        &_data_word(0x2b1ccf8a, 0x92b479a7, 0xf0f207f3, 0xa1e2694e);
+        &_data_word(0xcdf4da65, 0xd5be0506, 0x1f6234d1, 0x8afea6c4);
+        &_data_word(0x9d532e34, 0xa055f3a2, 0x32e18a05, 0x75ebf6a4);
+        &_data_word(0x39ec830b, 0xaaef6040, 0x069f715e, 0x51106ebd);
+        &_data_word(0xf98a213e, 0x3d06dd96, 0xae053edd, 0x46bde64d);
+        &_data_word(0xb58d5491, 0x055dc471, 0x6fd40604, 0xff155060);
+        &_data_word(0x24fb9819, 0x97e9bdd6, 0xcc434089, 0x779ed967);
+        &_data_word(0xbd42e8b0, 0x888b8907, 0x385b19e7, 0xdbeec879);
+        &_data_word(0x470a7ca1, 0xe90f427c, 0xc91e84f8, 0x00000000);
+        &_data_word(0x83868009, 0x48ed2b32, 0xac70111e, 0x4e725a6c);
+        &_data_word(0xfbff0efd, 0x5638850f, 0x1ed5ae3d, 0x27392d36);
+        &_data_word(0x64d90f0a, 0x21a65c68, 0xd1545b9b, 0x3a2e3624);
+        &_data_word(0xb1670a0c, 0x0fe75793, 0xd296eeb4, 0x9e919b1b);
+        &_data_word(0x4fc5c080, 0xa220dc61, 0x694b775a, 0x161a121c);
+        &_data_word(0x0aba93e2, 0xe52aa0c0, 0x43e0223c, 0x1d171b12);
+        &_data_word(0x0b0d090e, 0xadc78bf2, 0xb9a8b62d, 0xc8a91e14);
+        &_data_word(0x8519f157, 0x4c0775af, 0xbbdd99ee, 0xfd607fa3);
+        &_data_word(0x9f2601f7, 0xbcf5725c, 0xc53b6644, 0x347efb5b);
+        &_data_word(0x7629438b, 0xdcc623cb, 0x68fcedb6, 0x63f1e4b8);
+        &_data_word(0xcadc31d7, 0x10856342, 0x40229713, 0x2011c684);
+        &_data_word(0x7d244a85, 0xf83dbbd2, 0x1132f9ae, 0x6da129c7);
+        &_data_word(0x4b2f9e1d, 0xf330b2dc, 0xec52860d, 0xd0e3c177);
+        &_data_word(0x6c16b32b, 0x99b970a9, 0xfa489411, 0x2264e947);
+        &_data_word(0xc48cfca8, 0x1a3ff0a0, 0xd82c7d56, 0xef903322);
+        &_data_word(0xc74e4987, 0xc1d138d9, 0xfea2ca8c, 0x360bd498);
+        &_data_word(0xcf81f5a6, 0x28de7aa5, 0x268eb7da, 0xa4bfad3f);
+        &_data_word(0xe49d3a2c, 0x0d927850, 0x9bcc5f6a, 0x62467e54);
+        &_data_word(0xc2138df6, 0xe8b8d890, 0x5ef7392e, 0xf5afc382);
+        &_data_word(0xbe805d9f, 0x7c93d069, 0xa92dd56f, 0xb31225cf);
+        &_data_word(0x3b99acc8, 0xa77d1810, 0x6e639ce8, 0x7bbb3bdb);
+        &_data_word(0x097826cd, 0xf418596e, 0x01b79aec, 0xa89a4f83);
+        &_data_word(0x656e95e6, 0x7ee6ffaa, 0x08cfbc21, 0xe6e815ef);
+        &_data_word(0xd99be7ba, 0xce366f4a, 0xd4099fea, 0xd67cb029);
+        &_data_word(0xafb2a431, 0x31233f2a, 0x3094a5c6, 0xc066a235);
+        &_data_word(0x37bc4e74, 0xa6ca82fc, 0xb0d090e0, 0x15d8a733);
+        &_data_word(0x4a9804f1, 0xf7daec41, 0x0e50cd7f, 0x2ff69117);
+        &_data_word(0x8dd64d76, 0x4db0ef43, 0x544daacc, 0xdf0496e4);
+        &_data_word(0xe3b5d19e, 0x1b886a4c, 0xb81f2cc1, 0x7f516546);
+        &_data_word(0x04ea5e9d, 0x5d358c01, 0x737487fa, 0x2e410bfb);
+        &_data_word(0x5a1d67b3, 0x52d2db92, 0x335610e9, 0x1347d66d);
+        &_data_word(0x8c61d79a, 0x7a0ca137, 0x8e14f859, 0x893c13eb);
+        &_data_word(0xee27a9ce, 0x35c961b7, 0xede51ce1, 0x3cb1477a);
+        &_data_word(0x59dfd29c, 0x3f73f255, 0x79ce1418, 0xbf37c773);
+        &_data_word(0xeacdf753, 0x5baafd5f, 0x146f3ddf, 0x86db4478);
+        &_data_word(0x81f3afca, 0x3ec468b9, 0x2c342438, 0x5f40a3c2);
+        &_data_word(0x72c31d16, 0x0c25e2bc, 0x8b493c28, 0x41950dff);
+        &_data_word(0x7101a839, 0xdeb30c08, 0x9ce4b4d8, 0x90c15664);
+        &_data_word(0x6184cb7b, 0x70b632d5, 0x745c6c48, 0x4257b8d0);
+#Td4:
+        &data_byte(0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38);
+        &data_byte(0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb);
+        &data_byte(0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87);
+        &data_byte(0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb);
+        &data_byte(0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d);
+        &data_byte(0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e);
+        &data_byte(0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2);
+        &data_byte(0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25);
+        &data_byte(0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16);
+        &data_byte(0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92);
+        &data_byte(0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda);
+        &data_byte(0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84);
+        &data_byte(0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a);
+        &data_byte(0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06);
+        &data_byte(0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02);
+        &data_byte(0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b);
+        &data_byte(0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea);
+        &data_byte(0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73);
+        &data_byte(0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85);
+        &data_byte(0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e);
+        &data_byte(0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89);
+        &data_byte(0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b);
+        &data_byte(0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20);
+        &data_byte(0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4);
+        &data_byte(0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31);
+        &data_byte(0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f);
+        &data_byte(0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d);
+        &data_byte(0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef);
+        &data_byte(0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0);
+        &data_byte(0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61);
+        &data_byte(0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26);
+        &data_byte(0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d);
+&function_end_B("_x86_AES_decrypt");
+
+# void AES_decrypt (const void *inp,void *out,const AES_KEY *key);
+&public_label("AES_Td");
+&function_begin("AES_decrypt");
+        &mov    ($acc,&wparam(0));              # load inp
+        &mov    ($key,&wparam(2));              # load key
+
+        &mov    ($s0,"esp");
+        &sub    ("esp",24);
+        &and    ("esp",-64);
+        &add    ("esp",4);
+        &mov    (&DWP(16,"esp"),$s0);
+
+        &call   (&label("pic_point"));          # make it PIC!
+        &set_label("pic_point");
+        &blindpop("ebp");
+        &lea    ("ebp",&DWP(&label("AES_Td")."-".&label("pic_point"),"ebp"));
+
+        # prefetch Td4
+        &lea    ("ebp",&DWP(2048+128,"ebp"));
+        &mov    ($s0,&DWP(0-128,"ebp"));
+        &mov    ($s1,&DWP(32-128,"ebp"));
+        &mov    ($s2,&DWP(64-128,"ebp"));
+        &mov    ($s3,&DWP(96-128,"ebp"));
+        &mov    ($s0,&DWP(128-128,"ebp"));
+        &mov    ($s1,&DWP(160-128,"ebp"));
+        &mov    ($s2,&DWP(192-128,"ebp"));
+        &mov    ($s3,&DWP(224-128,"ebp"));
+        &lea    ("ebp",&DWP(-2048-128,"ebp"));
+
+        &mov    ($s0,&DWP(0,$acc));             # load input data
+        &mov    ($s1,&DWP(4,$acc));
+        &mov    ($s2,&DWP(8,$acc));
+        &mov    ($s3,&DWP(12,$acc));
+
+        &call   ("_x86_AES_decrypt");
+
+        &mov    ("esp",&DWP(16,"esp"));
+
+        &mov    ($acc,&wparam(1));              # load out
+        &mov    (&DWP(0,$acc),$s0);             # write output data
+        &mov    (&DWP(4,$acc),$s1);
+        &mov    (&DWP(8,$acc),$s2);
+        &mov    (&DWP(12,$acc),$s3);
+&function_end("AES_decrypt");
+
+# void AES_cbc_encrypt (const void char *inp, unsigned char *out,
+#                       size_t length, const AES_KEY *key,
+#                       unsigned char *ivp,const int enc);
+{
+# stack frame layout
+# -4(%esp)      0(%esp)         return address
+# 0(%esp)       4(%esp)         tmp1
+# 4(%esp)       8(%esp)         tmp2
+# 8(%esp)       12(%esp)        key
+# 12(%esp)      16(%esp)        end of key schedule
+my $_esp=&DWP(16,"esp");        #saved %esp
+my $_inp=&DWP(20,"esp");        #copy of wparam(0)
+my $_out=&DWP(24,"esp");        #copy of wparam(1)
+my $_len=&DWP(28,"esp");        #copy of wparam(2)
+my $_key=&DWP(32,"esp");        #copy of wparam(3)
+my $_ivp=&DWP(36,"esp");        #copy of wparam(4)
+my $_tmp=&DWP(40,"esp");        #volatile variable
+my $ivec=&DWP(44,"esp");        #ivec[16]
+my $aes_key=&DWP(60,"esp");     #copy of aes_key
+my $mark=&DWP(60+240,"esp");    #copy of aes_key->rounds
+
+&public_label("AES_Te");
+&public_label("AES_Td");
+&function_begin("AES_cbc_encrypt");
+        &mov    ($s2 eq "ecx"? $s2 : "",&wparam(2));    # load len
+        &cmp    ($s2,0);
+        &je     (&label("enc_out"));
+
+        &call   (&label("pic_point"));          # make it PIC!
+        &set_label("pic_point");
+        &blindpop("ebp");
+
+        &pushf  ();
+        &cld    ();
+
+        &cmp    (&wparam(5),0);
+        &je     (&label("DECRYPT"));
+
+        &lea    ("ebp",&DWP(&label("AES_Te")."-".&label("pic_point"),"ebp"));
+
+        # allocate aligned stack frame...
+        &lea    ($key,&DWP(-64-244,"esp"));
+        &and    ($key,-64);
+
+        # ... and make sure it doesn't alias with AES_Te modulo 4096
+        &mov    ($s0,"ebp");
+        &lea    ($s1,&DWP(2048,"ebp"));
+        &mov    ($s3,$key);
+        &and    ($s0,0xfff);            # s = %ebp&0xfff
+        &and    ($s1,0xfff);            # e = (%ebp+2048)&0xfff
+        &and    ($s3,0xfff);            # p = %esp&0xfff
+
+        &cmp    ($s3,$s1);              # if (p>=e) %esp =- (p-e);
+        &jb     (&label("te_break_out"));
+        &sub    ($s3,$s1);
+        &sub    ($key,$s3);
+        &jmp    (&label("te_ok"));
+        &set_label("te_break_out");     # else %esp -= (p-s)&0xfff + framesz;
+        &sub    ($s3,$s0);
+        &and    ($s3,0xfff);
+        &add    ($s3,64+256);
+        &sub    ($key,$s3);
+        &align  (4);
+        &set_label("te_ok");
+
+        &mov    ($s0,&wparam(0));       # load inp
+        &mov    ($s1,&wparam(1));       # load out
+        &mov    ($s3,&wparam(3));       # load key
+        &mov    ($acc,&wparam(4));      # load ivp
+
+        &exch   ("esp",$key);
+        &add    ("esp",4);              # reserve for return address!
+        &mov    ($_esp,$key);           # save %esp
+
+        &mov    ($_inp,$s0);            # save copy of inp
+        &mov    ($_out,$s1);            # save copy of out
+        &mov    ($_len,$s2);            # save copy of len
+        &mov    ($_key,$s3);            # save copy of key
+        &mov    ($_ivp,$acc);           # save copy of ivp
+
+        &mov    ($mark,0);              # copy of aes_key->rounds = 0;
+        if ($compromise) {
+                &cmp    ($s2,$compromise);
+                &jb     (&label("skip_ecopy"));
+        }
+        # do we copy key schedule to stack?
+        &mov    ($s1 eq "ebx" ? $s1 : "",$s3);
+        &mov    ($s2 eq "ecx" ? $s2 : "",244/4);
+        &sub    ($s1,"ebp");
+        &mov    ("esi",$s3);
+        &and    ($s1,0xfff);
+        &lea    ("edi",$aes_key);
+        &cmp    ($s1,2048);
+        &jb     (&label("do_ecopy"));
+        &cmp    ($s1,4096-244);
+        &jb     (&label("skip_ecopy"));
+        &align  (4);
+        &set_label("do_ecopy");
+                &mov    ($_key,"edi");
+                &data_word(0xA5F3F689); # rep movsd
+        &set_label("skip_ecopy");
+
+        &mov    ($acc,$s0);
+        &mov    ($key,16);
+        &align  (4);
+        &set_label("prefetch_te");
+                &mov    ($s0,&DWP(0,"ebp"));
+                &mov    ($s1,&DWP(32,"ebp"));
+                &mov    ($s2,&DWP(64,"ebp"));
+                &mov    ($s3,&DWP(96,"ebp"));
+                &lea    ("ebp",&DWP(128,"ebp"));
+                &dec    ($key);
+        &jnz    (&label("prefetch_te"));
+        &sub    ("ebp",2048);
+
+        &mov    ($s2,$_len);
+        &mov    ($key,$_ivp);
+        &test   ($s2,0xFFFFFFF0);
+        &jz     (&label("enc_tail"));           # short input...
+
+        &mov    ($s0,&DWP(0,$key));             # load iv
+        &mov    ($s1,&DWP(4,$key));
+
+        &align  (4);
+        &set_label("enc_loop");
+                &mov    ($s2,&DWP(8,$key));
+                &mov    ($s3,&DWP(12,$key));
+
+                &xor    ($s0,&DWP(0,$acc));     # xor input data
+                &xor    ($s1,&DWP(4,$acc));
+                &xor    ($s2,&DWP(8,$acc));
+                &xor    ($s3,&DWP(12,$acc));
+
+                &mov    ($key,$_key);           # load key
+                &call   ("_x86_AES_encrypt");
+
+                &mov    ($acc,$_inp);           # load inp
+                &mov    ($key,$_out);           # load out
+
+                &mov    (&DWP(0,$key),$s0);     # save output data
+                &mov    (&DWP(4,$key),$s1);
+                &mov    (&DWP(8,$key),$s2);
+                &mov    (&DWP(12,$key),$s3);
+
+                &mov    ($s2,$_len);            # load len
+
+                &lea    ($acc,&DWP(16,$acc));
+                &mov    ($_inp,$acc);           # save inp
+
+                &lea    ($s3,&DWP(16,$key));
+                &mov    ($_out,$s3);            # save out
+
+                &sub    ($s2,16);
+                &test   ($s2,0xFFFFFFF0);
+                &mov    ($_len,$s2);            # save len
+        &jnz    (&label("enc_loop"));
+        &test   ($s2,15);
+        &jnz    (&label("enc_tail"));
+        &mov    ($acc,$_ivp);           # load ivp
+        &mov    ($s2,&DWP(8,$key));     # restore last dwords
+        &mov    ($s3,&DWP(12,$key));
+        &mov    (&DWP(0,$acc),$s0);     # save ivec
+        &mov    (&DWP(4,$acc),$s1);
+        &mov    (&DWP(8,$acc),$s2);
+        &mov    (&DWP(12,$acc),$s3);
+
+        &cmp    ($mark,0);              # was the key schedule copied?
+        &mov    ("edi",$_key);
+        &je     (&label("skip_ezero"));
+        # zero copy of key schedule
+        &mov    ("ecx",240/4);
+        &xor    ("eax","eax");
+        &align  (4);
+        &data_word(0xABF3F689); # rep stosd
+        &set_label("skip_ezero")
+        &mov    ("esp",$_esp);
+        &popf   ();
+    &set_label("enc_out");
+        &function_end_A();
+        &pushf  ();                     # kludge, never executed
+
+    &align      (4);
+    &set_label("enc_tail");
+        &push   ($key eq "edi" ? $key : "");    # push ivp
+        &mov    ($key,$_out);                   # load out
+        &mov    ($s1,16);
+        &sub    ($s1,$s2);
+        &cmp    ($key,$acc);                    # compare with inp
+        &je     (&label("enc_in_place"));
+        &align  (4);
+        &data_word(0xA4F3F689); # rep movsb     # copy input
+        &jmp    (&label("enc_skip_in_place"));
+    &set_label("enc_in_place");
+        &lea    ($key,&DWP(0,$key,$s2));
+    &set_label("enc_skip_in_place");
+        &mov    ($s2,$s1);
+        &xor    ($s0,$s0);
+        &align  (4);
+        &data_word(0xAAF3F689); # rep stosb     # zero tail
+        &pop    ($key);                         # pop ivp
+
+        &mov    ($acc,$_out);                   # output as input
+        &mov    ($s0,&DWP(0,$key));
+        &mov    ($s1,&DWP(4,$key));
+        &mov    ($_len,16);                     # len=16
+        &jmp    (&label("enc_loop"));           # one more spin...
+
+#----------------------------- DECRYPT -----------------------------#
+&align  (4);
+&set_label("DECRYPT");
+        &lea    ("ebp",&DWP(&label("AES_Td")."-".&label("pic_point"),"ebp"));
+
+        # allocate aligned stack frame...
+        &lea    ($key,&DWP(-64-244,"esp"));
+        &and    ($key,-64);
+
+        # ... and make sure it doesn't alias with AES_Td modulo 4096
+        &mov    ($s0,"ebp");
+        &lea    ($s1,&DWP(2048+256,"ebp"));
+        &mov    ($s3,$key);
+        &and    ($s0,0xfff);            # s = %ebp&0xfff
+        &and    ($s1,0xfff);            # e = (%ebp+2048+256)&0xfff
+        &and    ($s3,0xfff);            # p = %esp&0xfff
+
+        &cmp    ($s3,$s1);              # if (p>=e) %esp =- (p-e);
+        &jb     (&label("td_break_out"));
+        &sub    ($s3,$s1);
+        &sub    ($key,$s3);
+        &jmp    (&label("td_ok"));
+        &set_label("td_break_out");     # else %esp -= (p-s)&0xfff + framesz;
+        &sub    ($s3,$s0);
+        &and    ($s3,0xfff);
+        &add    ($s3,64+256);
+        &sub    ($key,$s3);
+        &align  (4);
+        &set_label("td_ok");
+
+        &mov    ($s0,&wparam(0));       # load inp
+        &mov    ($s1,&wparam(1));       # load out
+        &mov    ($s3,&wparam(3));       # load key
+        &mov    ($acc,&wparam(4));      # load ivp
+
+        &exch   ("esp",$key);
+        &add    ("esp",4);              # reserve for return address!
+        &mov    ($_esp,$key);           # save %esp
+
+        &mov    ($_inp,$s0);            # save copy of inp
+        &mov    ($_out,$s1);            # save copy of out
+        &mov    ($_len,$s2);            # save copy of len
+        &mov    ($_key,$s3);            # save copy of key
+        &mov    ($_ivp,$acc);           # save copy of ivp
+
+        &mov    ($mark,0);              # copy of aes_key->rounds = 0;
+        if ($compromise) {
+                &cmp    ($s2,$compromise);
+                &jb     (&label("skip_dcopy"));
+        }
+        # do we copy key schedule to stack?
+        &mov    ($s1 eq "ebx" ? $s1 : "",$s3);
+        &mov    ($s2 eq "ecx" ? $s2 : "",244/4);
+        &sub    ($s1,"ebp");
+        &mov    ("esi",$s3);
+        &and    ($s1,0xfff);
+        &lea    ("edi",$aes_key);
+        &cmp    ($s1,2048+256);
+        &jb     (&label("do_dcopy"));
+        &cmp    ($s1,4096-244);
+        &jb     (&label("skip_dcopy"));
+        &align  (4);
+        &set_label("do_dcopy");
+                &mov    ($_key,"edi");
+                &data_word(0xA5F3F689); # rep movsd
+        &set_label("skip_dcopy");
+
+        &mov    ($acc,$s0);
+        &mov    ($key,18);
+        &align  (4);
+        &set_label("prefetch_td");
+                &mov    ($s0,&DWP(0,"ebp"));
+                &mov    ($s1,&DWP(32,"ebp"));
+                &mov    ($s2,&DWP(64,"ebp"));
+                &mov    ($s3,&DWP(96,"ebp"));
+                &lea    ("ebp",&DWP(128,"ebp"));
+                &dec    ($key);
+        &jnz    (&label("prefetch_td"));
+        &sub    ("ebp",2048+256);
+
+        &cmp    ($acc,$_out);
+        &je     (&label("dec_in_place"));       # in-place processing...
+
+        &mov    ($key,$_ivp);           # load ivp
+        &mov    ($_tmp,$key);
+
+        &align  (4);
+        &set_label("dec_loop");
+                &mov    ($s0,&DWP(0,$acc));     # read input
+                &mov    ($s1,&DWP(4,$acc));
+                &mov    ($s2,&DWP(8,$acc));
+                &mov    ($s3,&DWP(12,$acc));
+
+                &mov    ($key,$_key);           # load key
+                &call   ("_x86_AES_decrypt");
+
+                &mov    ($key,$_tmp);           # load ivp
+                &mov    ($acc,$_len);           # load len
+                &xor    ($s0,&DWP(0,$key));     # xor iv
+                &xor    ($s1,&DWP(4,$key));
+                &xor    ($s2,&DWP(8,$key));
+                &xor    ($s3,&DWP(12,$key));
+
+                &sub    ($acc,16);
+                &jc     (&label("dec_partial"));
+                &mov    ($_len,$acc);           # save len
+                &mov    ($acc,$_inp);           # load inp
+                &mov    ($key,$_out);           # load out
+
+                &mov    (&DWP(0,$key),$s0);     # write output
+                &mov    (&DWP(4,$key),$s1);
+                &mov    (&DWP(8,$key),$s2);
+                &mov    (&DWP(12,$key),$s3);
+
+                &mov    ($_tmp,$acc);           # save ivp
+                &lea    ($acc,&DWP(16,$acc));
+                &mov    ($_inp,$acc);           # save inp
+
+                &lea    ($key,&DWP(16,$key));
+                &mov    ($_out,$key);           # save out
+
+        &jnz    (&label("dec_loop"));
+        &mov    ($key,$_tmp);           # load temp ivp
+    &set_label("dec_end");
+        &mov    ($acc,$_ivp);           # load user ivp
+        &mov    ($s0,&DWP(0,$key));     # load iv
+        &mov    ($s1,&DWP(4,$key));
+        &mov    ($s2,&DWP(8,$key));
+        &mov    ($s3,&DWP(12,$key));
+        &mov    (&DWP(0,$acc),$s0);     # copy back to user
+        &mov    (&DWP(4,$acc),$s1);
+        &mov    (&DWP(8,$acc),$s2);
+        &mov    (&DWP(12,$acc),$s3);
+        &jmp    (&label("dec_out"));
+
+    &align      (4);
+    &set_label("dec_partial");
+        &lea    ($key,$ivec);
+        &mov    (&DWP(0,$key),$s0);     # dump output to stack
         &mov    (&DWP(4,$key),$s1);
         &mov    (&DWP(8,$key),$s2);
         &mov    (&DWP(12,$key),$s3);
+        &lea    ($s2 eq "ecx" ? $s2 : "",&DWP(16,$acc));
+        &mov    ($acc eq "esi" ? $acc : "",$key);
+        &mov    ($key eq "edi" ? $key : "",$_out);      # load out
+        &data_word(0xA4F3F689); # rep movsb             # copy output
+        &mov    ($key,$_inp);                           # use inp as temp ivp
+        &jmp    (&label("dec_end"));
+
+    &align      (4);
+    &set_label("dec_in_place");
+        &set_label("dec_in_place_loop");
+                &lea    ($key,$ivec);
+                &mov    ($s0,&DWP(0,$acc));     # read input
+                &mov    ($s1,&DWP(4,$acc));
+                &mov    ($s2,&DWP(8,$acc));
+                &mov    ($s3,&DWP(12,$acc));
+
+                &mov    (&DWP(0,$key),$s0);     # copy to temp
+                &mov    (&DWP(4,$key),$s1);
+                &mov    (&DWP(8,$key),$s2);
+                &mov    (&DWP(12,$key),$s3);
+
+                &mov    ($key,$_key);           # load key
+                &call   ("_x86_AES_decrypt");
+
+                &mov    ($key,$_ivp);           # load ivp
+                &mov    ($acc,$_out);           # load out
+                &xor    ($s0,&DWP(0,$key));     # xor iv
+                &xor    ($s1,&DWP(4,$key));
+                &xor    ($s2,&DWP(8,$key));
+                &xor    ($s3,&DWP(12,$key));
 
-        &pop    ("edi");
-        &pop    ("esi");
-        &pop    ("ebx");
-        &pop    ("ebp");
-        &ret    ();
+                &mov    (&DWP(0,$acc),$s0);     # write output
+                &mov    (&DWP(4,$acc),$s1);
+                &mov    (&DWP(8,$acc),$s2);
+                &mov    (&DWP(12,$acc),$s3);
+
+                &lea    ($acc,&DWP(16,$acc));
+                &mov    ($_out,$acc);           # save out
+
+                &lea    ($acc,$ivec);
+                &mov    ($s0,&DWP(0,$acc));     # read temp
+                &mov    ($s1,&DWP(4,$acc));
+                &mov    ($s2,&DWP(8,$acc));
+                &mov    ($s3,&DWP(12,$acc));
+
+                &mov    (&DWP(0,$key),$s0);     # copy iv
+                &mov    (&DWP(4,$key),$s1);
+                &mov    (&DWP(8,$key),$s2);
+                &mov    (&DWP(12,$key),$s3);
+
+                &mov    ($acc,$_inp);           # load inp
+
+                &lea    ($acc,&DWP(16,$acc));
+                &mov    ($_inp,$acc);           # save inp
+
+                &mov    ($s2,$_len);            # load len
+                &sub    ($s2,16);
+                &jc     (&label("dec_in_place_partial"));
+                &mov    ($_len,$s2);            # save len
+        &jnz    (&label("dec_in_place_loop"));
+        &jmp    (&label("dec_out"));
+
+    &align      (4);
+    &set_label("dec_in_place_partial");
+        # one can argue if this is actually required...
+        &mov    ($key eq "edi" ? $key : "",$_out);
+        &lea    ($acc eq "esi" ? $acc : "",$ivec);
+        &lea    ($key,&DWP(0,$key,$s2));
+        &lea    ($acc,&DWP(16,$acc,$s2));
+        &neg    ($s2 eq "ecx" ? $s2 : "");
+        &data_word(0xA4F3F689); # rep movsb     # restore tail
+
+    &align      (4);
+    &set_label("dec_out");
+    &cmp        ($mark,0);              # was the key schedule copied?
+    &mov        ("edi",$_key);
+    &je         (&label("skip_dzero"));
+    # zero copy of key schedule
+    &mov        ("ecx",240/4);
+    &xor        ("eax","eax");
+    &align      (4);
+    &data_word(0xABF3F689);     # rep stosd
+    &set_label("skip_dzero")
+    &mov        ("esp",$_esp);
+    &popf       ();
+&function_end("AES_cbc_encrypt");
+}
 
-&set_label("AES_Td",64);        # Yes! I keep it in the code segment!
-        &data_word(0x50a7f451, 0x5365417e, 0xc3a4171a, 0x965e273a);
-        &data_word(0xcb6bab3b, 0xf1459d1f, 0xab58faac, 0x9303e34b);
-        &data_word(0x55fa3020, 0xf66d76ad, 0x9176cc88, 0x254c02f5);
-        &data_word(0xfcd7e54f, 0xd7cb2ac5, 0x80443526, 0x8fa362b5);
-        &data_word(0x495ab1de, 0x671bba25, 0x980eea45, 0xe1c0fe5d);
-        &data_word(0x02752fc3, 0x12f04c81, 0xa397468d, 0xc6f9d36b);
-        &data_word(0xe75f8f03, 0x959c9215, 0xeb7a6dbf, 0xda595295);
-        &data_word(0x2d83bed4, 0xd3217458, 0x2969e049, 0x44c8c98e);
-        &data_word(0x6a89c275, 0x78798ef4, 0x6b3e5899, 0xdd71b927);
-        &data_word(0xb64fe1be, 0x17ad88f0, 0x66ac20c9, 0xb43ace7d);
-        &data_word(0x184adf63, 0x82311ae5, 0x60335197, 0x457f5362);
-        &data_word(0xe07764b1, 0x84ae6bbb, 0x1ca081fe, 0x942b08f9);
-        &data_word(0x58684870, 0x19fd458f, 0x876cde94, 0xb7f87b52);
-        &data_word(0x23d373ab, 0xe2024b72, 0x578f1fe3, 0x2aab5566);
-        &data_word(0x0728ebb2, 0x03c2b52f, 0x9a7bc586, 0xa50837d3);
-        &data_word(0xf2872830, 0xb2a5bf23, 0xba6a0302, 0x5c8216ed);
-        &data_word(0x2b1ccf8a, 0x92b479a7, 0xf0f207f3, 0xa1e2694e);
-        &data_word(0xcdf4da65, 0xd5be0506, 0x1f6234d1, 0x8afea6c4);
-        &data_word(0x9d532e34, 0xa055f3a2, 0x32e18a05, 0x75ebf6a4);
-        &data_word(0x39ec830b, 0xaaef6040, 0x069f715e, 0x51106ebd);
-        &data_word(0xf98a213e, 0x3d06dd96, 0xae053edd, 0x46bde64d);
-        &data_word(0xb58d5491, 0x055dc471, 0x6fd40604, 0xff155060);
-        &data_word(0x24fb9819, 0x97e9bdd6, 0xcc434089, 0x779ed967);
-        &data_word(0xbd42e8b0, 0x888b8907, 0x385b19e7, 0xdbeec879);
-        &data_word(0x470a7ca1, 0xe90f427c, 0xc91e84f8, 0x00000000);
-        &data_word(0x83868009, 0x48ed2b32, 0xac70111e, 0x4e725a6c);
-        &data_word(0xfbff0efd, 0x5638850f, 0x1ed5ae3d, 0x27392d36);
-        &data_word(0x64d90f0a, 0x21a65c68, 0xd1545b9b, 0x3a2e3624);
-        &data_word(0xb1670a0c, 0x0fe75793, 0xd296eeb4, 0x9e919b1b);
-        &data_word(0x4fc5c080, 0xa220dc61, 0x694b775a, 0x161a121c);
-        &data_word(0x0aba93e2, 0xe52aa0c0, 0x43e0223c, 0x1d171b12);
-        &data_word(0x0b0d090e, 0xadc78bf2, 0xb9a8b62d, 0xc8a91e14);
-        &data_word(0x8519f157, 0x4c0775af, 0xbbdd99ee, 0xfd607fa3);
-        &data_word(0x9f2601f7, 0xbcf5725c, 0xc53b6644, 0x347efb5b);
-        &data_word(0x7629438b, 0xdcc623cb, 0x68fcedb6, 0x63f1e4b8);
-        &data_word(0xcadc31d7, 0x10856342, 0x40229713, 0x2011c684);
-        &data_word(0x7d244a85, 0xf83dbbd2, 0x1132f9ae, 0x6da129c7);
-        &data_word(0x4b2f9e1d, 0xf330b2dc, 0xec52860d, 0xd0e3c177);
-        &data_word(0x6c16b32b, 0x99b970a9, 0xfa489411, 0x2264e947);
-        &data_word(0xc48cfca8, 0x1a3ff0a0, 0xd82c7d56, 0xef903322);
-        &data_word(0xc74e4987, 0xc1d138d9, 0xfea2ca8c, 0x360bd498);
-        &data_word(0xcf81f5a6, 0x28de7aa5, 0x268eb7da, 0xa4bfad3f);
-        &data_word(0xe49d3a2c, 0x0d927850, 0x9bcc5f6a, 0x62467e54);
-        &data_word(0xc2138df6, 0xe8b8d890, 0x5ef7392e, 0xf5afc382);
-        &data_word(0xbe805d9f, 0x7c93d069, 0xa92dd56f, 0xb31225cf);
-        &data_word(0x3b99acc8, 0xa77d1810, 0x6e639ce8, 0x7bbb3bdb);
-        &data_word(0x097826cd, 0xf418596e, 0x01b79aec, 0xa89a4f83);
-        &data_word(0x656e95e6, 0x7ee6ffaa, 0x08cfbc21, 0xe6e815ef);
-        &data_word(0xd99be7ba, 0xce366f4a, 0xd4099fea, 0xd67cb029);
-        &data_word(0xafb2a431, 0x31233f2a, 0x3094a5c6, 0xc066a235);
-        &data_word(0x37bc4e74, 0xa6ca82fc, 0xb0d090e0, 0x15d8a733);
-        &data_word(0x4a9804f1, 0xf7daec41, 0x0e50cd7f, 0x2ff69117);
-        &data_word(0x8dd64d76, 0x4db0ef43, 0x544daacc, 0xdf0496e4);
-        &data_word(0xe3b5d19e, 0x1b886a4c, 0xb81f2cc1, 0x7f516546);
-        &data_word(0x04ea5e9d, 0x5d358c01, 0x737487fa, 0x2e410bfb);
-        &data_word(0x5a1d67b3, 0x52d2db92, 0x335610e9, 0x1347d66d);
-        &data_word(0x8c61d79a, 0x7a0ca137, 0x8e14f859, 0x893c13eb);
-        &data_word(0xee27a9ce, 0x35c961b7, 0xede51ce1, 0x3cb1477a);
-        &data_word(0x59dfd29c, 0x3f73f255, 0x79ce1418, 0xbf37c773);
-        &data_word(0xeacdf753, 0x5baafd5f, 0x146f3ddf, 0x86db4478);
-        &data_word(0x81f3afca, 0x3ec468b9, 0x2c342438, 0x5f40a3c2);
-        &data_word(0x72c31d16, 0x0c25e2bc, 0x8b493c28, 0x41950dff);
-        &data_word(0x7101a839, 0xdeb30c08, 0x9ce4b4d8, 0x90c15664);
-        &data_word(0x6184cb7b, 0x70b632d5, 0x745c6c48, 0x4257b8d0);
-#Td1:
-        &data_word(0xa7f45150, 0x65417e53, 0xa4171ac3, 0x5e273a96);
-        &data_word(0x6bab3bcb, 0x459d1ff1, 0x58faacab, 0x03e34b93);
-        &data_word(0xfa302055, 0x6d76adf6, 0x76cc8891, 0x4c02f525);
-        &data_word(0xd7e54ffc, 0xcb2ac5d7, 0x44352680, 0xa362b58f);
-        &data_word(0x5ab1de49, 0x1bba2567, 0x0eea4598, 0xc0fe5de1);
-        &data_word(0x752fc302, 0xf04c8112, 0x97468da3, 0xf9d36bc6);
-        &data_word(0x5f8f03e7, 0x9c921595, 0x7a6dbfeb, 0x595295da);
-        &data_word(0x83bed42d, 0x217458d3, 0x69e04929, 0xc8c98e44);
-        &data_word(0x89c2756a, 0x798ef478, 0x3e58996b, 0x71b927dd);
-        &data_word(0x4fe1beb6, 0xad88f017, 0xac20c966, 0x3ace7db4);
-        &data_word(0x4adf6318, 0x311ae582, 0x33519760, 0x7f536245);
-        &data_word(0x7764b1e0, 0xae6bbb84, 0xa081fe1c, 0x2b08f994);
-        &data_word(0x68487058, 0xfd458f19, 0x6cde9487, 0xf87b52b7);
-        &data_word(0xd373ab23, 0x024b72e2, 0x8f1fe357, 0xab55662a);
-        &data_word(0x28ebb207, 0xc2b52f03, 0x7bc5869a, 0x0837d3a5);
-        &data_word(0x872830f2, 0xa5bf23b2, 0x6a0302ba, 0x8216ed5c);
-        &data_word(0x1ccf8a2b, 0xb479a792, 0xf207f3f0, 0xe2694ea1);
-        &data_word(0xf4da65cd, 0xbe0506d5, 0x6234d11f, 0xfea6c48a);
-        &data_word(0x532e349d, 0x55f3a2a0, 0xe18a0532, 0xebf6a475);
-        &data_word(0xec830b39, 0xef6040aa, 0x9f715e06, 0x106ebd51);
-        &data_word(0x8a213ef9, 0x06dd963d, 0x053eddae, 0xbde64d46);
-        &data_word(0x8d5491b5, 0x5dc47105, 0xd406046f, 0x155060ff);
-        &data_word(0xfb981924, 0xe9bdd697, 0x434089cc, 0x9ed96777);
-        &data_word(0x42e8b0bd, 0x8b890788, 0x5b19e738, 0xeec879db);
-        &data_word(0x0a7ca147, 0x0f427ce9, 0x1e84f8c9, 0x00000000);
-        &data_word(0x86800983, 0xed2b3248, 0x70111eac, 0x725a6c4e);
-        &data_word(0xff0efdfb, 0x38850f56, 0xd5ae3d1e, 0x392d3627);
-        &data_word(0xd90f0a64, 0xa65c6821, 0x545b9bd1, 0x2e36243a);
-        &data_word(0x670a0cb1, 0xe757930f, 0x96eeb4d2, 0x919b1b9e);
-        &data_word(0xc5c0804f, 0x20dc61a2, 0x4b775a69, 0x1a121c16);
-        &data_word(0xba93e20a, 0x2aa0c0e5, 0xe0223c43, 0x171b121d);
-        &data_word(0x0d090e0b, 0xc78bf2ad, 0xa8b62db9, 0xa91e14c8);
-        &data_word(0x19f15785, 0x0775af4c, 0xdd99eebb, 0x607fa3fd);
-        &data_word(0x2601f79f, 0xf5725cbc, 0x3b6644c5, 0x7efb5b34);
-        &data_word(0x29438b76, 0xc623cbdc, 0xfcedb668, 0xf1e4b863);
-        &data_word(0xdc31d7ca, 0x85634210, 0x22971340, 0x11c68420);
-        &data_word(0x244a857d, 0x3dbbd2f8, 0x32f9ae11, 0xa129c76d);
-        &data_word(0x2f9e1d4b, 0x30b2dcf3, 0x52860dec, 0xe3c177d0);
-        &data_word(0x16b32b6c, 0xb970a999, 0x489411fa, 0x64e94722);
-        &data_word(0x8cfca8c4, 0x3ff0a01a, 0x2c7d56d8, 0x903322ef);
-        &data_word(0x4e4987c7, 0xd138d9c1, 0xa2ca8cfe, 0x0bd49836);
-        &data_word(0x81f5a6cf, 0xde7aa528, 0x8eb7da26, 0xbfad3fa4);
-        &data_word(0x9d3a2ce4, 0x9278500d, 0xcc5f6a9b, 0x467e5462);
-        &data_word(0x138df6c2, 0xb8d890e8, 0xf7392e5e, 0xafc382f5);
-        &data_word(0x805d9fbe, 0x93d0697c, 0x2dd56fa9, 0x1225cfb3);
-        &data_word(0x99acc83b, 0x7d1810a7, 0x639ce86e, 0xbb3bdb7b);
-        &data_word(0x7826cd09, 0x18596ef4, 0xb79aec01, 0x9a4f83a8);
-        &data_word(0x6e95e665, 0xe6ffaa7e, 0xcfbc2108, 0xe815efe6);
-        &data_word(0x9be7bad9, 0x366f4ace, 0x099fead4, 0x7cb029d6);
-        &data_word(0xb2a431af, 0x233f2a31, 0x94a5c630, 0x66a235c0);
-        &data_word(0xbc4e7437, 0xca82fca6, 0xd090e0b0, 0xd8a73315);
-        &data_word(0x9804f14a, 0xdaec41f7, 0x50cd7f0e, 0xf691172f);
-        &data_word(0xd64d768d, 0xb0ef434d, 0x4daacc54, 0x0496e4df);
-        &data_word(0xb5d19ee3, 0x886a4c1b, 0x1f2cc1b8, 0x5165467f);
-        &data_word(0xea5e9d04, 0x358c015d, 0x7487fa73, 0x410bfb2e);
-        &data_word(0x1d67b35a, 0xd2db9252, 0x5610e933, 0x47d66d13);
-        &data_word(0x61d79a8c, 0x0ca1377a, 0x14f8598e, 0x3c13eb89);
-        &data_word(0x27a9ceee, 0xc961b735, 0xe51ce1ed, 0xb1477a3c);
-        &data_word(0xdfd29c59, 0x73f2553f, 0xce141879, 0x37c773bf);
-        &data_word(0xcdf753ea, 0xaafd5f5b, 0x6f3ddf14, 0xdb447886);
-        &data_word(0xf3afca81, 0xc468b93e, 0x3424382c, 0x40a3c25f);
-        &data_word(0xc31d1672, 0x25e2bc0c, 0x493c288b, 0x950dff41);
-        &data_word(0x01a83971, 0xb30c08de, 0xe4b4d89c, 0xc1566490);
-        &data_word(0x84cb7b61, 0xb632d570, 0x5c6c4874, 0x57b8d042);
-#Td2:
-        &data_word(0xf45150a7, 0x417e5365, 0x171ac3a4, 0x273a965e);
-        &data_word(0xab3bcb6b, 0x9d1ff145, 0xfaacab58, 0xe34b9303);
-        &data_word(0x302055fa, 0x76adf66d, 0xcc889176, 0x02f5254c);
-        &data_word(0xe54ffcd7, 0x2ac5d7cb, 0x35268044, 0x62b58fa3);
-        &data_word(0xb1de495a, 0xba25671b, 0xea45980e, 0xfe5de1c0);
-        &data_word(0x2fc30275, 0x4c8112f0, 0x468da397, 0xd36bc6f9);
-        &data_word(0x8f03e75f, 0x9215959c, 0x6dbfeb7a, 0x5295da59);
-        &data_word(0xbed42d83, 0x7458d321, 0xe0492969, 0xc98e44c8);
-        &data_word(0xc2756a89, 0x8ef47879, 0x58996b3e, 0xb927dd71);
-        &data_word(0xe1beb64f, 0x88f017ad, 0x20c966ac, 0xce7db43a);
-        &data_word(0xdf63184a, 0x1ae58231, 0x51976033, 0x5362457f);
-        &data_word(0x64b1e077, 0x6bbb84ae, 0x81fe1ca0, 0x08f9942b);
-        &data_word(0x48705868, 0x458f19fd, 0xde94876c, 0x7b52b7f8);
-        &data_word(0x73ab23d3, 0x4b72e202, 0x1fe3578f, 0x55662aab);
-        &data_word(0xebb20728, 0xb52f03c2, 0xc5869a7b, 0x37d3a508);
-        &data_word(0x2830f287, 0xbf23b2a5, 0x0302ba6a, 0x16ed5c82);
-        &data_word(0xcf8a2b1c, 0x79a792b4, 0x07f3f0f2, 0x694ea1e2);
-        &data_word(0xda65cdf4, 0x0506d5be, 0x34d11f62, 0xa6c48afe);
-        &data_word(0x2e349d53, 0xf3a2a055, 0x8a0532e1, 0xf6a475eb);
-        &data_word(0x830b39ec, 0x6040aaef, 0x715e069f, 0x6ebd5110);
-        &data_word(0x213ef98a, 0xdd963d06, 0x3eddae05, 0xe64d46bd);
-        &data_word(0x5491b58d, 0xc471055d, 0x06046fd4, 0x5060ff15);
-        &data_word(0x981924fb, 0xbdd697e9, 0x4089cc43, 0xd967779e);
-        &data_word(0xe8b0bd42, 0x8907888b, 0x19e7385b, 0xc879dbee);
-        &data_word(0x7ca1470a, 0x427ce90f, 0x84f8c91e, 0x00000000);
-        &data_word(0x80098386, 0x2b3248ed, 0x111eac70, 0x5a6c4e72);
-        &data_word(0x0efdfbff, 0x850f5638, 0xae3d1ed5, 0x2d362739);
-        &data_word(0x0f0a64d9, 0x5c6821a6, 0x5b9bd154, 0x36243a2e);
-        &data_word(0x0a0cb167, 0x57930fe7, 0xeeb4d296, 0x9b1b9e91);
-        &data_word(0xc0804fc5, 0xdc61a220, 0x775a694b, 0x121c161a);
-        &data_word(0x93e20aba, 0xa0c0e52a, 0x223c43e0, 0x1b121d17);
-        &data_word(0x090e0b0d, 0x8bf2adc7, 0xb62db9a8, 0x1e14c8a9);
-        &data_word(0xf1578519, 0x75af4c07, 0x99eebbdd, 0x7fa3fd60);
-        &data_word(0x01f79f26, 0x725cbcf5, 0x6644c53b, 0xfb5b347e);
-        &data_word(0x438b7629, 0x23cbdcc6, 0xedb668fc, 0xe4b863f1);
-        &data_word(0x31d7cadc, 0x63421085, 0x97134022, 0xc6842011);
-        &data_word(0x4a857d24, 0xbbd2f83d, 0xf9ae1132, 0x29c76da1);
-        &data_word(0x9e1d4b2f, 0xb2dcf330, 0x860dec52, 0xc177d0e3);
-        &data_word(0xb32b6c16, 0x70a999b9, 0x9411fa48, 0xe9472264);
-        &data_word(0xfca8c48c, 0xf0a01a3f, 0x7d56d82c, 0x3322ef90);
-        &data_word(0x4987c74e, 0x38d9c1d1, 0xca8cfea2, 0xd498360b);
-        &data_word(0xf5a6cf81, 0x7aa528de, 0xb7da268e, 0xad3fa4bf);
-        &data_word(0x3a2ce49d, 0x78500d92, 0x5f6a9bcc, 0x7e546246);
-        &data_word(0x8df6c213, 0xd890e8b8, 0x392e5ef7, 0xc382f5af);
-        &data_word(0x5d9fbe80, 0xd0697c93, 0xd56fa92d, 0x25cfb312);
-        &data_word(0xacc83b99, 0x1810a77d, 0x9ce86e63, 0x3bdb7bbb);
-        &data_word(0x26cd0978, 0x596ef418, 0x9aec01b7, 0x4f83a89a);
-        &data_word(0x95e6656e, 0xffaa7ee6, 0xbc2108cf, 0x15efe6e8);
-        &data_word(0xe7bad99b, 0x6f4ace36, 0x9fead409, 0xb029d67c);
-        &data_word(0xa431afb2, 0x3f2a3123, 0xa5c63094, 0xa235c066);
-        &data_word(0x4e7437bc, 0x82fca6ca, 0x90e0b0d0, 0xa73315d8);
-        &data_word(0x04f14a98, 0xec41f7da, 0xcd7f0e50, 0x91172ff6);
-        &data_word(0x4d768dd6, 0xef434db0, 0xaacc544d, 0x96e4df04);
-        &data_word(0xd19ee3b5, 0x6a4c1b88, 0x2cc1b81f, 0x65467f51);
-        &data_word(0x5e9d04ea, 0x8c015d35, 0x87fa7374, 0x0bfb2e41);
-        &data_word(0x67b35a1d, 0xdb9252d2, 0x10e93356, 0xd66d1347);
-        &data_word(0xd79a8c61, 0xa1377a0c, 0xf8598e14, 0x13eb893c);
-        &data_word(0xa9ceee27, 0x61b735c9, 0x1ce1ede5, 0x477a3cb1);
-        &data_word(0xd29c59df, 0xf2553f73, 0x141879ce, 0xc773bf37);
-        &data_word(0xf753eacd, 0xfd5f5baa, 0x3ddf146f, 0x447886db);
-        &data_word(0xafca81f3, 0x68b93ec4, 0x24382c34, 0xa3c25f40);
-        &data_word(0x1d1672c3, 0xe2bc0c25, 0x3c288b49, 0x0dff4195);
-        &data_word(0xa8397101, 0x0c08deb3, 0xb4d89ce4, 0x566490c1);
-        &data_word(0xcb7b6184, 0x32d570b6, 0x6c48745c, 0xb8d04257);
-#Td3:
-        &data_word(0x5150a7f4, 0x7e536541, 0x1ac3a417, 0x3a965e27);
-        &data_word(0x3bcb6bab, 0x1ff1459d, 0xacab58fa, 0x4b9303e3);
-        &data_word(0x2055fa30, 0xadf66d76, 0x889176cc, 0xf5254c02);
-        &data_word(0x4ffcd7e5, 0xc5d7cb2a, 0x26804435, 0xb58fa362);
-        &data_word(0xde495ab1, 0x25671bba, 0x45980eea, 0x5de1c0fe);
-        &data_word(0xc302752f, 0x8112f04c, 0x8da39746, 0x6bc6f9d3);
-        &data_word(0x03e75f8f, 0x15959c92, 0xbfeb7a6d, 0x95da5952);
-        &data_word(0xd42d83be, 0x58d32174, 0x492969e0, 0x8e44c8c9);
-        &data_word(0x756a89c2, 0xf478798e, 0x996b3e58, 0x27dd71b9);
-        &data_word(0xbeb64fe1, 0xf017ad88, 0xc966ac20, 0x7db43ace);
-        &data_word(0x63184adf, 0xe582311a, 0x97603351, 0x62457f53);
-        &data_word(0xb1e07764, 0xbb84ae6b, 0xfe1ca081, 0xf9942b08);
-        &data_word(0x70586848, 0x8f19fd45, 0x94876cde, 0x52b7f87b);
-        &data_word(0xab23d373, 0x72e2024b, 0xe3578f1f, 0x662aab55);
-        &data_word(0xb20728eb, 0x2f03c2b5, 0x869a7bc5, 0xd3a50837);
-        &data_word(0x30f28728, 0x23b2a5bf, 0x02ba6a03, 0xed5c8216);
-        &data_word(0x8a2b1ccf, 0xa792b479, 0xf3f0f207, 0x4ea1e269);
-        &data_word(0x65cdf4da, 0x06d5be05, 0xd11f6234, 0xc48afea6);
-        &data_word(0x349d532e, 0xa2a055f3, 0x0532e18a, 0xa475ebf6);
-        &data_word(0x0b39ec83, 0x40aaef60, 0x5e069f71, 0xbd51106e);
-        &data_word(0x3ef98a21, 0x963d06dd, 0xddae053e, 0x4d46bde6);
-        &data_word(0x91b58d54, 0x71055dc4, 0x046fd406, 0x60ff1550);
-        &data_word(0x1924fb98, 0xd697e9bd, 0x89cc4340, 0x67779ed9);
-        &data_word(0xb0bd42e8, 0x07888b89, 0xe7385b19, 0x79dbeec8);
-        &data_word(0xa1470a7c, 0x7ce90f42, 0xf8c91e84, 0x00000000);
-        &data_word(0x09838680, 0x3248ed2b, 0x1eac7011, 0x6c4e725a);
-        &data_word(0xfdfbff0e, 0x0f563885, 0x3d1ed5ae, 0x3627392d);
-        &data_word(0x0a64d90f, 0x6821a65c, 0x9bd1545b, 0x243a2e36);
-        &data_word(0x0cb1670a, 0x930fe757, 0xb4d296ee, 0x1b9e919b);
-        &data_word(0x804fc5c0, 0x61a220dc, 0x5a694b77, 0x1c161a12);
-        &data_word(0xe20aba93, 0xc0e52aa0, 0x3c43e022, 0x121d171b);
-        &data_word(0x0e0b0d09, 0xf2adc78b, 0x2db9a8b6, 0x14c8a91e);
-        &data_word(0x578519f1, 0xaf4c0775, 0xeebbdd99, 0xa3fd607f);
-        &data_word(0xf79f2601, 0x5cbcf572, 0x44c53b66, 0x5b347efb);
-        &data_word(0x8b762943, 0xcbdcc623, 0xb668fced, 0xb863f1e4);
-        &data_word(0xd7cadc31, 0x42108563, 0x13402297, 0x842011c6);
-        &data_word(0x857d244a, 0xd2f83dbb, 0xae1132f9, 0xc76da129);
-        &data_word(0x1d4b2f9e, 0xdcf330b2, 0x0dec5286, 0x77d0e3c1);
-        &data_word(0x2b6c16b3, 0xa999b970, 0x11fa4894, 0x472264e9);
-        &data_word(0xa8c48cfc, 0xa01a3ff0, 0x56d82c7d, 0x22ef9033);
-        &data_word(0x87c74e49, 0xd9c1d138, 0x8cfea2ca, 0x98360bd4);
-        &data_word(0xa6cf81f5, 0xa528de7a, 0xda268eb7, 0x3fa4bfad);
-        &data_word(0x2ce49d3a, 0x500d9278, 0x6a9bcc5f, 0x5462467e);
-        &data_word(0xf6c2138d, 0x90e8b8d8, 0x2e5ef739, 0x82f5afc3);
-        &data_word(0x9fbe805d, 0x697c93d0, 0x6fa92dd5, 0xcfb31225);
-        &data_word(0xc83b99ac, 0x10a77d18, 0xe86e639c, 0xdb7bbb3b);
-        &data_word(0xcd097826, 0x6ef41859, 0xec01b79a, 0x83a89a4f);
-        &data_word(0xe6656e95, 0xaa7ee6ff, 0x2108cfbc, 0xefe6e815);
-        &data_word(0xbad99be7, 0x4ace366f, 0xead4099f, 0x29d67cb0);
-        &data_word(0x31afb2a4, 0x2a31233f, 0xc63094a5, 0x35c066a2);
-        &data_word(0x7437bc4e, 0xfca6ca82, 0xe0b0d090, 0x3315d8a7);
-        &data_word(0xf14a9804, 0x41f7daec, 0x7f0e50cd, 0x172ff691);
-        &data_word(0x768dd64d, 0x434db0ef, 0xcc544daa, 0xe4df0496);
-        &data_word(0x9ee3b5d1, 0x4c1b886a, 0xc1b81f2c, 0x467f5165);
-        &data_word(0x9d04ea5e, 0x015d358c, 0xfa737487, 0xfb2e410b);
-        &data_word(0xb35a1d67, 0x9252d2db, 0xe9335610, 0x6d1347d6);
-        &data_word(0x9a8c61d7, 0x377a0ca1, 0x598e14f8, 0xeb893c13);
-        &data_word(0xceee27a9, 0xb735c961, 0xe1ede51c, 0x7a3cb147);
-        &data_word(0x9c59dfd2, 0x553f73f2, 0x1879ce14, 0x73bf37c7);
-        &data_word(0x53eacdf7, 0x5f5baafd, 0xdf146f3d, 0x7886db44);
-        &data_word(0xca81f3af, 0xb93ec468, 0x382c3424, 0xc25f40a3);
-        &data_word(0x1672c31d, 0xbc0c25e2, 0x288b493c, 0xff41950d);
-        &data_word(0x397101a8, 0x08deb30c, 0xd89ce4b4, 0x6490c156);
-        &data_word(0x7b6184cb, 0xd570b632, 0x48745c6c, 0xd04257b8);
-#Td4:
-        &data_word(0x52525252, 0x09090909, 0x6a6a6a6a, 0xd5d5d5d5);
-        &data_word(0x30303030, 0x36363636, 0xa5a5a5a5, 0x38383838);
-        &data_word(0xbfbfbfbf, 0x40404040, 0xa3a3a3a3, 0x9e9e9e9e);
-        &data_word(0x81818181, 0xf3f3f3f3, 0xd7d7d7d7, 0xfbfbfbfb);
-        &data_word(0x7c7c7c7c, 0xe3e3e3e3, 0x39393939, 0x82828282);
-        &data_word(0x9b9b9b9b, 0x2f2f2f2f, 0xffffffff, 0x87878787);
-        &data_word(0x34343434, 0x8e8e8e8e, 0x43434343, 0x44444444);
-        &data_word(0xc4c4c4c4, 0xdededede, 0xe9e9e9e9, 0xcbcbcbcb);
-        &data_word(0x54545454, 0x7b7b7b7b, 0x94949494, 0x32323232);
-        &data_word(0xa6a6a6a6, 0xc2c2c2c2, 0x23232323, 0x3d3d3d3d);
-        &data_word(0xeeeeeeee, 0x4c4c4c4c, 0x95959595, 0x0b0b0b0b);
-        &data_word(0x42424242, 0xfafafafa, 0xc3c3c3c3, 0x4e4e4e4e);
-        &data_word(0x08080808, 0x2e2e2e2e, 0xa1a1a1a1, 0x66666666);
-        &data_word(0x28282828, 0xd9d9d9d9, 0x24242424, 0xb2b2b2b2);
-        &data_word(0x76767676, 0x5b5b5b5b, 0xa2a2a2a2, 0x49494949);
-        &data_word(0x6d6d6d6d, 0x8b8b8b8b, 0xd1d1d1d1, 0x25252525);
-        &data_word(0x72727272, 0xf8f8f8f8, 0xf6f6f6f6, 0x64646464);
-        &data_word(0x86868686, 0x68686868, 0x98989898, 0x16161616);
-        &data_word(0xd4d4d4d4, 0xa4a4a4a4, 0x5c5c5c5c, 0xcccccccc);
-        &data_word(0x5d5d5d5d, 0x65656565, 0xb6b6b6b6, 0x92929292);
-        &data_word(0x6c6c6c6c, 0x70707070, 0x48484848, 0x50505050);
-        &data_word(0xfdfdfdfd, 0xedededed, 0xb9b9b9b9, 0xdadadada);
-        &data_word(0x5e5e5e5e, 0x15151515, 0x46464646, 0x57575757);
-        &data_word(0xa7a7a7a7, 0x8d8d8d8d, 0x9d9d9d9d, 0x84848484);
-        &data_word(0x90909090, 0xd8d8d8d8, 0xabababab, 0x00000000);
-        &data_word(0x8c8c8c8c, 0xbcbcbcbc, 0xd3d3d3d3, 0x0a0a0a0a);
-        &data_word(0xf7f7f7f7, 0xe4e4e4e4, 0x58585858, 0x05050505);
-        &data_word(0xb8b8b8b8, 0xb3b3b3b3, 0x45454545, 0x06060606);
-        &data_word(0xd0d0d0d0, 0x2c2c2c2c, 0x1e1e1e1e, 0x8f8f8f8f);
-        &data_word(0xcacacaca, 0x3f3f3f3f, 0x0f0f0f0f, 0x02020202);
-        &data_word(0xc1c1c1c1, 0xafafafaf, 0xbdbdbdbd, 0x03030303);
-        &data_word(0x01010101, 0x13131313, 0x8a8a8a8a, 0x6b6b6b6b);
-        &data_word(0x3a3a3a3a, 0x91919191, 0x11111111, 0x41414141);
-        &data_word(0x4f4f4f4f, 0x67676767, 0xdcdcdcdc, 0xeaeaeaea);
-        &data_word(0x97979797, 0xf2f2f2f2, 0xcfcfcfcf, 0xcececece);
-        &data_word(0xf0f0f0f0, 0xb4b4b4b4, 0xe6e6e6e6, 0x73737373);
-        &data_word(0x96969696, 0xacacacac, 0x74747474, 0x22222222);
-        &data_word(0xe7e7e7e7, 0xadadadad, 0x35353535, 0x85858585);
-        &data_word(0xe2e2e2e2, 0xf9f9f9f9, 0x37373737, 0xe8e8e8e8);
-        &data_word(0x1c1c1c1c, 0x75757575, 0xdfdfdfdf, 0x6e6e6e6e);
-        &data_word(0x47474747, 0xf1f1f1f1, 0x1a1a1a1a, 0x71717171);
-        &data_word(0x1d1d1d1d, 0x29292929, 0xc5c5c5c5, 0x89898989);
-        &data_word(0x6f6f6f6f, 0xb7b7b7b7, 0x62626262, 0x0e0e0e0e);
-        &data_word(0xaaaaaaaa, 0x18181818, 0xbebebebe, 0x1b1b1b1b);
-        &data_word(0xfcfcfcfc, 0x56565656, 0x3e3e3e3e, 0x4b4b4b4b);
-        &data_word(0xc6c6c6c6, 0xd2d2d2d2, 0x79797979, 0x20202020);
-        &data_word(0x9a9a9a9a, 0xdbdbdbdb, 0xc0c0c0c0, 0xfefefefe);
-        &data_word(0x78787878, 0xcdcdcdcd, 0x5a5a5a5a, 0xf4f4f4f4);
-        &data_word(0x1f1f1f1f, 0xdddddddd, 0xa8a8a8a8, 0x33333333);
-        &data_word(0x88888888, 0x07070707, 0xc7c7c7c7, 0x31313131);
-        &data_word(0xb1b1b1b1, 0x12121212, 0x10101010, 0x59595959);
-        &data_word(0x27272727, 0x80808080, 0xecececec, 0x5f5f5f5f);
-        &data_word(0x60606060, 0x51515151, 0x7f7f7f7f, 0xa9a9a9a9);
-        &data_word(0x19191919, 0xb5b5b5b5, 0x4a4a4a4a, 0x0d0d0d0d);
-        &data_word(0x2d2d2d2d, 0xe5e5e5e5, 0x7a7a7a7a, 0x9f9f9f9f);
-        &data_word(0x93939393, 0xc9c9c9c9, 0x9c9c9c9c, 0xefefefef);
-        &data_word(0xa0a0a0a0, 0xe0e0e0e0, 0x3b3b3b3b, 0x4d4d4d4d);
-        &data_word(0xaeaeaeae, 0x2a2a2a2a, 0xf5f5f5f5, 0xb0b0b0b0);
-        &data_word(0xc8c8c8c8, 0xebebebeb, 0xbbbbbbbb, 0x3c3c3c3c);
-        &data_word(0x83838383, 0x53535353, 0x99999999, 0x61616161);
-        &data_word(0x17171717, 0x2b2b2b2b, 0x04040404, 0x7e7e7e7e);
-        &data_word(0xbabababa, 0x77777777, 0xd6d6d6d6, 0x26262626);
-        &data_word(0xe1e1e1e1, 0x69696969, 0x14141414, 0x63636363);
-        &data_word(0x55555555, 0x21212121, 0x0c0c0c0c, 0x7d7d7d7d);
-&function_end_B("AES_decrypt");
+#------------------------------------------------------------------#
 
 sub enckey()
 {
         &movz   ("esi",&LB("edx"));             # rk[i]>>0
-        &mov    ("ebx",&DWP(0,"ebp","esi",4));
+        &mov    ("ebx",&DWP(2,"ebp","esi",8));
         &movz   ("esi",&HB("edx"));             # rk[i]>>8
         &and    ("ebx",0xFF000000);
         &xor    ("eax","ebx");
 
-        &mov    ("ebx",&DWP(0,"ebp","esi",4));
+        &mov    ("ebx",&DWP(2,"ebp","esi",8));
         &shr    ("edx",16);
         &and    ("ebx",0x000000FF);
         &movz   ("esi",&LB("edx"));             # rk[i]>>16
         &xor    ("eax","ebx");
 
-        &mov    ("ebx",&DWP(0,"ebp","esi",4));
+        &mov    ("ebx",&DWP(0,"ebp","esi",8));
         &movz   ("esi",&HB("edx"));             # rk[i]>>24
         &and    ("ebx",0x0000FF00);
         &xor    ("eax","ebx");
 
-        &mov    ("ebx",&DWP(0,"ebp","esi",4));
+        &mov    ("ebx",&DWP(0,"ebp","esi",8));
         &and    ("ebx",0x00FF0000);
         &xor    ("eax","ebx");
 
-        &xor    ("eax",&DWP(1024,"ebp","ecx",4));       # rcon
+        &xor    ("eax",&DWP(2048,"ebp","ecx",4));       # rcon
 }
 
 # int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
@@ -1260,7 +1253,6 @@ sub enckey()
         &set_label("pic_point");
         &blindpop("ebp");
         &lea    ("ebp",&DWP(&label("AES_Te")."-".&label("pic_point"),"ebp"));
-        &add    ("ebp",1024*4);                 # skip to Te4
 
         &mov    ("ecx",&wparam(1));             # number of bits in key
         &cmp    ("ecx",128);
@@ -1401,23 +1393,23 @@ sub enckey()
                 &mov    ("edx","eax");
                 &mov    ("eax",&DWP(16,"edi"));         # rk[4]
                 &movz   ("esi",&LB("edx"));             # rk[11]>>0
-                &mov    ("ebx",&DWP(0,"ebp","esi",4));
+                &mov    ("ebx",&DWP(2,"ebp","esi",8));
                 &movz   ("esi",&HB("edx"));             # rk[11]>>8
                 &and    ("ebx",0x000000FF);
                 &xor    ("eax","ebx");
 
-                &mov    ("ebx",&DWP(0,"ebp","esi",4));
+                &mov    ("ebx",&DWP(0,"ebp","esi",8));
                 &shr    ("edx",16);
                 &and    ("ebx",0x0000FF00);
                 &movz   ("esi",&LB("edx"));             # rk[11]>>16
                 &xor    ("eax","ebx");
 
-                &mov    ("ebx",&DWP(0,"ebp","esi",4));
+                &mov    ("ebx",&DWP(0,"ebp","esi",8));
                 &movz   ("esi",&HB("edx"));             # rk[11]>>24
                 &and    ("ebx",0x00FF0000);
                 &xor    ("eax","ebx");
 
-                &mov    ("ebx",&DWP(0,"ebp","esi",4));
+                &mov    ("ebx",&DWP(2,"ebp","esi",8));
                 &and    ("ebx",0xFF000000);
                 &xor    ("eax","ebx");
 
@@ -1443,23 +1435,23 @@ sub enckey()
 &function_end("AES_set_encrypt_key");
 
 sub deckey()
-{ my ($i,$ptr,$te4,$td) = @_;
+{ my ($i,$ptr,$te,$td) = @_;
 
         &mov    ("eax",&DWP($i,$ptr));
         &mov    ("edx","eax");
         &movz   ("ebx",&HB("eax"));
         &shr    ("edx",16);
         &and    ("eax",0xFF);
-        &movz   ("eax",&BP(0,$te4,"eax",4));
-        &movz   ("ebx",&BP(0,$te4,"ebx",4));
-        &mov    ("eax",&DWP(1024*0,$td,"eax",4));
-        &xor    ("eax",&DWP(1024*1,$td,"ebx",4));
+        &movz   ("eax",&BP(2,$te,"eax",8));
+        &movz   ("ebx",&BP(2,$te,"ebx",8));
+        &mov    ("eax",&DWP(0,$td,"eax",8));
+        &xor    ("eax",&DWP(3,$td,"ebx",8));
         &movz   ("ebx",&HB("edx"));
         &and    ("edx",0xFF);
-        &movz   ("edx",&BP(0,$te4,"edx",4));
-        &movz   ("ebx",&BP(0,$te4,"ebx",4));
-        &xor    ("eax",&DWP(1024*2,$td,"edx",4));
-        &xor    ("eax",&DWP(1024*3,$td,"ebx",4));
+        &movz   ("edx",&BP(2,$te,"edx",8));
+        &movz   ("ebx",&BP(2,$te,"ebx",8));
+        &xor    ("eax",&DWP(2,$td,"edx",8));
+        &xor    ("eax",&DWP(1,$td,"ebx",8));
         &mov    (&DWP($i,$ptr),"eax");
 }
 
@@ -1520,7 +1512,6 @@ sub deckey()
         blindpop("ebp");
         &lea    ("edi",&DWP(&label("AES_Td")."-".&label("pic_point"),"ebp"));
         &lea    ("ebp",&DWP(&label("AES_Te")."-".&label("pic_point"),"ebp"));
-        &add    ("ebp",1024*4);                 # skip to Te4
 
         &mov    ("esi",&wparam(2));
         &mov    ("ecx",&DWP(240,"esi"));        # pull number of rounds
diff --git a/src/lib/libssl/src/crypto/asn1/a_bitstr.c b/src/lib/libssl/src/crypto/asn1/a_bitstr.c
index b81bf4fc81..0fb9ce0c2a 100644
--- a/src/lib/libssl/src/crypto/asn1/a_bitstr.c
+++ b/src/lib/libssl/src/crypto/asn1/a_bitstr.c
@@ -113,11 +113,12 @@ int i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp)
         return(ret);
         }
 
-ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
-             long len)
+ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,
+        const unsigned char **pp, long len)
         {
         ASN1_BIT_STRING *ret=NULL;
-        unsigned char *p,*s;
+        const unsigned char *p;
+        unsigned char *s;
         int i;
 
         if (len < 1)
@@ -164,7 +165,7 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
         *pp=p;
         return(ret);
 err:
-        ASN1err(ASN1_F_D2I_ASN1_BIT_STRING,i);
+        ASN1err(ASN1_F_C2I_ASN1_BIT_STRING,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
                 M_ASN1_BIT_STRING_free(ret);
         return(NULL);
@@ -182,9 +183,11 @@ int ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value)
         iv= ~v;
         if (!value) v=0;
 
+        if (a == NULL)
+                return 0;
+
         a->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07); /* clear, set on write */
 
-        if (a == NULL) return(0);
         if ((a->length < (w+1)) || (a->data == NULL))
                 {
                 if (!value) return(1); /* Don't need to set */
diff --git a/src/lib/libssl/src/crypto/asn1/a_bool.c b/src/lib/libssl/src/crypto/asn1/a_bool.c
index 24333ea4d5..331acdf053 100644
--- a/src/lib/libssl/src/crypto/asn1/a_bool.c
+++ b/src/lib/libssl/src/crypto/asn1/a_bool.c
@@ -75,10 +75,10 @@ int i2d_ASN1_BOOLEAN(int a, unsigned char **pp)
         return(r);
         }
 
-int d2i_ASN1_BOOLEAN(int *a, unsigned char **pp, long length)
+int d2i_ASN1_BOOLEAN(int *a, const unsigned char **pp, long length)
         {
         int ret= -1;
-        unsigned char *p;
+        const unsigned char *p;
         long len;
         int inf,tag,xclass;
         int i=0;
diff --git a/src/lib/libssl/src/crypto/asn1/a_bytes.c b/src/lib/libssl/src/crypto/asn1/a_bytes.c
index 2407f7c87a..92d630cdba 100644
--- a/src/lib/libssl/src/crypto/asn1/a_bytes.c
+++ b/src/lib/libssl/src/crypto/asn1/a_bytes.c
@@ -60,14 +60,15 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
-static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c);
+static int asn1_collate_primitive(ASN1_STRING *a, ASN1_const_CTX *c);
 /* type is a 'bitmap' of acceptable string types.
  */
-ASN1_STRING *d2i_ASN1_type_bytes(ASN1_STRING **a, unsigned char **pp,
+ASN1_STRING *d2i_ASN1_type_bytes(ASN1_STRING **a, const unsigned char **pp,
              long length, int type)
         {
         ASN1_STRING *ret=NULL;
-        unsigned char *p,*s;
+        const unsigned char *p;
+        unsigned char *s;
         long len;
         int inf,tag,xclass;
         int i=0;
@@ -153,11 +154,12 @@ int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
         return(r);
         }
 
-ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
-             int Ptag, int Pclass)
+ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, const unsigned char **pp,
+             long length, int Ptag, int Pclass)
         {
         ASN1_STRING *ret=NULL;
-        unsigned char *p,*s;
+        const unsigned char *p;
+        unsigned char *s;
         long len;
         int inf,tag,xclass;
         int i=0;
@@ -185,7 +187,7 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
 
         if (inf & V_ASN1_CONSTRUCTED)
                 {
-                ASN1_CTX c;
+                ASN1_const_CTX c;
 
                 c.pp=pp;
                 c.p=p;
@@ -247,7 +249,7 @@ err:
  * them into the one structure that is then returned */
 /* There have been a few bug fixes for this function from
  * Paul Keogh <paul.keogh@sse.ie>, many thanks to him */
-static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c)
+static int asn1_collate_primitive(ASN1_STRING *a, ASN1_const_CTX *c)
         {
         ASN1_STRING *os=NULL;
         BUF_MEM b;
@@ -268,7 +270,7 @@ static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c)
                 {
                 if (c->inf & 1)
                         {
-                        c->eos=ASN1_check_infinite_end(&c->p,
+                        c->eos=ASN1_const_check_infinite_end(&c->p,
                                 (long)(c->max-c->p));
                         if (c->eos) break;
                         }
@@ -296,7 +298,7 @@ static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c)
                 num+=os->length;
                 }
 
-        if (!asn1_Finish(c)) goto err;
+        if (!asn1_const_Finish(c)) goto err;
 
         a->length=num;
         if (a->data != NULL) OPENSSL_free(a->data);
diff --git a/src/lib/libssl/src/crypto/asn1/a_d2i_fp.c b/src/lib/libssl/src/crypto/asn1/a_d2i_fp.c
index b67b75e7c2..ece40bc4c0 100644
--- a/src/lib/libssl/src/crypto/asn1/a_d2i_fp.c
+++ b/src/lib/libssl/src/crypto/asn1/a_d2i_fp.c
@@ -66,11 +66,10 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb);
 #ifndef NO_OLD_ASN1
 #ifndef OPENSSL_NO_FP_API
 
-char *ASN1_d2i_fp(char *(*xnew)(), char *(*d2i)(), FILE *in,
-             unsigned char **x)
+void *ASN1_d2i_fp(void *(*xnew)(void), d2i_of_void *d2i, FILE *in, void **x)
         {
         BIO *b;
-        char *ret;
+        void *ret;
 
         if ((b=BIO_new(BIO_s_file())) == NULL)
                 {
@@ -84,12 +83,11 @@ char *ASN1_d2i_fp(char *(*xnew)(), char *(*d2i)(), FILE *in,
         }
 #endif
 
-char *ASN1_d2i_bio(char *(*xnew)(), char *(*d2i)(), BIO *in,
-             unsigned char **x)
+void *ASN1_d2i_bio(void *(*xnew)(void), d2i_of_void *d2i, BIO *in, void **x)
         {
         BUF_MEM *b = NULL;
-        unsigned char *p;
-        char *ret=NULL;
+        const unsigned char *p;
+        void *ret=NULL;
         int len;
 
         len = asn1_d2i_read_bio(in, &b);
@@ -107,14 +105,14 @@ err:
 void *ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x)
         {
         BUF_MEM *b = NULL;
-        unsigned char *p;
+        const unsigned char *p;
         void *ret=NULL;
         int len;
 
         len = asn1_d2i_read_bio(in, &b);
         if(len < 0) goto err;
 
-        p=(unsigned char *)b->data;
+        p=(const unsigned char *)b->data;
         ret=ASN1_item_d2i(x,&p,len, it);
 err:
         if (b != NULL) BUF_MEM_free(b);
@@ -129,7 +127,7 @@ void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x)
 
         if ((b=BIO_new(BIO_s_file())) == NULL)
                 {
-                ASN1err(ASN1_F_ASN1_D2I_FP,ERR_R_BUF_LIB);
+                ASN1err(ASN1_F_ASN1_ITEM_D2I_FP,ERR_R_BUF_LIB);
                 return(NULL);
                 }
         BIO_set_fp(b,in,BIO_NOCLOSE);
@@ -146,7 +144,7 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
         unsigned char *p;
         int i;
         int ret=-1;
-        ASN1_CTX c;
+        ASN1_const_CTX c;
         int want=HEADER_SIZE;
         int eos=0;
 #if defined(__GNUC__) && defined(__ia64)
@@ -160,7 +158,7 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
         b=BUF_MEM_new();
         if (b == NULL)
                 {
-                ASN1err(ASN1_F_ASN1_D2I_BIO,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ERR_R_MALLOC_FAILURE);
                 return -1;
                 }
 
@@ -173,13 +171,13 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
 
                         if (!BUF_MEM_grow_clean(b,len+want))
                                 {
-                                ASN1err(ASN1_F_ASN1_D2I_BIO,ERR_R_MALLOC_FAILURE);
+                                ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ERR_R_MALLOC_FAILURE);
                                 goto err;
                                 }
                         i=BIO_read(in,&(b->data[len]),want);
                         if ((i < 0) && ((len-off) == 0))
                                 {
-                                ASN1err(ASN1_F_ASN1_D2I_BIO,ASN1_R_NOT_ENOUGH_DATA);
+                                ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ASN1_R_NOT_ENOUGH_DATA);
                                 goto err;
                                 }
                         if (i > 0)
@@ -199,7 +197,7 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
                         if (e != ASN1_R_TOO_LONG)
                                 goto err;
                         else
-                                ERR_get_error(); /* clear error */
+                                ERR_clear_error(); /* clear error */
                         }
                 i=c.p-p;/* header length */
                 off+=i; /* end of data */
@@ -228,7 +226,7 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
                                 want-=(len-off);
                                 if (!BUF_MEM_grow_clean(b,len+want))
                                         {
-                                        ASN1err(ASN1_F_ASN1_D2I_BIO,ERR_R_MALLOC_FAILURE);
+                                        ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ERR_R_MALLOC_FAILURE);
                                         goto err;
                                         }
                                 while (want > 0)
@@ -236,7 +234,7 @@ static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
                                         i=BIO_read(in,&(b->data[len]),want);
                                         if (i <= 0)
                                                 {
-                                                ASN1err(ASN1_F_ASN1_D2I_BIO,
+                                                ASN1err(ASN1_F_ASN1_D2I_READ_BIO,
                                                     ASN1_R_NOT_ENOUGH_DATA);
                                                 goto err;
                                                 }
diff --git a/src/lib/libssl/src/crypto/asn1/a_digest.c b/src/lib/libssl/src/crypto/asn1/a_digest.c
index 7182e9fa5d..d00d9e22b1 100644
--- a/src/lib/libssl/src/crypto/asn1/a_digest.c
+++ b/src/lib/libssl/src/crypto/asn1/a_digest.c
@@ -72,7 +72,7 @@
 
 #ifndef NO_ASN1_OLD
 
-int ASN1_digest(int (*i2d)(), const EVP_MD *type, char *data,
+int ASN1_digest(i2d_of_void *i2d, const EVP_MD *type, char *data,
                 unsigned char *md, unsigned int *len)
         {
         int i;
diff --git a/src/lib/libssl/src/crypto/asn1/a_dup.c b/src/lib/libssl/src/crypto/asn1/a_dup.c
index 58a017884c..199d50f521 100644
--- a/src/lib/libssl/src/crypto/asn1/a_dup.c
+++ b/src/lib/libssl/src/crypto/asn1/a_dup.c
@@ -62,22 +62,23 @@
 
 #ifndef NO_OLD_ASN1
 
-char *ASN1_dup(int (*i2d)(), char *(*d2i)(), char *x)
+void *ASN1_dup(i2d_of_void *i2d, d2i_of_void *d2i, char *x)
         {
         unsigned char *b,*p;
-        long i;
+        const unsigned char *p2;
+        int i;
         char *ret;
 
         if (x == NULL) return(NULL);
 
-        i=(long)i2d(x,NULL);
-        b=(unsigned char *)OPENSSL_malloc((unsigned int)i+10);
+        i=i2d(x,NULL);
+        b=OPENSSL_malloc(i+10);
         if (b == NULL)
                 { ASN1err(ASN1_F_ASN1_DUP,ERR_R_MALLOC_FAILURE); return(NULL); }
         p= b;
         i=i2d(x,&p);
-        p= b;
-        ret=d2i(NULL,&p,i);
+        p2= b;
+        ret=d2i(NULL,&p2,i);
         OPENSSL_free(b);
         return(ret);
         }
@@ -91,7 +92,8 @@ char *ASN1_dup(int (*i2d)(), char *(*d2i)(), char *x)
 
 void *ASN1_item_dup(const ASN1_ITEM *it, void *x)
         {
-        unsigned char *b = NULL, *p;
+        unsigned char *b = NULL;
+        const unsigned char *p;
         long i;
         void *ret;
 
@@ -99,7 +101,7 @@ void *ASN1_item_dup(const ASN1_ITEM *it, void *x)
 
         i=ASN1_item_i2d(x,&b,it);
         if (b == NULL)
-                { ASN1err(ASN1_F_ASN1_DUP,ERR_R_MALLOC_FAILURE); return(NULL); }
+                { ASN1err(ASN1_F_ASN1_ITEM_DUP,ERR_R_MALLOC_FAILURE); return(NULL); }
         p= b;
         ret=ASN1_item_d2i(NULL,&p,i, it);
         OPENSSL_free(b);
diff --git a/src/lib/libssl/src/crypto/asn1/a_enum.c b/src/lib/libssl/src/crypto/asn1/a_enum.c
index 03ede68d1c..fe9aa13b9c 100644
--- a/src/lib/libssl/src/crypto/asn1/a_enum.c
+++ b/src/lib/libssl/src/crypto/asn1/a_enum.c
@@ -59,6 +59,7 @@
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/asn1.h>
+#include <openssl/bn.h>
 
 /* 
  * Code for ENUMERATED type: identical to INTEGER apart from a different tag.
@@ -67,12 +68,13 @@
 
 int ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v)
         {
-        int i,j,k;
+        int j,k;
+        unsigned int i;
         unsigned char buf[sizeof(long)+1];
         long d;
 
         a->type=V_ASN1_ENUMERATED;
-        if (a->length < (sizeof(long)+1))
+        if (a->length < (int)(sizeof(long)+1))
                 {
                 if (a->data != NULL)
                         OPENSSL_free(a->data);
@@ -116,7 +118,7 @@ long ASN1_ENUMERATED_get(ASN1_ENUMERATED *a)
         else if (i != V_ASN1_ENUMERATED)
                 return -1;
         
-        if (a->length > sizeof(long))
+        if (a->length > (int)sizeof(long))
                 {
                 /* hmm... a bit ugly */
                 return(0xffffffffL);
@@ -147,7 +149,7 @@ ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
                 ASN1err(ASN1_F_BN_TO_ASN1_ENUMERATED,ERR_R_NESTED_ASN1_ERROR);
                 goto err;
                 }
-        if(bn->neg) ret->type = V_ASN1_NEG_ENUMERATED;
+        if(BN_is_negative(bn)) ret->type = V_ASN1_NEG_ENUMERATED;
         else ret->type=V_ASN1_ENUMERATED;
         j=BN_num_bits(bn);
         len=((j == 0)?0:((j/8)+1));
@@ -175,6 +177,6 @@ BIGNUM *ASN1_ENUMERATED_to_BN(ASN1_ENUMERATED *ai, BIGNUM *bn)
 
         if ((ret=BN_bin2bn(ai->data,ai->length,bn)) == NULL)
                 ASN1err(ASN1_F_ASN1_ENUMERATED_TO_BN,ASN1_R_BN_LIB);
-        else if(ai->type == V_ASN1_NEG_ENUMERATED) ret->neg = 1;
+        else if(ai->type == V_ASN1_NEG_ENUMERATED) BN_set_negative(ret,1);
         return(ret);
         }
diff --git a/src/lib/libssl/src/crypto/asn1/a_gentm.c b/src/lib/libssl/src/crypto/asn1/a_gentm.c
index 0dfd576211..def79062a5 100644
--- a/src/lib/libssl/src/crypto/asn1/a_gentm.c
+++ b/src/lib/libssl/src/crypto/asn1/a_gentm.c
@@ -181,7 +181,7 @@ err:
         return(0);
         }
 
-int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, char *str)
+int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, const char *str)
         {
         ASN1_GENERALIZEDTIME t;
 
diff --git a/src/lib/libssl/src/crypto/asn1/a_hdr.c b/src/lib/libssl/src/crypto/asn1/a_hdr.c
index b1aad81f77..d1c2a7b9e3 100644
--- a/src/lib/libssl/src/crypto/asn1/a_hdr.c
+++ b/src/lib/libssl/src/crypto/asn1/a_hdr.c
@@ -76,17 +76,17 @@ int i2d_ASN1_HEADER(ASN1_HEADER *a, unsigned char **pp)
         M_ASN1_I2D_finish();
         }
 
-ASN1_HEADER *d2i_ASN1_HEADER(ASN1_HEADER **a, unsigned char **pp,
+ASN1_HEADER *d2i_ASN1_HEADER(ASN1_HEADER **a, const unsigned char **pp,
              long length)
         {
         M_ASN1_D2I_vars(a,ASN1_HEADER *,ASN1_HEADER_new);
 
         M_ASN1_D2I_Init();
         M_ASN1_D2I_start_sequence();
-        M_ASN1_D2I_get(ret->header,d2i_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_x(ASN1_OCTET_STRING,ret->header,d2i_ASN1_OCTET_STRING);
         if (ret->meth != NULL)
                 {
-                M_ASN1_D2I_get(ret->data,ret->meth->d2i);
+                M_ASN1_D2I_get_x(void,ret->data,ret->meth->d2i);
                 }
         else
                 {
diff --git a/src/lib/libssl/src/crypto/asn1/a_i2d_fp.c b/src/lib/libssl/src/crypto/asn1/a_i2d_fp.c
index f4f1b73ebe..a3ad76d356 100644
--- a/src/lib/libssl/src/crypto/asn1/a_i2d_fp.c
+++ b/src/lib/libssl/src/crypto/asn1/a_i2d_fp.c
@@ -64,7 +64,7 @@
 #ifndef NO_OLD_ASN1
 
 #ifndef OPENSSL_NO_FP_API
-int ASN1_i2d_fp(int (*i2d)(), FILE *out, unsigned char *x)
+int ASN1_i2d_fp(i2d_of_void *i2d, FILE *out, void *x)
         {
         BIO *b;
         int ret;
@@ -81,7 +81,7 @@ int ASN1_i2d_fp(int (*i2d)(), FILE *out, unsigned char *x)
         }
 #endif
 
-int ASN1_i2d_bio(int (*i2d)(), BIO *out, unsigned char *x)
+int ASN1_i2d_bio(i2d_of_void *i2d, BIO *out, unsigned char *x)
         {
         char *b;
         unsigned char *p;
@@ -124,7 +124,7 @@ int ASN1_item_i2d_fp(const ASN1_ITEM *it, FILE *out, void *x)
 
         if ((b=BIO_new(BIO_s_file())) == NULL)
                 {
-                ASN1err(ASN1_F_ASN1_I2D_FP,ERR_R_BUF_LIB);
+                ASN1err(ASN1_F_ASN1_ITEM_I2D_FP,ERR_R_BUF_LIB);
                 return(0);
                 }
         BIO_set_fp(b,out,BIO_NOCLOSE);
@@ -142,7 +142,7 @@ int ASN1_item_i2d_bio(const ASN1_ITEM *it, BIO *out, void *x)
         n = ASN1_item_i2d(x, &b, it);
         if (b == NULL)
                 {
-                ASN1err(ASN1_F_ASN1_I2D_BIO,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_ASN1_ITEM_I2D_BIO,ERR_R_MALLOC_FAILURE);
                 return(0);
                 }
 
diff --git a/src/lib/libssl/src/crypto/asn1/a_int.c b/src/lib/libssl/src/crypto/asn1/a_int.c
index 21cc64bb23..f8d198efb1 100644
--- a/src/lib/libssl/src/crypto/asn1/a_int.c
+++ b/src/lib/libssl/src/crypto/asn1/a_int.c
@@ -59,6 +59,7 @@
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/asn1.h>
+#include <openssl/bn.h>
 
 ASN1_INTEGER *ASN1_INTEGER_dup(ASN1_INTEGER *x)
 { return M_ASN1_INTEGER_dup(x);}
@@ -174,11 +175,12 @@ int i2c_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
 
 /* Convert just ASN1 INTEGER content octets to ASN1_INTEGER structure */
 
-ASN1_INTEGER *c2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
+ASN1_INTEGER *c2i_ASN1_INTEGER(ASN1_INTEGER **a, const unsigned char **pp,
              long len)
         {
         ASN1_INTEGER *ret=NULL;
-        unsigned char *p,*to,*s, *pend;
+        const unsigned char *p, *pend;
+        unsigned char *to,*s;
         int i;
 
         if ((a == NULL) || ((*a) == NULL))
@@ -254,7 +256,7 @@ ASN1_INTEGER *c2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
         *pp=pend;
         return(ret);
 err:
-        ASN1err(ASN1_F_D2I_ASN1_INTEGER,i);
+        ASN1err(ASN1_F_C2I_ASN1_INTEGER,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
                 M_ASN1_INTEGER_free(ret);
         return(NULL);
@@ -266,11 +268,12 @@ err:
  * with its MSB set as negative (it doesn't add a padding zero).
  */
 
-ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
+ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, const unsigned char **pp,
              long length)
         {
         ASN1_INTEGER *ret=NULL;
-        unsigned char *p,*to,*s;
+        const unsigned char *p;
+        unsigned char *to,*s;
         long len;
         int inf,tag,xclass;
         int i;
@@ -332,12 +335,13 @@ err:
 
 int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
         {
-        int i,j,k;
+        int j,k;
+        unsigned int i;
         unsigned char buf[sizeof(long)+1];
         long d;
 
         a->type=V_ASN1_INTEGER;
-        if (a->length < (sizeof(long)+1))
+        if (a->length < (int)(sizeof(long)+1))
                 {
                 if (a->data != NULL)
                         OPENSSL_free(a->data);
@@ -381,7 +385,7 @@ long ASN1_INTEGER_get(ASN1_INTEGER *a)
         else if (i != V_ASN1_INTEGER)
                 return -1;
         
-        if (a->length > sizeof(long))
+        if (a->length > (int)sizeof(long))
                 {
                 /* hmm... a bit ugly */
                 return(0xffffffffL);
@@ -412,7 +416,8 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai)
                 ASN1err(ASN1_F_BN_TO_ASN1_INTEGER,ERR_R_NESTED_ASN1_ERROR);
                 goto err;
                 }
-        if(bn->neg) ret->type = V_ASN1_NEG_INTEGER;
+        if (BN_is_negative(bn))
+                ret->type = V_ASN1_NEG_INTEGER;
         else ret->type=V_ASN1_INTEGER;
         j=BN_num_bits(bn);
         len=((j == 0)?0:((j/8)+1));
@@ -445,7 +450,8 @@ BIGNUM *ASN1_INTEGER_to_BN(ASN1_INTEGER *ai, BIGNUM *bn)
 
         if ((ret=BN_bin2bn(ai->data,ai->length,bn)) == NULL)
                 ASN1err(ASN1_F_ASN1_INTEGER_TO_BN,ASN1_R_BN_LIB);
-        else if(ai->type == V_ASN1_NEG_INTEGER) ret->neg = 1;
+        else if(ai->type == V_ASN1_NEG_INTEGER)
+                BN_set_negative(ret, 1);
         return(ret);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/a_mbstr.c b/src/lib/libssl/src/crypto/asn1/a_mbstr.c
index 208b3ec395..2d4800a22a 100644
--- a/src/lib/libssl/src/crypto/asn1/a_mbstr.c
+++ b/src/lib/libssl/src/crypto/asn1/a_mbstr.c
@@ -107,7 +107,7 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
 
                 case MBSTRING_BMP:
                 if(len & 1) {
-                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                        ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY,
                                          ASN1_R_INVALID_BMPSTRING_LENGTH);
                         return -1;
                 }
@@ -116,7 +116,7 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
 
                 case MBSTRING_UNIV:
                 if(len & 3) {
-                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                        ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY,
                                          ASN1_R_INVALID_UNIVERSALSTRING_LENGTH);
                         return -1;
                 }
@@ -128,7 +128,7 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
                 /* This counts the characters and does utf8 syntax checking */
                 ret = traverse_string(in, len, MBSTRING_UTF8, in_utf8, &nchar);
                 if(ret < 0) {
-                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                        ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY,
                                                  ASN1_R_INVALID_UTF8STRING);
                         return -1;
                 }
@@ -139,19 +139,19 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
                 break;
 
                 default:
-                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_UNKNOWN_FORMAT);
+                ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ASN1_R_UNKNOWN_FORMAT);
                 return -1;
         }
 
         if((minsize > 0) && (nchar < minsize)) {
-                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_SHORT);
+                ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ASN1_R_STRING_TOO_SHORT);
                 BIO_snprintf(strbuf, sizeof strbuf, "%ld", minsize);
                 ERR_add_error_data(2, "minsize=", strbuf);
                 return -1;
         }
 
         if((maxsize > 0) && (nchar > maxsize)) {
-                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_LONG);
+                ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ASN1_R_STRING_TOO_LONG);
                 BIO_snprintf(strbuf, sizeof strbuf, "%ld", maxsize);
                 ERR_add_error_data(2, "maxsize=", strbuf);
                 return -1;
@@ -159,7 +159,7 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
 
         /* Now work out minimal type (if any) */
         if(traverse_string(in, len, inform, type_str, &mask) < 0) {
-                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_ILLEGAL_CHARACTERS);
+                ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ASN1_R_ILLEGAL_CHARACTERS);
                 return -1;
         }
 
@@ -193,7 +193,7 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
                 free_out = 1;
                 dest = ASN1_STRING_type_new(str_type);
                 if(!dest) {
-                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                        ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY,
                                                         ERR_R_MALLOC_FAILURE);
                         return -1;
                 }
@@ -202,7 +202,7 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
         /* If both the same type just copy across */
         if(inform == outform) {
                 if(!ASN1_STRING_set(dest, in, len)) {
-                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,ERR_R_MALLOC_FAILURE);
+                        ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY,ERR_R_MALLOC_FAILURE);
                         return -1;
                 }
                 return str_type;
@@ -233,7 +233,7 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
         }
         if(!(p = OPENSSL_malloc(outlen + 1))) {
                 if(free_out) ASN1_STRING_free(dest);
-                ASN1err(ASN1_F_ASN1_MBSTRING_COPY,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY,ERR_R_MALLOC_FAILURE);
                 return -1;
         }
         dest->length = outlen;
diff --git a/src/lib/libssl/src/crypto/asn1/a_meth.c b/src/lib/libssl/src/crypto/asn1/a_meth.c
index 63158e9cab..50bea917e3 100644
--- a/src/lib/libssl/src/crypto/asn1/a_meth.c
+++ b/src/lib/libssl/src/crypto/asn1/a_meth.c
@@ -62,16 +62,16 @@
 #include <openssl/asn1.h>
 
 static  ASN1_METHOD ia5string_meth={
-        (int (*)())     i2d_ASN1_IA5STRING,
-        (char *(*)())   d2i_ASN1_IA5STRING,
-        (char *(*)())   ASN1_STRING_new,
-        (void (*)())    ASN1_STRING_free};
+        (I2D_OF(void))  i2d_ASN1_IA5STRING,
+        (D2I_OF(void))  d2i_ASN1_IA5STRING,
+        (void *(*)(void))ASN1_STRING_new,
+        (void (*)(void *))ASN1_STRING_free};
 
 static  ASN1_METHOD bit_string_meth={
-        (int (*)())     i2d_ASN1_BIT_STRING,
-        (char *(*)())   d2i_ASN1_BIT_STRING,
-        (char *(*)())   ASN1_STRING_new,
-        (void (*)())    ASN1_STRING_free};
+        (I2D_OF(void))  i2d_ASN1_BIT_STRING,
+        (D2I_OF(void))  d2i_ASN1_BIT_STRING,
+        (void *(*)(void))ASN1_STRING_new,
+        (void (*)(void *))ASN1_STRING_free};
 
 ASN1_METHOD *ASN1_IA5STRING_asn1_meth(void)
         {
diff --git a/src/lib/libssl/src/crypto/asn1/a_object.c b/src/lib/libssl/src/crypto/asn1/a_object.c
index 0a8e6c287c..dc980421d0 100644
--- a/src/lib/libssl/src/crypto/asn1/a_object.c
+++ b/src/lib/libssl/src/crypto/asn1/a_object.c
@@ -57,10 +57,12 @@
  */
 
 #include <stdio.h>
+#include <limits.h>
 #include "cryptlib.h"
 #include <openssl/buffer.h>
 #include <openssl/asn1.h>
 #include <openssl/objects.h>
+#include <openssl/bn.h>
 
 int i2d_ASN1_OBJECT(ASN1_OBJECT *a, unsigned char **pp)
         {
@@ -83,10 +85,12 @@ int i2d_ASN1_OBJECT(ASN1_OBJECT *a, unsigned char **pp)
 
 int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
         {
-        int i,first,len=0,c;
-        char tmp[24];
+        int i,first,len=0,c, use_bn;
+        char ftmp[24], *tmp = ftmp;
+        int tmpsize = sizeof ftmp;
         const char *p;
         unsigned long l;
+        BIGNUM *bl = NULL;
 
         if (num == 0)
                 return(0);
@@ -98,7 +102,7 @@ int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
         num--;
         if ((c >= '0') && (c <= '2'))
                 {
-                first=(c-'0')*40;
+                first= c-'0';
                 }
         else
                 {
@@ -122,6 +126,7 @@ int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
                         goto err;
                         }
                 l=0;
+                use_bn = 0;
                 for (;;)
                         {
                         if (num <= 0) break;
@@ -134,7 +139,22 @@ int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
                                 ASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_INVALID_DIGIT);
                                 goto err;
                                 }
-                        l=l*10L+(long)(c-'0');
+                        if (!use_bn && l > (ULONG_MAX / 10L))
+                                {
+                                use_bn = 1;
+                                if (!bl)
+                                        bl = BN_new();
+                                if (!bl || !BN_set_word(bl, l))
+                                        goto err;
+                                }
+                        if (use_bn)
+                                {
+                                if (!BN_mul_word(bl, 10L)
+                                        || !BN_add_word(bl, c-'0'))
+                                        goto err;
+                                }
+                        else
+                                l=l*10L+(long)(c-'0');
                         }
                 if (len == 0)
                         {
@@ -143,14 +163,42 @@ int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
                                 ASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_SECOND_NUMBER_TOO_LARGE);
                                 goto err;
                                 }
-                        l+=(long)first;
+                        if (use_bn)
+                                {
+                                if (!BN_add_word(bl, first * 40))
+                                        goto err;
+                                }
+                        else
+                                l+=(long)first*40;
                         }
                 i=0;
-                for (;;)
+                if (use_bn)
+                        {
+                        int blsize;
+                        blsize = BN_num_bits(bl);
+                        blsize = (blsize + 6)/7;
+                        if (blsize > tmpsize)
+                                {
+                                if (tmp != ftmp)
+                                        OPENSSL_free(tmp);
+                                tmpsize = blsize + 32;
+                                tmp = OPENSSL_malloc(tmpsize);
+                                if (!tmp)
+                                        goto err;
+                                }
+                        while(blsize--)
+                                tmp[i++] = (unsigned char)BN_div_word(bl, 0x80L);
+                        }
+                else
                         {
-                        tmp[i++]=(unsigned char)l&0x7f;
-                        l>>=7L;
-                        if (l == 0L) break;
+                                        
+                        for (;;)
+                                {
+                                tmp[i++]=(unsigned char)l&0x7f;
+                                l>>=7L;
+                                if (l == 0L) break;
+                                }
+
                         }
                 if (out != NULL)
                         {
@@ -166,8 +214,16 @@ int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
                 else
                         len+=i;
                 }
+        if (tmp != ftmp)
+                OPENSSL_free(tmp);
+        if (bl)
+                BN_free(bl);
         return(len);
 err:
+        if (tmp != ftmp)
+                OPENSSL_free(tmp);
+        if (bl)
+                BN_free(bl);
         return(0);
         }
 
@@ -178,21 +234,31 @@ int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
 
 int i2a_ASN1_OBJECT(BIO *bp, ASN1_OBJECT *a)
         {
-        char buf[80];
+        char buf[80], *p = buf;
         int i;
 
         if ((a == NULL) || (a->data == NULL))
                 return(BIO_write(bp,"NULL",4));
         i=i2t_ASN1_OBJECT(buf,sizeof buf,a);
-        if (i > sizeof buf) i=sizeof buf;
-        BIO_write(bp,buf,i);
+        if (i > (int)(sizeof(buf) - 1))
+                {
+                p = OPENSSL_malloc(i + 1);
+                if (!p)
+                        return -1;
+                i2t_ASN1_OBJECT(p,i + 1,a);
+                }
+        if (i <= 0)
+                return BIO_write(bp, "<INVALID>", 9);
+        BIO_write(bp,p,i);
+        if (p != buf)
+                OPENSSL_free(p);
         return(i);
         }
 
-ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, unsigned char **pp,
+ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
              long length)
 {
-        unsigned char *p;
+        const unsigned char *p;
         long len;
         int tag,xclass;
         int inf,i;
@@ -219,11 +285,11 @@ err:
                 ASN1_OBJECT_free(ret);
         return(NULL);
 }
-ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, unsigned char **pp,
+ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
              long len)
         {
         ASN1_OBJECT *ret=NULL;
-        unsigned char *p;
+        const unsigned char *p;
         int i;
 
         /* only the ASN1_OBJECTs from the 'table' will have values
@@ -255,7 +321,7 @@ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, unsigned char **pp,
         *pp=p;
         return(ret);
 err:
-        ASN1err(ASN1_F_D2I_ASN1_OBJECT,i);
+        ASN1err(ASN1_F_C2I_ASN1_OBJECT,i);
         if ((ret != NULL) && ((a == NULL) || (*a != ret)))
                 ASN1_OBJECT_free(ret);
         return(NULL);
diff --git a/src/lib/libssl/src/crypto/asn1/a_octet.c b/src/lib/libssl/src/crypto/asn1/a_octet.c
index 9690bae0f1..24fd0f8e5a 100644
--- a/src/lib/libssl/src/crypto/asn1/a_octet.c
+++ b/src/lib/libssl/src/crypto/asn1/a_octet.c
@@ -66,6 +66,6 @@ ASN1_OCTET_STRING *ASN1_OCTET_STRING_dup(ASN1_OCTET_STRING *x)
 int ASN1_OCTET_STRING_cmp(ASN1_OCTET_STRING *a, ASN1_OCTET_STRING *b)
 { return M_ASN1_OCTET_STRING_cmp(a, b); }
 
-int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, unsigned char *d, int len)
+int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, const unsigned char *d, int len)
 { return M_ASN1_OCTET_STRING_set(x, d, len); }
 
diff --git a/src/lib/libssl/src/crypto/asn1/a_set.c b/src/lib/libssl/src/crypto/asn1/a_set.c
index e24061c545..958558c204 100644
--- a/src/lib/libssl/src/crypto/asn1/a_set.c
+++ b/src/lib/libssl/src/crypto/asn1/a_set.c
@@ -85,8 +85,8 @@ static int SetBlobCmp(const void *elem1, const void *elem2 )
     }
 
 /* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE)    */
-int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
-             int ex_class, int is_set)
+int i2d_ASN1_SET(STACK *a, unsigned char **pp, i2d_of_void *i2d, int ex_tag,
+                 int ex_class, int is_set)
         {
         int ret=0,r;
         int i;
@@ -97,7 +97,7 @@ int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
 
         if (a == NULL) return(0);
         for (i=sk_num(a)-1; i>=0; i--)
-                ret+=func(sk_value(a,i),NULL);
+                ret+=i2d(sk_value(a,i),NULL);
         r=ASN1_object_size(1,ret,ex_tag);
         if (pp == NULL) return(r);
 
@@ -111,7 +111,7 @@ int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
         if(!is_set || (sk_num(a) < 2))
                 {
                 for (i=0; i<sk_num(a); i++)
-                        func(sk_value(a,i),&p);
+                        i2d(sk_value(a,i),&p);
 
                 *pp=p;
                 return(r);
@@ -129,7 +129,7 @@ int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
         for (i=0; i<sk_num(a); i++)
                 {
                 rgSetBlob[i].pbData = p;  /* catch each set encode blob */
-                func(sk_value(a,i),&p);
+                i2d(sk_value(a,i),&p);
                 rgSetBlob[i].cbData = p - rgSetBlob[i].pbData; /* Length of this
 SetBlob
 */
@@ -162,10 +162,11 @@ SetBlob
         return(r);
         }
 
-STACK *d2i_ASN1_SET(STACK **a, unsigned char **pp, long length,
-             char *(*func)(), void (*free_func)(void *), int ex_tag, int ex_class)
+STACK *d2i_ASN1_SET(STACK **a, const unsigned char **pp, long length,
+                    d2i_of_void *d2i, void (*free_func)(void *), int ex_tag,
+                    int ex_class)
         {
-        ASN1_CTX c;
+        ASN1_const_CTX c;
         STACK *ret=NULL;
 
         if ((a == NULL) || ((*a) == NULL))
@@ -210,7 +211,9 @@ STACK *d2i_ASN1_SET(STACK **a, unsigned char **pp, long length,
                 char *s;
 
                 if (M_ASN1_D2I_end_sequence()) break;
-                if ((s=func(NULL,&c.p,c.slen,c.max-c.p)) == NULL)
+                /* XXX: This was called with 4 arguments, incorrectly, it seems
+                   if ((s=func(NULL,&c.p,c.slen,c.max-c.p)) == NULL) */
+                if ((s=d2i(NULL,&c.p,c.slen)) == NULL)
                         {
                         ASN1err(ASN1_F_D2I_ASN1_SET,ASN1_R_ERROR_PARSING_SET_ELEMENT);
                         asn1_add_error(*pp,(int)(c.q- *pp));
diff --git a/src/lib/libssl/src/crypto/asn1/a_sign.c b/src/lib/libssl/src/crypto/asn1/a_sign.c
index 52ce7e3974..1081950518 100644
--- a/src/lib/libssl/src/crypto/asn1/a_sign.c
+++ b/src/lib/libssl/src/crypto/asn1/a_sign.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -126,9 +126,9 @@
 
 #ifndef NO_ASN1_OLD
 
-int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
-             ASN1_BIT_STRING *signature, char *data, EVP_PKEY *pkey,
-             const EVP_MD *type)
+int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2,
+              ASN1_BIT_STRING *signature, char *data, EVP_PKEY *pkey,
+              const EVP_MD *type)
         {
         EVP_MD_CTX ctx;
         unsigned char *p,*buf_in=NULL,*buf_out=NULL;
@@ -229,10 +229,11 @@ int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
                 else
                         a=algor2;
                 if (a == NULL) continue;
-                if (type->pkey_type == NID_dsaWithSHA1)
+                if (type->pkey_type == NID_dsaWithSHA1 ||
+                        type->pkey_type == NID_ecdsa_with_SHA1)
                         {
-                        /* special case: RFC 2459 tells us to omit 'parameters'
-                         * with id-dsa-with-sha1 */
+                        /* special case: RFC 3279 tells us to omit 'parameters'
+                         * with id-dsa-with-sha1 and ecdsa-with-SHA1 */
                         ASN1_TYPE_free(a->parameter);
                         a->parameter = NULL;
                         }
@@ -247,12 +248,12 @@ int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
                 a->algorithm=OBJ_nid2obj(type->pkey_type);
                 if (a->algorithm == NULL)
                         {
-                        ASN1err(ASN1_F_ASN1_SIGN,ASN1_R_UNKNOWN_OBJECT_TYPE);
+                        ASN1err(ASN1_F_ASN1_ITEM_SIGN,ASN1_R_UNKNOWN_OBJECT_TYPE);
                         goto err;
                         }
                 if (a->algorithm->length == 0)
                         {
-                        ASN1err(ASN1_F_ASN1_SIGN,ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
+                        ASN1err(ASN1_F_ASN1_ITEM_SIGN,ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD);
                         goto err;
                         }
                 }
@@ -262,7 +263,7 @@ int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
         if ((buf_in == NULL) || (buf_out == NULL))
                 {
                 outl=0;
-                ASN1err(ASN1_F_ASN1_SIGN,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_ASN1_ITEM_SIGN,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
 
@@ -272,7 +273,7 @@ int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
                         (unsigned int *)&outl,pkey))
                 {
                 outl=0;
-                ASN1err(ASN1_F_ASN1_SIGN,ERR_R_EVP_LIB);
+                ASN1err(ASN1_F_ASN1_ITEM_SIGN,ERR_R_EVP_LIB);
                 goto err;
                 }
         if (signature->data != NULL) OPENSSL_free(signature->data);
diff --git a/src/lib/libssl/src/crypto/asn1/a_strex.c b/src/lib/libssl/src/crypto/asn1/a_strex.c
index a07122ba47..c2dbb6f9a5 100644
--- a/src/lib/libssl/src/crypto/asn1/a_strex.c
+++ b/src/lib/libssl/src/crypto/asn1/a_strex.c
@@ -3,7 +3,7 @@
  * project 2000.
  */
 /* ====================================================================
- * Copyright (c) 2000-2004 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -58,12 +58,12 @@
 
 #include <stdio.h>
 #include <string.h>
+#include "cryptlib.h"
 #include <openssl/crypto.h>
 #include <openssl/x509.h>
 #include <openssl/asn1.h>
 
 #include "charmap.h"
-#include "cryptlib.h"
 
 /* ASN1_STRING_print_ex() and X509_NAME_print_ex().
  * Enhanced string and name printing routines handling
@@ -170,7 +170,7 @@ static int do_buf(unsigned char *buf, int buflen,
         q = buf + buflen;
         outlen = 0;
         while(p != q) {
-                if(p == buf) orflags = CHARTYPE_FIRST_ESC_2253;
+                if(p == buf && flags & ASN1_STRFLGS_ESC_2253) orflags = CHARTYPE_FIRST_ESC_2253;
                 else orflags = 0;
                 switch(type & BUF_TYPE_WIDTH_MASK) {
                         case 4:
@@ -194,8 +194,10 @@ static int do_buf(unsigned char *buf, int buflen,
                         if(i < 0) return -1;    /* Invalid UTF8String */
                         p += i;
                         break;
+                        default:
+                        return -1;      /* invalid width */
                 }
-                if (p == q) orflags = CHARTYPE_LAST_ESC_2253;
+                if (p == q && flags & ASN1_STRFLGS_ESC_2253) orflags = CHARTYPE_LAST_ESC_2253;
                 if(type & BUF_TYPE_CONVUTF8) {
                         unsigned char utfbuf[6];
                         int utflen;
@@ -223,7 +225,7 @@ static int do_buf(unsigned char *buf, int buflen,
 
 static int do_hex_dump(char_io *io_ch, void *arg, unsigned char *buf, int buflen)
 {
-        const static char hexdig[] = "0123456789ABCDEF";
+        static const char hexdig[] = "0123456789ABCDEF";
         unsigned char *p, *q;
         char hextmp[2];
         if(arg) {
@@ -279,7 +281,7 @@ static int do_dump(unsigned long lflags, char_io *io_ch, void *arg, ASN1_STRING
  * otherwise it is the number of bytes per character
  */
 
-const static signed char tag2nbyte[] = {
+static const signed char tag2nbyte[] = {
         -1, -1, -1, -1, -1,     /* 0-4 */
         -1, -1, -1, -1, -1,     /* 5-9 */
         -1, -1, 0, -1,          /* 10-13 */
@@ -356,12 +358,13 @@ static int do_print_ex(char_io *io_ch, void *arg, unsigned long lflags, ASN1_STR
         }
 
         len = do_buf(str->data, str->length, type, flags, &quotes, io_ch, NULL);
-        if(outlen < 0) return -1;
+        if(len < 0) return -1;
         outlen += len;
         if(quotes) outlen += 2;
         if(!arg) return outlen;
         if(quotes && !io_ch(arg, "\"", 1)) return -1;
-        do_buf(str->data, str->length, type, flags, NULL, io_ch, arg);
+        if(do_buf(str->data, str->length, type, flags, NULL, io_ch, arg) < 0)
+                return -1;
         if(quotes && !io_ch(arg, "\"", 1)) return -1;
         return outlen;
 }
@@ -513,7 +516,7 @@ int X509_NAME_print_ex(BIO *out, X509_NAME *nm, int indent, unsigned long flags)
         return do_name_ex(send_bio_chars, out, nm, indent, flags);
 }
 
-
+#ifndef OPENSSL_NO_FP_API
 int X509_NAME_print_ex_fp(FILE *fp, X509_NAME *nm, int indent, unsigned long flags)
 {
         if(flags == XN_FLAG_COMPAT)
@@ -528,17 +531,19 @@ int X509_NAME_print_ex_fp(FILE *fp, X509_NAME *nm, int indent, unsigned long fla
                 }
         return do_name_ex(send_fp_chars, fp, nm, indent, flags);
 }
+#endif
 
 int ASN1_STRING_print_ex(BIO *out, ASN1_STRING *str, unsigned long flags)
 {
         return do_print_ex(send_bio_chars, out, flags, str);
 }
 
-
+#ifndef OPENSSL_NO_FP_API
 int ASN1_STRING_print_ex_fp(FILE *fp, ASN1_STRING *str, unsigned long flags)
 {
         return do_print_ex(send_fp_chars, fp, flags, str);
 }
+#endif
 
 /* Utility function: convert any string type to UTF8, returns number of bytes
  * in output string or a negative error code
@@ -553,12 +558,7 @@ int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in)
         if((type < 0) || (type > 30)) return -1;
         mbflag = tag2nbyte[type];
         if(mbflag == -1) return -1;
-        if (mbflag == 0)
-                mbflag = MBSTRING_UTF8;
-        else if (mbflag == 4)
-                mbflag = MBSTRING_UNIV;
-        else            
-                mbflag |= MBSTRING_FLAG;
+        mbflag |= MBSTRING_FLAG;
         stmp.data = NULL;
         ret = ASN1_mbstring_copy(&str, in->data, in->length, mbflag, B_ASN1_UTF8STRING);
         if(ret < 0) return ret;
diff --git a/src/lib/libssl/src/crypto/asn1/a_type.c b/src/lib/libssl/src/crypto/asn1/a_type.c
index 2292d49b93..36beceacdb 100644
--- a/src/lib/libssl/src/crypto/asn1/a_type.c
+++ b/src/lib/libssl/src/crypto/asn1/a_type.c
@@ -57,8 +57,9 @@
  */
 
 #include <stdio.h>
-#include <openssl/asn1t.h>
 #include "cryptlib.h"
+#include <openssl/asn1t.h>
+#include <openssl/objects.h>
 
 int ASN1_TYPE_get(ASN1_TYPE *a)
         {
@@ -79,6 +80,31 @@ void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value)
         a->value.ptr=value;
         }
 
+int ASN1_TYPE_set1(ASN1_TYPE *a, int type, const void *value)
+        {
+        if (!value || (type == V_ASN1_BOOLEAN))
+                {
+                void *p = (void *)value;
+                ASN1_TYPE_set(a, type, p);
+                }
+        else if (type == V_ASN1_OBJECT)
+                {
+                ASN1_OBJECT *odup;
+                odup = OBJ_dup(value);
+                if (!odup)
+                        return 0;
+                ASN1_TYPE_set(a, type, odup);
+                }
+        else
+                {
+                ASN1_STRING *sdup;
+                sdup = ASN1_STRING_dup((ASN1_STRING *)value);
+                if (!sdup)
+                        return 0;
+                ASN1_TYPE_set(a, type, sdup);
+                }
+        return 1;
+        }
 
 IMPLEMENT_STACK_OF(ASN1_TYPE)
 IMPLEMENT_ASN1_SET_OF(ASN1_TYPE)
diff --git a/src/lib/libssl/src/crypto/asn1/a_utctm.c b/src/lib/libssl/src/crypto/asn1/a_utctm.c
index 7b25fed331..d31c028193 100644
--- a/src/lib/libssl/src/crypto/asn1/a_utctm.c
+++ b/src/lib/libssl/src/crypto/asn1/a_utctm.c
@@ -162,7 +162,7 @@ err:
         return(0);
         }
 
-int ASN1_UTCTIME_set_string(ASN1_UTCTIME *s, char *str)
+int ASN1_UTCTIME_set_string(ASN1_UTCTIME *s, const char *str)
         {
         ASN1_UTCTIME t;
 
diff --git a/src/lib/libssl/src/crypto/asn1/a_verify.c b/src/lib/libssl/src/crypto/asn1/a_verify.c
index 18ef0acf00..fdce6e4380 100644
--- a/src/lib/libssl/src/crypto/asn1/a_verify.c
+++ b/src/lib/libssl/src/crypto/asn1/a_verify.c
@@ -73,8 +73,8 @@
 
 #ifndef NO_ASN1_OLD
 
-int ASN1_verify(int (*i2d)(), X509_ALGOR *a, ASN1_BIT_STRING *signature,
-             char *data, EVP_PKEY *pkey)
+int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *a, ASN1_BIT_STRING *signature,
+                char *data, EVP_PKEY *pkey)
         {
         EVP_MD_CTX ctx;
         const EVP_MD *type;
@@ -138,13 +138,13 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, ASN1_BIT_STRING *signat
         type=EVP_get_digestbyname(OBJ_nid2sn(i));
         if (type == NULL)
                 {
-                ASN1err(ASN1_F_ASN1_VERIFY,ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM);
+                ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM);
                 goto err;
                 }
 
         if (!EVP_VerifyInit_ex(&ctx,type, NULL))
                 {
-                ASN1err(ASN1_F_ASN1_VERIFY,ERR_R_EVP_LIB);
+                ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ERR_R_EVP_LIB);
                 ret=0;
                 goto err;
                 }
@@ -153,7 +153,7 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, ASN1_BIT_STRING *signat
         
         if (buf_in == NULL)
                 {
-                ASN1err(ASN1_F_ASN1_VERIFY,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
 
@@ -165,7 +165,7 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, ASN1_BIT_STRING *signat
         if (EVP_VerifyFinal(&ctx,(unsigned char *)signature->data,
                         (unsigned int)signature->length,pkey) <= 0)
                 {
-                ASN1err(ASN1_F_ASN1_VERIFY,ERR_R_EVP_LIB);
+                ASN1err(ASN1_F_ASN1_ITEM_VERIFY,ERR_R_EVP_LIB);
                 ret=0;
                 goto err;
                 }
diff --git a/src/lib/libssl/src/crypto/asn1/asn1.h b/src/lib/libssl/src/crypto/asn1/asn1.h
index 0184b475a7..424cd348bb 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1.h
+++ b/src/lib/libssl/src/crypto/asn1/asn1.h
@@ -60,17 +60,19 @@
 #define HEADER_ASN1_H
 
 #include <time.h>
+#include <openssl/e_os2.h>
 #ifndef OPENSSL_NO_BIO
 #include <openssl/bio.h>
 #endif
-#include <openssl/e_os2.h>
-#include <openssl/bn.h>
 #include <openssl/stack.h>
 #include <openssl/safestack.h>
 
 #include <openssl/symhacks.h>
 
 #include <openssl/ossl_typ.h>
+#ifndef OPENSSL_NO_DEPRECATED
+#include <openssl/bn.h>
+#endif
 
 #ifdef OPENSSL_BUILD_SHLIBCRYPTO
 # undef OPENSSL_EXTERN
@@ -147,19 +149,29 @@ extern "C" {
 #define B_ASN1_UTF8STRING       0x2000
 #define B_ASN1_UTCTIME          0x4000
 #define B_ASN1_GENERALIZEDTIME  0x8000
+#define B_ASN1_SEQUENCE         0x10000
 
 /* For use with ASN1_mbstring_copy() */
 #define MBSTRING_FLAG           0x1000
+#define MBSTRING_UTF8           (MBSTRING_FLAG)
 #define MBSTRING_ASC            (MBSTRING_FLAG|1)
 #define MBSTRING_BMP            (MBSTRING_FLAG|2)
-#define MBSTRING_UNIV           (MBSTRING_FLAG|3)
-#define MBSTRING_UTF8           (MBSTRING_FLAG|4)
+#define MBSTRING_UNIV           (MBSTRING_FLAG|4)
+
+#define SMIME_OLDMIME           0x400
+#define SMIME_CRLFEOL           0x800
+#define SMIME_STREAM            0x1000
 
 struct X509_algor_st;
+DECLARE_STACK_OF(X509_ALGOR)
 
 #define DECLARE_ASN1_SET_OF(type) /* filled in by mkstack.pl */
 #define IMPLEMENT_ASN1_SET_OF(type) /* nothing, no longer needed */
 
+/* We MUST make sure that, except for constness, asn1_ctx_st and
+   asn1_const_ctx are exactly the same.  Fortunately, as soon as
+   the old ASN1 parsing macros are gone, we can throw this away
+   as well... */
 typedef struct asn1_ctx_st
         {
         unsigned char *p;/* work char pointer */
@@ -175,6 +187,21 @@ typedef struct asn1_ctx_st
         int line;       /* used in error processing */
         } ASN1_CTX;
 
+typedef struct asn1_const_ctx_st
+        {
+        const unsigned char *p;/* work char pointer */
+        int eos;        /* end of sequence read for indefinite encoding */
+        int error;      /* error code to use when returning an error */
+        int inf;        /* constructed if 0x20, indefinite is 0x21 */
+        int tag;        /* tag from last 'get object' */
+        int xclass;     /* class from last 'get object' */
+        long slen;      /* length of last 'get object' */
+        const unsigned char *max; /* largest value of p allowed */
+        const unsigned char *q;/* temporary variable */
+        const unsigned char **pp;/* variable */
+        int line;       /* used in error processing */
+        } ASN1_const_CTX;
+
 /* These are used internally in the ASN1_OBJECT to keep track of
  * whether the names and data need to be free()ed */
 #define ASN1_OBJECT_FLAG_DYNAMIC         0x01   /* internal use */
@@ -191,6 +218,18 @@ typedef struct asn1_object_st
         } ASN1_OBJECT;
 
 #define ASN1_STRING_FLAG_BITS_LEFT 0x08 /* Set if 0x07 has bits left value */
+/* This indicates that the ASN1_STRING is not a real value but just a place
+ * holder for the location where indefinite length constructed data should
+ * be inserted in the memory buffer 
+ */
+#define ASN1_STRING_FLAG_NDEF 0x010 
+
+/* This flag is used by the CMS code to indicate that a string is not
+ * complete and is a place holder for content when it had all been 
+ * accessed. The flag will be reset when content has been written to it.
+ */
+#define ASN1_STRING_FLAG_CONT 0x020 
+
 /* This is the base type that holds just about everything :-) */
 typedef struct asn1_string_st
         {
@@ -259,18 +298,19 @@ typedef struct ASN1_VALUE_st ASN1_VALUE;
 
 #define DECLARE_ASN1_FUNCTIONS(type) DECLARE_ASN1_FUNCTIONS_name(type, type)
 
+#define DECLARE_ASN1_ALLOC_FUNCTIONS(type) \
+        DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, type)
+
 #define DECLARE_ASN1_FUNCTIONS_name(type, name) \
-        type *name##_new(void); \
-        void name##_free(type *a); \
+        DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \
         DECLARE_ASN1_ENCODE_FUNCTIONS(type, name, name)
 
 #define DECLARE_ASN1_FUNCTIONS_fname(type, itname, name) \
-        type *name##_new(void); \
-        void name##_free(type *a); \
+        DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \
         DECLARE_ASN1_ENCODE_FUNCTIONS(type, itname, name)
 
 #define DECLARE_ASN1_ENCODE_FUNCTIONS(type, itname, name) \
-        type *d2i_##name(type **a, unsigned char **in, long len); \
+        type *d2i_##name(type **a, const unsigned char **in, long len); \
         int i2d_##name(type *a, unsigned char **out); \
         DECLARE_ASN1_ITEM(itname)
 
@@ -279,10 +319,37 @@ typedef struct ASN1_VALUE_st ASN1_VALUE;
         int i2d_##name(const type *a, unsigned char **out); \
         DECLARE_ASN1_ITEM(name)
 
+#define DECLARE_ASN1_NDEF_FUNCTION(name) \
+        int i2d_##name##_NDEF(name *a, unsigned char **out);
+
 #define DECLARE_ASN1_FUNCTIONS_const(name) \
-        name *name##_new(void); \
-        void name##_free(name *a);
+        DECLARE_ASN1_ALLOC_FUNCTIONS(name) \
+        DECLARE_ASN1_ENCODE_FUNCTIONS_const(name, name)
 
+#define DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \
+        type *name##_new(void); \
+        void name##_free(type *a);
+
+#define D2I_OF(type) type *(*)(type **,const unsigned char **,long)
+#define I2D_OF(type) int (*)(type *,unsigned char **)
+#define I2D_OF_const(type) int (*)(const type *,unsigned char **)
+
+#define CHECKED_D2I_OF(type, d2i) \
+    ((d2i_of_void*) (1 ? d2i : ((D2I_OF(type))0)))
+#define CHECKED_I2D_OF(type, i2d) \
+    ((i2d_of_void*) (1 ? i2d : ((I2D_OF(type))0)))
+#define CHECKED_NEW_OF(type, xnew) \
+    ((void *(*)(void)) (1 ? xnew : ((type *(*)(void))0)))
+#define CHECKED_PTR_OF(type, p) \
+    ((void*) (1 ? p : (type*)0))
+#define CHECKED_PPTR_OF(type, p) \
+    ((void**) (1 ? p : (type**)0))
+
+#define TYPEDEF_D2I_OF(type) typedef type *d2i_of_##type(type **,const unsigned char **,long)
+#define TYPEDEF_I2D_OF(type) typedef int i2d_of_##type(type *,unsigned char **)
+#define TYPEDEF_D2I2D_OF(type) TYPEDEF_D2I_OF(type); TYPEDEF_I2D_OF(type)
+
+TYPEDEF_D2I2D_OF(void);
 
 /* The following macros and typedefs allow an ASN1_ITEM
  * to be embedded in a structure and referenced. Since
@@ -467,6 +534,7 @@ typedef struct asn1_type_st
                  * contain the set or sequence bytes */
                 ASN1_STRING *           set;
                 ASN1_STRING *           sequence;
+                ASN1_VALUE  *           asn1_value;
                 } value;
         } ASN1_TYPE;
 
@@ -475,17 +543,17 @@ DECLARE_ASN1_SET_OF(ASN1_TYPE)
 
 typedef struct asn1_method_st
         {
-        int (*i2d)();
-        char *(*d2i)();
-        char *(*create)();
-        void (*destroy)();
+        i2d_of_void *i2d;
+        d2i_of_void *d2i;
+        void *(*create)(void);
+        void (*destroy)(void *);
         } ASN1_METHOD;
 
 /* This is used when parsing some Netscape objects */
 typedef struct asn1_header_st
         {
         ASN1_OCTET_STRING *header;
-        char *data;
+        void *data;
         ASN1_METHOD *meth;
         } ASN1_HEADER;
 
@@ -551,6 +619,7 @@ typedef struct BIT_STRING_BITNAME_st {
                         B_ASN1_UNIVERSALSTRING|\
                         B_ASN1_BMPSTRING|\
                         B_ASN1_UTF8STRING|\
+                        B_ASN1_SEQUENCE|\
                         B_ASN1_UNKNOWN
 
 #define B_ASN1_DIRECTORYSTRING \
@@ -696,13 +765,14 @@ DECLARE_ASN1_FUNCTIONS_fname(ASN1_TYPE, ASN1_ANY, ASN1_TYPE)
 
 int ASN1_TYPE_get(ASN1_TYPE *a);
 void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value);
+int ASN1_TYPE_set1(ASN1_TYPE *a, int type, const void *value);
 
 ASN1_OBJECT *   ASN1_OBJECT_new(void );
 void            ASN1_OBJECT_free(ASN1_OBJECT *a);
 int             i2d_ASN1_OBJECT(ASN1_OBJECT *a,unsigned char **pp);
-ASN1_OBJECT *   c2i_ASN1_OBJECT(ASN1_OBJECT **a,unsigned char **pp,
+ASN1_OBJECT *   c2i_ASN1_OBJECT(ASN1_OBJECT **a,const unsigned char **pp,
                         long length);
-ASN1_OBJECT *   d2i_ASN1_OBJECT(ASN1_OBJECT **a,unsigned char **pp,
+ASN1_OBJECT *   d2i_ASN1_OBJECT(ASN1_OBJECT **a,const unsigned char **pp,
                         long length);
 
 DECLARE_ASN1_ITEM(ASN1_OBJECT)
@@ -718,6 +788,7 @@ int 		ASN1_STRING_cmp(ASN1_STRING *a, ASN1_STRING *b);
   /* Since this is used to store all sorts of things, via macros, for now, make
      its data void * */
 int             ASN1_STRING_set(ASN1_STRING *str, const void *data, int len);
+void            ASN1_STRING_set0(ASN1_STRING *str, void *data, int len);
 int ASN1_STRING_length(ASN1_STRING *x);
 void ASN1_STRING_length_set(ASN1_STRING *x, int n);
 int ASN1_STRING_type(ASN1_STRING *x);
@@ -725,7 +796,7 @@ unsigned char * ASN1_STRING_data(ASN1_STRING *x);
 
 DECLARE_ASN1_FUNCTIONS(ASN1_BIT_STRING)
 int             i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a,unsigned char **pp);
-ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,unsigned char **pp,
+ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,const unsigned char **pp,
                         long length);
 int             ASN1_BIT_STRING_set(ASN1_BIT_STRING *a, unsigned char *d,
                         int length );
@@ -741,13 +812,13 @@ int ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, char *name, int value,
                                 BIT_STRING_BITNAME *tbl);
 
 int             i2d_ASN1_BOOLEAN(int a,unsigned char **pp);
-int             d2i_ASN1_BOOLEAN(int *a,unsigned char **pp,long length);
+int             d2i_ASN1_BOOLEAN(int *a,const unsigned char **pp,long length);
 
 DECLARE_ASN1_FUNCTIONS(ASN1_INTEGER)
 int             i2c_ASN1_INTEGER(ASN1_INTEGER *a,unsigned char **pp);
-ASN1_INTEGER *c2i_ASN1_INTEGER(ASN1_INTEGER **a,unsigned char **pp,
+ASN1_INTEGER *c2i_ASN1_INTEGER(ASN1_INTEGER **a,const unsigned char **pp,
                         long length);
-ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a,unsigned char **pp,
+ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a,const unsigned char **pp,
                         long length);
 ASN1_INTEGER *  ASN1_INTEGER_dup(ASN1_INTEGER *x);
 int ASN1_INTEGER_cmp(ASN1_INTEGER *x, ASN1_INTEGER *y);
@@ -756,7 +827,7 @@ DECLARE_ASN1_FUNCTIONS(ASN1_ENUMERATED)
 
 int ASN1_UTCTIME_check(ASN1_UTCTIME *a);
 ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s,time_t t);
-int ASN1_UTCTIME_set_string(ASN1_UTCTIME *s, char *str); 
+int ASN1_UTCTIME_set_string(ASN1_UTCTIME *s, const char *str);
 int ASN1_UTCTIME_cmp_time_t(const ASN1_UTCTIME *s, time_t t);
 #if 0
 time_t ASN1_UTCTIME_get(const ASN1_UTCTIME *s);
@@ -764,12 +835,12 @@ time_t ASN1_UTCTIME_get(const ASN1_UTCTIME *s);
 
 int ASN1_GENERALIZEDTIME_check(ASN1_GENERALIZEDTIME *a);
 ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,time_t t);
-int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, char *str); 
+int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, const char *str);
 
 DECLARE_ASN1_FUNCTIONS(ASN1_OCTET_STRING)
 ASN1_OCTET_STRING *     ASN1_OCTET_STRING_dup(ASN1_OCTET_STRING *a);
 int     ASN1_OCTET_STRING_cmp(ASN1_OCTET_STRING *a, ASN1_OCTET_STRING *b);
-int     ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *str, unsigned char *data, int len);
+int     ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *str, const unsigned char *data, int len);
 
 DECLARE_ASN1_FUNCTIONS(ASN1_VISIBLESTRING)
 DECLARE_ASN1_FUNCTIONS(ASN1_UNIVERSALSTRING)
@@ -792,15 +863,17 @@ DECLARE_ASN1_FUNCTIONS(ASN1_UTCTIME)
 DECLARE_ASN1_FUNCTIONS(ASN1_GENERALIZEDTIME)
 DECLARE_ASN1_FUNCTIONS(ASN1_TIME)
 
+DECLARE_ASN1_ITEM(ASN1_OCTET_STRING_NDEF)
+
 ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s,time_t t);
 int ASN1_TIME_check(ASN1_TIME *t);
 ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t, ASN1_GENERALIZEDTIME **out);
 
-int             i2d_ASN1_SET(STACK *a, unsigned char **pp,
-                        int (*func)(), int ex_tag, int ex_class, int is_set);
-STACK *         d2i_ASN1_SET(STACK **a, unsigned char **pp, long length,
-                        char *(*func)(), void (*free_func)(void *),
-                        int ex_tag, int ex_class);
+int i2d_ASN1_SET(STACK *a, unsigned char **pp,
+                 i2d_of_void *i2d, int ex_tag, int ex_class, int is_set);
+STACK * d2i_ASN1_SET(STACK **a, const unsigned char **pp, long length,
+                     d2i_of_void *d2i, void (*free_func)(void *),
+                     int ex_tag, int ex_class);
 
 #ifndef OPENSSL_NO_BIO
 int i2a_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *a);
@@ -832,33 +905,70 @@ BIGNUM *ASN1_ENUMERATED_to_BN(ASN1_ENUMERATED *ai,BIGNUM *bn);
 int ASN1_PRINTABLE_type(const unsigned char *s, int max);
 
 int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass);
-ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp,
+ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, const unsigned char **pp,
         long length, int Ptag, int Pclass);
 unsigned long ASN1_tag2bit(int tag);
 /* type is one or more of the B_ASN1_ values. */
-ASN1_STRING *d2i_ASN1_type_bytes(ASN1_STRING **a,unsigned char **pp,
+ASN1_STRING *d2i_ASN1_type_bytes(ASN1_STRING **a,const unsigned char **pp,
                 long length,int type);
 
 /* PARSING */
 int asn1_Finish(ASN1_CTX *c);
+int asn1_const_Finish(ASN1_const_CTX *c);
 
 /* SPECIALS */
-int ASN1_get_object(unsigned char **pp, long *plength, int *ptag,
+int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
         int *pclass, long omax);
 int ASN1_check_infinite_end(unsigned char **p,long len);
+int ASN1_const_check_infinite_end(const unsigned char **p,long len);
 void ASN1_put_object(unsigned char **pp, int constructed, int length,
         int tag, int xclass);
+int ASN1_put_eoc(unsigned char **pp);
 int ASN1_object_size(int constructed, int length, int tag);
 
 /* Used to implement other functions */
-char *ASN1_dup(int (*i2d)(),char *(*d2i)(),char *x);
+void *ASN1_dup(i2d_of_void *i2d, d2i_of_void *d2i, char *x);
+
+#define ASN1_dup_of(type,i2d,d2i,x) \
+    ((type*)ASN1_dup(CHECKED_I2D_OF(type, i2d), \
+                     CHECKED_D2I_OF(type, d2i), \
+                     CHECKED_PTR_OF(type, x)))
+
+#define ASN1_dup_of_const(type,i2d,d2i,x) \
+    ((type*)ASN1_dup(CHECKED_I2D_OF(const type, i2d), \
+                     CHECKED_D2I_OF(type, d2i), \
+                     CHECKED_PTR_OF(const type, x)))
 
 void *ASN1_item_dup(const ASN1_ITEM *it, void *x);
 
+/* ASN1 alloc/free macros for when a type is only used internally */
+
+#define M_ASN1_new_of(type) (type *)ASN1_item_new(ASN1_ITEM_rptr(type))
+#define M_ASN1_free_of(x, type) \
+                ASN1_item_free(CHECKED_PTR_OF(type, x), ASN1_ITEM_rptr(type))
+
 #ifndef OPENSSL_NO_FP_API
-char *ASN1_d2i_fp(char *(*xnew)(),char *(*d2i)(),FILE *fp,unsigned char **x);
+void *ASN1_d2i_fp(void *(*xnew)(void), d2i_of_void *d2i, FILE *in, void **x);
+
+#define ASN1_d2i_fp_of(type,xnew,d2i,in,x) \
+    ((type*)ASN1_d2i_fp(CHECKED_NEW_OF(type, xnew), \
+                        CHECKED_D2I_OF(type, d2i), \
+                        in, \
+                        CHECKED_PPTR_OF(type, x)))
+
 void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x);
-int ASN1_i2d_fp(int (*i2d)(),FILE *out,unsigned char *x);
+int ASN1_i2d_fp(i2d_of_void *i2d,FILE *out,void *x);
+
+#define ASN1_i2d_fp_of(type,i2d,out,x) \
+    (ASN1_i2d_fp(CHECKED_I2D_OF(type, i2d), \
+                 out, \
+                 CHECKED_PTR_OF(type, x)))
+
+#define ASN1_i2d_fp_of_const(type,i2d,out,x) \
+    (ASN1_i2d_fp(CHECKED_I2D_OF(const type, i2d), \
+                 out, \
+                 CHECKED_PTR_OF(const type, x)))
+
 int ASN1_item_i2d_fp(const ASN1_ITEM *it, FILE *out, void *x);
 int ASN1_STRING_print_ex_fp(FILE *fp, ASN1_STRING *str, unsigned long flags);
 #endif
@@ -866,23 +976,41 @@ int ASN1_STRING_print_ex_fp(FILE *fp, ASN1_STRING *str, unsigned long flags);
 int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in);
 
 #ifndef OPENSSL_NO_BIO
-char *ASN1_d2i_bio(char *(*xnew)(),char *(*d2i)(),BIO *bp,unsigned char **x);
+void *ASN1_d2i_bio(void *(*xnew)(void), d2i_of_void *d2i, BIO *in, void **x);
+
+#define ASN1_d2i_bio_of(type,xnew,d2i,in,x) \
+    ((type*)ASN1_d2i_bio( CHECKED_NEW_OF(type, xnew), \
+                          CHECKED_D2I_OF(type, d2i), \
+                          in, \
+                          CHECKED_PPTR_OF(type, x)))
+
 void *ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x);
-int ASN1_i2d_bio(int (*i2d)(),BIO *out,unsigned char *x);
+int ASN1_i2d_bio(i2d_of_void *i2d,BIO *out, unsigned char *x);
+
+#define ASN1_i2d_bio_of(type,i2d,out,x) \
+    (ASN1_i2d_bio(CHECKED_I2D_OF(type, i2d), \
+                  out, \
+                  CHECKED_PTR_OF(type, x)))
+
+#define ASN1_i2d_bio_of_const(type,i2d,out,x) \
+    (ASN1_i2d_bio(CHECKED_I2D_OF(const type, i2d), \
+                  out, \
+                  CHECKED_PTR_OF(const type, x)))
+
 int ASN1_item_i2d_bio(const ASN1_ITEM *it, BIO *out, void *x);
 int ASN1_UTCTIME_print(BIO *fp,ASN1_UTCTIME *a);
 int ASN1_GENERALIZEDTIME_print(BIO *fp,ASN1_GENERALIZEDTIME *a);
 int ASN1_TIME_print(BIO *fp,ASN1_TIME *a);
 int ASN1_STRING_print(BIO *bp,ASN1_STRING *v);
 int ASN1_STRING_print_ex(BIO *out, ASN1_STRING *str, unsigned long flags);
-int ASN1_parse(BIO *bp,unsigned char *pp,long len,int indent);
-int ASN1_parse_dump(BIO *bp,unsigned char *pp,long len,int indent,int dump);
+int ASN1_parse(BIO *bp,const unsigned char *pp,long len,int indent);
+int ASN1_parse_dump(BIO *bp,const unsigned char *pp,long len,int indent,int dump);
 #endif
 const char *ASN1_tag2str(int tag);
 
 /* Used to load and write netscape format cert/key */
 int i2d_ASN1_HEADER(ASN1_HEADER *a,unsigned char **pp);
-ASN1_HEADER *d2i_ASN1_HEADER(ASN1_HEADER **a,unsigned char **pp, long length);
+ASN1_HEADER *d2i_ASN1_HEADER(ASN1_HEADER **a,const unsigned char **pp, long length);
 ASN1_HEADER *ASN1_HEADER_new(void );
 void ASN1_HEADER_free(ASN1_HEADER *a);
 
@@ -903,13 +1031,20 @@ int ASN1_TYPE_set_int_octetstring(ASN1_TYPE *a, long num,
 int ASN1_TYPE_get_int_octetstring(ASN1_TYPE *a,long *num,
         unsigned char *data, int max_len);
 
-STACK *ASN1_seq_unpack(unsigned char *buf, int len, char *(*d2i)(),
-                                                 void (*free_func)(void *) ); 
-unsigned char *ASN1_seq_pack(STACK *safes, int (*i2d)(), unsigned char **buf,
-                             int *len );
-void *ASN1_unpack_string(ASN1_STRING *oct, char *(*d2i)());
+STACK *ASN1_seq_unpack(const unsigned char *buf, int len,
+                       d2i_of_void *d2i, void (*free_func)(void *));
+unsigned char *ASN1_seq_pack(STACK *safes, i2d_of_void *i2d,
+                             unsigned char **buf, int *len );
+void *ASN1_unpack_string(ASN1_STRING *oct, d2i_of_void *d2i);
 void *ASN1_item_unpack(ASN1_STRING *oct, const ASN1_ITEM *it);
-ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
+ASN1_STRING *ASN1_pack_string(void *obj, i2d_of_void *i2d,
+                              ASN1_OCTET_STRING **oct);
+
+#define ASN1_pack_string_of(type,obj,i2d,oct) \
+    (ASN1_pack_string(CHECKED_PTR_OF(type, obj), \
+                      CHECKED_I2D_OF(type, i2d), \
+                      oct))
+
 ASN1_STRING *ASN1_item_pack(void *obj, const ASN1_ITEM *it, ASN1_OCTET_STRING **oct);
 
 void ASN1_STRING_set_default_mask(unsigned long mask);
@@ -932,11 +1067,25 @@ void ASN1_STRING_TABLE_cleanup(void);
 /* Old API compatible functions */
 ASN1_VALUE *ASN1_item_new(const ASN1_ITEM *it);
 void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it);
-ASN1_VALUE * ASN1_item_d2i(ASN1_VALUE **val, unsigned char **in, long len, const ASN1_ITEM *it);
+ASN1_VALUE * ASN1_item_d2i(ASN1_VALUE **val, const unsigned char **in, long len, const ASN1_ITEM *it);
 int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it);
+int ASN1_item_ndef_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it);
 
 void ASN1_add_oid_module(void);
 
+ASN1_TYPE *ASN1_generate_nconf(char *str, CONF *nconf);
+ASN1_TYPE *ASN1_generate_v3(char *str, X509V3_CTX *cnf);
+
+typedef int asn1_output_data_fn(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
+                                        const ASN1_ITEM *it);
+
+int int_smime_write_ASN1(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
+                                int ctype_nid, int econt_nid,
+                                STACK_OF(X509_ALGOR) *mdalgs,
+                                asn1_output_data_fn *data_fn,
+                                const ASN1_ITEM *it);
+ASN1_VALUE *SMIME_read_ASN1(BIO *bio, BIO **bcont, const ASN1_ITEM *it);
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -950,49 +1099,70 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_F_A2I_ASN1_ENUMERATED                       101
 #define ASN1_F_A2I_ASN1_INTEGER                          102
 #define ASN1_F_A2I_ASN1_STRING                           103
-#define ASN1_F_ASN1_BIT_STRING_SET_BIT                   176
+#define ASN1_F_APPEND_EXP                                176
+#define ASN1_F_ASN1_BIT_STRING_SET_BIT                   183
+#define ASN1_F_ASN1_CB                                   177
 #define ASN1_F_ASN1_CHECK_TLEN                           104
 #define ASN1_F_ASN1_COLLATE_PRIMITIVE                    105
 #define ASN1_F_ASN1_COLLECT                              106
-#define ASN1_F_ASN1_D2I_BIO                              107
 #define ASN1_F_ASN1_D2I_EX_PRIMITIVE                     108
 #define ASN1_F_ASN1_D2I_FP                               109
-#define ASN1_F_ASN1_DIGEST                               177
+#define ASN1_F_ASN1_D2I_READ_BIO                         107
+#define ASN1_F_ASN1_DIGEST                               184
 #define ASN1_F_ASN1_DO_ADB                               110
 #define ASN1_F_ASN1_DUP                                  111
 #define ASN1_F_ASN1_ENUMERATED_SET                       112
 #define ASN1_F_ASN1_ENUMERATED_TO_BN                     113
-#define ASN1_F_ASN1_FIND_END                             182
-#define ASN1_F_ASN1_GENERALIZEDTIME_SET                  178
+#define ASN1_F_ASN1_EX_C2I                               204
+#define ASN1_F_ASN1_FIND_END                             190
+#define ASN1_F_ASN1_GENERALIZEDTIME_SET                  185
+#define ASN1_F_ASN1_GENERATE_V3                          178
 #define ASN1_F_ASN1_GET_OBJECT                           114
 #define ASN1_F_ASN1_HEADER_NEW                           115
 #define ASN1_F_ASN1_I2D_BIO                              116
 #define ASN1_F_ASN1_I2D_FP                               117
 #define ASN1_F_ASN1_INTEGER_SET                          118
 #define ASN1_F_ASN1_INTEGER_TO_BN                        119
+#define ASN1_F_ASN1_ITEM_D2I_FP                          206
+#define ASN1_F_ASN1_ITEM_DUP                             191
+#define ASN1_F_ASN1_ITEM_EX_COMBINE_NEW                  121
 #define ASN1_F_ASN1_ITEM_EX_D2I                          120
-#define ASN1_F_ASN1_ITEM_NEW                             121
-#define ASN1_F_ASN1_MBSTRING_COPY                        122
+#define ASN1_F_ASN1_ITEM_I2D_BIO                         192
+#define ASN1_F_ASN1_ITEM_I2D_FP                          193
+#define ASN1_F_ASN1_ITEM_PACK                            198
+#define ASN1_F_ASN1_ITEM_SIGN                            195
+#define ASN1_F_ASN1_ITEM_UNPACK                          199
+#define ASN1_F_ASN1_ITEM_VERIFY                          197
+#define ASN1_F_ASN1_MBSTRING_NCOPY                       122
 #define ASN1_F_ASN1_OBJECT_NEW                           123
+#define ASN1_F_ASN1_OUTPUT_DATA                          207
 #define ASN1_F_ASN1_PACK_STRING                          124
-#define ASN1_F_ASN1_PBE_SET                              125
+#define ASN1_F_ASN1_PCTX_NEW                             205
+#define ASN1_F_ASN1_PKCS5_PBE_SET                        125
 #define ASN1_F_ASN1_SEQ_PACK                             126
 #define ASN1_F_ASN1_SEQ_UNPACK                           127
 #define ASN1_F_ASN1_SIGN                                 128
-#define ASN1_F_ASN1_STRING_SET                           179
+#define ASN1_F_ASN1_STR2TYPE                             179
+#define ASN1_F_ASN1_STRING_SET                           186
 #define ASN1_F_ASN1_STRING_TABLE_ADD                     129
 #define ASN1_F_ASN1_STRING_TYPE_NEW                      130
-#define ASN1_F_ASN1_TEMPLATE_D2I                         131
 #define ASN1_F_ASN1_TEMPLATE_EX_D2I                      132
 #define ASN1_F_ASN1_TEMPLATE_NEW                         133
+#define ASN1_F_ASN1_TEMPLATE_NOEXP_D2I                   131
 #define ASN1_F_ASN1_TIME_SET                             175
 #define ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING             134
 #define ASN1_F_ASN1_TYPE_GET_OCTETSTRING                 135
 #define ASN1_F_ASN1_UNPACK_STRING                        136
-#define ASN1_F_ASN1_UTCTIME_SET                          180
+#define ASN1_F_ASN1_UTCTIME_SET                          187
 #define ASN1_F_ASN1_VERIFY                               137
+#define ASN1_F_B64_READ_ASN1                             208
+#define ASN1_F_B64_WRITE_ASN1                            209
+#define ASN1_F_BITSTR_CB                                 180
 #define ASN1_F_BN_TO_ASN1_ENUMERATED                     138
 #define ASN1_F_BN_TO_ASN1_INTEGER                        139
+#define ASN1_F_C2I_ASN1_BIT_STRING                       189
+#define ASN1_F_C2I_ASN1_INTEGER                          194
+#define ASN1_F_C2I_ASN1_OBJECT                           196
 #define ASN1_F_COLLECT_DATA                              140
 #define ASN1_F_D2I_ASN1_BIT_STRING                       141
 #define ASN1_F_D2I_ASN1_BOOLEAN                          142
@@ -1009,29 +1179,39 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_F_D2I_NETSCAPE_RSA_2                        153
 #define ASN1_F_D2I_PRIVATEKEY                            154
 #define ASN1_F_D2I_PUBLICKEY                             155
+#define ASN1_F_D2I_RSA_NET                               200
+#define ASN1_F_D2I_RSA_NET_2                             201
 #define ASN1_F_D2I_X509                                  156
 #define ASN1_F_D2I_X509_CINF                             157
-#define ASN1_F_D2I_X509_NAME                             158
 #define ASN1_F_D2I_X509_PKEY                             159
-#define ASN1_F_I2D_ASN1_SET                              181
+#define ASN1_F_I2D_ASN1_SET                              188
 #define ASN1_F_I2D_ASN1_TIME                             160
 #define ASN1_F_I2D_DSA_PUBKEY                            161
-#define ASN1_F_I2D_NETSCAPE_RSA                          162
+#define ASN1_F_I2D_EC_PUBKEY                             181
 #define ASN1_F_I2D_PRIVATEKEY                            163
 #define ASN1_F_I2D_PUBLICKEY                             164
+#define ASN1_F_I2D_RSA_NET                               162
 #define ASN1_F_I2D_RSA_PUBKEY                            165
 #define ASN1_F_LONG_C2I                                  166
 #define ASN1_F_OID_MODULE_INIT                           174
+#define ASN1_F_PARSE_TAGGING                             182
 #define ASN1_F_PKCS5_PBE2_SET                            167
+#define ASN1_F_PKCS5_PBE_SET                             202
+#define ASN1_F_SMIME_READ_ASN1                           210
+#define ASN1_F_SMIME_TEXT                                211
 #define ASN1_F_X509_CINF_NEW                             168
 #define ASN1_F_X509_CRL_ADD0_REVOKED                     169
 #define ASN1_F_X509_INFO_NEW                             170
-#define ASN1_F_X509_NAME_NEW                             171
+#define ASN1_F_X509_NAME_ENCODE                          203
+#define ASN1_F_X509_NAME_EX_D2I                          158
+#define ASN1_F_X509_NAME_EX_NEW                          171
 #define ASN1_F_X509_NEW                                  172
 #define ASN1_F_X509_PKEY_NEW                             173
 
 /* Reason codes. */
 #define ASN1_R_ADDING_OBJECT                             171
+#define ASN1_R_ASN1_PARSE_ERROR                          198
+#define ASN1_R_ASN1_SIG_PARSE_ERROR                      199
 #define ASN1_R_AUX_ERROR                                 100
 #define ASN1_R_BAD_CLASS                                 101
 #define ASN1_R_BAD_OBJECT_HEADER                         102
@@ -1044,6 +1224,7 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_R_DATA_IS_WRONG                             109
 #define ASN1_R_DECODE_ERROR                              110
 #define ASN1_R_DECODING_ERROR                            111
+#define ASN1_R_DEPTH_EXCEEDED                            174
 #define ASN1_R_ENCODE_ERROR                              112
 #define ASN1_R_ERROR_GETTING_TIME                        173
 #define ASN1_R_ERROR_LOADING_SECTION                     172
@@ -1058,39 +1239,68 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_R_FIELD_MISSING                             121
 #define ASN1_R_FIRST_NUM_TOO_LARGE                       122
 #define ASN1_R_HEADER_TOO_LONG                           123
+#define ASN1_R_ILLEGAL_BITSTRING_FORMAT                  175
+#define ASN1_R_ILLEGAL_BOOLEAN                           176
 #define ASN1_R_ILLEGAL_CHARACTERS                        124
+#define ASN1_R_ILLEGAL_FORMAT                            177
+#define ASN1_R_ILLEGAL_HEX                               178
+#define ASN1_R_ILLEGAL_IMPLICIT_TAG                      179
+#define ASN1_R_ILLEGAL_INTEGER                           180
+#define ASN1_R_ILLEGAL_NESTED_TAGGING                    181
 #define ASN1_R_ILLEGAL_NULL                              125
+#define ASN1_R_ILLEGAL_NULL_VALUE                        182
+#define ASN1_R_ILLEGAL_OBJECT                            183
 #define ASN1_R_ILLEGAL_OPTIONAL_ANY                      126
 #define ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE          170
 #define ASN1_R_ILLEGAL_TAGGED_ANY                        127
+#define ASN1_R_ILLEGAL_TIME_VALUE                        184
+#define ASN1_R_INTEGER_NOT_ASCII_FORMAT                  185
 #define ASN1_R_INTEGER_TOO_LARGE_FOR_LONG                128
 #define ASN1_R_INVALID_BMPSTRING_LENGTH                  129
 #define ASN1_R_INVALID_DIGIT                             130
+#define ASN1_R_INVALID_MIME_TYPE                         200
+#define ASN1_R_INVALID_MODIFIER                          186
+#define ASN1_R_INVALID_NUMBER                            187
 #define ASN1_R_INVALID_SEPARATOR                         131
 #define ASN1_R_INVALID_TIME_FORMAT                       132
 #define ASN1_R_INVALID_UNIVERSALSTRING_LENGTH            133
 #define ASN1_R_INVALID_UTF8STRING                        134
 #define ASN1_R_IV_TOO_LARGE                              135
 #define ASN1_R_LENGTH_ERROR                              136
+#define ASN1_R_LIST_ERROR                                188
+#define ASN1_R_MIME_NO_CONTENT_TYPE                      201
+#define ASN1_R_MIME_PARSE_ERROR                          202
+#define ASN1_R_MIME_SIG_PARSE_ERROR                      203
 #define ASN1_R_MISSING_EOC                               137
 #define ASN1_R_MISSING_SECOND_NUMBER                     138
+#define ASN1_R_MISSING_VALUE                             189
 #define ASN1_R_MSTRING_NOT_UNIVERSAL                     139
 #define ASN1_R_MSTRING_WRONG_TAG                         140
-#define ASN1_R_NESTED_ASN1_STRING                        174
+#define ASN1_R_NESTED_ASN1_STRING                        197
 #define ASN1_R_NON_HEX_CHARACTERS                        141
+#define ASN1_R_NOT_ASCII_FORMAT                          190
 #define ASN1_R_NOT_ENOUGH_DATA                           142
+#define ASN1_R_NO_CONTENT_TYPE                           204
 #define ASN1_R_NO_MATCHING_CHOICE_TYPE                   143
+#define ASN1_R_NO_MULTIPART_BODY_FAILURE                 205
+#define ASN1_R_NO_MULTIPART_BOUNDARY                     206
+#define ASN1_R_NO_SIG_CONTENT_TYPE                       207
 #define ASN1_R_NULL_IS_WRONG_LENGTH                      144
+#define ASN1_R_OBJECT_NOT_ASCII_FORMAT                   191
 #define ASN1_R_ODD_NUMBER_OF_CHARS                       145
 #define ASN1_R_PRIVATE_KEY_HEADER_MISSING                146
 #define ASN1_R_SECOND_NUMBER_TOO_LARGE                   147
 #define ASN1_R_SEQUENCE_LENGTH_MISMATCH                  148
 #define ASN1_R_SEQUENCE_NOT_CONSTRUCTED                  149
+#define ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG              192
 #define ASN1_R_SHORT_LINE                                150
+#define ASN1_R_SIG_INVALID_MIME_TYPE                     208
+#define ASN1_R_STREAMING_NOT_SUPPORTED                   209
 #define ASN1_R_STRING_TOO_LONG                           151
 #define ASN1_R_STRING_TOO_SHORT                          152
 #define ASN1_R_TAG_VALUE_TOO_HIGH                        153
 #define ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 154
+#define ASN1_R_TIME_NOT_ASCII_FORMAT                     193
 #define ASN1_R_TOO_LONG                                  155
 #define ASN1_R_TYPE_NOT_CONSTRUCTED                      156
 #define ASN1_R_UNABLE_TO_DECODE_RSA_KEY                  157
@@ -1100,10 +1310,13 @@ void ERR_load_ASN1_strings(void);
 #define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM          161
 #define ASN1_R_UNKNOWN_OBJECT_TYPE                       162
 #define ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE                   163
+#define ASN1_R_UNKNOWN_TAG                               194
+#define ASN1_R_UNKOWN_FORMAT                             195
 #define ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE           164
 #define ASN1_R_UNSUPPORTED_CIPHER                        165
 #define ASN1_R_UNSUPPORTED_ENCRYPTION_ALGORITHM          166
 #define ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE               167
+#define ASN1_R_UNSUPPORTED_TYPE                          196
 #define ASN1_R_WRONG_TAG                                 168
 #define ASN1_R_WRONG_TYPE                                169
 
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_err.c b/src/lib/libssl/src/crypto/asn1/asn1_err.c
index 315d0a0807..f8a3e2e6cd 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_err.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_err.c
@@ -1,6 +1,6 @@
 /* crypto/asn1/asn1_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2008 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -74,49 +74,70 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_FUNC(ASN1_F_A2I_ASN1_ENUMERATED),  "a2i_ASN1_ENUMERATED"},
 {ERR_FUNC(ASN1_F_A2I_ASN1_INTEGER),     "a2i_ASN1_INTEGER"},
 {ERR_FUNC(ASN1_F_A2I_ASN1_STRING),      "a2i_ASN1_STRING"},
+{ERR_FUNC(ASN1_F_APPEND_EXP),   "APPEND_EXP"},
 {ERR_FUNC(ASN1_F_ASN1_BIT_STRING_SET_BIT),      "ASN1_BIT_STRING_set_bit"},
+{ERR_FUNC(ASN1_F_ASN1_CB),      "ASN1_CB"},
 {ERR_FUNC(ASN1_F_ASN1_CHECK_TLEN),      "ASN1_CHECK_TLEN"},
 {ERR_FUNC(ASN1_F_ASN1_COLLATE_PRIMITIVE),       "ASN1_COLLATE_PRIMITIVE"},
 {ERR_FUNC(ASN1_F_ASN1_COLLECT), "ASN1_COLLECT"},
-{ERR_FUNC(ASN1_F_ASN1_D2I_BIO), "ASN1_d2i_bio"},
 {ERR_FUNC(ASN1_F_ASN1_D2I_EX_PRIMITIVE),        "ASN1_D2I_EX_PRIMITIVE"},
 {ERR_FUNC(ASN1_F_ASN1_D2I_FP),  "ASN1_d2i_fp"},
+{ERR_FUNC(ASN1_F_ASN1_D2I_READ_BIO),    "ASN1_D2I_READ_BIO"},
 {ERR_FUNC(ASN1_F_ASN1_DIGEST),  "ASN1_digest"},
 {ERR_FUNC(ASN1_F_ASN1_DO_ADB),  "ASN1_DO_ADB"},
 {ERR_FUNC(ASN1_F_ASN1_DUP),     "ASN1_dup"},
 {ERR_FUNC(ASN1_F_ASN1_ENUMERATED_SET),  "ASN1_ENUMERATED_set"},
 {ERR_FUNC(ASN1_F_ASN1_ENUMERATED_TO_BN),        "ASN1_ENUMERATED_to_BN"},
+{ERR_FUNC(ASN1_F_ASN1_EX_C2I),  "ASN1_EX_C2I"},
 {ERR_FUNC(ASN1_F_ASN1_FIND_END),        "ASN1_FIND_END"},
 {ERR_FUNC(ASN1_F_ASN1_GENERALIZEDTIME_SET),     "ASN1_GENERALIZEDTIME_set"},
+{ERR_FUNC(ASN1_F_ASN1_GENERATE_V3),     "ASN1_generate_v3"},
 {ERR_FUNC(ASN1_F_ASN1_GET_OBJECT),      "ASN1_get_object"},
 {ERR_FUNC(ASN1_F_ASN1_HEADER_NEW),      "ASN1_HEADER_new"},
 {ERR_FUNC(ASN1_F_ASN1_I2D_BIO), "ASN1_i2d_bio"},
 {ERR_FUNC(ASN1_F_ASN1_I2D_FP),  "ASN1_i2d_fp"},
 {ERR_FUNC(ASN1_F_ASN1_INTEGER_SET),     "ASN1_INTEGER_set"},
 {ERR_FUNC(ASN1_F_ASN1_INTEGER_TO_BN),   "ASN1_INTEGER_to_BN"},
+{ERR_FUNC(ASN1_F_ASN1_ITEM_D2I_FP),     "ASN1_item_d2i_fp"},
+{ERR_FUNC(ASN1_F_ASN1_ITEM_DUP),        "ASN1_item_dup"},
+{ERR_FUNC(ASN1_F_ASN1_ITEM_EX_COMBINE_NEW),     "ASN1_ITEM_EX_COMBINE_NEW"},
 {ERR_FUNC(ASN1_F_ASN1_ITEM_EX_D2I),     "ASN1_ITEM_EX_D2I"},
-{ERR_FUNC(ASN1_F_ASN1_ITEM_NEW),        "ASN1_item_new"},
-{ERR_FUNC(ASN1_F_ASN1_MBSTRING_COPY),   "ASN1_mbstring_copy"},
+{ERR_FUNC(ASN1_F_ASN1_ITEM_I2D_BIO),    "ASN1_item_i2d_bio"},
+{ERR_FUNC(ASN1_F_ASN1_ITEM_I2D_FP),     "ASN1_item_i2d_fp"},
+{ERR_FUNC(ASN1_F_ASN1_ITEM_PACK),       "ASN1_item_pack"},
+{ERR_FUNC(ASN1_F_ASN1_ITEM_SIGN),       "ASN1_item_sign"},
+{ERR_FUNC(ASN1_F_ASN1_ITEM_UNPACK),     "ASN1_item_unpack"},
+{ERR_FUNC(ASN1_F_ASN1_ITEM_VERIFY),     "ASN1_item_verify"},
+{ERR_FUNC(ASN1_F_ASN1_MBSTRING_NCOPY),  "ASN1_mbstring_ncopy"},
 {ERR_FUNC(ASN1_F_ASN1_OBJECT_NEW),      "ASN1_OBJECT_new"},
+{ERR_FUNC(ASN1_F_ASN1_OUTPUT_DATA),     "ASN1_OUTPUT_DATA"},
 {ERR_FUNC(ASN1_F_ASN1_PACK_STRING),     "ASN1_pack_string"},
-{ERR_FUNC(ASN1_F_ASN1_PBE_SET), "ASN1_PBE_SET"},
+{ERR_FUNC(ASN1_F_ASN1_PCTX_NEW),        "ASN1_PCTX_NEW"},
+{ERR_FUNC(ASN1_F_ASN1_PKCS5_PBE_SET),   "ASN1_PKCS5_PBE_SET"},
 {ERR_FUNC(ASN1_F_ASN1_SEQ_PACK),        "ASN1_seq_pack"},
 {ERR_FUNC(ASN1_F_ASN1_SEQ_UNPACK),      "ASN1_seq_unpack"},
 {ERR_FUNC(ASN1_F_ASN1_SIGN),    "ASN1_sign"},
+{ERR_FUNC(ASN1_F_ASN1_STR2TYPE),        "ASN1_STR2TYPE"},
 {ERR_FUNC(ASN1_F_ASN1_STRING_SET),      "ASN1_STRING_set"},
 {ERR_FUNC(ASN1_F_ASN1_STRING_TABLE_ADD),        "ASN1_STRING_TABLE_add"},
 {ERR_FUNC(ASN1_F_ASN1_STRING_TYPE_NEW), "ASN1_STRING_type_new"},
-{ERR_FUNC(ASN1_F_ASN1_TEMPLATE_D2I),    "ASN1_TEMPLATE_D2I"},
 {ERR_FUNC(ASN1_F_ASN1_TEMPLATE_EX_D2I), "ASN1_TEMPLATE_EX_D2I"},
 {ERR_FUNC(ASN1_F_ASN1_TEMPLATE_NEW),    "ASN1_TEMPLATE_NEW"},
+{ERR_FUNC(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I),      "ASN1_TEMPLATE_NOEXP_D2I"},
 {ERR_FUNC(ASN1_F_ASN1_TIME_SET),        "ASN1_TIME_set"},
 {ERR_FUNC(ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING),        "ASN1_TYPE_get_int_octetstring"},
 {ERR_FUNC(ASN1_F_ASN1_TYPE_GET_OCTETSTRING),    "ASN1_TYPE_get_octetstring"},
 {ERR_FUNC(ASN1_F_ASN1_UNPACK_STRING),   "ASN1_unpack_string"},
 {ERR_FUNC(ASN1_F_ASN1_UTCTIME_SET),     "ASN1_UTCTIME_set"},
 {ERR_FUNC(ASN1_F_ASN1_VERIFY),  "ASN1_verify"},
+{ERR_FUNC(ASN1_F_B64_READ_ASN1),        "B64_READ_ASN1"},
+{ERR_FUNC(ASN1_F_B64_WRITE_ASN1),       "B64_WRITE_ASN1"},
+{ERR_FUNC(ASN1_F_BITSTR_CB),    "BITSTR_CB"},
 {ERR_FUNC(ASN1_F_BN_TO_ASN1_ENUMERATED),        "BN_to_ASN1_ENUMERATED"},
 {ERR_FUNC(ASN1_F_BN_TO_ASN1_INTEGER),   "BN_to_ASN1_INTEGER"},
+{ERR_FUNC(ASN1_F_C2I_ASN1_BIT_STRING),  "c2i_ASN1_BIT_STRING"},
+{ERR_FUNC(ASN1_F_C2I_ASN1_INTEGER),     "c2i_ASN1_INTEGER"},
+{ERR_FUNC(ASN1_F_C2I_ASN1_OBJECT),      "c2i_ASN1_OBJECT"},
 {ERR_FUNC(ASN1_F_COLLECT_DATA), "COLLECT_DATA"},
 {ERR_FUNC(ASN1_F_D2I_ASN1_BIT_STRING),  "D2I_ASN1_BIT_STRING"},
 {ERR_FUNC(ASN1_F_D2I_ASN1_BOOLEAN),     "d2i_ASN1_BOOLEAN"},
@@ -133,24 +154,32 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_FUNC(ASN1_F_D2I_NETSCAPE_RSA_2),   "D2I_NETSCAPE_RSA_2"},
 {ERR_FUNC(ASN1_F_D2I_PRIVATEKEY),       "d2i_PrivateKey"},
 {ERR_FUNC(ASN1_F_D2I_PUBLICKEY),        "d2i_PublicKey"},
+{ERR_FUNC(ASN1_F_D2I_RSA_NET),  "d2i_RSA_NET"},
+{ERR_FUNC(ASN1_F_D2I_RSA_NET_2),        "D2I_RSA_NET_2"},
 {ERR_FUNC(ASN1_F_D2I_X509),     "D2I_X509"},
 {ERR_FUNC(ASN1_F_D2I_X509_CINF),        "D2I_X509_CINF"},
-{ERR_FUNC(ASN1_F_D2I_X509_NAME),        "D2I_X509_NAME"},
 {ERR_FUNC(ASN1_F_D2I_X509_PKEY),        "d2i_X509_PKEY"},
 {ERR_FUNC(ASN1_F_I2D_ASN1_SET), "i2d_ASN1_SET"},
 {ERR_FUNC(ASN1_F_I2D_ASN1_TIME),        "I2D_ASN1_TIME"},
 {ERR_FUNC(ASN1_F_I2D_DSA_PUBKEY),       "i2d_DSA_PUBKEY"},
-{ERR_FUNC(ASN1_F_I2D_NETSCAPE_RSA),     "i2d_Netscape_RSA"},
+{ERR_FUNC(ASN1_F_I2D_EC_PUBKEY),        "i2d_EC_PUBKEY"},
 {ERR_FUNC(ASN1_F_I2D_PRIVATEKEY),       "i2d_PrivateKey"},
 {ERR_FUNC(ASN1_F_I2D_PUBLICKEY),        "i2d_PublicKey"},
+{ERR_FUNC(ASN1_F_I2D_RSA_NET),  "i2d_RSA_NET"},
 {ERR_FUNC(ASN1_F_I2D_RSA_PUBKEY),       "i2d_RSA_PUBKEY"},
 {ERR_FUNC(ASN1_F_LONG_C2I),     "LONG_C2I"},
 {ERR_FUNC(ASN1_F_OID_MODULE_INIT),      "OID_MODULE_INIT"},
+{ERR_FUNC(ASN1_F_PARSE_TAGGING),        "PARSE_TAGGING"},
 {ERR_FUNC(ASN1_F_PKCS5_PBE2_SET),       "PKCS5_pbe2_set"},
+{ERR_FUNC(ASN1_F_PKCS5_PBE_SET),        "PKCS5_pbe_set"},
+{ERR_FUNC(ASN1_F_SMIME_READ_ASN1),      "SMIME_read_ASN1"},
+{ERR_FUNC(ASN1_F_SMIME_TEXT),   "SMIME_text"},
 {ERR_FUNC(ASN1_F_X509_CINF_NEW),        "X509_CINF_NEW"},
 {ERR_FUNC(ASN1_F_X509_CRL_ADD0_REVOKED),        "X509_CRL_add0_revoked"},
 {ERR_FUNC(ASN1_F_X509_INFO_NEW),        "X509_INFO_new"},
-{ERR_FUNC(ASN1_F_X509_NAME_NEW),        "X509_NAME_NEW"},
+{ERR_FUNC(ASN1_F_X509_NAME_ENCODE),     "X509_NAME_ENCODE"},
+{ERR_FUNC(ASN1_F_X509_NAME_EX_D2I),     "X509_NAME_EX_D2I"},
+{ERR_FUNC(ASN1_F_X509_NAME_EX_NEW),     "X509_NAME_EX_NEW"},
 {ERR_FUNC(ASN1_F_X509_NEW),     "X509_NEW"},
 {ERR_FUNC(ASN1_F_X509_PKEY_NEW),        "X509_PKEY_new"},
 {0,NULL}
@@ -159,6 +188,8 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 static ERR_STRING_DATA ASN1_str_reasons[]=
         {
 {ERR_REASON(ASN1_R_ADDING_OBJECT)        ,"adding object"},
+{ERR_REASON(ASN1_R_ASN1_PARSE_ERROR)     ,"asn1 parse error"},
+{ERR_REASON(ASN1_R_ASN1_SIG_PARSE_ERROR) ,"asn1 sig parse error"},
 {ERR_REASON(ASN1_R_AUX_ERROR)            ,"aux error"},
 {ERR_REASON(ASN1_R_BAD_CLASS)            ,"bad class"},
 {ERR_REASON(ASN1_R_BAD_OBJECT_HEADER)    ,"bad object header"},
@@ -171,6 +202,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ERR_REASON(ASN1_R_DATA_IS_WRONG)        ,"data is wrong"},
 {ERR_REASON(ASN1_R_DECODE_ERROR)         ,"decode error"},
 {ERR_REASON(ASN1_R_DECODING_ERROR)       ,"decoding error"},
+{ERR_REASON(ASN1_R_DEPTH_EXCEEDED)       ,"depth exceeded"},
 {ERR_REASON(ASN1_R_ENCODE_ERROR)         ,"encode error"},
 {ERR_REASON(ASN1_R_ERROR_GETTING_TIME)   ,"error getting time"},
 {ERR_REASON(ASN1_R_ERROR_LOADING_SECTION),"error loading section"},
@@ -185,39 +217,68 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ERR_REASON(ASN1_R_FIELD_MISSING)        ,"field missing"},
 {ERR_REASON(ASN1_R_FIRST_NUM_TOO_LARGE)  ,"first num too large"},
 {ERR_REASON(ASN1_R_HEADER_TOO_LONG)      ,"header too long"},
+{ERR_REASON(ASN1_R_ILLEGAL_BITSTRING_FORMAT),"illegal bitstring format"},
+{ERR_REASON(ASN1_R_ILLEGAL_BOOLEAN)      ,"illegal boolean"},
 {ERR_REASON(ASN1_R_ILLEGAL_CHARACTERS)   ,"illegal characters"},
+{ERR_REASON(ASN1_R_ILLEGAL_FORMAT)       ,"illegal format"},
+{ERR_REASON(ASN1_R_ILLEGAL_HEX)          ,"illegal hex"},
+{ERR_REASON(ASN1_R_ILLEGAL_IMPLICIT_TAG) ,"illegal implicit tag"},
+{ERR_REASON(ASN1_R_ILLEGAL_INTEGER)      ,"illegal integer"},
+{ERR_REASON(ASN1_R_ILLEGAL_NESTED_TAGGING),"illegal nested tagging"},
 {ERR_REASON(ASN1_R_ILLEGAL_NULL)         ,"illegal null"},
+{ERR_REASON(ASN1_R_ILLEGAL_NULL_VALUE)   ,"illegal null value"},
+{ERR_REASON(ASN1_R_ILLEGAL_OBJECT)       ,"illegal object"},
 {ERR_REASON(ASN1_R_ILLEGAL_OPTIONAL_ANY) ,"illegal optional any"},
 {ERR_REASON(ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE),"illegal options on item template"},
 {ERR_REASON(ASN1_R_ILLEGAL_TAGGED_ANY)   ,"illegal tagged any"},
+{ERR_REASON(ASN1_R_ILLEGAL_TIME_VALUE)   ,"illegal time value"},
+{ERR_REASON(ASN1_R_INTEGER_NOT_ASCII_FORMAT),"integer not ascii format"},
 {ERR_REASON(ASN1_R_INTEGER_TOO_LARGE_FOR_LONG),"integer too large for long"},
 {ERR_REASON(ASN1_R_INVALID_BMPSTRING_LENGTH),"invalid bmpstring length"},
 {ERR_REASON(ASN1_R_INVALID_DIGIT)        ,"invalid digit"},
+{ERR_REASON(ASN1_R_INVALID_MIME_TYPE)    ,"invalid mime type"},
+{ERR_REASON(ASN1_R_INVALID_MODIFIER)     ,"invalid modifier"},
+{ERR_REASON(ASN1_R_INVALID_NUMBER)       ,"invalid number"},
 {ERR_REASON(ASN1_R_INVALID_SEPARATOR)    ,"invalid separator"},
 {ERR_REASON(ASN1_R_INVALID_TIME_FORMAT)  ,"invalid time format"},
 {ERR_REASON(ASN1_R_INVALID_UNIVERSALSTRING_LENGTH),"invalid universalstring length"},
 {ERR_REASON(ASN1_R_INVALID_UTF8STRING)   ,"invalid utf8string"},
 {ERR_REASON(ASN1_R_IV_TOO_LARGE)         ,"iv too large"},
 {ERR_REASON(ASN1_R_LENGTH_ERROR)         ,"length error"},
+{ERR_REASON(ASN1_R_LIST_ERROR)           ,"list error"},
+{ERR_REASON(ASN1_R_MIME_NO_CONTENT_TYPE) ,"mime no content type"},
+{ERR_REASON(ASN1_R_MIME_PARSE_ERROR)     ,"mime parse error"},
+{ERR_REASON(ASN1_R_MIME_SIG_PARSE_ERROR) ,"mime sig parse error"},
 {ERR_REASON(ASN1_R_MISSING_EOC)          ,"missing eoc"},
 {ERR_REASON(ASN1_R_MISSING_SECOND_NUMBER),"missing second number"},
+{ERR_REASON(ASN1_R_MISSING_VALUE)        ,"missing value"},
 {ERR_REASON(ASN1_R_MSTRING_NOT_UNIVERSAL),"mstring not universal"},
 {ERR_REASON(ASN1_R_MSTRING_WRONG_TAG)    ,"mstring wrong tag"},
 {ERR_REASON(ASN1_R_NESTED_ASN1_STRING)   ,"nested asn1 string"},
 {ERR_REASON(ASN1_R_NON_HEX_CHARACTERS)   ,"non hex characters"},
+{ERR_REASON(ASN1_R_NOT_ASCII_FORMAT)     ,"not ascii format"},
 {ERR_REASON(ASN1_R_NOT_ENOUGH_DATA)      ,"not enough data"},
+{ERR_REASON(ASN1_R_NO_CONTENT_TYPE)      ,"no content type"},
 {ERR_REASON(ASN1_R_NO_MATCHING_CHOICE_TYPE),"no matching choice type"},
+{ERR_REASON(ASN1_R_NO_MULTIPART_BODY_FAILURE),"no multipart body failure"},
+{ERR_REASON(ASN1_R_NO_MULTIPART_BOUNDARY),"no multipart boundary"},
+{ERR_REASON(ASN1_R_NO_SIG_CONTENT_TYPE)  ,"no sig content type"},
 {ERR_REASON(ASN1_R_NULL_IS_WRONG_LENGTH) ,"null is wrong length"},
+{ERR_REASON(ASN1_R_OBJECT_NOT_ASCII_FORMAT),"object not ascii format"},
 {ERR_REASON(ASN1_R_ODD_NUMBER_OF_CHARS)  ,"odd number of chars"},
 {ERR_REASON(ASN1_R_PRIVATE_KEY_HEADER_MISSING),"private key header missing"},
 {ERR_REASON(ASN1_R_SECOND_NUMBER_TOO_LARGE),"second number too large"},
 {ERR_REASON(ASN1_R_SEQUENCE_LENGTH_MISMATCH),"sequence length mismatch"},
 {ERR_REASON(ASN1_R_SEQUENCE_NOT_CONSTRUCTED),"sequence not constructed"},
+{ERR_REASON(ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG),"sequence or set needs config"},
 {ERR_REASON(ASN1_R_SHORT_LINE)           ,"short line"},
+{ERR_REASON(ASN1_R_SIG_INVALID_MIME_TYPE),"sig invalid mime type"},
+{ERR_REASON(ASN1_R_STREAMING_NOT_SUPPORTED),"streaming not supported"},
 {ERR_REASON(ASN1_R_STRING_TOO_LONG)      ,"string too long"},
 {ERR_REASON(ASN1_R_STRING_TOO_SHORT)     ,"string too short"},
 {ERR_REASON(ASN1_R_TAG_VALUE_TOO_HIGH)   ,"tag value too high"},
 {ERR_REASON(ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD),"the asn1 object identifier is not known for this md"},
+{ERR_REASON(ASN1_R_TIME_NOT_ASCII_FORMAT),"time not ascii format"},
 {ERR_REASON(ASN1_R_TOO_LONG)             ,"too long"},
 {ERR_REASON(ASN1_R_TYPE_NOT_CONSTRUCTED) ,"type not constructed"},
 {ERR_REASON(ASN1_R_UNABLE_TO_DECODE_RSA_KEY),"unable to decode rsa key"},
@@ -227,10 +288,13 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ERR_REASON(ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM),"unknown message digest algorithm"},
 {ERR_REASON(ASN1_R_UNKNOWN_OBJECT_TYPE)  ,"unknown object type"},
 {ERR_REASON(ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE),"unknown public key type"},
+{ERR_REASON(ASN1_R_UNKNOWN_TAG)          ,"unknown tag"},
+{ERR_REASON(ASN1_R_UNKOWN_FORMAT)        ,"unkown format"},
 {ERR_REASON(ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE),"unsupported any defined by type"},
 {ERR_REASON(ASN1_R_UNSUPPORTED_CIPHER)   ,"unsupported cipher"},
 {ERR_REASON(ASN1_R_UNSUPPORTED_ENCRYPTION_ALGORITHM),"unsupported encryption algorithm"},
 {ERR_REASON(ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE),"unsupported public key type"},
+{ERR_REASON(ASN1_R_UNSUPPORTED_TYPE)     ,"unsupported type"},
 {ERR_REASON(ASN1_R_WRONG_TAG)            ,"wrong tag"},
 {ERR_REASON(ASN1_R_WRONG_TYPE)           ,"wrong type"},
 {0,NULL}
@@ -240,15 +304,12 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 
 void ERR_load_ASN1_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(ASN1_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,ASN1_str_functs);
                 ERR_load_strings(0,ASN1_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_lib.c b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
index 97b9b35f4b..5af559ef8d 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_lib.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
@@ -62,11 +62,11 @@
 #include <openssl/asn1.h>
 #include <openssl/asn1_mac.h>
 
-static int asn1_get_length(unsigned char **pp,int *inf,long *rl,int max);
+static int asn1_get_length(const unsigned char **pp,int *inf,long *rl,int max);
 static void asn1_put_length(unsigned char **pp, int length);
-const char *ASN1_version="ASN.1" OPENSSL_VERSION_PTEXT;
+const char ASN1_version[]="ASN.1" OPENSSL_VERSION_PTEXT;
 
-int ASN1_check_infinite_end(unsigned char **p, long len)
+static int _asn1_check_infinite_end(const unsigned char **p, long len)
         {
         /* If there is 0 or 1 byte left, the length check should pick
          * things up */
@@ -80,13 +80,23 @@ int ASN1_check_infinite_end(unsigned char **p, long len)
         return(0);
         }
 
+int ASN1_check_infinite_end(unsigned char **p, long len)
+        {
+        return _asn1_check_infinite_end((const unsigned char **)p, len);
+        }
 
-int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
-             long omax)
+int ASN1_const_check_infinite_end(const unsigned char **p, long len)
+        {
+        return _asn1_check_infinite_end(p, len);
+        }
+
+
+int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
+        int *pclass, long omax)
         {
         int i,ret;
         long l;
-        unsigned char *p= *pp;
+        const unsigned char *p= *pp;
         int tag,xclass,inf;
         long max=omax;
 
@@ -141,11 +151,11 @@ err:
         return(0x80);
         }
 
-static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
+static int asn1_get_length(const unsigned char **pp, int *inf, long *rl, int max)
         {
-        unsigned char *p= *pp;
+        const unsigned char *p= *pp;
         unsigned long ret=0;
-        int i;
+        unsigned int i;
 
         if (max-- < 1) return(0);
         if (*p == 0x80)
@@ -205,13 +215,22 @@ void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
                         }
                 p += ttag;
                 }
-        if ((constructed == 2) && (length == 0))
-                *(p++)=0x80; /* der_put_length would output 0 instead */
+        if (constructed == 2)
+                *(p++)=0x80;
         else
                 asn1_put_length(&p,length);
         *pp=p;
         }
 
+int ASN1_put_eoc(unsigned char **pp)
+        {
+        unsigned char *p = *pp;
+        *p++ = 0;
+        *p++ = 0;
+        *pp = p;
+        return 2;
+        }
+
 static void asn1_put_length(unsigned char **pp, int length)
         {
         unsigned char *p= *pp;
@@ -249,8 +268,8 @@ int ASN1_object_size(int constructed, int length, int tag)
                         ret++;
                         }
                 }
-        if ((length == 0) && (constructed == 2))
-                ret+=2;
+        if (constructed == 2)
+                return ret + 3;
         ret++;
         if (length > 127)
                 {
@@ -263,11 +282,11 @@ int ASN1_object_size(int constructed, int length, int tag)
         return(ret);
         }
 
-int asn1_Finish(ASN1_CTX *c)
+static int _asn1_Finish(ASN1_const_CTX *c)
         {
         if ((c->inf == (1|V_ASN1_CONSTRUCTED)) && (!c->eos))
                 {
-                if (!ASN1_check_infinite_end(&c->p,c->slen))
+                if (!ASN1_const_check_infinite_end(&c->p,c->slen))
                         {
                         c->error=ERR_R_MISSING_ASN1_EOS;
                         return(0);
@@ -282,9 +301,19 @@ int asn1_Finish(ASN1_CTX *c)
         return(1);
         }
 
-int asn1_GetSequence(ASN1_CTX *c, long *length)
+int asn1_Finish(ASN1_CTX *c)
+        {
+        return _asn1_Finish((ASN1_const_CTX *)c);
+        }
+
+int asn1_const_Finish(ASN1_const_CTX *c)
         {
-        unsigned char *q;
+        return _asn1_Finish(c);
+        }
+
+int asn1_GetSequence(ASN1_const_CTX *c, long *length)
+        {
+        const unsigned char *q;
 
         q=c->p;
         c->inf=ASN1_get_object(&(c->p),&(c->slen),&(c->tag),&(c->xclass),
@@ -364,6 +393,14 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
         return(1);
         }
 
+void ASN1_STRING_set0(ASN1_STRING *str, void *data, int len)
+        {
+        if (str->data)
+                OPENSSL_free(str->data);
+        str->data = data;
+        str->length = len;
+        }
+
 ASN1_STRING *ASN1_STRING_new(void)
         {
         return(ASN1_STRING_type_new(V_ASN1_OCTET_STRING));
@@ -411,7 +448,7 @@ int ASN1_STRING_cmp(ASN1_STRING *a, ASN1_STRING *b)
                 return(i);
         }
 
-void asn1_add_error(unsigned char *address, int offset)
+void asn1_add_error(const unsigned char *address, int offset)
         {
         char buf1[DECIMAL_SIZE(address)+1],buf2[DECIMAL_SIZE(offset)+1];
 
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_mac.h b/src/lib/libssl/src/crypto/asn1/asn1_mac.h
index a48649ceeb..d958ca60d9 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_mac.h
+++ b/src/lib/libssl/src/crypto/asn1/asn1_mac.h
@@ -73,11 +73,11 @@ extern "C" {
         ERR_PUT_error(ASN1_MAC_ERR_LIB,(f),(r),__FILE__,(line))
 
 #define M_ASN1_D2I_vars(a,type,func) \
-        ASN1_CTX c; \
+        ASN1_const_CTX c; \
         type ret=NULL; \
         \
-        c.pp=(unsigned char **)pp; \
-        c.q= *(unsigned char **)pp; \
+        c.pp=(const unsigned char **)pp; \
+        c.q= *(const unsigned char **)pp; \
         c.error=ERR_R_NESTED_ASN1_ERROR; \
         if ((a == NULL) || ((*a) == NULL)) \
                 { if ((ret=(type)func()) == NULL) \
@@ -85,13 +85,13 @@ extern "C" {
         else    ret=(*a);
 
 #define M_ASN1_D2I_Init() \
-        c.p= *(unsigned char **)pp; \
+        c.p= *(const unsigned char **)pp; \
         c.max=(length == 0)?0:(c.p+length);
 
 #define M_ASN1_D2I_Finish_2(a) \
-        if (!asn1_Finish(&c)) \
+        if (!asn1_const_Finish(&c)) \
                 { c.line=__LINE__; goto err; } \
-        *(unsigned char **)pp=c.p; \
+        *(const unsigned char **)pp=c.p; \
         if (a != NULL) (*a)=ret; \
         return(ret);
 
@@ -99,7 +99,7 @@ extern "C" {
         M_ASN1_D2I_Finish_2(a); \
 err:\
         ASN1_MAC_H_err((e),c.error,c.line); \
-        asn1_add_error(*(unsigned char **)pp,(int)(c.q- *pp)); \
+        asn1_add_error(*(const unsigned char **)pp,(int)(c.q- *pp)); \
         if ((ret != NULL) && ((a == NULL) || (*a != ret))) func(ret); \
         return(NULL)
 
@@ -123,15 +123,22 @@ err:\
 
 #define M_ASN1_D2I_end_sequence() \
         (((c.inf&1) == 0)?(c.slen <= 0): \
-                (c.eos=ASN1_check_infinite_end(&c.p,c.slen)))
+                (c.eos=ASN1_const_check_infinite_end(&c.p,c.slen)))
 
 /* Don't use this with d2i_ASN1_BOOLEAN() */
-#define M_ASN1_D2I_get(b,func) \
+#define M_ASN1_D2I_get(b, func) \
         c.q=c.p; \
         if (func(&(b),&c.p,c.slen) == NULL) \
                 {c.line=__LINE__; goto err; } \
         c.slen-=(c.p-c.q);
 
+/* Don't use this with d2i_ASN1_BOOLEAN() */
+#define M_ASN1_D2I_get_x(type,b,func) \
+        c.q=c.p; \
+        if (((D2I_OF(type))func)(&(b),&c.p,c.slen) == NULL) \
+                {c.line=__LINE__; goto err; } \
+        c.slen-=(c.p-c.q);
+
 /* use this instead () */
 #define M_ASN1_D2I_get_int(b,func) \
         c.q=c.p; \
@@ -278,7 +285,7 @@ err:\
                         { c.line=__LINE__; goto err; } \
                 if (Tinf == (V_ASN1_CONSTRUCTED+1)) { \
                         Tlen = c.slen - (c.p - c.q); \
-                        if(!ASN1_check_infinite_end(&c.p, Tlen)) \
+                        if(!ASN1_const_check_infinite_end(&c.p, Tlen)) \
                                 { c.error=ERR_R_MISSING_ASN1_EOS; \
                                 c.line=__LINE__; goto err; } \
                 }\
@@ -353,8 +360,12 @@ err:\
                 return(NULL)
 
 
-#define M_ASN1_next             (*c.p)
-#define M_ASN1_next_prev        (*c.q)
+/* BIG UGLY WARNING!  This is so damn ugly I wanna puke.  Unfortunately,
+   some macros that use ASN1_const_CTX still insist on writing in the input
+   stream.  ARGH!  ARGH!  ARGH!  Let's get rid of this macro package.
+   Please?                                              -- Richard Levitte */
+#define M_ASN1_next             (*((unsigned char *)(c.p)))
+#define M_ASN1_next_prev        (*((unsigned char *)(c.q)))
 
 /*************************************************/
 
@@ -551,8 +562,8 @@ err:\
 #define M_ASN1_I2D_finish()     *pp=p; \
                                 return(r);
 
-int asn1_GetSequence(ASN1_CTX *c, long *length);
-void asn1_add_error(unsigned char *address,int offset);
+int asn1_GetSequence(ASN1_const_CTX *c, long *length);
+void asn1_add_error(const unsigned char *address,int offset);
 #ifdef  __cplusplus
 }
 #endif
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_par.c b/src/lib/libssl/src/crypto/asn1/asn1_par.c
index 676d434f03..501b62a4b1 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_par.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_par.c
@@ -64,7 +64,7 @@
 
 static int asn1_print_info(BIO *bp, int tag, int xclass,int constructed,
         int indent);
-static int asn1_parse2(BIO *bp, unsigned char **pp, long length,
+static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
         int offset, int depth, int indent, int dump);
 static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
              int indent)
@@ -88,7 +88,10 @@ static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
                 BIO_snprintf(str,sizeof str,"cont [ %d ]",tag);
         else if ((xclass & V_ASN1_APPLICATION) == V_ASN1_APPLICATION)
                 BIO_snprintf(str,sizeof str,"appl [ %d ]",tag);
-        else p = ASN1_tag2str(tag);
+        else if (tag > 30)
+                BIO_snprintf(str,sizeof str,"<ASN1 %d>",tag);
+        else
+                p = ASN1_tag2str(tag);
 
         if (p2 != NULL)
                 {
@@ -103,20 +106,20 @@ err:
         return(0);
         }
 
-int ASN1_parse(BIO *bp, unsigned char *pp, long len, int indent)
+int ASN1_parse(BIO *bp, const unsigned char *pp, long len, int indent)
         {
         return(asn1_parse2(bp,&pp,len,0,0,indent,0));
         }
 
-int ASN1_parse_dump(BIO *bp, unsigned char *pp, long len, int indent, int dump)
+int ASN1_parse_dump(BIO *bp, const unsigned char *pp, long len, int indent, int dump)
         {
         return(asn1_parse2(bp,&pp,len,0,0,indent,dump));
         }
 
-static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
+static int asn1_parse2(BIO *bp, const unsigned char **pp, long length, int offset,
              int depth, int indent, int dump)
         {
-        unsigned char *p,*ep,*tot,*op,*opp;
+        const unsigned char *p,*ep,*tot,*op,*opp;
         long len;
         int tag,xclass,ret=0;
         int nl,hl,j,r;
@@ -215,7 +218,7 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
                                 {
                                 if (BIO_write(bp,":",1) <= 0) goto end;
                                 if ((len > 0) &&
-                                        BIO_write(bp,(char *)p,(int)len)
+                                        BIO_write(bp,(const char *)p,(int)len)
                                         != (int)len)
                                         goto end;
                                 }
@@ -256,9 +259,11 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
 
                                 opp=op;
                                 os=d2i_ASN1_OCTET_STRING(NULL,&opp,len+hl);
-                                if (os != NULL)
+                                if (os != NULL && os->length > 0)
                                         {
-                                        opp=os->data;
+                                        opp = os->data;
+                                        /* testing whether the octet string is
+                                         * printable */
                                         for (i=0; i<os->length; i++)
                                                 {
                                                 if ((   (opp[i] < ' ') &&
@@ -271,28 +276,47 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
                                                         break;
                                                         }
                                                 }
-                                        if (printable && (os->length > 0))
+                                        if (printable)
+                                        /* printable string */
                                                 {
                                                 if (BIO_write(bp,":",1) <= 0)
                                                         goto end;
-                                                if (BIO_write(bp,(char *)opp,
+                                                if (BIO_write(bp,(const char *)opp,
                                                         os->length) <= 0)
                                                         goto end;
                                                 }
-                                        if (!printable && (os->length > 0)
-                                                && dump)
+                                        else if (!dump)
+                                        /* not printable => print octet string
+                                         * as hex dump */
+                                                {
+                                                if (BIO_write(bp,"[HEX DUMP]:",11) <= 0)
+                                                        goto end;
+                                                for (i=0; i<os->length; i++)
+                                                        {
+                                                        if (BIO_printf(bp,"%02X"
+                                                                , opp[i]) <= 0)
+                                                                goto end;
+                                                        }
+                                                }
+                                        else
+                                        /* print the normal dump */
                                                 {
                                                 if (!nl) 
                                                         {
                                                         if (BIO_write(bp,"\n",1) <= 0)
                                                                 goto end;
                                                         }
-                                                if (BIO_dump_indent(bp,(char *)opp,
-                                                        ((dump == -1 || dump > os->length)?os->length:dump),
+                                                if (BIO_dump_indent(bp,
+                                                        (const char *)opp,
+                                                        ((dump == -1 || dump > 
+                                                        os->length)?os->length:dump),
                                                         dump_indent) <= 0)
                                                         goto end;
                                                 nl=1;
                                                 }
+                                        }
+                                if (os != NULL)
+                                        {
                                         M_ASN1_OCTET_STRING_free(os);
                                         os=NULL;
                                         }
@@ -368,7 +392,7 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
                                         if (BIO_write(bp,"\n",1) <= 0)
                                                 goto end;
                                         }
-                                if (BIO_dump_indent(bp,(char *)p,
+                                if (BIO_dump_indent(bp,(const char *)p,
                                         ((dump == -1 || dump > len)?len:dump),
                                         dump_indent) <= 0)
                                         goto end;
@@ -398,7 +422,7 @@ end:
 
 const char *ASN1_tag2str(int tag)
 {
-        const static char *tag2str[] = {
+        static const char *tag2str[] = {
          "EOC", "BOOLEAN", "INTEGER", "BIT STRING", "OCTET STRING", /* 0-4 */
          "NULL", "OBJECT", "OBJECT DESCRIPTOR", "EXTERNAL", "REAL", /* 5-9 */
          "ENUMERATED", "<ASN1 11>", "UTF8STRING", "<ASN1 13>",      /* 10-13 */
diff --git a/src/lib/libssl/src/crypto/asn1/asn1t.h b/src/lib/libssl/src/crypto/asn1/asn1t.h
index ed372f8554..bf315e65ed 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1t.h
+++ b/src/lib/libssl/src/crypto/asn1/asn1t.h
@@ -99,7 +99,7 @@ extern "C" {
 #define ASN1_ITEM_start(itname) \
         const ASN1_ITEM * itname##_it(void) \
         { \
-                static const ASN1_ITEM local_it = { \
+                static const ASN1_ITEM local_it = { 
 
 #define ASN1_ITEM_end(itname) \
                 }; \
@@ -112,7 +112,7 @@ extern "C" {
 /* Macros to aid ASN1 template writing */
 
 #define ASN1_ITEM_TEMPLATE(tname) \
-        const static ASN1_TEMPLATE tname##_item_tt 
+        static const ASN1_TEMPLATE tname##_item_tt 
 
 #define ASN1_ITEM_TEMPLATE_END(tname) \
         ;\
@@ -150,7 +150,7 @@ extern "C" {
  */
 
 #define ASN1_SEQUENCE(tname) \
-        const static ASN1_TEMPLATE tname##_seq_tt[] 
+        static const ASN1_TEMPLATE tname##_seq_tt[] 
 
 #define ASN1_SEQUENCE_END(stname) ASN1_SEQUENCE_END_name(stname, stname)
 
@@ -166,22 +166,40 @@ extern "C" {
                 #stname \
         ASN1_ITEM_end(tname)
 
+#define ASN1_NDEF_SEQUENCE(tname) \
+        ASN1_SEQUENCE(tname)
+
+#define ASN1_NDEF_SEQUENCE_cb(tname, cb) \
+        ASN1_SEQUENCE_cb(tname, cb)
+
 #define ASN1_SEQUENCE_cb(tname, cb) \
-        const static ASN1_AUX tname##_aux = {NULL, 0, 0, 0, cb, 0}; \
+        static const ASN1_AUX tname##_aux = {NULL, 0, 0, 0, cb, 0}; \
         ASN1_SEQUENCE(tname)
 
 #define ASN1_BROKEN_SEQUENCE(tname) \
-        const static ASN1_AUX tname##_aux = {NULL, ASN1_AFLG_BROKEN, 0, 0, 0, 0}; \
+        static const ASN1_AUX tname##_aux = {NULL, ASN1_AFLG_BROKEN, 0, 0, 0, 0}; \
         ASN1_SEQUENCE(tname)
 
 #define ASN1_SEQUENCE_ref(tname, cb, lck) \
-        const static ASN1_AUX tname##_aux = {NULL, ASN1_AFLG_REFCOUNT, offsetof(tname, references), lck, cb, 0}; \
+        static const ASN1_AUX tname##_aux = {NULL, ASN1_AFLG_REFCOUNT, offsetof(tname, references), lck, cb, 0}; \
         ASN1_SEQUENCE(tname)
 
 #define ASN1_SEQUENCE_enc(tname, enc, cb) \
-        const static ASN1_AUX tname##_aux = {NULL, ASN1_AFLG_ENCODING, 0, 0, cb, offsetof(tname, enc)}; \
+        static const ASN1_AUX tname##_aux = {NULL, ASN1_AFLG_ENCODING, 0, 0, cb, offsetof(tname, enc)}; \
         ASN1_SEQUENCE(tname)
 
+#define ASN1_NDEF_SEQUENCE_END(tname) \
+        ;\
+        ASN1_ITEM_start(tname) \
+                ASN1_ITYPE_NDEF_SEQUENCE,\
+                V_ASN1_SEQUENCE,\
+                tname##_seq_tt,\
+                sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\
+                NULL,\
+                sizeof(tname),\
+                #tname \
+        ASN1_ITEM_end(tname)
+
 #define ASN1_BROKEN_SEQUENCE_END(stname) ASN1_SEQUENCE_END_ref(stname, stname)
 
 #define ASN1_SEQUENCE_END_enc(stname, tname) ASN1_SEQUENCE_END_ref(stname, tname)
@@ -224,10 +242,10 @@ extern "C" {
  */
 
 #define ASN1_CHOICE(tname) \
-        const static ASN1_TEMPLATE tname##_ch_tt[] 
+        static const ASN1_TEMPLATE tname##_ch_tt[] 
 
 #define ASN1_CHOICE_cb(tname, cb) \
-        const static ASN1_AUX tname##_aux = {NULL, 0, 0, 0, cb, 0}; \
+        static const ASN1_AUX tname##_aux = {NULL, 0, 0, 0, cb, 0}; \
         ASN1_CHOICE(tname)
 
 #define ASN1_CHOICE_END(stname) ASN1_CHOICE_END_name(stname, stname)
@@ -353,16 +371,24 @@ extern "C" {
 #define ASN1_EXP_SEQUENCE_OF_OPT(stname, field, type, tag) \
                         ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_SEQUENCE_OF|ASN1_TFLG_OPTIONAL)
 
+/* EXPLICIT using indefinite length constructed form */
+#define ASN1_NDEF_EXP(stname, field, type, tag) \
+                        ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_NDEF)
+
+/* EXPLICIT OPTIONAL using indefinite length constructed form */
+#define ASN1_NDEF_EXP_OPT(stname, field, type, tag) \
+                        ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_OPTIONAL|ASN1_TFLG_NDEF)
+
 /* Macros for the ASN1_ADB structure */
 
 #define ASN1_ADB(name) \
-        const static ASN1_ADB_TABLE name##_adbtbl[] 
+        static const ASN1_ADB_TABLE name##_adbtbl[] 
 
 #ifndef OPENSSL_EXPORT_VAR_AS_FUNCTION
 
 #define ASN1_ADB_END(name, flags, field, app_table, def, none) \
         ;\
-        const static ASN1_ADB name##_adb = {\
+        static const ASN1_ADB name##_adb = {\
                 flags,\
                 offsetof(name, field),\
                 app_table,\
@@ -376,9 +402,9 @@ extern "C" {
 
 #define ASN1_ADB_END(name, flags, field, app_table, def, none) \
         ;\
-        const static ASN1_ITEM *name##_adb(void) \
+        static const ASN1_ITEM *name##_adb(void) \
         { \
-        const static ASN1_ADB internal_adb = \
+        static const ASN1_ADB internal_adb = \
                 {\
                 flags,\
                 offsetof(name, field),\
@@ -397,7 +423,7 @@ extern "C" {
 #define ADB_ENTRY(val, template) {val, template}
 
 #define ASN1_ADB_TEMPLATE(name) \
-        const static ASN1_TEMPLATE name##_tt 
+        static const ASN1_TEMPLATE name##_tt 
 
 /* This is the ASN1 template structure that defines
  * a wrapper round the actual type. It determines the
@@ -410,7 +436,7 @@ unsigned long flags;		/* Various flags */
 long tag;                       /* tag, not used if no tagging */
 unsigned long offset;           /* Offset of this field in structure */
 #ifndef NO_ASN1_FIELD_NAMES
-char *field_name;               /* Field name */
+const char *field_name;         /* Field name */
 #endif
 ASN1_ITEM_EXP *item;            /* Relevant ASN1_ITEM or ASN1_ADB */
 };
@@ -518,6 +544,13 @@ struct ASN1_ADB_TABLE_st {
 
 #define ASN1_TFLG_COMBINE       (0x1<<10)
 
+/* This flag when present in a SEQUENCE OF, SET OF
+ * or EXPLICIT causes indefinite length constructed
+ * encoding to be used if required.
+ */
+
+#define ASN1_TFLG_NDEF          (0x1<<11)
+
 /* This is the actual ASN1 item itself */
 
 struct ASN1_ITEM_st {
@@ -570,19 +603,25 @@ const char *sname;		/* Structure name */
  * has a special meaning, it is used as a mask
  * of acceptable types using the B_ASN1 constants.
  *
+ * NDEF_SEQUENCE is the same as SEQUENCE except
+ * that it will use indefinite length constructed
+ * encoding if requested.
+ *
  */
 
-#define ASN1_ITYPE_PRIMITIVE    0x0
+#define ASN1_ITYPE_PRIMITIVE            0x0
+
+#define ASN1_ITYPE_SEQUENCE             0x1
 
-#define ASN1_ITYPE_SEQUENCE     0x1
+#define ASN1_ITYPE_CHOICE               0x2
 
-#define ASN1_ITYPE_CHOICE       0x2
+#define ASN1_ITYPE_COMPAT               0x3
 
-#define ASN1_ITYPE_COMPAT       0x3
+#define ASN1_ITYPE_EXTERN               0x4
 
-#define ASN1_ITYPE_EXTERN       0x4
+#define ASN1_ITYPE_MSTRING              0x5
 
-#define ASN1_ITYPE_MSTRING      0x5
+#define ASN1_ITYPE_NDEF_SEQUENCE        0x6
 
 /* Cache for ASN1 tag and length, so we
  * don't keep re-reading it for things
@@ -602,10 +641,10 @@ struct ASN1_TLC_st{
 
 typedef ASN1_VALUE * ASN1_new_func(void);
 typedef void ASN1_free_func(ASN1_VALUE *a);
-typedef ASN1_VALUE * ASN1_d2i_func(ASN1_VALUE **a, unsigned char ** in, long length);
+typedef ASN1_VALUE * ASN1_d2i_func(ASN1_VALUE **a, const unsigned char ** in, long length);
 typedef int ASN1_i2d_func(ASN1_VALUE * a, unsigned char **in);
 
-typedef int ASN1_ex_d2i(ASN1_VALUE **pval, unsigned char **in, long len, const ASN1_ITEM *it,
+typedef int ASN1_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, const ASN1_ITEM *it,
                                         int tag, int aclass, char opt, ASN1_TLC *ctx);
 
 typedef int ASN1_ex_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it, int tag, int aclass);
@@ -613,7 +652,7 @@ typedef int ASN1_ex_new_func(ASN1_VALUE **pval, const ASN1_ITEM *it);
 typedef void ASN1_ex_free_func(ASN1_VALUE **pval, const ASN1_ITEM *it);
 
 typedef int ASN1_primitive_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype, const ASN1_ITEM *it);
-typedef int ASN1_primitive_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it);
+typedef int ASN1_primitive_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it);
 
 typedef struct ASN1_COMPAT_FUNCS_st {
         ASN1_new_func *asn1_new;
@@ -743,6 +782,9 @@ typedef struct ASN1_AUX_st {
 #define IMPLEMENT_ASN1_FUNCTIONS_ENCODE_name(stname, itname) \
                         IMPLEMENT_ASN1_FUNCTIONS_ENCODE_fname(stname, itname, itname)
 
+#define IMPLEMENT_ASN1_ALLOC_FUNCTIONS(stname) \
+                IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname(stname, stname, stname)
+
 #define IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname(stname, itname, fname) \
         stname *fname##_new(void) \
         { \
@@ -758,7 +800,7 @@ typedef struct ASN1_AUX_st {
         IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname(stname, itname, fname)
 
 #define IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(stname, itname, fname) \
-        stname *d2i_##fname(stname **a, unsigned char **in, long len) \
+        stname *d2i_##fname(stname **a, const unsigned char **in, long len) \
         { \
                 return (stname *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, ASN1_ITEM_rptr(itname));\
         } \
@@ -767,13 +809,19 @@ typedef struct ASN1_AUX_st {
                 return ASN1_item_i2d((ASN1_VALUE *)a, out, ASN1_ITEM_rptr(itname));\
         } 
 
+#define IMPLEMENT_ASN1_NDEF_FUNCTION(stname) \
+        int i2d_##stname##_NDEF(stname *a, unsigned char **out) \
+        { \
+                return ASN1_item_ndef_i2d((ASN1_VALUE *)a, out, ASN1_ITEM_rptr(stname));\
+        } 
+
 /* This includes evil casts to remove const: they will go away when full
  * ASN1 constification is done.
  */
 #define IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(stname, itname, fname) \
         stname *d2i_##fname(stname **a, const unsigned char **in, long len) \
         { \
-                return (stname *)ASN1_item_d2i((ASN1_VALUE **)a, (unsigned char **)in, len, ASN1_ITEM_rptr(itname));\
+                return (stname *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, ASN1_ITEM_rptr(itname));\
         } \
         int i2d_##fname(const stname *a, unsigned char **out) \
         { \
@@ -798,7 +846,6 @@ typedef struct ASN1_AUX_st {
 DECLARE_ASN1_ITEM(ASN1_BOOLEAN)
 DECLARE_ASN1_ITEM(ASN1_TBOOLEAN)
 DECLARE_ASN1_ITEM(ASN1_FBOOLEAN)
-DECLARE_ASN1_ITEM(ASN1_ANY)
 DECLARE_ASN1_ITEM(ASN1_SEQUENCE)
 DECLARE_ASN1_ITEM(CBIGNUM)
 DECLARE_ASN1_ITEM(BIGNUM)
@@ -815,8 +862,8 @@ int ASN1_template_new(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt);
 int ASN1_primitive_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
 
 void ASN1_template_free(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt);
-int ASN1_template_d2i(ASN1_VALUE **pval, unsigned char **in, long len, const ASN1_TEMPLATE *tt);
-int ASN1_item_ex_d2i(ASN1_VALUE **pval, unsigned char **in, long len, const ASN1_ITEM *it,
+int ASN1_template_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, const ASN1_TEMPLATE *tt);
+int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, const ASN1_ITEM *it,
                                 int tag, int aclass, char opt, ASN1_TLC *ctx);
 
 int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it, int tag, int aclass);
@@ -824,7 +871,7 @@ int ASN1_template_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_TEMPLAT
 void ASN1_primitive_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
 
 int asn1_ex_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype, const ASN1_ITEM *it);
-int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it);
+int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it);
 
 int asn1_get_choice_selector(ASN1_VALUE **pval, const ASN1_ITEM *it);
 int asn1_set_choice_selector(ASN1_VALUE **pval, int value, const ASN1_ITEM *it);
@@ -838,7 +885,7 @@ int asn1_do_lock(ASN1_VALUE **pval, int op, const ASN1_ITEM *it);
 void asn1_enc_init(ASN1_VALUE **pval, const ASN1_ITEM *it);
 void asn1_enc_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
 int asn1_enc_restore(int *len, unsigned char **out, ASN1_VALUE **pval, const ASN1_ITEM *it);
-int asn1_enc_save(ASN1_VALUE **pval, unsigned char *in, int inlen, const ASN1_ITEM *it);
+int asn1_enc_save(ASN1_VALUE **pval, const unsigned char *in, int inlen, const ASN1_ITEM *it);
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/asn1/asn_moid.c b/src/lib/libssl/src/crypto/asn1/asn_moid.c
index edb44c988f..9132350f10 100644
--- a/src/lib/libssl/src/crypto/asn1/asn_moid.c
+++ b/src/lib/libssl/src/crypto/asn1/asn_moid.c
@@ -3,7 +3,7 @@
  * project 2001.
  */
 /* ====================================================================
- * Copyright (c) 2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2001-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -57,6 +57,7 @@
  */
 
 #include <stdio.h>
+#include <ctype.h>
 #include <openssl/crypto.h>
 #include "cryptlib.h"
 #include <openssl/conf.h>
@@ -65,6 +66,8 @@
 
 /* Simple ASN1 OID module: add all objects in a given section */
 
+static int do_create(char *value, char *name);
+
 static int oid_module_init(CONF_IMODULE *md, const CONF *cnf)
         {
         int i;
@@ -80,7 +83,7 @@ static int oid_module_init(CONF_IMODULE *md, const CONF *cnf)
         for(i = 0; i < sk_CONF_VALUE_num(sktmp); i++)
                 {
                 oval = sk_CONF_VALUE_value(sktmp, i);
-                if(OBJ_create(oval->value, oval->name, oval->name) == NID_undef)
+                if(!do_create(oval->value, oval->name))
                         {
                         ASN1err(ASN1_F_OID_MODULE_INIT, ASN1_R_ADDING_OBJECT);
                         return 0;
@@ -98,3 +101,60 @@ void ASN1_add_oid_module(void)
         {
         CONF_module_add("oid_section", oid_module_init, oid_module_finish);
         }
+
+/* Create an OID based on a name value pair. Accept two formats.
+ * shortname = 1.2.3.4
+ * shortname = some long name, 1.2.3.4
+ */
+
+
+static int do_create(char *value, char *name)
+        {
+        int nid;
+        ASN1_OBJECT *oid;
+        char *ln, *ostr, *p, *lntmp;
+        p = strrchr(value, ',');
+        if (!p)
+                {
+                ln = name;
+                ostr = value;
+                }
+        else
+                {
+                ln = NULL;
+                ostr = p + 1;
+                if (!*ostr)
+                        return 0;
+                while(isspace((unsigned char)*ostr)) ostr++;
+                }
+
+        nid = OBJ_create(ostr, name, ln);
+
+        if (nid == NID_undef)
+                return 0;
+
+        if (p)
+                {
+                ln = value;
+                while(isspace((unsigned char)*ln)) ln++;
+                p--;
+                while(isspace((unsigned char)*p))
+                        {
+                        if (p == ln)
+                                return 0;
+                        p--;
+                        }
+                p++;
+                lntmp = OPENSSL_malloc((p - ln) + 1);
+                if (lntmp == NULL)
+                        return 0;
+                memcpy(lntmp, ln, p - ln);
+                lntmp[p - ln] = 0;
+                oid = OBJ_nid2obj(nid);
+                oid->ln = lntmp;
+                }
+
+        return 1;
+        }
+                
+                
diff --git a/src/lib/libssl/src/crypto/asn1/asn_pack.c b/src/lib/libssl/src/crypto/asn1/asn_pack.c
index e6051db2dc..e8b671b7b5 100644
--- a/src/lib/libssl/src/crypto/asn1/asn_pack.c
+++ b/src/lib/libssl/src/crypto/asn1/asn_pack.c
@@ -66,11 +66,11 @@
 
 /* Turn an ASN1 encoded SEQUENCE OF into a STACK of structures */
 
-STACK *ASN1_seq_unpack(unsigned char *buf, int len, char *(*d2i)(),
-             void (*free_func)(void *))
+STACK *ASN1_seq_unpack(const unsigned char *buf, int len,
+                       d2i_of_void *d2i,void (*free_func)(void *))
 {
     STACK *sk;
-    unsigned char *pbuf;
+    const unsigned char *pbuf;
     pbuf =  buf;
     if (!(sk = d2i_ASN1_SET(NULL, &pbuf, len, d2i, free_func,
                                         V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL)))
@@ -82,8 +82,8 @@ STACK *ASN1_seq_unpack(unsigned char *buf, int len, char *(*d2i)(),
  * OPENSSL_malloc'ed buffer
  */
 
-unsigned char *ASN1_seq_pack(STACK *safes, int (*i2d)(), unsigned char **buf,
-             int *len)
+unsigned char *ASN1_seq_pack(STACK *safes, i2d_of_void *i2d,
+                             unsigned char **buf, int *len)
 {
         int safelen;
         unsigned char *safe, *p;
@@ -106,9 +106,9 @@ unsigned char *ASN1_seq_pack(STACK *safes, int (*i2d)(), unsigned char **buf,
 
 /* Extract an ASN1 object from an ASN1_STRING */
 
-void *ASN1_unpack_string (ASN1_STRING *oct, char *(*d2i)())
+void *ASN1_unpack_string(ASN1_STRING *oct, d2i_of_void *d2i)
 {
-        unsigned char *p;
+        const unsigned char *p;
         char *ret;
 
         p = oct->data;
@@ -119,7 +119,7 @@ void *ASN1_unpack_string (ASN1_STRING *oct, char *(*d2i)())
 
 /* Pack an ASN1 object into an ASN1_STRING */
 
-ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_STRING **oct)
+ASN1_STRING *ASN1_pack_string(void *obj, i2d_of_void *i2d, ASN1_STRING **oct)
 {
         unsigned char *p;
         ASN1_STRING *octmp;
@@ -155,7 +155,7 @@ ASN1_STRING *ASN1_item_pack(void *obj, const ASN1_ITEM *it, ASN1_STRING **oct)
 
         if (!oct || !*oct) {
                 if (!(octmp = ASN1_STRING_new ())) {
-                        ASN1err(ASN1_F_ASN1_PACK_STRING,ERR_R_MALLOC_FAILURE);
+                        ASN1err(ASN1_F_ASN1_ITEM_PACK,ERR_R_MALLOC_FAILURE);
                         return NULL;
                 }
                 if (oct) *oct = octmp;
@@ -167,11 +167,11 @@ ASN1_STRING *ASN1_item_pack(void *obj, const ASN1_ITEM *it, ASN1_STRING **oct)
         }
                 
         if (!(octmp->length = ASN1_item_i2d(obj, &octmp->data, it))) {
-                ASN1err(ASN1_F_ASN1_PACK_STRING,ASN1_R_ENCODE_ERROR);
+                ASN1err(ASN1_F_ASN1_ITEM_PACK,ASN1_R_ENCODE_ERROR);
                 return NULL;
         }
         if (!octmp->data) {
-                ASN1err(ASN1_F_ASN1_PACK_STRING,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_ASN1_ITEM_PACK,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         return octmp;
@@ -181,11 +181,11 @@ ASN1_STRING *ASN1_item_pack(void *obj, const ASN1_ITEM *it, ASN1_STRING **oct)
 
 void *ASN1_item_unpack(ASN1_STRING *oct, const ASN1_ITEM *it)
 {
-        unsigned char *p;
+        const unsigned char *p;
         void *ret;
 
         p = oct->data;
         if(!(ret = ASN1_item_d2i(NULL, &p, oct->length, it)))
-                ASN1err(ASN1_F_ASN1_UNPACK_STRING,ASN1_R_DECODE_ERROR);
+                ASN1err(ASN1_F_ASN1_ITEM_UNPACK,ASN1_R_DECODE_ERROR);
         return ret;
 }
diff --git a/src/lib/libssl/src/crypto/asn1/d2i_pr.c b/src/lib/libssl/src/crypto/asn1/d2i_pr.c
index 2e7d96af90..207ccda5ac 100644
--- a/src/lib/libssl/src/crypto/asn1/d2i_pr.c
+++ b/src/lib/libssl/src/crypto/asn1/d2i_pr.c
@@ -68,8 +68,11 @@
 #ifndef OPENSSL_NO_DSA
 #include <openssl/dsa.h>
 #endif
+#ifndef OPENSSL_NO_EC
+#include <openssl/ec.h>
+#endif
 
-EVP_PKEY *d2i_PrivateKey(int type, EVP_PKEY **a, unsigned char **pp,
+EVP_PKEY *d2i_PrivateKey(int type, EVP_PKEY **a, const unsigned char **pp,
              long length)
         {
         EVP_PKEY *ret;
@@ -108,6 +111,16 @@ EVP_PKEY *d2i_PrivateKey(int type, EVP_PKEY **a, unsigned char **pp,
                         }
                 break;
 #endif
+#ifndef OPENSSL_NO_EC
+        case EVP_PKEY_EC:
+                if ((ret->pkey.ec = d2i_ECPrivateKey(NULL, 
+                        (const unsigned char **)pp, length)) == NULL)
+                        {
+                        ASN1err(ASN1_F_D2I_PRIVATEKEY, ERR_R_ASN1_LIB);
+                        goto err;
+                        }
+                break;
+#endif
         default:
                 ASN1err(ASN1_F_D2I_PRIVATEKEY,ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE);
                 goto err;
@@ -122,11 +135,11 @@ err:
 
 /* This works like d2i_PrivateKey() except it automatically works out the type */
 
-EVP_PKEY *d2i_AutoPrivateKey(EVP_PKEY **a, unsigned char **pp,
+EVP_PKEY *d2i_AutoPrivateKey(EVP_PKEY **a, const unsigned char **pp,
              long length)
 {
         STACK_OF(ASN1_TYPE) *inkey;
-        unsigned char *p;
+        const unsigned char *p;
         int keytype;
         p = *pp;
         /* Dirty trick: read in the ASN1 data into a STACK_OF(ASN1_TYPE):
@@ -138,7 +151,10 @@ EVP_PKEY *d2i_AutoPrivateKey(EVP_PKEY **a, unsigned char **pp,
         /* Since we only need to discern "traditional format" RSA and DSA
          * keys we can just count the elements.
          */
-        if(sk_ASN1_TYPE_num(inkey) == 6) keytype = EVP_PKEY_DSA;
+        if(sk_ASN1_TYPE_num(inkey) == 6) 
+                keytype = EVP_PKEY_DSA;
+        else if (sk_ASN1_TYPE_num(inkey) == 4)
+                keytype = EVP_PKEY_EC;
         else keytype = EVP_PKEY_RSA;
         sk_ASN1_TYPE_pop_free(inkey, ASN1_TYPE_free);
         return d2i_PrivateKey(keytype, a, pp, length);
diff --git a/src/lib/libssl/src/crypto/asn1/d2i_pu.c b/src/lib/libssl/src/crypto/asn1/d2i_pu.c
index 71f2eb361b..3694f51a8c 100644
--- a/src/lib/libssl/src/crypto/asn1/d2i_pu.c
+++ b/src/lib/libssl/src/crypto/asn1/d2i_pu.c
@@ -68,8 +68,11 @@
 #ifndef OPENSSL_NO_DSA
 #include <openssl/dsa.h>
 #endif
+#ifndef OPENSSL_NO_EC
+#include <openssl/ec.h>
+#endif
 
-EVP_PKEY *d2i_PublicKey(int type, EVP_PKEY **a, unsigned char **pp,
+EVP_PKEY *d2i_PublicKey(int type, EVP_PKEY **a, const unsigned char **pp,
              long length)
         {
         EVP_PKEY *ret;
@@ -100,14 +103,24 @@ EVP_PKEY *d2i_PublicKey(int type, EVP_PKEY **a, unsigned char **pp,
 #endif
 #ifndef OPENSSL_NO_DSA
         case EVP_PKEY_DSA:
-                if ((ret->pkey.dsa=d2i_DSAPublicKey(NULL,
-                        (const unsigned char **)pp,length)) == NULL) /* TMP UGLY CAST */
+                if (!d2i_DSAPublicKey(&(ret->pkey.dsa),
+                        (const unsigned char **)pp,length)) /* TMP UGLY CAST */
                         {
                         ASN1err(ASN1_F_D2I_PUBLICKEY,ERR_R_ASN1_LIB);
                         goto err;
                         }
                 break;
 #endif
+#ifndef OPENSSL_NO_EC
+        case EVP_PKEY_EC:
+                if (!o2i_ECPublicKey(&(ret->pkey.ec),
+                                     (const unsigned char **)pp, length))
+                        {
+                        ASN1err(ASN1_F_D2I_PUBLICKEY, ERR_R_ASN1_LIB);
+                        goto err;
+                        }
+        break;
+#endif
         default:
                 ASN1err(ASN1_F_D2I_PUBLICKEY,ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE);
                 goto err;
diff --git a/src/lib/libssl/src/crypto/asn1/evp_asn1.c b/src/lib/libssl/src/crypto/asn1/evp_asn1.c
index f92ce6cb5d..f3d9804860 100644
--- a/src/lib/libssl/src/crypto/asn1/evp_asn1.c
+++ b/src/lib/libssl/src/crypto/asn1/evp_asn1.c
@@ -141,9 +141,9 @@ int ASN1_TYPE_get_int_octetstring(ASN1_TYPE *a, long *num, unsigned char *data,
         int ret= -1,n;
         ASN1_INTEGER *ai=NULL;
         ASN1_OCTET_STRING *os=NULL;
-        unsigned char *p;
+        const unsigned char *p;
         long length;
-        ASN1_CTX c;
+        ASN1_const_CTX c;
 
         if ((a->type != V_ASN1_SEQUENCE) || (a->value.sequence == NULL))
                 {
diff --git a/src/lib/libssl/src/crypto/asn1/i2d_pr.c b/src/lib/libssl/src/crypto/asn1/i2d_pr.c
index 1e951ae01d..0be52c5b76 100644
--- a/src/lib/libssl/src/crypto/asn1/i2d_pr.c
+++ b/src/lib/libssl/src/crypto/asn1/i2d_pr.c
@@ -67,6 +67,9 @@
 #ifndef OPENSSL_NO_DSA
 #include <openssl/dsa.h>
 #endif
+#ifndef OPENSSL_NO_EC
+#include <openssl/ec.h>
+#endif
 
 int i2d_PrivateKey(EVP_PKEY *a, unsigned char **pp)
         {
@@ -83,6 +86,12 @@ int i2d_PrivateKey(EVP_PKEY *a, unsigned char **pp)
                 return(i2d_DSAPrivateKey(a->pkey.dsa,pp));
                 }
 #endif
+#ifndef OPENSSL_NO_EC
+        if (a->type == EVP_PKEY_EC)
+                {
+                return(i2d_ECPrivateKey(a->pkey.ec, pp));
+                }
+#endif
 
         ASN1err(ASN1_F_I2D_PRIVATEKEY,ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE);
         return(-1);
diff --git a/src/lib/libssl/src/crypto/asn1/i2d_pu.c b/src/lib/libssl/src/crypto/asn1/i2d_pu.c
index 013d19bbf4..34286dbd35 100644
--- a/src/lib/libssl/src/crypto/asn1/i2d_pu.c
+++ b/src/lib/libssl/src/crypto/asn1/i2d_pu.c
@@ -67,6 +67,9 @@
 #ifndef OPENSSL_NO_DSA
 #include <openssl/dsa.h>
 #endif
+#ifndef OPENSSL_NO_EC
+#include <openssl/ec.h>
+#endif
 
 int i2d_PublicKey(EVP_PKEY *a, unsigned char **pp)
         {
@@ -80,6 +83,10 @@ int i2d_PublicKey(EVP_PKEY *a, unsigned char **pp)
         case EVP_PKEY_DSA:
                 return(i2d_DSAPublicKey(a->pkey.dsa,pp));
 #endif
+#ifndef OPENSSL_NO_EC
+        case EVP_PKEY_EC:
+                return(i2o_ECPublicKey(a->pkey.ec, pp));
+#endif
         default:
                 ASN1err(ASN1_F_I2D_PUBLICKEY,ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE);
                 return(-1);
diff --git a/src/lib/libssl/src/crypto/asn1/n_pkey.c b/src/lib/libssl/src/crypto/asn1/n_pkey.c
index 766b51c538..60bc437938 100644
--- a/src/lib/libssl/src/crypto/asn1/n_pkey.c
+++ b/src/lib/libssl/src/crypto/asn1/n_pkey.c
@@ -56,9 +56,9 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_RSA
 #include <stdio.h>
 #include "cryptlib.h"
+#ifndef OPENSSL_NO_RSA
 #include <openssl/rsa.h>
 #include <openssl/objects.h>
 #include <openssl/asn1t.h>
@@ -107,14 +107,20 @@ DECLARE_ASN1_ENCODE_FUNCTIONS_const(NETSCAPE_PKEY,NETSCAPE_PKEY)
 IMPLEMENT_ASN1_FUNCTIONS_const(NETSCAPE_PKEY)
 
 static RSA *d2i_RSA_NET_2(RSA **a, ASN1_OCTET_STRING *os,
-             int (*cb)(), int sgckey);
+                          int (*cb)(char *buf, int len, const char *prompt,
+                                    int verify),
+                          int sgckey);
 
-int i2d_Netscape_RSA(const RSA *a, unsigned char **pp, int (*cb)())
+int i2d_Netscape_RSA(const RSA *a, unsigned char **pp,
+                     int (*cb)(char *buf, int len, const char *prompt,
+                               int verify))
 {
         return i2d_RSA_NET(a, pp, cb, 0);
 }
 
-int i2d_RSA_NET(const RSA *a, unsigned char **pp, int (*cb)(), int sgckey)
+int i2d_RSA_NET(const RSA *a, unsigned char **pp,
+                int (*cb)(char *buf, int len, const char *prompt, int verify),
+                int sgckey)
         {
         int i, j, ret = 0;
         int rsalen, pkeylen, olen;
@@ -164,7 +170,7 @@ int i2d_RSA_NET(const RSA *a, unsigned char **pp, int (*cb)(), int sgckey)
         /* Since its RC4 encrypted length is actual length */
         if ((zz=(unsigned char *)OPENSSL_malloc(rsalen)) == NULL)
                 {
-                ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_I2D_RSA_NET,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
 
@@ -174,13 +180,13 @@ int i2d_RSA_NET(const RSA *a, unsigned char **pp, int (*cb)(), int sgckey)
 
         if ((zz=OPENSSL_malloc(pkeylen)) == NULL)
                 {
-                ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_I2D_RSA_NET,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
 
         if (!ASN1_STRING_set(enckey->os, "private-key", -1)) 
                 {
-                ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_I2D_RSA_NET,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
         enckey->enckey->digest->data = zz;
@@ -191,10 +197,10 @@ int i2d_RSA_NET(const RSA *a, unsigned char **pp, int (*cb)(), int sgckey)
                 
         if (cb == NULL)
                 cb=EVP_read_pw_string;
-        i=cb(buf,256,"Enter Private Key password:",1);
+        i=cb((char *)buf,256,"Enter Private Key password:",1);
         if (i != 0)
                 {
-                ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ASN1_R_BAD_PASSWORD_READ);
+                ASN1err(ASN1_F_I2D_RSA_NET,ASN1_R_BAD_PASSWORD_READ);
                 goto err;
                 }
         i = strlen((char *)buf);
@@ -224,12 +230,16 @@ err:
         }
 
 
-RSA *d2i_Netscape_RSA(RSA **a, const unsigned char **pp, long length, int (*cb)())
+RSA *d2i_Netscape_RSA(RSA **a, const unsigned char **pp, long length,
+                      int (*cb)(char *buf, int len, const char *prompt,
+                                int verify))
 {
         return d2i_RSA_NET(a, pp, length, cb, 0);
 }
 
-RSA *d2i_RSA_NET(RSA **a, const unsigned char **pp, long length, int (*cb)(), int sgckey)
+RSA *d2i_RSA_NET(RSA **a, const unsigned char **pp, long length,
+                 int (*cb)(char *buf, int len, const char *prompt, int verify),
+                 int sgckey)
         {
         RSA *ret=NULL;
         const unsigned char *p, *kp;
@@ -239,20 +249,20 @@ RSA *d2i_RSA_NET(RSA **a, const unsigned char **pp, long length, int (*cb)(), in
 
         enckey = d2i_NETSCAPE_ENCRYPTED_PKEY(NULL, &p, length);
         if(!enckey) {
-                ASN1err(ASN1_F_D2I_NETSCAPE_RSA,ASN1_R_DECODING_ERROR);
+                ASN1err(ASN1_F_D2I_RSA_NET,ASN1_R_DECODING_ERROR);
                 return NULL;
         }
 
         if ((enckey->os->length != 11) || (strncmp("private-key",
                 (char *)enckey->os->data,11) != 0))
                 {
-                ASN1err(ASN1_F_D2I_NETSCAPE_RSA,ASN1_R_PRIVATE_KEY_HEADER_MISSING);
+                ASN1err(ASN1_F_D2I_RSA_NET,ASN1_R_PRIVATE_KEY_HEADER_MISSING);
                 NETSCAPE_ENCRYPTED_PKEY_free(enckey);
                 return NULL;
                 }
         if (OBJ_obj2nid(enckey->enckey->algor->algorithm) != NID_rc4)
                 {
-                ASN1err(ASN1_F_D2I_NETSCAPE_RSA_2,ASN1_R_UNSUPPORTED_ENCRYPTION_ALGORITHM);
+                ASN1err(ASN1_F_D2I_RSA_NET,ASN1_R_UNSUPPORTED_ENCRYPTION_ALGORITHM);
                 goto err;
         }
         kp = enckey->enckey->digest->data;
@@ -269,7 +279,8 @@ RSA *d2i_RSA_NET(RSA **a, const unsigned char **pp, long length, int (*cb)(), in
         }
 
 static RSA *d2i_RSA_NET_2(RSA **a, ASN1_OCTET_STRING *os,
-             int (*cb)(), int sgckey)
+                          int (*cb)(char *buf, int len, const char *prompt,
+                                    int verify), int sgckey)
         {
         NETSCAPE_PKEY *pkey=NULL;
         RSA *ret=NULL;
@@ -279,10 +290,10 @@ static RSA *d2i_RSA_NET_2(RSA **a, ASN1_OCTET_STRING *os,
         unsigned char key[EVP_MAX_KEY_LENGTH];
         EVP_CIPHER_CTX ctx;
 
-        i=cb(buf,256,"Enter Private Key password:",0);
+        i=cb((char *)buf,256,"Enter Private Key password:",0);
         if (i != 0)
                 {
-                ASN1err(ASN1_F_D2I_NETSCAPE_RSA_2,ASN1_R_BAD_PASSWORD_READ);
+                ASN1err(ASN1_F_D2I_RSA_NET_2,ASN1_R_BAD_PASSWORD_READ);
                 goto err;
                 }
 
@@ -307,14 +318,14 @@ static RSA *d2i_RSA_NET_2(RSA **a, ASN1_OCTET_STRING *os,
 
         if ((pkey=d2i_NETSCAPE_PKEY(NULL,&zz,os->length)) == NULL)
                 {
-                ASN1err(ASN1_F_D2I_NETSCAPE_RSA_2,ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY);
+                ASN1err(ASN1_F_D2I_RSA_NET_2,ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY);
                 goto err;
                 }
                 
         zz=pkey->private_key->data;
         if ((ret=d2i_RSAPrivateKey(a,&zz,pkey->private_key->length)) == NULL)
                 {
-                ASN1err(ASN1_F_D2I_NETSCAPE_RSA_2,ASN1_R_UNABLE_TO_DECODE_RSA_KEY);
+                ASN1err(ASN1_F_D2I_RSA_NET_2,ASN1_R_UNABLE_TO_DECODE_RSA_KEY);
                 goto err;
                 }
 err:
diff --git a/src/lib/libssl/src/crypto/asn1/p5_pbe.c b/src/lib/libssl/src/crypto/asn1/p5_pbe.c
index ec788267e0..da91170094 100644
--- a/src/lib/libssl/src/crypto/asn1/p5_pbe.c
+++ b/src/lib/libssl/src/crypto/asn1/p5_pbe.c
@@ -82,17 +82,17 @@ X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt,
         ASN1_TYPE *astype=NULL;
 
         if (!(pbe = PBEPARAM_new ())) {
-                ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_PKCS5_PBE_SET,ERR_R_MALLOC_FAILURE);
                 goto err;
         }
         if(iter <= 0) iter = PKCS5_DEFAULT_ITER;
         if (!ASN1_INTEGER_set(pbe->iter, iter)) {
-                ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_PKCS5_PBE_SET,ERR_R_MALLOC_FAILURE);
                 goto err;
         }
         if (!saltlen) saltlen = PKCS5_SALT_LEN;
         if (!(pbe->salt->data = OPENSSL_malloc (saltlen))) {
-                ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_PKCS5_PBE_SET,ERR_R_MALLOC_FAILURE);
                 goto err;
         }
         pbe->salt->length = saltlen;
@@ -101,13 +101,14 @@ X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt,
                 goto err;
 
         if (!(astype = ASN1_TYPE_new())) {
-                ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_PKCS5_PBE_SET,ERR_R_MALLOC_FAILURE);
                 goto err;
         }
 
         astype->type = V_ASN1_SEQUENCE;
-        if(!ASN1_pack_string(pbe, i2d_PBEPARAM, &astype->value.sequence)) {
-                ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);
+        if(!ASN1_pack_string_of(PBEPARAM, pbe, i2d_PBEPARAM,
+                                &astype->value.sequence)) {
+                ASN1err(ASN1_F_PKCS5_PBE_SET,ERR_R_MALLOC_FAILURE);
                 goto err;
         }
         PBEPARAM_free (pbe);
@@ -115,7 +116,7 @@ X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt,
         
         al = OBJ_nid2obj(alg); /* never need to free al */
         if (!(algor = X509_ALGOR_new())) {
-                ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);
+                ASN1err(ASN1_F_PKCS5_PBE_SET,ERR_R_MALLOC_FAILURE);
                 goto err;
         }
         ASN1_OBJECT_free(algor->algorithm);
diff --git a/src/lib/libssl/src/crypto/asn1/p5_pbev2.c b/src/lib/libssl/src/crypto/asn1/p5_pbev2.c
index e0dc0ec4ee..c834a38ddf 100644
--- a/src/lib/libssl/src/crypto/asn1/p5_pbev2.c
+++ b/src/lib/libssl/src/crypto/asn1/p5_pbev2.c
@@ -115,7 +115,7 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
         /* Create random IV */
         if (EVP_CIPHER_iv_length(cipher) &&
                 RAND_pseudo_bytes(iv, EVP_CIPHER_iv_length(cipher)) < 0)
-                goto err;
+                goto err;
 
         EVP_CIPHER_CTX_init(&ctx);
 
@@ -164,7 +164,7 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
 
         if(!(pbe2->keyfunc->parameter = ASN1_TYPE_new())) goto merr;
 
-        if(!ASN1_pack_string(kdf, i2d_PBKDF2PARAM,
+        if(!ASN1_pack_string_of(PBKDF2PARAM, kdf, i2d_PBKDF2PARAM,
                          &pbe2->keyfunc->parameter->value.sequence)) goto merr;
         pbe2->keyfunc->parameter->type = V_ASN1_SEQUENCE;
 
@@ -180,7 +180,7 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
 
         /* Encode PBE2PARAM into parameter */
 
-        if(!ASN1_pack_string(pbe2, i2d_PBE2PARAM,
+        if(!ASN1_pack_string_of(PBE2PARAM, pbe2, i2d_PBE2PARAM,
                                  &ret->parameter->value.sequence)) goto merr;
         ret->parameter->type = V_ASN1_SEQUENCE;
 
diff --git a/src/lib/libssl/src/crypto/asn1/t_crl.c b/src/lib/libssl/src/crypto/asn1/t_crl.c
index 757c148df8..929b3e5904 100644
--- a/src/lib/libssl/src/crypto/asn1/t_crl.c
+++ b/src/lib/libssl/src/crypto/asn1/t_crl.c
@@ -72,7 +72,7 @@ int X509_CRL_print_fp(FILE *fp, X509_CRL *x)
 
         if ((b=BIO_new(BIO_s_file())) == NULL)
                 {
-                X509err(X509_F_X509_PRINT_FP,ERR_R_BUF_LIB);
+                X509err(X509_F_X509_CRL_PRINT_FP,ERR_R_BUF_LIB);
                 return(0);
                 }
         BIO_set_fp(b,fp,BIO_NOCLOSE);
@@ -121,7 +121,7 @@ int X509_CRL_print(BIO *out, X509_CRL *x)
                 r = sk_X509_REVOKED_value(rev, i);
                 BIO_printf(out,"    Serial Number: ");
                 i2a_ASN1_INTEGER(out,r->serialNumber);
-                BIO_printf(out,"\n        Revocation Date: ","");
+                BIO_printf(out,"\n        Revocation Date: ");
                 ASN1_TIME_print(out,r->revocationDate);
                 BIO_printf(out,"\n");
                 X509V3_extensions_print(out, "CRL entry extensions",
diff --git a/src/lib/libssl/src/crypto/asn1/t_pkey.c b/src/lib/libssl/src/crypto/asn1/t_pkey.c
index d15006e654..afb95d6712 100644
--- a/src/lib/libssl/src/crypto/asn1/t_pkey.c
+++ b/src/lib/libssl/src/crypto/asn1/t_pkey.c
@@ -55,9 +55,15 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * Binary polynomial ECC support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #include <stdio.h>
 #include "cryptlib.h"
+#include <openssl/objects.h>
 #include <openssl/buffer.h>
 #include <openssl/bn.h>
 #ifndef OPENSSL_NO_RSA
@@ -69,26 +75,33 @@
 #ifndef OPENSSL_NO_DSA
 #include <openssl/dsa.h>
 #endif
+#ifndef OPENSSL_NO_EC
+#include <openssl/ec.h>
+#endif
 
-static int print(BIO *fp,const char *str,BIGNUM *num,
+static int print(BIO *fp,const char *str, const BIGNUM *num,
                 unsigned char *buf,int off);
+#ifndef OPENSSL_NO_EC
+static int print_bin(BIO *fp, const char *str, const unsigned char *num,
+                size_t len, int off);
+#endif
 #ifndef OPENSSL_NO_RSA
 #ifndef OPENSSL_NO_FP_API
 int RSA_print_fp(FILE *fp, const RSA *x, int off)
-        {
-        BIO *b;
-        int ret;
+        {
+        BIO *b;
+        int ret;
 
-        if ((b=BIO_new(BIO_s_file())) == NULL)
+        if ((b=BIO_new(BIO_s_file())) == NULL)
                 {
                 RSAerr(RSA_F_RSA_PRINT_FP,ERR_R_BUF_LIB);
-                return(0);
+                return(0);
                 }
-        BIO_set_fp(b,fp,BIO_NOCLOSE);
-        ret=RSA_print(b,x,off);
-        BIO_free(b);
-        return(ret);
-        }
+        BIO_set_fp(b,fp,BIO_NOCLOSE);
+        ret=RSA_print(b,x,off);
+        BIO_free(b);
+        return(ret);
+        }
 #endif
 
 int RSA_print(BIO *bp, const RSA *x, int off)
@@ -96,7 +109,7 @@ int RSA_print(BIO *bp, const RSA *x, int off)
         char str[128];
         const char *s;
         unsigned char *m=NULL;
-        int ret=0;
+        int ret=0, mod_len = 0;
         size_t buf_len=0, i;
 
         if (x->n)
@@ -130,27 +143,37 @@ int RSA_print(BIO *bp, const RSA *x, int off)
                 goto err;
                 }
 
+        if (x->n != NULL)
+                mod_len = BN_num_bits(x->n);
+
         if (x->d != NULL)
                 {
                 if(!BIO_indent(bp,off,128))
                    goto err;
-                if (BIO_printf(bp,"Private-Key: (%d bit)\n",BN_num_bits(x->n))
+                if (BIO_printf(bp,"Private-Key: (%d bit)\n", mod_len)
                         <= 0) goto err;
                 }
 
         if (x->d == NULL)
-                BIO_snprintf(str,sizeof str,"Modulus (%d bit):",BN_num_bits(x->n));
+                BIO_snprintf(str,sizeof str,"Modulus (%d bit):", mod_len);
         else
                 BUF_strlcpy(str,"modulus:",sizeof str);
         if (!print(bp,str,x->n,m,off)) goto err;
         s=(x->d == NULL)?"Exponent:":"publicExponent:";
-        if (!print(bp,s,x->e,m,off)) goto err;
-        if (!print(bp,"privateExponent:",x->d,m,off)) goto err;
-        if (!print(bp,"prime1:",x->p,m,off)) goto err;
-        if (!print(bp,"prime2:",x->q,m,off)) goto err;
-        if (!print(bp,"exponent1:",x->dmp1,m,off)) goto err;
-        if (!print(bp,"exponent2:",x->dmq1,m,off)) goto err;
-        if (!print(bp,"coefficient:",x->iqmp,m,off)) goto err;
+        if ((x->e != NULL) && !print(bp,s,x->e,m,off))
+                goto err;
+        if ((x->d != NULL) && !print(bp,"privateExponent:",x->d,m,off))
+                goto err;
+        if ((x->p != NULL) && !print(bp,"prime1:",x->p,m,off))
+                goto err;
+        if ((x->q != NULL) && !print(bp,"prime2:",x->q,m,off))
+                goto err;
+        if ((x->dmp1 != NULL) && !print(bp,"exponent1:",x->dmp1,m,off))
+                goto err;
+        if ((x->dmq1 != NULL) && !print(bp,"exponent2:",x->dmq1,m,off))
+                goto err;
+        if ((x->iqmp != NULL) && !print(bp,"coefficient:",x->iqmp,m,off))
+                goto err;
         ret=1;
 err:
         if (m != NULL) OPENSSL_free(m);
@@ -185,6 +208,11 @@ int DSA_print(BIO *bp, const DSA *x, int off)
 
         if (x->p)
                 buf_len = (size_t)BN_num_bytes(x->p);
+        else
+                {
+                DSAerr(DSA_F_DSA_PRINT,DSA_R_MISSING_PARAMETERS);
+                goto err;
+                }
         if (x->q)
                 if (buf_len < (i = (size_t)BN_num_bytes(x->q)))
                         buf_len = i;
@@ -227,16 +255,334 @@ err:
         }
 #endif /* !OPENSSL_NO_DSA */
 
-static int print(BIO *bp, const char *number, BIGNUM *num, unsigned char *buf,
+#ifndef OPENSSL_NO_EC
+#ifndef OPENSSL_NO_FP_API
+int ECPKParameters_print_fp(FILE *fp, const EC_GROUP *x, int off)
+        {
+        BIO *b;
+        int ret;
+
+        if ((b=BIO_new(BIO_s_file())) == NULL)
+                {
+                ECerr(EC_F_ECPKPARAMETERS_PRINT_FP,ERR_R_BUF_LIB);
+                return(0);
+                }
+        BIO_set_fp(b, fp, BIO_NOCLOSE);
+        ret = ECPKParameters_print(b, x, off);
+        BIO_free(b);
+        return(ret);
+        }
+
+int EC_KEY_print_fp(FILE *fp, const EC_KEY *x, int off)
+        {
+        BIO *b;
+        int ret;
+ 
+        if ((b=BIO_new(BIO_s_file())) == NULL)
+                {
+                ECerr(EC_F_EC_KEY_PRINT_FP, ERR_R_BIO_LIB);
+                return(0);
+                }
+        BIO_set_fp(b, fp, BIO_NOCLOSE);
+        ret = EC_KEY_print(b, x, off);
+        BIO_free(b);
+        return(ret);
+        }
+#endif
+
+int ECPKParameters_print(BIO *bp, const EC_GROUP *x, int off)
+        {
+        unsigned char *buffer=NULL;
+        size_t  buf_len=0, i;
+        int     ret=0, reason=ERR_R_BIO_LIB;
+        BN_CTX  *ctx=NULL;
+        const EC_POINT *point=NULL;
+        BIGNUM  *p=NULL, *a=NULL, *b=NULL, *gen=NULL,
+                *order=NULL, *cofactor=NULL;
+        const unsigned char *seed;
+        size_t  seed_len=0;
+        
+        static const char *gen_compressed = "Generator (compressed):";
+        static const char *gen_uncompressed = "Generator (uncompressed):";
+        static const char *gen_hybrid = "Generator (hybrid):";
+ 
+        if (!x)
+                {
+                reason = ERR_R_PASSED_NULL_PARAMETER;
+                goto err;
+                }
+
+        if (EC_GROUP_get_asn1_flag(x))
+                {
+                /* the curve parameter are given by an asn1 OID */
+                int nid;
+
+                if (!BIO_indent(bp, off, 128))
+                        goto err;
+
+                nid = EC_GROUP_get_curve_name(x);
+                if (nid == 0)
+                        goto err;
+
+                if (BIO_printf(bp, "ASN1 OID: %s", OBJ_nid2sn(nid)) <= 0)
+                        goto err;
+                if (BIO_printf(bp, "\n") <= 0)
+                        goto err;
+                }
+        else
+                {
+                /* explicit parameters */
+                int is_char_two = 0;
+                point_conversion_form_t form;
+                int tmp_nid = EC_METHOD_get_field_type(EC_GROUP_method_of(x));
+
+                if (tmp_nid == NID_X9_62_characteristic_two_field)
+                        is_char_two = 1;
+
+                if ((p = BN_new()) == NULL || (a = BN_new()) == NULL ||
+                        (b = BN_new()) == NULL || (order = BN_new()) == NULL ||
+                        (cofactor = BN_new()) == NULL)
+                        {
+                        reason = ERR_R_MALLOC_FAILURE;
+                        goto err;
+                        }
+
+                if (is_char_two)
+                        {
+                        if (!EC_GROUP_get_curve_GF2m(x, p, a, b, ctx))
+                                {
+                                reason = ERR_R_EC_LIB;
+                                goto err;
+                                }
+                        }
+                else /* prime field */
+                        {
+                        if (!EC_GROUP_get_curve_GFp(x, p, a, b, ctx))
+                                {
+                                reason = ERR_R_EC_LIB;
+                                goto err;
+                                }
+                        }
+
+                if ((point = EC_GROUP_get0_generator(x)) == NULL)
+                        {
+                        reason = ERR_R_EC_LIB;
+                        goto err;
+                        }
+                if (!EC_GROUP_get_order(x, order, NULL) || 
+                        !EC_GROUP_get_cofactor(x, cofactor, NULL))
+                        {
+                        reason = ERR_R_EC_LIB;
+                        goto err;
+                        }
+                
+                form = EC_GROUP_get_point_conversion_form(x);
+
+                if ((gen = EC_POINT_point2bn(x, point, 
+                                form, NULL, ctx)) == NULL)
+                        {
+                        reason = ERR_R_EC_LIB;
+                        goto err;
+                        }
+
+                buf_len = (size_t)BN_num_bytes(p);
+                if (buf_len < (i = (size_t)BN_num_bytes(a)))
+                        buf_len = i;
+                if (buf_len < (i = (size_t)BN_num_bytes(b)))
+                        buf_len = i;
+                if (buf_len < (i = (size_t)BN_num_bytes(gen)))
+                        buf_len = i;
+                if (buf_len < (i = (size_t)BN_num_bytes(order)))
+                        buf_len = i;
+                if (buf_len < (i = (size_t)BN_num_bytes(cofactor))) 
+                        buf_len = i;
+
+                if ((seed = EC_GROUP_get0_seed(x)) != NULL)
+                        seed_len = EC_GROUP_get_seed_len(x);
+
+                buf_len += 10;
+                if ((buffer = OPENSSL_malloc(buf_len)) == NULL)
+                        {
+                        reason = ERR_R_MALLOC_FAILURE;
+                        goto err;
+                        }
+
+                if (!BIO_indent(bp, off, 128))
+                        goto err;
+
+                /* print the 'short name' of the field type */
+                if (BIO_printf(bp, "Field Type: %s\n", OBJ_nid2sn(tmp_nid))
+                        <= 0)
+                        goto err;  
+
+                if (is_char_two)
+                        {
+                        /* print the 'short name' of the base type OID */
+                        int basis_type = EC_GROUP_get_basis_type(x);
+                        if (basis_type == 0)
+                                goto err;
+
+                        if (!BIO_indent(bp, off, 128))
+                                goto err;
+
+                        if (BIO_printf(bp, "Basis Type: %s\n", 
+                                OBJ_nid2sn(basis_type)) <= 0)
+                                goto err;
+
+                        /* print the polynomial */
+                        if ((p != NULL) && !print(bp, "Polynomial:", p, buffer,
+                                off))
+                                goto err;
+                        }
+                else
+                        {
+                        if ((p != NULL) && !print(bp, "Prime:", p, buffer,off))
+                                goto err;
+                        }
+                if ((a != NULL) && !print(bp, "A:   ", a, buffer, off)) 
+                        goto err;
+                if ((b != NULL) && !print(bp, "B:   ", b, buffer, off))
+                        goto err;
+                if (form == POINT_CONVERSION_COMPRESSED)
+                        {
+                        if ((gen != NULL) && !print(bp, gen_compressed, gen,
+                                buffer, off))
+                                goto err;
+                        }
+                else if (form == POINT_CONVERSION_UNCOMPRESSED)
+                        {
+                        if ((gen != NULL) && !print(bp, gen_uncompressed, gen,
+                                buffer, off))
+                                goto err;
+                        }
+                else /* form == POINT_CONVERSION_HYBRID */
+                        {
+                        if ((gen != NULL) && !print(bp, gen_hybrid, gen,
+                                buffer, off))
+                                goto err;
+                        }
+                if ((order != NULL) && !print(bp, "Order: ", order, 
+                        buffer, off)) goto err;
+                if ((cofactor != NULL) && !print(bp, "Cofactor: ", cofactor, 
+                        buffer, off)) goto err;
+                if (seed && !print_bin(bp, "Seed:", seed, seed_len, off))
+                        goto err;
+                }
+        ret=1;
+err:
+        if (!ret)
+                ECerr(EC_F_ECPKPARAMETERS_PRINT, reason);
+        if (p) 
+                BN_free(p);
+        if (a) 
+                BN_free(a);
+        if (b)
+                BN_free(b);
+        if (gen)
+                BN_free(gen);
+        if (order)
+                BN_free(order);
+        if (cofactor)
+                BN_free(cofactor);
+        if (ctx)
+                BN_CTX_free(ctx);
+        if (buffer != NULL) 
+                OPENSSL_free(buffer);
+        return(ret);    
+        }
+
+int EC_KEY_print(BIO *bp, const EC_KEY *x, int off)
+        {
+        unsigned char *buffer=NULL;
+        size_t  buf_len=0, i;
+        int     ret=0, reason=ERR_R_BIO_LIB;
+        BIGNUM  *pub_key=NULL, *order=NULL;
+        BN_CTX  *ctx=NULL;
+        const EC_GROUP *group;
+        const EC_POINT *public_key;
+        const BIGNUM *priv_key;
+ 
+        if (x == NULL || (group = EC_KEY_get0_group(x)) == NULL)
+                {
+                reason = ERR_R_PASSED_NULL_PARAMETER;
+                goto err;
+                }
+
+        public_key = EC_KEY_get0_public_key(x);
+        if ((pub_key = EC_POINT_point2bn(group, public_key,
+                EC_KEY_get_conv_form(x), NULL, ctx)) == NULL)
+                {
+                reason = ERR_R_EC_LIB;
+                goto err;
+                }
+
+        buf_len = (size_t)BN_num_bytes(pub_key);
+        priv_key = EC_KEY_get0_private_key(x);
+        if (priv_key != NULL)
+                {
+                if ((i = (size_t)BN_num_bytes(priv_key)) > buf_len)
+                        buf_len = i;
+                }
+
+        buf_len += 10;
+        if ((buffer = OPENSSL_malloc(buf_len)) == NULL)
+                {
+                reason = ERR_R_MALLOC_FAILURE;
+                goto err;
+                }
+
+        if (priv_key != NULL)
+                {
+                if (!BIO_indent(bp, off, 128))
+                        goto err;
+                if ((order = BN_new()) == NULL)
+                        goto err;
+                if (!EC_GROUP_get_order(group, order, NULL))
+                        goto err;
+                if (BIO_printf(bp, "Private-Key: (%d bit)\n", 
+                        BN_num_bits(order)) <= 0) goto err;
+                }
+  
+        if ((priv_key != NULL) && !print(bp, "priv:", priv_key, 
+                buffer, off))
+                goto err;
+        if ((pub_key != NULL) && !print(bp, "pub: ", pub_key,
+                buffer, off))
+                goto err;
+        if (!ECPKParameters_print(bp, group, off))
+                goto err;
+        ret=1;
+err:
+        if (!ret)
+                ECerr(EC_F_EC_KEY_PRINT, reason);
+        if (pub_key) 
+                BN_free(pub_key);
+        if (order)
+                BN_free(order);
+        if (ctx)
+                BN_CTX_free(ctx);
+        if (buffer != NULL)
+                OPENSSL_free(buffer);
+        return(ret);
+        }
+#endif /* OPENSSL_NO_EC */
+
+static int print(BIO *bp, const char *number, const BIGNUM *num, unsigned char *buf,
              int off)
         {
         int n,i;
         const char *neg;
 
         if (num == NULL) return(1);
-        neg=(num->neg)?"-":"";
+        neg = (BN_is_negative(num))?"-":"";
         if(!BIO_indent(bp,off,128))
                 return 0;
+        if (BN_is_zero(num))
+                {
+                if (BIO_printf(bp, "%s 0\n", number) <= 0)
+                        return 0;
+                return 1;
+                }
 
         if (BN_num_bytes(num) <= BN_BYTES)
                 {
@@ -272,23 +618,63 @@ static int print(BIO *bp, const char *number, BIGNUM *num, unsigned char *buf,
         return(1);
         }
 
+#ifndef OPENSSL_NO_EC
+static int print_bin(BIO *fp, const char *name, const unsigned char *buf,
+                size_t len, int off)
+        {
+        size_t i;
+        char str[128];
+
+        if (buf == NULL)
+                return 1;
+        if (off)
+                {
+                if (off > 128)
+                        off=128;
+                memset(str,' ',off);
+                if (BIO_write(fp, str, off) <= 0)
+                        return 0;
+                }
+
+        if (BIO_printf(fp,"%s", name) <= 0)
+                return 0;
+
+        for (i=0; i<len; i++)
+                {
+                if ((i%15) == 0)
+                        {
+                        str[0]='\n';
+                        memset(&(str[1]),' ',off+4);
+                        if (BIO_write(fp, str, off+1+4) <= 0)
+                                return 0;
+                        }
+                if (BIO_printf(fp,"%02x%s",buf[i],((i+1) == len)?"":":") <= 0)
+                        return 0;
+                }
+        if (BIO_write(fp,"\n",1) <= 0)
+                return 0;
+
+        return 1;
+        }
+#endif
+
 #ifndef OPENSSL_NO_DH
 #ifndef OPENSSL_NO_FP_API
 int DHparams_print_fp(FILE *fp, const DH *x)
-        {
-        BIO *b;
-        int ret;
+        {
+        BIO *b;
+        int ret;
 
-        if ((b=BIO_new(BIO_s_file())) == NULL)
+        if ((b=BIO_new(BIO_s_file())) == NULL)
                 {
                 DHerr(DH_F_DHPARAMS_PRINT_FP,ERR_R_BUF_LIB);
-                return(0);
+                return(0);
                 }
-        BIO_set_fp(b,fp,BIO_NOCLOSE);
-        ret=DHparams_print(b, x);
-        BIO_free(b);
-        return(ret);
-        }
+        BIO_set_fp(b,fp,BIO_NOCLOSE);
+        ret=DHparams_print(b, x);
+        BIO_free(b);
+        return(ret);
+        }
 #endif
 
 int DHparams_print(BIO *bp, const DH *x)
@@ -299,6 +685,11 @@ int DHparams_print(BIO *bp, const DH *x)
 
         if (x->p)
                 buf_len = (size_t)BN_num_bytes(x->p);
+        else
+                {
+                reason = ERR_R_PASSED_NULL_PARAMETER;
+                goto err;
+                }
         if (x->g)
                 if (buf_len < (i = (size_t)BN_num_bytes(x->g)))
                         buf_len = i;
@@ -333,30 +724,35 @@ err:
 #ifndef OPENSSL_NO_DSA
 #ifndef OPENSSL_NO_FP_API
 int DSAparams_print_fp(FILE *fp, const DSA *x)
-        {
-        BIO *b;
-        int ret;
+        {
+        BIO *b;
+        int ret;
 
-        if ((b=BIO_new(BIO_s_file())) == NULL)
+        if ((b=BIO_new(BIO_s_file())) == NULL)
                 {
                 DSAerr(DSA_F_DSAPARAMS_PRINT_FP,ERR_R_BUF_LIB);
-                return(0);
+                return(0);
                 }
-        BIO_set_fp(b,fp,BIO_NOCLOSE);
-        ret=DSAparams_print(b, x);
-        BIO_free(b);
-        return(ret);
-        }
+        BIO_set_fp(b,fp,BIO_NOCLOSE);
+        ret=DSAparams_print(b, x);
+        BIO_free(b);
+        return(ret);
+        }
 #endif
 
 int DSAparams_print(BIO *bp, const DSA *x)
         {
         unsigned char *m=NULL;
-        int reason=ERR_R_BUF_LIB,ret=0;
+        int ret=0;
         size_t buf_len=0,i;
 
         if (x->p)
                 buf_len = (size_t)BN_num_bytes(x->p);
+        else
+                {
+                DSAerr(DSA_F_DSAPARAMS_PRINT,DSA_R_MISSING_PARAMETERS);
+                goto err;
+                }
         if (x->q)
                 if (buf_len < (i = (size_t)BN_num_bytes(x->q)))
                         buf_len = i;
@@ -366,7 +762,7 @@ int DSAparams_print(BIO *bp, const DSA *x)
         m=(unsigned char *)OPENSSL_malloc(buf_len+10);
         if (m == NULL)
                 {
-                reason=ERR_R_MALLOC_FAILURE;
+                DSAerr(DSA_F_DSAPARAMS_PRINT,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
 
@@ -374,14 +770,70 @@ int DSAparams_print(BIO *bp, const DSA *x)
                 BN_num_bits(x->p)) <= 0)
                 goto err;
         if (!print(bp,"p:",x->p,m,4)) goto err;
-        if (!print(bp,"q:",x->q,m,4)) goto err;
-        if (!print(bp,"g:",x->g,m,4)) goto err;
+        if ((x->q != NULL) && !print(bp,"q:",x->q,m,4)) goto err;
+        if ((x->g != NULL) && !print(bp,"g:",x->g,m,4)) goto err;
         ret=1;
 err:
         if (m != NULL) OPENSSL_free(m);
-        DSAerr(DSA_F_DSAPARAMS_PRINT,reason);
         return(ret);
         }
 
 #endif /* !OPENSSL_NO_DSA */
 
+#ifndef OPENSSL_NO_EC
+#ifndef OPENSSL_NO_FP_API
+int ECParameters_print_fp(FILE *fp, const EC_KEY *x)
+        {
+        BIO *b;
+        int ret;
+ 
+        if ((b=BIO_new(BIO_s_file())) == NULL)
+                {
+                ECerr(EC_F_ECPARAMETERS_PRINT_FP, ERR_R_BIO_LIB);
+                return(0);
+                }
+        BIO_set_fp(b, fp, BIO_NOCLOSE);
+        ret = ECParameters_print(b, x);
+        BIO_free(b);
+        return(ret);
+        }
+#endif
+
+int ECParameters_print(BIO *bp, const EC_KEY *x)
+        {
+        int     reason=ERR_R_EC_LIB, ret=0;
+        BIGNUM  *order=NULL;
+        const EC_GROUP *group;
+ 
+        if (x == NULL || (group = EC_KEY_get0_group(x)) == NULL)
+                {
+                reason = ERR_R_PASSED_NULL_PARAMETER;;
+                goto err;
+                }
+
+        if ((order = BN_new()) == NULL)
+                {
+                reason = ERR_R_MALLOC_FAILURE;
+                goto err;
+                }
+
+        if (!EC_GROUP_get_order(group, order, NULL))
+                {
+                reason = ERR_R_EC_LIB;
+                goto err;
+                }
+ 
+        if (BIO_printf(bp, "ECDSA-Parameters: (%d bit)\n", 
+                BN_num_bits(order)) <= 0)
+                goto err;
+        if (!ECPKParameters_print(bp, group, 4))
+                goto err;
+        ret=1;
+err:
+        if (order)
+                BN_free(order);
+        ECerr(EC_F_ECPARAMETERS_PRINT, reason);
+        return(ret);
+        }
+  
+#endif
diff --git a/src/lib/libssl/src/crypto/asn1/t_req.c b/src/lib/libssl/src/crypto/asn1/t_req.c
index 740cee80c0..5557e06584 100644
--- a/src/lib/libssl/src/crypto/asn1/t_req.c
+++ b/src/lib/libssl/src/crypto/asn1/t_req.c
@@ -63,6 +63,12 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
 
 #ifndef OPENSSL_NO_FP_API
 int X509_REQ_print_fp(FILE *fp, X509_REQ *x)
@@ -160,6 +166,14 @@ int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long
                         }
                 else
 #endif
+#ifndef OPENSSL_NO_EC
+                if (pkey->type == EVP_PKEY_EC)
+                {
+                        BIO_printf(bp, "%12sEC Public Key: \n","");
+                        EC_KEY_print(bp, pkey->pkey.ec, 16);
+                }
+        else
+#endif
                         BIO_printf(bp,"%12sUnknown Public Key:\n","");
 
                 EVP_PKEY_free(pkey);
@@ -230,7 +244,7 @@ get_next:
                                 }
                         }
                 }
-        if(!(cflag & X509_FLAG_NO_ATTRIBUTES))
+        if(!(cflag & X509_FLAG_NO_EXTENSIONS))
                 {
                 exts = X509_REQ_get_extensions(x);
                 if(exts)
@@ -246,9 +260,9 @@ get_next:
                                 obj=X509_EXTENSION_get_object(ex);
                                 i2a_ASN1_OBJECT(bp,obj);
                                 j=X509_EXTENSION_get_critical(ex);
-                                if (BIO_printf(bp,": %s\n",j?"critical":"","") <= 0)
+                                if (BIO_printf(bp,": %s\n",j?"critical":"") <= 0)
                                         goto err;
-                                if(!X509V3_EXT_print(bp, ex, 0, 16))
+                                if(!X509V3_EXT_print(bp, ex, cflag, 16))
                                         {
                                         BIO_printf(bp, "%16s", "");
                                         M_ASN1_OCTET_STRING_print(bp,ex->value);
@@ -266,7 +280,7 @@ get_next:
 
         return(1);
 err:
-        X509err(X509_F_X509_REQ_PRINT,ERR_R_BUF_LIB);
+        X509err(X509_F_X509_REQ_PRINT_EX,ERR_R_BUF_LIB);
         return(0);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/t_spki.c b/src/lib/libssl/src/crypto/asn1/t_spki.c
index 5abfbc815e..c2a5797dd8 100644
--- a/src/lib/libssl/src/crypto/asn1/t_spki.c
+++ b/src/lib/libssl/src/crypto/asn1/t_spki.c
@@ -60,6 +60,13 @@
 #include "cryptlib.h"
 #include <openssl/x509.h>
 #include <openssl/asn1.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#include <openssl/bn.h>
 
 /* Print out an SPKI */
 
@@ -93,6 +100,15 @@ int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
                 }
                 else
 #endif
+#ifndef OPENSSL_NO_EC
+                if (pkey->type == EVP_PKEY_EC)
+                {
+                        BIO_printf(out, "  EC Public Key:\n");
+                        EC_KEY_print(out, pkey->pkey.ec,2);
+                }
+                else
+#endif
+
                         BIO_printf(out,"  Unknown Public Key:\n");
                 EVP_PKEY_free(pkey);
         }
diff --git a/src/lib/libssl/src/crypto/asn1/t_x509.c b/src/lib/libssl/src/crypto/asn1/t_x509.c
index 30f68561b7..26d3361722 100644
--- a/src/lib/libssl/src/crypto/asn1/t_x509.c
+++ b/src/lib/libssl/src/crypto/asn1/t_x509.c
@@ -66,6 +66,9 @@
 #ifndef OPENSSL_NO_DSA
 #include <openssl/dsa.h>
 #endif
+#ifndef OPENSSL_NO_EC
+#include <openssl/ec.h>
+#endif
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
@@ -83,7 +86,7 @@ int X509_print_ex_fp(FILE *fp, X509 *x, unsigned long nmflag, unsigned long cfla
 
         if ((b=BIO_new(BIO_s_file())) == NULL)
                 {
-                X509err(X509_F_X509_PRINT_FP,ERR_R_BUF_LIB);
+                X509err(X509_F_X509_PRINT_EX_FP,ERR_R_BUF_LIB);
                 return(0);
                 }
         BIO_set_fp(b,fp,BIO_NOCLOSE);
@@ -229,6 +232,14 @@ int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, unsigned long cflag)
                         }
                 else
 #endif
+#ifndef OPENSSL_NO_EC
+                if (pkey->type == EVP_PKEY_EC)
+                        {
+                        BIO_printf(bp, "%12sEC Public Key:\n","");
+                        EC_KEY_print(bp, pkey->pkey.ec, 16);
+                        }
+                else
+#endif
                         BIO_printf(bp,"%12sUnknown Public Key:\n","");
 
                 EVP_PKEY_free(pkey);
@@ -434,19 +445,18 @@ err:
 int X509_NAME_print(BIO *bp, X509_NAME *name, int obase)
         {
         char *s,*c,*b;
-        int ret=0,l,ll,i,first=1;
+        int ret=0,l,i;
 
-        ll=80-2-obase;
+        l=80-2-obase;
 
-        b=s=X509_NAME_oneline(name,NULL,0);
-        if (!*s)
+        b=X509_NAME_oneline(name,NULL,0);
+        if (!*b)
                 {
                 OPENSSL_free(b);
                 return 1;
                 }
-        s++; /* skip the first slash */
+        s=b+1; /* skip the first slash */
 
-        l=ll;
         c=s;
         for (;;)
                 {
@@ -468,20 +478,9 @@ int X509_NAME_print(BIO *bp, X509_NAME *name, int obase)
                         (*s == '\0'))
 #endif
                         {
-                        if ((l <= 0) && !first)
-                                {
-                                first=0;
-                                if (BIO_write(bp,"\n",1) != 1) goto err;
-                                for (i=0; i<obase; i++)
-                                        {
-                                        if (BIO_write(bp," ",1) != 1) goto err;
-                                        }
-                                l=ll;
-                                }
                         i=s-c;
                         if (BIO_write(bp,c,i) != i) goto err;
-                        c+=i;
-                        c++;
+                        c=s+1;  /* skip following slash */
                         if (*s != '\0')
                                 {
                                 if (BIO_write(bp,", ",2) != 2) goto err;
diff --git a/src/lib/libssl/src/crypto/asn1/tasn_dec.c b/src/lib/libssl/src/crypto/asn1/tasn_dec.c
index b7e916ef36..0ee406231e 100644
--- a/src/lib/libssl/src/crypto/asn1/tasn_dec.c
+++ b/src/lib/libssl/src/crypto/asn1/tasn_dec.c
@@ -3,7 +3,7 @@
  * project 2000.
  */
 /* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -65,24 +65,40 @@
 #include <openssl/buffer.h>
 #include <openssl/err.h>
 
-static int asn1_check_eoc(unsigned char **in, long len);
-static int asn1_find_end(unsigned char **in, long len, char inf);
-static int asn1_collect(BUF_MEM *buf, unsigned char **in, long len, char inf, int tag, int aclass);
-static int collect_data(BUF_MEM *buf, unsigned char **p, long plen);
-static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass, char *inf, char *cst,
-                        unsigned char **in, long len, int exptag, int expclass, char opt, ASN1_TLC *ctx);
-static int asn1_template_ex_d2i(ASN1_VALUE **pval, unsigned char **in, long len, const ASN1_TEMPLATE *tt, char opt, ASN1_TLC *ctx);
-static int asn1_template_noexp_d2i(ASN1_VALUE **val, unsigned char **in, long len, const ASN1_TEMPLATE *tt, char opt, ASN1_TLC *ctx);
-static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, unsigned char **in, long len,
-                                        const ASN1_ITEM *it, int tag, int aclass, char opt, ASN1_TLC *ctx);
+static int asn1_check_eoc(const unsigned char **in, long len);
+static int asn1_find_end(const unsigned char **in, long len, char inf);
+
+static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
+                                char inf, int tag, int aclass);
+
+static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen);
+
+static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
+                                char *inf, char *cst,
+                                const unsigned char **in, long len,
+                                int exptag, int expclass, char opt,
+                                ASN1_TLC *ctx);
+
+static int asn1_template_ex_d2i(ASN1_VALUE **pval,
+                                const unsigned char **in, long len,
+                                const ASN1_TEMPLATE *tt, char opt,
+                                ASN1_TLC *ctx);
+static int asn1_template_noexp_d2i(ASN1_VALUE **val,
+                                const unsigned char **in, long len,
+                                const ASN1_TEMPLATE *tt, char opt,
+                                ASN1_TLC *ctx);
+static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
+                                const unsigned char **in, long len,
+                                const ASN1_ITEM *it,
+                                int tag, int aclass, char opt, ASN1_TLC *ctx);
 
 /* Table to convert tags to bit values, used for MSTRING type */
-static unsigned long tag2bit[32]={
+static const unsigned long tag2bit[32] = {
 0,      0,      0,      B_ASN1_BIT_STRING,      /* tags  0 -  3 */
 B_ASN1_OCTET_STRING,    0,      0,              B_ASN1_UNKNOWN,/* tags  4- 7 */
 B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN,/* tags  8-11 */
 B_ASN1_UTF8STRING,B_ASN1_UNKNOWN,B_ASN1_UNKNOWN,B_ASN1_UNKNOWN,/* tags 12-15 */
-0,      0,      B_ASN1_NUMERICSTRING,B_ASN1_PRINTABLESTRING,   /* tags 16-19 */
+B_ASN1_SEQUENCE,0,B_ASN1_NUMERICSTRING,B_ASN1_PRINTABLESTRING, /* tags 16-19 */
 B_ASN1_T61STRING,B_ASN1_VIDEOTEXSTRING,B_ASN1_IA5STRING,       /* tags 20-22 */
 B_ASN1_UTCTIME, B_ASN1_GENERALIZEDTIME,                        /* tags 23-24 */ 
 B_ASN1_GRAPHICSTRING,B_ASN1_ISO64STRING,B_ASN1_GENERALSTRING,  /* tags 25-27 */
@@ -90,14 +106,14 @@ B_ASN1_UNIVERSALSTRING,B_ASN1_UNKNOWN,B_ASN1_BMPSTRING,B_ASN1_UNKNOWN, /* tags 2
         };
 
 unsigned long ASN1_tag2bit(int tag)
-{
-        if((tag < 0) || (tag > 30)) return 0;
+        {
+        if ((tag < 0) || (tag > 30)) return 0;
         return tag2bit[tag];
-}
+        }
 
 /* Macro to initialize and invalidate the cache */
 
-#define asn1_tlc_clear(c)       if(c) (c)->valid = 0
+#define asn1_tlc_clear(c)       if (c) (c)->valid = 0
 
 /* Decode an ASN1 item, this currently behaves just 
  * like a standard 'd2i' function. 'in' points to 
@@ -107,113 +123,147 @@ unsigned long ASN1_tag2bit(int tag)
  * case.
  */
 
-ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval, unsigned char **in, long len, const ASN1_ITEM *it)
-{
+ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
+                const unsigned char **in, long len, const ASN1_ITEM *it)
+        {
         ASN1_TLC c;
         ASN1_VALUE *ptmpval = NULL;
-        if(!pval) pval = &ptmpval;
-        asn1_tlc_clear(&c);
-        if(ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0) 
+        if (!pval)
+                pval = &ptmpval;
+        c.valid = 0;
+        if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0) 
                 return *pval;
         return NULL;
-}
+        }
 
-int ASN1_template_d2i(ASN1_VALUE **pval, unsigned char **in, long len, const ASN1_TEMPLATE *tt)
-{
+int ASN1_template_d2i(ASN1_VALUE **pval,
+                const unsigned char **in, long len, const ASN1_TEMPLATE *tt)
+        {
         ASN1_TLC c;
-        asn1_tlc_clear(&c);
+        c.valid = 0;
         return asn1_template_ex_d2i(pval, in, len, tt, 0, &c);
-}
+        }
 
 
 /* Decode an item, taking care of IMPLICIT tagging, if any.
  * If 'opt' set and tag mismatch return -1 to handle OPTIONAL
  */
 
-int ASN1_item_ex_d2i(ASN1_VALUE **pval, unsigned char **in, long len, const ASN1_ITEM *it,
-                                int tag, int aclass, char opt, ASN1_TLC *ctx)
-{
+int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
+                        const ASN1_ITEM *it,
+                        int tag, int aclass, char opt, ASN1_TLC *ctx)
+        {
         const ASN1_TEMPLATE *tt, *errtt = NULL;
         const ASN1_COMPAT_FUNCS *cf;
         const ASN1_EXTERN_FUNCS *ef;
         const ASN1_AUX *aux = it->funcs;
         ASN1_aux_cb *asn1_cb;
-        unsigned char *p, *q, imphack = 0, oclass;
+        const unsigned char *p = NULL, *q;
+        unsigned char *wp=NULL; /* BIG FAT WARNING!  BREAKS CONST WHERE USED */
+        unsigned char imphack = 0, oclass;
         char seq_eoc, seq_nolen, cst, isopt;
         long tmplen;
         int i;
         int otag;
         int ret = 0;
         ASN1_VALUE *pchval, **pchptr, *ptmpval;
-        if(!pval) return 0;
-        if(aux && aux->asn1_cb) asn1_cb = aux->asn1_cb;
+        if (!pval)
+                return 0;
+        if (aux && aux->asn1_cb)
+                asn1_cb = aux->asn1_cb;
         else asn1_cb = 0;
 
-        switch(it->itype) {
-
+        switch(it->itype)
+                {
                 case ASN1_ITYPE_PRIMITIVE:
-                if(it->templates) {
-                        /* tagging or OPTIONAL is currently illegal on an item template
-                         * because the flags can't get passed down. In practice this isn't
-                         * a problem: we include the relevant flags from the item template
-                         * in the template itself.
+                if (it->templates)
+                        {
+                        /* tagging or OPTIONAL is currently illegal on an item
+                         * template because the flags can't get passed down.
+                         * In practice this isn't a problem: we include the
+                         * relevant flags from the item template in the
+                         * template itself.
                          */
-                        if ((tag != -1) || opt) {
-                                ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE);
+                        if ((tag != -1) || opt)
+                                {
+                                ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE);
                                 goto err;
-                        }
-                        return asn1_template_ex_d2i(pval, in, len, it->templates, opt, ctx);
+                                }
+                        return asn1_template_ex_d2i(pval, in, len,
+                                        it->templates, opt, ctx);
                 }
-                return asn1_d2i_ex_primitive(pval, in, len, it, tag, aclass, opt, ctx);
+                return asn1_d2i_ex_primitive(pval, in, len, it,
+                                                tag, aclass, opt, ctx);
                 break;
 
                 case ASN1_ITYPE_MSTRING:
                 p = *in;
                 /* Just read in tag and class */
-                ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL, &p, len, -1, 0, 1, ctx);
-                if(!ret) {
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
+                ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
+                                                &p, len, -1, 0, 1, ctx);
+                if (!ret)
+                        {
+                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                        ERR_R_NESTED_ASN1_ERROR);
                         goto err;
-                } 
+                        }
+
                 /* Must be UNIVERSAL class */
-                if(oclass != V_ASN1_UNIVERSAL) {
+                if (oclass != V_ASN1_UNIVERSAL)
+                        {
                         /* If OPTIONAL, assume this is OK */
-                        if(opt) return -1;
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_MSTRING_NOT_UNIVERSAL);
+                        if (opt) return -1;
+                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                        ASN1_R_MSTRING_NOT_UNIVERSAL);
                         goto err;
-                } 
+                        }
                 /* Check tag matches bit map */
-                if(!(ASN1_tag2bit(otag) & it->utype)) {
+                if (!(ASN1_tag2bit(otag) & it->utype))
+                        {
                         /* If OPTIONAL, assume this is OK */
-                        if(opt) return -1;
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_MSTRING_WRONG_TAG);
+                        if (opt)
+                                return -1;
+                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                        ASN1_R_MSTRING_WRONG_TAG);
                         goto err;
-                } 
-                return asn1_d2i_ex_primitive(pval, in, len, it, otag, 0, 0, ctx);
+                        }
+                return asn1_d2i_ex_primitive(pval, in, len,
+                                                it, otag, 0, 0, ctx);
 
                 case ASN1_ITYPE_EXTERN:
                 /* Use new style d2i */
                 ef = it->funcs;
-                return ef->asn1_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx);
+                return ef->asn1_ex_d2i(pval, in, len,
+                                                it, tag, aclass, opt, ctx);
 
                 case ASN1_ITYPE_COMPAT:
                 /* we must resort to old style evil hackery */
                 cf = it->funcs;
 
                 /* If OPTIONAL see if it is there */
-                if(opt) {
+                if (opt)
+                        {
                         int exptag;
                         p = *in;
-                        if(tag == -1) exptag = it->utype;
+                        if (tag == -1)
+                                exptag = it->utype;
                         else exptag = tag;
-                        /* Don't care about anything other than presence of expected tag */
-                        ret = asn1_check_tlen(NULL, NULL, NULL, NULL, NULL, &p, len, exptag, aclass, 1, ctx);
-                        if(!ret) {
-                                ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
+                        /* Don't care about anything other than presence
+                         * of expected tag */
+
+                        ret = asn1_check_tlen(NULL, NULL, NULL, NULL, NULL,
+                                        &p, len, exptag, aclass, 1, ctx);
+                        if (!ret)
+                                {
+                                ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                        ERR_R_NESTED_ASN1_ERROR);
                                 goto err;
+                                }
+                        if (ret == -1)
+                                return -1;
                         }
-                        if(ret == -1) return -1;
-                }
+
                 /* This is the old style evil hack IMPLICIT handling:
                  * since the underlying code is expecting a tag and
                  * class other than the one present we change the
@@ -229,245 +279,332 @@ int ASN1_item_ex_d2i(ASN1_VALUE **pval, unsigned char **in, long len, const ASN1
                  * buffer.
                  */
 
-                if(tag != -1) {
-                        p = *in;
-                        imphack = *p;
-                        *p = (unsigned char)((*p & V_ASN1_CONSTRUCTED) | it->utype);
-                }
+                if (tag != -1)
+                        {
+                        wp = *(unsigned char **)in;
+                        imphack = *wp;
+                        if (p == NULL)
+                                {
+                                ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                        ERR_R_NESTED_ASN1_ERROR);
+                                goto err;
+                                }
+                        *wp = (unsigned char)((*p & V_ASN1_CONSTRUCTED)
+                                                                | it->utype);
+                        }
 
                 ptmpval = cf->asn1_d2i(pval, in, len);
 
-                if(tag != -1) *p = imphack;
+                if (tag != -1)
+                        *wp = imphack;
+
+                if (ptmpval)
+                        return 1;
 
-                if(ptmpval) return 1;
                 ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
                 goto err;
 
 
                 case ASN1_ITYPE_CHOICE:
-                if(asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it))
+                if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it))
                                 goto auxerr;
 
                 /* Allocate structure */
-                if(!*pval) {
-                        if(!ASN1_item_ex_new(pval, it)) {
-                                ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
-                                goto err;
+                if (!*pval && !ASN1_item_ex_new(pval, it))
+                        {
+                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                                ERR_R_NESTED_ASN1_ERROR);
+                        goto err;
                         }
-                }
                 /* CHOICE type, try each possibility in turn */
                 pchval = NULL;
                 p = *in;
-                for(i = 0, tt=it->templates; i < it->tcount; i++, tt++) {
+                for (i = 0, tt=it->templates; i < it->tcount; i++, tt++)
+                        {
                         pchptr = asn1_get_field_ptr(pval, tt);
                         /* We mark field as OPTIONAL so its absence
                          * can be recognised.
                          */
                         ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx);
                         /* If field not present, try the next one */
-                        if(ret == -1) continue;
+                        if (ret == -1)
+                                continue;
                         /* If positive return, read OK, break loop */
-                        if(ret > 0) break;
+                        if (ret > 0)
+                                break;
                         /* Otherwise must be an ASN1 parsing error */
                         errtt = tt;
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
+                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                                ERR_R_NESTED_ASN1_ERROR);
                         goto err;
-                }
+                        }
+
                 /* Did we fall off the end without reading anything? */
-                if(i == it->tcount) {
+                if (i == it->tcount)
+                        {
                         /* If OPTIONAL, this is OK */
-                        if(opt) {
+                        if (opt)
+                                {
                                 /* Free and zero it */
                                 ASN1_item_ex_free(pval, it);
                                 return -1;
-                        }
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_NO_MATCHING_CHOICE_TYPE);
+                                }
+                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                        ASN1_R_NO_MATCHING_CHOICE_TYPE);
                         goto err;
-                }
+                        }
+
                 asn1_set_choice_selector(pval, i, it);
                 *in = p;
-                if(asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it))
+                if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it))
                                 goto auxerr;
                 return 1;
 
+                case ASN1_ITYPE_NDEF_SEQUENCE:
                 case ASN1_ITYPE_SEQUENCE:
                 p = *in;
                 tmplen = len;
 
                 /* If no IMPLICIT tagging set to SEQUENCE, UNIVERSAL */
-                if(tag == -1) {
+                if (tag == -1)
+                        {
                         tag = V_ASN1_SEQUENCE;
                         aclass = V_ASN1_UNIVERSAL;
-                }
+                        }
                 /* Get SEQUENCE length and update len, p */
-                ret = asn1_check_tlen(&len, NULL, NULL, &seq_eoc, &cst, &p, len, tag, aclass, opt, ctx);
-                if(!ret) {
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
+                ret = asn1_check_tlen(&len, NULL, NULL, &seq_eoc, &cst,
+                                        &p, len, tag, aclass, opt, ctx);
+                if (!ret)
+                        {
+                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                        ERR_R_NESTED_ASN1_ERROR);
                         goto err;
-                } else if(ret == -1) return -1;
-                if(aux && (aux->flags & ASN1_AFLG_BROKEN)) {
+                        }
+                else if (ret == -1)
+                        return -1;
+                if (aux && (aux->flags & ASN1_AFLG_BROKEN))
+                        {
                         len = tmplen - (p - *in);
                         seq_nolen = 1;
-                } else seq_nolen = seq_eoc;     /* If indefinite we don't do a length check */
-                if(!cst) {
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_SEQUENCE_NOT_CONSTRUCTED);
+                        }
+                /* If indefinite we don't do a length check */
+                else seq_nolen = seq_eoc;
+                if (!cst)
+                        {
+                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                ASN1_R_SEQUENCE_NOT_CONSTRUCTED);
                         goto err;
-                }
+                        }
 
-                if(!*pval) {
-                        if(!ASN1_item_ex_new(pval, it)) {
-                                ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
-                                goto err;
+                if (!*pval && !ASN1_item_ex_new(pval, it))
+                        {
+                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                ERR_R_NESTED_ASN1_ERROR);
+                        goto err;
                         }
-                }
-                if(asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it))
+
+                if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it))
                                 goto auxerr;
 
                 /* Get each field entry */
-                for(i = 0, tt = it->templates; i < it->tcount; i++, tt++) {
+                for (i = 0, tt = it->templates; i < it->tcount; i++, tt++)
+                        {
                         const ASN1_TEMPLATE *seqtt;
                         ASN1_VALUE **pseqval;
                         seqtt = asn1_do_adb(pval, tt, 1);
-                        if(!seqtt) goto err;
+                        if (!seqtt)
+                                goto err;
                         pseqval = asn1_get_field_ptr(pval, seqtt);
                         /* Have we ran out of data? */
-                        if(!len) break;
+                        if (!len)
+                                break;
                         q = p;
-                        if(asn1_check_eoc(&p, len)) {
-                                if(!seq_eoc) {
-                                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_UNEXPECTED_EOC);
+                        if (asn1_check_eoc(&p, len))
+                                {
+                                if (!seq_eoc)
+                                        {
+                                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                                        ASN1_R_UNEXPECTED_EOC);
                                         goto err;
-                                }
+                                        }
                                 len -= p - q;
                                 seq_eoc = 0;
                                 q = p;
                                 break;
-                        }
-                        /* This determines the OPTIONAL flag value. The field cannot
-                         * be omitted if it is the last of a SEQUENCE and there is
-                         * still data to be read. This isn't strictly necessary but
-                         * it increases efficiency in some cases.
+                                }
+                        /* This determines the OPTIONAL flag value. The field
+                         * cannot be omitted if it is the last of a SEQUENCE
+                         * and there is still data to be read. This isn't
+                         * strictly necessary but it increases efficiency in
+                         * some cases.
                          */
-                        if(i == (it->tcount - 1)) isopt = 0;
+                        if (i == (it->tcount - 1))
+                                isopt = 0;
                         else isopt = (char)(seqtt->flags & ASN1_TFLG_OPTIONAL);
-                        /* attempt to read in field, allowing each to be OPTIONAL */
-                        ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx);
-                        if(!ret) {
+                        /* attempt to read in field, allowing each to be
+                         * OPTIONAL */
+
+                        ret = asn1_template_ex_d2i(pseqval, &p, len,
+                                                        seqtt, isopt, ctx);
+                        if (!ret)
+                                {
                                 errtt = seqtt;
                                 goto err;
-                        } else if(ret == -1) {
-                                /* OPTIONAL component absent. Free and zero the field
+                                }
+                        else if (ret == -1)
+                                {
+                                /* OPTIONAL component absent.
+                                 * Free and zero the field.
                                  */
                                 ASN1_template_free(pseqval, seqtt);
                                 continue;
-                        }
+                                }
                         /* Update length */
                         len -= p - q;
-                }
+                        }
+
                 /* Check for EOC if expecting one */
-                if(seq_eoc && !asn1_check_eoc(&p, len)) {
+                if (seq_eoc && !asn1_check_eoc(&p, len))
+                        {
                         ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_MISSING_EOC);
                         goto err;
-                }
+                        }
                 /* Check all data read */
-                if(!seq_nolen && len) {
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_SEQUENCE_LENGTH_MISMATCH);
+                if (!seq_nolen && len)
+                        {
+                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                        ASN1_R_SEQUENCE_LENGTH_MISMATCH);
                         goto err;
-                }
+                        }
 
                 /* If we get here we've got no more data in the SEQUENCE,
                  * however we may not have read all fields so check all
                  * remaining are OPTIONAL and clear any that are.
                  */
-                for(; i < it->tcount; tt++, i++) {
+                for (; i < it->tcount; tt++, i++)
+                        {
                         const ASN1_TEMPLATE *seqtt;
                         seqtt = asn1_do_adb(pval, tt, 1);
-                        if(!seqtt) goto err;
-                        if(seqtt->flags & ASN1_TFLG_OPTIONAL) {
+                        if (!seqtt)
+                                goto err;
+                        if (seqtt->flags & ASN1_TFLG_OPTIONAL)
+                                {
                                 ASN1_VALUE **pseqval;
                                 pseqval = asn1_get_field_ptr(pval, seqtt);
                                 ASN1_template_free(pseqval, seqtt);
-                        } else {
+                                }
+                        else
+                                {
                                 errtt = seqtt;
-                                ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_FIELD_MISSING);
+                                ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
+                                                        ASN1_R_FIELD_MISSING);
                                 goto err;
+                                }
                         }
-                }
                 /* Save encoding */
-                if(!asn1_enc_save(pval, *in, p - *in, it)) goto auxerr;
+                if (!asn1_enc_save(pval, *in, p - *in, it))
+                        goto auxerr;
                 *in = p;
-                if(asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it))
+                if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it))
                                 goto auxerr;
                 return 1;
 
                 default:
                 return 0;
-        }
+                }
         auxerr:
         ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_AUX_ERROR);
         err:
         ASN1_item_ex_free(pval, it);
-        if(errtt) ERR_add_error_data(4, "Field=", errtt->field_name, ", Type=", it->sname);
-        else ERR_add_error_data(2, "Type=", it->sname);
+        if (errtt)
+                ERR_add_error_data(4, "Field=", errtt->field_name,
+                                        ", Type=", it->sname);
+        else
+                ERR_add_error_data(2, "Type=", it->sname);
         return 0;
-}
+        }
 
-/* Templates are handled with two separate functions. One handles any EXPLICIT tag and the other handles the
- * rest.
+/* Templates are handled with two separate functions.
+ * One handles any EXPLICIT tag and the other handles the rest.
  */
 
-static int asn1_template_ex_d2i(ASN1_VALUE **val, unsigned char **in, long inlen, const ASN1_TEMPLATE *tt, char opt, ASN1_TLC *ctx)
-{
+static int asn1_template_ex_d2i(ASN1_VALUE **val,
+                                const unsigned char **in, long inlen,
+                                const ASN1_TEMPLATE *tt, char opt,
+                                                        ASN1_TLC *ctx)
+        {
         int flags, aclass;
         int ret;
         long len;
-        unsigned char *p, *q;
+        const unsigned char *p, *q;
         char exp_eoc;
-        if(!val) return 0;
+        if (!val)
+                return 0;
         flags = tt->flags;
         aclass = flags & ASN1_TFLG_TAG_CLASS;
 
         p = *in;
 
         /* Check if EXPLICIT tag expected */
-        if(flags & ASN1_TFLG_EXPTAG) {
+        if (flags & ASN1_TFLG_EXPTAG)
+                {
                 char cst;
-                /* Need to work out amount of data available to the inner content and where it
-                 * starts: so read in EXPLICIT header to get the info.
+                /* Need to work out amount of data available to the inner
+                 * content and where it starts: so read in EXPLICIT header to
+                 * get the info.
                  */
-                ret = asn1_check_tlen(&len, NULL, NULL, &exp_eoc, &cst, &p, inlen, tt->tag, aclass, opt, ctx);
+                ret = asn1_check_tlen(&len, NULL, NULL, &exp_eoc, &cst,
+                                        &p, inlen, tt->tag, aclass, opt, ctx);
                 q = p;
-                if(!ret) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
+                if (!ret)
+                        {
+                        ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
+                                        ERR_R_NESTED_ASN1_ERROR);
                         return 0;
-                } else if(ret == -1) return -1;
-                if(!cst) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I, ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED);
+                        }
+                else if (ret == -1)
+                        return -1;
+                if (!cst)
+                        {
+                        ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
+                                        ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED);
                         return 0;
-                }
+                        }
                 /* We've found the field so it can't be OPTIONAL now */
                 ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, ctx);
-                if(!ret) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
+                if (!ret)
+                        {
+                        ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
+                                        ERR_R_NESTED_ASN1_ERROR);
                         return 0;
-                }
+                        }
                 /* We read the field in OK so update length */
                 len -= p - q;
-                if(exp_eoc) {
+                if (exp_eoc)
+                        {
                         /* If NDEF we must have an EOC here */
-                        if(!asn1_check_eoc(&p, len)) {
-                                ASN1err(ASN1_F_ASN1_TEMPLATE_D2I, ASN1_R_MISSING_EOC);
+                        if (!asn1_check_eoc(&p, len))
+                                {
+                                ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
+                                                ASN1_R_MISSING_EOC);
                                 goto err;
+                                }
                         }
-                } else {
-                        /* Otherwise we must hit the EXPLICIT tag end or its an error */
-                        if(len) {
-                                ASN1err(ASN1_F_ASN1_TEMPLATE_D2I, ASN1_R_EXPLICIT_LENGTH_MISMATCH);
+                else
+                        {
+                        /* Otherwise we must hit the EXPLICIT tag end or its
+                         * an error */
+                        if (len)
+                                {
+                                ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
+                                        ASN1_R_EXPLICIT_LENGTH_MISMATCH);
                                 goto err;
+                                }
                         }
                 }
-        } else 
-                return asn1_template_noexp_d2i(val, in, inlen, tt, opt, ctx);
+                else 
+                        return asn1_template_noexp_d2i(val, in, inlen,
+                                                                tt, opt, ctx);
 
         *in = p;
         return 1;
@@ -476,98 +613,145 @@ static int asn1_template_ex_d2i(ASN1_VALUE **val, unsigned char **in, long inlen
         ASN1_template_free(val, tt);
         *val = NULL;
         return 0;
-}
+        }
 
-static int asn1_template_noexp_d2i(ASN1_VALUE **val, unsigned char **in, long len, const ASN1_TEMPLATE *tt, char opt, ASN1_TLC *ctx)
-{
+static int asn1_template_noexp_d2i(ASN1_VALUE **val,
+                                const unsigned char **in, long len,
+                                const ASN1_TEMPLATE *tt, char opt,
+                                ASN1_TLC *ctx)
+        {
         int flags, aclass;
         int ret;
-        unsigned char *p, *q;
-        if(!val) return 0;
+        const unsigned char *p, *q;
+        if (!val)
+                return 0;
         flags = tt->flags;
         aclass = flags & ASN1_TFLG_TAG_CLASS;
 
         p = *in;
         q = p;
 
-        if(flags & ASN1_TFLG_SK_MASK) {
+        if (flags & ASN1_TFLG_SK_MASK)
+                {
                 /* SET OF, SEQUENCE OF */
                 int sktag, skaclass;
                 char sk_eoc;
                 /* First work out expected inner tag value */
-                if(flags & ASN1_TFLG_IMPTAG) {
+                if (flags & ASN1_TFLG_IMPTAG)
+                        {
                         sktag = tt->tag;
                         skaclass = aclass;
-                } else {
+                        }
+                else
+                        {
                         skaclass = V_ASN1_UNIVERSAL;
-                        if(flags & ASN1_TFLG_SET_OF) sktag = V_ASN1_SET;
-                        else sktag = V_ASN1_SEQUENCE;
-                }
+                        if (flags & ASN1_TFLG_SET_OF)
+                                sktag = V_ASN1_SET;
+                        else
+                                sktag = V_ASN1_SEQUENCE;
+                        }
                 /* Get the tag */
-                ret = asn1_check_tlen(&len, NULL, NULL, &sk_eoc, NULL, &p, len, sktag, skaclass, opt, ctx);
-                if(!ret) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
+                ret = asn1_check_tlen(&len, NULL, NULL, &sk_eoc, NULL,
+                                        &p, len, sktag, skaclass, opt, ctx);
+                if (!ret)
+                        {
+                        ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
+                                                ERR_R_NESTED_ASN1_ERROR);
                         return 0;
-                } else if(ret == -1) return -1;
-                if(!*val) *val = (ASN1_VALUE *)sk_new_null();
-                else {
+                        }
+                else if (ret == -1)
+                        return -1;
+                if (!*val)
+                        *val = (ASN1_VALUE *)sk_new_null();
+                else
+                        {
                         /* We've got a valid STACK: free up any items present */
                         STACK *sktmp = (STACK *)*val;
                         ASN1_VALUE *vtmp;
-                        while(sk_num(sktmp) > 0) {
+                        while(sk_num(sktmp) > 0)
+                                {
                                 vtmp = (ASN1_VALUE *)sk_pop(sktmp);
-                                ASN1_item_ex_free(&vtmp, ASN1_ITEM_ptr(tt->item));
+                                ASN1_item_ex_free(&vtmp,
+                                                ASN1_ITEM_ptr(tt->item));
+                                }
                         }
-                }
                                 
-                if(!*val) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I, ERR_R_MALLOC_FAILURE);
+                if (!*val)
+                        {
+                        ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
+                                                ERR_R_MALLOC_FAILURE);
                         goto err;
-                }
+                        }
+
                 /* Read as many items as we can */
-                while(len > 0) {
+                while(len > 0)
+                        {
                         ASN1_VALUE *skfield;
                         q = p;
                         /* See if EOC found */
-                        if(asn1_check_eoc(&p, len)) {
-                                if(!sk_eoc) {
-                                        ASN1err(ASN1_F_ASN1_TEMPLATE_D2I, ASN1_R_UNEXPECTED_EOC);
+                        if (asn1_check_eoc(&p, len))
+                                {
+                                if (!sk_eoc)
+                                        {
+                                        ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
+                                                        ASN1_R_UNEXPECTED_EOC);
                                         goto err;
-                                }
+                                        }
                                 len -= p - q;
                                 sk_eoc = 0;
                                 break;
-                        }
+                                }
                         skfield = NULL;
-                        if(!ASN1_item_ex_d2i(&skfield, &p, len, ASN1_ITEM_ptr(tt->item), -1, 0, 0, ctx)) {
-                                ASN1err(ASN1_F_ASN1_TEMPLATE_D2I, ERR_R_NESTED_ASN1_ERROR);
+                        if (!ASN1_item_ex_d2i(&skfield, &p, len,
+                                                ASN1_ITEM_ptr(tt->item),
+                                                -1, 0, 0, ctx))
+                                {
+                                ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
+                                        ERR_R_NESTED_ASN1_ERROR);
                                 goto err;
-                        }
+                                }
                         len -= p - q;
-                        if(!sk_push((STACK *)*val, (char *)skfield)) {
-                                ASN1err(ASN1_F_ASN1_TEMPLATE_D2I, ERR_R_MALLOC_FAILURE);
+                        if (!sk_push((STACK *)*val, (char *)skfield))
+                                {
+                                ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
+                                                ERR_R_MALLOC_FAILURE);
                                 goto err;
+                                }
                         }
-                }
-                if(sk_eoc) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_D2I, ASN1_R_MISSING_EOC);
+                if (sk_eoc)
+                        {
+                        ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ASN1_R_MISSING_EOC);
                         goto err;
+                        }
                 }
-        } else if(flags & ASN1_TFLG_IMPTAG) {
+        else if (flags & ASN1_TFLG_IMPTAG)
+                {
                 /* IMPLICIT tagging */
-                ret = ASN1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item), tt->tag, aclass, opt, ctx);
-                if(!ret) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_D2I, ERR_R_NESTED_ASN1_ERROR);
+                ret = ASN1_item_ex_d2i(val, &p, len,
+                        ASN1_ITEM_ptr(tt->item), tt->tag, aclass, opt, ctx);
+                if (!ret)
+                        {
+                        ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
+                                                ERR_R_NESTED_ASN1_ERROR);
                         goto err;
-                } else if(ret == -1) return -1;
-        } else {
+                        }
+                else if (ret == -1)
+                        return -1;
+                }
+        else
+                {
                 /* Nothing special */
-                ret = ASN1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item), -1, 0, opt, ctx);
-                if(!ret) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_D2I, ERR_R_NESTED_ASN1_ERROR);
+                ret = ASN1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item),
+                                                        -1, 0, opt, ctx);
+                if (!ret)
+                        {
+                        ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
+                                        ERR_R_NESTED_ASN1_ERROR);
                         goto err;
-                } else if(ret == -1) return -1;
-        }
+                        }
+                else if (ret == -1)
+                        return -1;
+                }
 
         *in = p;
         return 1;
@@ -576,85 +760,115 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val, unsigned char **in, long le
         ASN1_template_free(val, tt);
         *val = NULL;
         return 0;
-}
+        }
 
-static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, unsigned char **in, long inlen, 
-                                                const ASN1_ITEM *it,
-                                                int tag, int aclass, char opt, ASN1_TLC *ctx)
-{
+static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
+                                const unsigned char **in, long inlen, 
+                                const ASN1_ITEM *it,
+                                int tag, int aclass, char opt, ASN1_TLC *ctx)
+        {
         int ret = 0, utype;
         long plen;
         char cst, inf, free_cont = 0;
-        unsigned char *p;
+        const unsigned char *p;
         BUF_MEM buf;
-        unsigned char *cont = NULL;
+        const unsigned char *cont = NULL;
         long len; 
-        if(!pval) {
+        if (!pval)
+                {
                 ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_ILLEGAL_NULL);
                 return 0; /* Should never happen */
-        }
+                }
 
-        if(it->itype == ASN1_ITYPE_MSTRING) {
+        if (it->itype == ASN1_ITYPE_MSTRING)
+                {
                 utype = tag;
                 tag = -1;
-        } else utype = it->utype;
+                }
+        else
+                utype = it->utype;
 
-        if(utype == V_ASN1_ANY) {
+        if (utype == V_ASN1_ANY)
+                {
                 /* If type is ANY need to figure out type from tag */
                 unsigned char oclass;
-                if(tag >= 0) {
-                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_ILLEGAL_TAGGED_ANY);
+                if (tag >= 0)
+                        {
+                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
+                                        ASN1_R_ILLEGAL_TAGGED_ANY);
                         return 0;
-                }
-                if(opt) {
-                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_ILLEGAL_OPTIONAL_ANY);
+                        }
+                if (opt)
+                        {
+                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
+                                        ASN1_R_ILLEGAL_OPTIONAL_ANY);
                         return 0;
-                }
+                        }
                 p = *in;
-                ret = asn1_check_tlen(NULL, &utype, &oclass, NULL, NULL, &p, inlen, -1, 0, 0, ctx);
-                if(!ret) {
-                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR);
+                ret = asn1_check_tlen(NULL, &utype, &oclass, NULL, NULL,
+                                        &p, inlen, -1, 0, 0, ctx);
+                if (!ret)
+                        {
+                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
+                                        ERR_R_NESTED_ASN1_ERROR);
                         return 0;
+                        }
+                if (oclass != V_ASN1_UNIVERSAL)
+                        utype = V_ASN1_OTHER;
                 }
-                if(oclass != V_ASN1_UNIVERSAL) utype = V_ASN1_OTHER;
-        }
-        if(tag == -1) {
+        if (tag == -1)
+                {
                 tag = utype;
                 aclass = V_ASN1_UNIVERSAL;
-        }
+                }
         p = *in;
         /* Check header */
-        ret = asn1_check_tlen(&plen, NULL, NULL, &inf, &cst, &p, inlen, tag, aclass, opt, ctx);
-        if(!ret) {
+        ret = asn1_check_tlen(&plen, NULL, NULL, &inf, &cst,
+                                &p, inlen, tag, aclass, opt, ctx);
+        if (!ret)
+                {
                 ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR);
                 return 0;
-        } else if(ret == -1) return -1;
-
-        ret = 0;
+                }
+        else if (ret == -1)
+                return -1;
+        ret = 0;
         /* SEQUENCE, SET and "OTHER" are left in encoded form */
-        if((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER)) {
-                /* Clear context cache for type OTHER because the auto clear when
-                 * we have a exact match wont work
+        if ((utype == V_ASN1_SEQUENCE)
+                || (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER))
+                {
+                /* Clear context cache for type OTHER because the auto clear
+                 * when we have a exact match wont work
                  */
-                if(utype == V_ASN1_OTHER) {
+                if (utype == V_ASN1_OTHER)
+                        {
                         asn1_tlc_clear(ctx);
+                        }
                 /* SEQUENCE and SET must be constructed */
-                } else if(!cst) {
-                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_TYPE_NOT_CONSTRUCTED);
+                else if (!cst)
+                        {
+                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
+                                ASN1_R_TYPE_NOT_CONSTRUCTED);
                         return 0;
-                }
+                        }
 
                 cont = *in;
                 /* If indefinite length constructed find the real end */
-                if(inf) {
-                        if(!asn1_find_end(&p, plen, inf)) goto err;
+                if (inf)
+                        {
+                        if (!asn1_find_end(&p, plen, inf))
+                                 goto err;
                         len = p - cont;
-                } else {
+                        }
+                else
+                        {
                         len = p - cont + plen;
                         p += plen;
                         buf.data = NULL;
+                        }
                 }
-        } else if(cst) {
+        else if (cst)
+                {
                 buf.length = 0;
                 buf.max = 0;
                 buf.data = NULL;
@@ -664,36 +878,46 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, unsigned char **in, long inl
                  * internally irrespective of the type. So instead just check
                  * for UNIVERSAL class and ignore the tag.
                  */
-                if(!asn1_collect(&buf, &p, plen, inf, -1, V_ASN1_UNIVERSAL)) goto err;
+                if (!asn1_collect(&buf, &p, plen, inf, -1, V_ASN1_UNIVERSAL))
+                        {
+                        free_cont = 1;
+                        goto err;
+                        }
                 len = buf.length;
                 /* Append a final null to string */
-                if(!BUF_MEM_grow_clean(&buf, len + 1)) {
-                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_MALLOC_FAILURE);
+                if (!BUF_MEM_grow_clean(&buf, len + 1))
+                        {
+                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
+                                                ERR_R_MALLOC_FAILURE);
                         return 0;
-                }
+                        }
                 buf.data[len] = 0;
-                cont = (unsigned char *)buf.data;
+                cont = (const unsigned char *)buf.data;
                 free_cont = 1;
-        } else {
+                }
+        else
+                {
                 cont = p;
                 len = plen;
                 p += plen;
-        }
+                }
 
         /* We now have content length and type: translate into a structure */
-        if(!asn1_ex_c2i(pval, cont, len, utype, &free_cont, it)) goto err;
+        if (!asn1_ex_c2i(pval, cont, len, utype, &free_cont, it))
+                goto err;
 
         *in = p;
         ret = 1;
         err:
-        if(free_cont && buf.data) OPENSSL_free(buf.data);
+        if (free_cont && buf.data) OPENSSL_free(buf.data);
         return ret;
-}
+        }
 
 /* Translate ASN1 content octets into a structure */
 
-int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it)
-{
+int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
+                        int utype, char *free_cont, const ASN1_ITEM *it)
+        {
         ASN1_VALUE **opval = NULL;
         ASN1_STRING *stmp;
         ASN1_TYPE *typ = NULL;
@@ -701,43 +925,62 @@ int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char
         const ASN1_PRIMITIVE_FUNCS *pf;
         ASN1_INTEGER **tint;
         pf = it->funcs;
-        if(pf && pf->prim_c2i) return pf->prim_c2i(pval, cont, len, utype, free_cont, it);
+
+        if (pf && pf->prim_c2i)
+                return pf->prim_c2i(pval, cont, len, utype, free_cont, it);
         /* If ANY type clear type and set pointer to internal value */
-        if(it->utype == V_ASN1_ANY) {
-                if(!*pval) {
+        if (it->utype == V_ASN1_ANY)
+                {
+                if (!*pval)
+                        {
                         typ = ASN1_TYPE_new();
+                        if (typ == NULL)
+                                goto err;
                         *pval = (ASN1_VALUE *)typ;
-                } else typ = (ASN1_TYPE *)*pval;
-                if(utype != typ->type) ASN1_TYPE_set(typ, utype, NULL);
+                        }
+                else
+                        typ = (ASN1_TYPE *)*pval;
+
+                if (utype != typ->type)
+                        ASN1_TYPE_set(typ, utype, NULL);
                 opval = pval;
-                pval = (ASN1_VALUE **)&typ->value.ptr;
-        }
-        switch(utype) {
+                pval = &typ->value.asn1_value;
+                }
+        switch(utype)
+                {
                 case V_ASN1_OBJECT:
-                if(!c2i_ASN1_OBJECT((ASN1_OBJECT **)pval, &cont, len)) goto err;
+                if (!c2i_ASN1_OBJECT((ASN1_OBJECT **)pval, &cont, len))
+                        goto err;
                 break;
 
                 case V_ASN1_NULL:
-                if(len) {
-                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_NULL_IS_WRONG_LENGTH);
+                if (len)
+                        {
+                        ASN1err(ASN1_F_ASN1_EX_C2I,
+                                                ASN1_R_NULL_IS_WRONG_LENGTH);
                         goto err;
-                }
+                        }
                 *pval = (ASN1_VALUE *)1;
                 break;
 
                 case V_ASN1_BOOLEAN:
-                if(len != 1) {
-                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_BOOLEAN_IS_WRONG_LENGTH);
+                if (len != 1)
+                        {
+                        ASN1err(ASN1_F_ASN1_EX_C2I,
+                                                ASN1_R_BOOLEAN_IS_WRONG_LENGTH);
                         goto err;
-                } else {
+                        }
+                else
+                        {
                         ASN1_BOOLEAN *tbool;
                         tbool = (ASN1_BOOLEAN *)pval;
                         *tbool = *cont;
-                }
+                        }
                 break;
 
                 case V_ASN1_BIT_STRING:
-                if(!c2i_ASN1_BIT_STRING((ASN1_BIT_STRING **)pval, &cont, len)) goto err;
+                if (!c2i_ASN1_BIT_STRING((ASN1_BIT_STRING **)pval, &cont, len))
+                        goto err;
                 break;
 
                 case V_ASN1_INTEGER:
@@ -745,7 +988,8 @@ int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char
                 case V_ASN1_ENUMERATED:
                 case V_ASN1_NEG_ENUMERATED:
                 tint = (ASN1_INTEGER **)pval;
-                if(!c2i_ASN1_INTEGER(tint, &cont, len)) goto err;
+                if (!c2i_ASN1_INTEGER(tint, &cont, len))
+                        goto err;
                 /* Fixup type to match the expected form */
                 (*tint)->type = utype | ((*tint)->type & V_ASN1_NEG);
                 break;
@@ -769,46 +1013,59 @@ int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char
                 case V_ASN1_SEQUENCE:
                 default:
                 /* All based on ASN1_STRING and handled the same */
-                if(!*pval) {
+                if (!*pval)
+                        {
                         stmp = ASN1_STRING_type_new(utype);
-                        if(!stmp) {
-                                ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_MALLOC_FAILURE);
+                        if (!stmp)
+                                {
+                                ASN1err(ASN1_F_ASN1_EX_C2I,
+                                                        ERR_R_MALLOC_FAILURE);
                                 goto err;
-                        }
+                                }
                         *pval = (ASN1_VALUE *)stmp;
-                } else {
+                        }
+                else
+                        {
                         stmp = (ASN1_STRING *)*pval;
                         stmp->type = utype;
-                }
+                        }
                 /* If we've already allocated a buffer use it */
-                if(*free_cont) {
-                        if(stmp->data) OPENSSL_free(stmp->data);
-                        stmp->data = cont;
+                if (*free_cont)
+                        {
+                        if (stmp->data)
+                                OPENSSL_free(stmp->data);
+                        stmp->data = (unsigned char *)cont; /* UGLY CAST! RL */
                         stmp->length = len;
                         *free_cont = 0;
-                } else {
-                        if(!ASN1_STRING_set(stmp, cont, len)) {
-                                ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_MALLOC_FAILURE);
+                        }
+                else
+                        {
+                        if (!ASN1_STRING_set(stmp, cont, len))
+                                {
+                                ASN1err(ASN1_F_ASN1_EX_C2I,
+                                                        ERR_R_MALLOC_FAILURE);
                                 ASN1_STRING_free(stmp); 
                                 *pval = NULL;
                                 goto err;
+                                }
                         }
-                }
                 break;
-        }
+                }
         /* If ASN1_ANY and NULL type fix up value */
-        if(typ && utype==V_ASN1_NULL) typ->value.ptr = NULL;
+        if (typ && (utype == V_ASN1_NULL))
+                 typ->value.ptr = NULL;
 
         ret = 1;
         err:
-        if(!ret)
+        if (!ret)
                 {
                 ASN1_TYPE_free(typ);
                 if (opval)
                         *opval = NULL;
                 }
         return ret;
-}
+        }
+
 
 /* This function finds the end of an ASN1 structure when passed its maximum
  * length, whether it is indefinite length and a pointer to the content.
@@ -816,11 +1073,11 @@ int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char
  * recurse on each indefinite length header.
  */
 
-static int asn1_find_end(unsigned char **in, long len, char inf)
+static int asn1_find_end(const unsigned char **in, long len, char inf)
         {
         int expected_eoc;
         long plen;
-        unsigned char *p = *in, *q;
+        const unsigned char *p = *in, *q;
         /* If not indefinite length constructed just add length */
         if (inf == 0)
                 {
@@ -830,7 +1087,7 @@ static int asn1_find_end(unsigned char **in, long len, char inf)
         expected_eoc = 1;
         /* Indefinite length constructed form. Find the end when enough EOCs
          * are found. If more indefinite length constructed headers
-         * are encountered increment the expected eoc count otherwise justi
+         * are encountered increment the expected eoc count otherwise just
          * skip to the end of the data.
          */
         while (len > 0)
@@ -865,38 +1122,55 @@ static int asn1_find_end(unsigned char **in, long len, char inf)
         *in = p;
         return 1;
         }
-
 /* This function collects the asn1 data from a constructred string
  * type into a buffer. The values of 'in' and 'len' should refer
  * to the contents of the constructed type and 'inf' should be set
  * if it is indefinite length.
  */
 
-static int asn1_collect(BUF_MEM *buf, unsigned char **in, long len, char inf, int tag, int aclass)
-{
-        unsigned char *p, *q;
+static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
+                                char inf, int tag, int aclass)
+        {
+        const unsigned char *p, *q;
         long plen;
         char cst, ininf;
         p = *in;
         inf &= 1;
-        while(len > 0) {
+        /* If no buffer and not indefinite length constructed just pass over
+         * the encoded data */
+        if (!buf && !inf)
+                {
+                *in += len;
+                return 1;
+                }
+        while(len > 0)
+                {
                 q = p;
                 /* Check for EOC */
-                if(asn1_check_eoc(&p, len)) {
-                        /* EOC is illegal outside indefinite length constructed form */
-                        if(!inf) {
-                                ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_UNEXPECTED_EOC);
+                if (asn1_check_eoc(&p, len))
+                        {
+                        /* EOC is illegal outside indefinite length
+                         * constructed form */
+                        if (!inf)
+                                {
+                                ASN1err(ASN1_F_ASN1_COLLECT,
+                                        ASN1_R_UNEXPECTED_EOC);
                                 return 0;
-                        }
+                                }
                         inf = 0;
                         break;
-                }
-                if(!asn1_check_tlen(&plen, NULL, NULL, &ininf, &cst, &p, len, tag, aclass, 0, NULL)) {
+                        }
+
+                if (!asn1_check_tlen(&plen, NULL, NULL, &ininf, &cst, &p,
+                                        len, tag, aclass, 0, NULL))
+                        {
                         ASN1err(ASN1_F_ASN1_COLLECT, ERR_R_NESTED_ASN1_ERROR);
                         return 0;
-                }
+                        }
+
                 /* If indefinite length constructed update max length */
-                if(cst) {
+                if (cst)
+                        {
 #ifdef OPENSSL_ALLOW_NESTED_ASN1_STRINGS
                         if (!asn1_collect(buf, &p, plen, ininf, tag, aclass))
                                 return 0;
@@ -904,47 +1178,51 @@ static int asn1_collect(BUF_MEM *buf, unsigned char **in, long len, char inf, in
                         ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_NESTED_ASN1_STRING);
                         return 0;
 #endif
-                } else {
-                        if(plen && !collect_data(buf, &p, plen)) return 0;
-                }
+                        }
+                else if (plen && !collect_data(buf, &p, plen))
+                        return 0;
                 len -= p - q;
-        }
-        if(inf) {
+                }
+        if (inf)
+                {
                 ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_MISSING_EOC);
                 return 0;
-        }
+                }
         *in = p;
         return 1;
-}
-
-static int collect_data(BUF_MEM *buf, unsigned char **p, long plen)
-{
-                int len;
-                if(buf) {
-                        len = buf->length;
-                        if(!BUF_MEM_grow_clean(buf, len + plen)) {
-                                ASN1err(ASN1_F_COLLECT_DATA, ERR_R_MALLOC_FAILURE);
-                                return 0;
+        }
+
+static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen)
+        {
+        int len;
+        if (buf)
+                {
+                len = buf->length;
+                if (!BUF_MEM_grow_clean(buf, len + plen))
+                        {
+                        ASN1err(ASN1_F_COLLECT_DATA, ERR_R_MALLOC_FAILURE);
+                        return 0;
                         }
-                        memcpy(buf->data + len, *p, plen);
+                memcpy(buf->data + len, *p, plen);
                 }
-                *p += plen;
-                return 1;
-}
+        *p += plen;
+        return 1;
+        }
 
 /* Check for ASN1 EOC and swallow it if found */
 
-static int asn1_check_eoc(unsigned char **in, long len)
-{
-        unsigned char *p;
-        if(len < 2) return 0;
+static int asn1_check_eoc(const unsigned char **in, long len)
+        {
+        const unsigned char *p;
+        if (len < 2) return 0;
         p = *in;
-        if(!p[0] && !p[1]) {
+        if (!p[0] && !p[1])
+                {
                 *in += 2;
                 return 1;
-        }
+                }
         return 0;
-}
+        }
 
 /* Check an ASN1 tag and length: a bit like ASN1_get_object
  * but it sets the length for indefinite length constructed
@@ -953,25 +1231,32 @@ static int asn1_check_eoc(unsigned char **in, long len)
  * header length just read.
  */
 
-static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass, char *inf, char *cst,
-                unsigned char **in, long len, int exptag, int expclass, char opt, ASN1_TLC *ctx)
-{
+static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
+                                char *inf, char *cst,
+                                const unsigned char **in, long len,
+                                int exptag, int expclass, char opt,
+                                ASN1_TLC *ctx)
+        {
         int i;
         int ptag, pclass;
         long plen;
-        unsigned char *p, *q;
+        const unsigned char *p, *q;
         p = *in;
         q = p;
 
-        if(ctx && ctx->valid) {
+        if (ctx && ctx->valid)
+                {
                 i = ctx->ret;
                 plen = ctx->plen;
                 pclass = ctx->pclass;
                 ptag = ctx->ptag;
                 p += ctx->hdrlen;
-        } else {
+                }
+        else
+                {
                 i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
-                if(ctx) {
+                if (ctx)
+                        {
                         ctx->ret = i;
                         ctx->plen = plen;
                         ctx->pclass = pclass;
@@ -981,43 +1266,57 @@ static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass, char *i
                         /* If definite length, and no error, length +
                          * header can't exceed total amount of data available. 
                          */
-                        if(!(i & 0x81) && ((plen + ctx->hdrlen) > len)) {
-                                ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_TOO_LONG);
+                        if (!(i & 0x81) && ((plen + ctx->hdrlen) > len))
+                                {
+                                ASN1err(ASN1_F_ASN1_CHECK_TLEN,
+                                                        ASN1_R_TOO_LONG);
                                 asn1_tlc_clear(ctx);
                                 return 0;
+                                }
                         }
                 }
-        }
 
-        if(i & 0x80) {
+        if (i & 0x80)
+                {
                 ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_BAD_OBJECT_HEADER);
                 asn1_tlc_clear(ctx);
                 return 0;
-        }
-        if(exptag >= 0) {
-                if((exptag != ptag) || (expclass != pclass)) {
-                        /* If type is OPTIONAL, not an error, but indicate missing
-                         * type.
+                }
+        if (exptag >= 0)
+                {
+                if ((exptag != ptag) || (expclass != pclass))
+                        {
+                        /* If type is OPTIONAL, not an error:
+                         * indicate missing type.
                          */
-                        if(opt) return -1;
+                        if (opt) return -1;
                         asn1_tlc_clear(ctx);
                         ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_WRONG_TAG);
                         return 0;
-                }
-                /* We have a tag and class match, so assume we are going to do something with it */
+                        }
+                /* We have a tag and class match:
+                 * assume we are going to do something with it */
                 asn1_tlc_clear(ctx);
-        }
+                }
+
+        if (i & 1)
+                plen = len - (p - q);
 
-        if(i & 1) plen = len - (p - q);
+        if (inf)
+                *inf = i & 1;
 
-        if(inf) *inf = i & 1;
+        if (cst)
+                *cst = i & V_ASN1_CONSTRUCTED;
 
-        if(cst) *cst = i & V_ASN1_CONSTRUCTED;
+        if (olen)
+                *olen = plen;
 
-        if(olen) *olen = plen;
-        if(oclass) *oclass = pclass;
-        if(otag) *otag = ptag;
+        if (oclass)
+                *oclass = pclass;
+
+        if (otag)
+                *otag = ptag;
 
         *in = p;
         return 1;
-}
+        }
diff --git a/src/lib/libssl/src/crypto/asn1/tasn_enc.c b/src/lib/libssl/src/crypto/asn1/tasn_enc.c
index c675c3c832..be19b36acd 100644
--- a/src/lib/libssl/src/crypto/asn1/tasn_enc.c
+++ b/src/lib/libssl/src/crypto/asn1/tasn_enc.c
@@ -3,7 +3,7 @@
  * project 2000.
  */
 /* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -59,88 +59,119 @@
 
 #include <stddef.h>
 #include <string.h>
+#include "cryptlib.h"
 #include <openssl/asn1.h>
 #include <openssl/asn1t.h>
 #include <openssl/objects.h>
 
-static int asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it, int tag, int aclass);
-static int asn1_set_seq_out(STACK_OF(ASN1_VALUE) *seq, unsigned char **out, int skcontlen, const ASN1_ITEM *item, int isset);
+static int asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out,
+                                        const ASN1_ITEM *it,
+                                        int tag, int aclass);
+static int asn1_set_seq_out(STACK_OF(ASN1_VALUE) *sk, unsigned char **out,
+                                        int skcontlen, const ASN1_ITEM *item,
+                                        int do_sort, int iclass);
+static int asn1_template_ex_i2d(ASN1_VALUE **pval, unsigned char **out,
+                                        const ASN1_TEMPLATE *tt,
+                                        int tag, int aclass);
+static int asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out,
+                                        const ASN1_ITEM *it, int flags);
+
+/* Top level i2d equivalents: the 'ndef' variant instructs the encoder
+ * to use indefinite length constructed encoding, where appropriate
+ */
+
+int ASN1_item_ndef_i2d(ASN1_VALUE *val, unsigned char **out,
+                                                const ASN1_ITEM *it)
+        {
+        return asn1_item_flags_i2d(val, out, it, ASN1_TFLG_NDEF);
+        }
+
+int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
+        {
+        return asn1_item_flags_i2d(val, out, it, 0);
+        }
 
-/* Encode an ASN1 item, this is compatible with the
+/* Encode an ASN1 item, this is use by the
  * standard 'i2d' function. 'out' points to 
- * a buffer to output the data to, in future we will
- * have more advanced versions that can output data
- * a piece at a time and this will simply be a special
- * case.
+ * a buffer to output the data to.
  *
  * The new i2d has one additional feature. If the output
  * buffer is NULL (i.e. *out == NULL) then a buffer is
  * allocated and populated with the encoding.
  */
 
-
-int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
-{
-        if(out && !*out) {
+static int asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out,
+                                        const ASN1_ITEM *it, int flags)
+        {
+        if (out && !*out)
+                {
                 unsigned char *p, *buf;
                 int len;
-                len = ASN1_item_ex_i2d(&val, NULL, it, -1, 0);
-                if(len <= 0) return len;
+                len = ASN1_item_ex_i2d(&val, NULL, it, -1, flags);
+                if (len <= 0)
+                        return len;
                 buf = OPENSSL_malloc(len);
-                if(!buf) return -1;
+                if (!buf)
+                        return -1;
                 p = buf;
-                ASN1_item_ex_i2d(&val, &p, it, -1, 0);
+                ASN1_item_ex_i2d(&val, &p, it, -1, flags);
                 *out = buf;
                 return len;
+                }
+
+        return ASN1_item_ex_i2d(&val, out, it, -1, flags);
         }
-                
-        return ASN1_item_ex_i2d(&val, out, it, -1, 0);
-}
 
 /* Encode an item, taking care of IMPLICIT tagging (if any).
  * This function performs the normal item handling: it can be
  * used in external types.
  */
 
-int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it, int tag, int aclass)
-{
+int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out,
+                        const ASN1_ITEM *it, int tag, int aclass)
+        {
         const ASN1_TEMPLATE *tt = NULL;
         unsigned char *p = NULL;
-        int i, seqcontlen, seqlen;
-        ASN1_STRING *strtmp;
+        int i, seqcontlen, seqlen, ndef = 1;
         const ASN1_COMPAT_FUNCS *cf;
         const ASN1_EXTERN_FUNCS *ef;
         const ASN1_AUX *aux = it->funcs;
-        ASN1_aux_cb *asn1_cb;
-        if((it->itype != ASN1_ITYPE_PRIMITIVE) && !*pval) return 0;
-        if(aux && aux->asn1_cb) asn1_cb = aux->asn1_cb;
-        else asn1_cb = 0;
+        ASN1_aux_cb *asn1_cb = 0;
+
+        if ((it->itype != ASN1_ITYPE_PRIMITIVE) && !*pval)
+                return 0;
 
-        switch(it->itype) {
+        if (aux && aux->asn1_cb)
+                 asn1_cb = aux->asn1_cb;
+
+        switch(it->itype)
+                {
 
                 case ASN1_ITYPE_PRIMITIVE:
-                if(it->templates)
-                        return ASN1_template_i2d(pval, out, it->templates);
+                if (it->templates)
+                        return asn1_template_ex_i2d(pval, out, it->templates,
+                                                                tag, aclass);
                 return asn1_i2d_ex_primitive(pval, out, it, tag, aclass);
                 break;
 
                 case ASN1_ITYPE_MSTRING:
-                strtmp = (ASN1_STRING *)*pval;
-                return asn1_i2d_ex_primitive(pval, out, it, -1, 0);
+                return asn1_i2d_ex_primitive(pval, out, it, -1, aclass);
 
                 case ASN1_ITYPE_CHOICE:
-                if(asn1_cb && !asn1_cb(ASN1_OP_I2D_PRE, pval, it))
+                if (asn1_cb && !asn1_cb(ASN1_OP_I2D_PRE, pval, it))
                                 return 0;
                 i = asn1_get_choice_selector(pval, it);
-                if((i >= 0) && (i < it->tcount)) {
+                if ((i >= 0) && (i < it->tcount))
+                        {
                         ASN1_VALUE **pchval;
                         const ASN1_TEMPLATE *chtt;
                         chtt = it->templates + i;
                         pchval = asn1_get_field_ptr(pval, chtt);
-                        return ASN1_template_i2d(pchval, out, chtt);
-                } 
+                        return asn1_template_ex_i2d(pchval, out, chtt,
+                                                                -1, aclass);
+                        }
                 /* Fixme: error condition if selector out of range */
-                if(asn1_cb && !asn1_cb(ASN1_OP_I2D_POST, pval, it))
+                if (asn1_cb && !asn1_cb(ASN1_OP_I2D_POST, pval, it))
                                 return 0;
                 break;
 
@@ -152,136 +183,236 @@ int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it
                 case ASN1_ITYPE_COMPAT:
                 /* old style hackery... */
                 cf = it->funcs;
-                if(out) p = *out;
+                if (out)
+                        p = *out;
                 i = cf->asn1_i2d(*pval, out);
                 /* Fixup for IMPLICIT tag: note this messes up for tags > 30,
                  * but so did the old code. Tags > 30 are very rare anyway.
                  */
-                if(out && (tag != -1))
+                if (out && (tag != -1))
                         *p = aclass | tag | (*p & V_ASN1_CONSTRUCTED);
                 return i;
                 
+                case ASN1_ITYPE_NDEF_SEQUENCE:
+                /* Use indefinite length constructed if requested */
+                if (aclass & ASN1_TFLG_NDEF) ndef = 2;
+                /* fall through */
+
                 case ASN1_ITYPE_SEQUENCE:
                 i = asn1_enc_restore(&seqcontlen, out, pval, it);
                 /* An error occurred */
-                if(i < 0) return 0;
+                if (i < 0)
+                        return 0;
                 /* We have a valid cached encoding... */
-                if(i > 0) return seqcontlen;
+                if (i > 0)
+                        return seqcontlen;
                 /* Otherwise carry on */
                 seqcontlen = 0;
                 /* If no IMPLICIT tagging set to SEQUENCE, UNIVERSAL */
-                if(tag == -1) {
+                if (tag == -1)
+                        {
                         tag = V_ASN1_SEQUENCE;
-                        aclass = V_ASN1_UNIVERSAL;
-                }
-                if(asn1_cb && !asn1_cb(ASN1_OP_I2D_PRE, pval, it))
+                        /* Retain any other flags in aclass */
+                        aclass = (aclass & ~ASN1_TFLG_TAG_CLASS)
+                                        | V_ASN1_UNIVERSAL;
+                        }
+                if (asn1_cb && !asn1_cb(ASN1_OP_I2D_PRE, pval, it))
                                 return 0;
                 /* First work out sequence content length */
-                for(i = 0, tt = it->templates; i < it->tcount; tt++, i++) {
+                for (i = 0, tt = it->templates; i < it->tcount; tt++, i++)
+                        {
                         const ASN1_TEMPLATE *seqtt;
                         ASN1_VALUE **pseqval;
                         seqtt = asn1_do_adb(pval, tt, 1);
-                        if(!seqtt) return 0;
+                        if (!seqtt)
+                                return 0;
                         pseqval = asn1_get_field_ptr(pval, seqtt);
                         /* FIXME: check for errors in enhanced version */
-                        /* FIXME: special handling of indefinite length encoding */
-                        seqcontlen += ASN1_template_i2d(pseqval, NULL, seqtt);
-                }
-                seqlen = ASN1_object_size(1, seqcontlen, tag);
-                if(!out) return seqlen;
+                        seqcontlen += asn1_template_ex_i2d(pseqval, NULL, seqtt,
+                                                                -1, aclass);
+                        }
+
+                seqlen = ASN1_object_size(ndef, seqcontlen, tag);
+                if (!out)
+                        return seqlen;
                 /* Output SEQUENCE header */
-                ASN1_put_object(out, 1, seqcontlen, tag, aclass);
-                for(i = 0, tt = it->templates; i < it->tcount; tt++, i++) {
+                ASN1_put_object(out, ndef, seqcontlen, tag, aclass);
+                for (i = 0, tt = it->templates; i < it->tcount; tt++, i++)
+                        {
                         const ASN1_TEMPLATE *seqtt;
                         ASN1_VALUE **pseqval;
                         seqtt = asn1_do_adb(pval, tt, 1);
-                        if(!seqtt) return 0;
+                        if (!seqtt)
+                                return 0;
                         pseqval = asn1_get_field_ptr(pval, seqtt);
                         /* FIXME: check for errors in enhanced version */
-                        ASN1_template_i2d(pseqval, out, seqtt);
-                }
-                if(asn1_cb  && !asn1_cb(ASN1_OP_I2D_POST, pval, it))
+                        asn1_template_ex_i2d(pseqval, out, seqtt, -1, aclass);
+                        }
+                if (ndef == 2)
+                        ASN1_put_eoc(out);
+                if (asn1_cb  && !asn1_cb(ASN1_OP_I2D_POST, pval, it))
                                 return 0;
                 return seqlen;
 
                 default:
                 return 0;
-        }
+
+                }
         return 0;
-}
+        }
 
-int ASN1_template_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_TEMPLATE *tt)
-{
-        int i, ret, flags, aclass;
+int ASN1_template_i2d(ASN1_VALUE **pval, unsigned char **out,
+                                                        const ASN1_TEMPLATE *tt)
+        {
+        return asn1_template_ex_i2d(pval, out, tt, -1, 0);
+        }
+
+static int asn1_template_ex_i2d(ASN1_VALUE **pval, unsigned char **out,
+                                const ASN1_TEMPLATE *tt, int tag, int iclass)
+        {
+        int i, ret, flags, ttag, tclass, ndef;
         flags = tt->flags;
-        aclass = flags & ASN1_TFLG_TAG_CLASS;
-        if(flags & ASN1_TFLG_SK_MASK) {
+        /* Work out tag and class to use: tagging may come
+         * either from the template or the arguments, not both
+         * because this would create ambiguity. Additionally
+         * the iclass argument may contain some additional flags
+         * which should be noted and passed down to other levels.
+         */
+        if (flags & ASN1_TFLG_TAG_MASK)
+                {
+                /* Error if argument and template tagging */
+                if (tag != -1)
+                        /* FIXME: error code here */
+                        return -1;
+                /* Get tagging from template */
+                ttag = tt->tag;
+                tclass = flags & ASN1_TFLG_TAG_CLASS;
+                }
+        else if (tag != -1)
+                {
+                /* No template tagging, get from arguments */
+                ttag = tag;
+                tclass = iclass & ASN1_TFLG_TAG_CLASS;
+                }
+        else
+                {
+                ttag = -1;
+                tclass = 0;
+                }
+        /* 
+         * Remove any class mask from iflag.
+         */
+        iclass &= ~ASN1_TFLG_TAG_CLASS;
+
+        /* At this point 'ttag' contains the outer tag to use,
+         * 'tclass' is the class and iclass is any flags passed
+         * to this function.
+         */
+
+        /* if template and arguments require ndef, use it */
+        if ((flags & ASN1_TFLG_NDEF) && (iclass & ASN1_TFLG_NDEF))
+                ndef = 2;
+        else ndef = 1;
+
+        if (flags & ASN1_TFLG_SK_MASK)
+                {
                 /* SET OF, SEQUENCE OF */
                 STACK_OF(ASN1_VALUE) *sk = (STACK_OF(ASN1_VALUE) *)*pval;
                 int isset, sktag, skaclass;
                 int skcontlen, sklen;
                 ASN1_VALUE *skitem;
-                if(!*pval) return 0;
-                if(flags & ASN1_TFLG_SET_OF) {
+
+                if (!*pval)
+                        return 0;
+
+                if (flags & ASN1_TFLG_SET_OF)
+                        {
                         isset = 1;
                         /* 2 means we reorder */
-                        if(flags & ASN1_TFLG_SEQUENCE_OF) isset = 2;
-                } else isset = 0;
-                /* First work out inner tag value */
-                if(flags & ASN1_TFLG_IMPTAG) {
-                        sktag = tt->tag;
-                        skaclass = aclass;
-                } else {
+                        if (flags & ASN1_TFLG_SEQUENCE_OF)
+                                isset = 2;
+                        }
+                else isset = 0;
+
+                /* Work out inner tag value: if EXPLICIT
+                 * or no tagging use underlying type.
+                 */
+                if ((ttag != -1) && !(flags & ASN1_TFLG_EXPTAG))
+                        {
+                        sktag = ttag;
+                        skaclass = tclass;
+                        }
+                else
+                        {
                         skaclass = V_ASN1_UNIVERSAL;
-                        if(isset) sktag = V_ASN1_SET;
+                        if (isset)
+                                sktag = V_ASN1_SET;
                         else sktag = V_ASN1_SEQUENCE;
-                }
-                /* Now work out length of items */
+                        }
+
+                /* Determine total length of items */
                 skcontlen = 0;
-                for(i = 0; i < sk_ASN1_VALUE_num(sk); i++) {
+                for (i = 0; i < sk_ASN1_VALUE_num(sk); i++)
+                        {
                         skitem = sk_ASN1_VALUE_value(sk, i);
-                        skcontlen += ASN1_item_ex_i2d(&skitem, NULL, ASN1_ITEM_ptr(tt->item), -1, 0);
-                }
-                sklen = ASN1_object_size(1, skcontlen, sktag);
+                        skcontlen += ASN1_item_ex_i2d(&skitem, NULL,
+                                                ASN1_ITEM_ptr(tt->item),
+                                                        -1, iclass);
+                        }
+                sklen = ASN1_object_size(ndef, skcontlen, sktag);
                 /* If EXPLICIT need length of surrounding tag */
-                if(flags & ASN1_TFLG_EXPTAG)
-                        ret = ASN1_object_size(1, sklen, tt->tag);
+                if (flags & ASN1_TFLG_EXPTAG)
+                        ret = ASN1_object_size(ndef, sklen, ttag);
                 else ret = sklen;
 
-                if(!out) return ret;
+                if (!out)
+                        return ret;
 
                 /* Now encode this lot... */
                 /* EXPLICIT tag */
-                if(flags & ASN1_TFLG_EXPTAG)
-                        ASN1_put_object(out, 1, sklen, tt->tag, aclass);
+                if (flags & ASN1_TFLG_EXPTAG)
+                        ASN1_put_object(out, ndef, sklen, ttag, tclass);
                 /* SET or SEQUENCE and IMPLICIT tag */
-                ASN1_put_object(out, 1, skcontlen, sktag, skaclass);
-                /* And finally the stuff itself */
-                asn1_set_seq_out(sk, out, skcontlen, ASN1_ITEM_ptr(tt->item), isset);
+                ASN1_put_object(out, ndef, skcontlen, sktag, skaclass);
+                /* And the stuff itself */
+                asn1_set_seq_out(sk, out, skcontlen, ASN1_ITEM_ptr(tt->item),
+                                                                isset, iclass);
+                if (ndef == 2)
+                        {
+                        ASN1_put_eoc(out);
+                        if (flags & ASN1_TFLG_EXPTAG)
+                                ASN1_put_eoc(out);
+                        }
 
                 return ret;
-        }
-                        
-        if(flags & ASN1_TFLG_EXPTAG) {
+                }
+
+        if (flags & ASN1_TFLG_EXPTAG)
+                {
                 /* EXPLICIT tagging */
                 /* Find length of tagged item */
-                i = ASN1_item_ex_i2d(pval, NULL, ASN1_ITEM_ptr(tt->item), -1, 0);
-                if(!i) return 0;
+                i = ASN1_item_ex_i2d(pval, NULL, ASN1_ITEM_ptr(tt->item),
+                                                                -1, iclass);
+                if (!i)
+                        return 0;
                 /* Find length of EXPLICIT tag */
-                ret = ASN1_object_size(1, i, tt->tag);
-                if(out) {
+                ret = ASN1_object_size(ndef, i, ttag);
+                if (out)
+                        {
                         /* Output tag and item */
-                        ASN1_put_object(out, 1, i, tt->tag, aclass);
-                        ASN1_item_ex_i2d(pval, out, ASN1_ITEM_ptr(tt->item), -1, 0);
-                }
+                        ASN1_put_object(out, ndef, i, ttag, tclass);
+                        ASN1_item_ex_i2d(pval, out, ASN1_ITEM_ptr(tt->item),
+                                                                -1, iclass);
+                        if (ndef == 2)
+                                ASN1_put_eoc(out);
+                        }
                 return ret;
-        }
-        if(flags & ASN1_TFLG_IMPTAG) {
-                /* IMPLICIT tagging */
-                return ASN1_item_ex_i2d(pval, out, ASN1_ITEM_ptr(tt->item), tt->tag, aclass);
-        }
-        /* Nothing special: treat as normal */
-        return ASN1_item_ex_i2d(pval, out, ASN1_ITEM_ptr(tt->item), -1, 0);
+                }
+
+        /* Either normal or IMPLICIT tagging: combine class and flags */
+        return ASN1_item_ex_i2d(pval, out, ASN1_ITEM_ptr(tt->item),
+                                                ttag, tclass | iclass);
+
 }
 
 /* Temporary structure used to hold DER encoding of items for SET OF */
@@ -293,72 +424,90 @@ typedef	struct {
 } DER_ENC;
 
 static int der_cmp(const void *a, const void *b)
-{
+        {
         const DER_ENC *d1 = a, *d2 = b;
         int cmplen, i;
         cmplen = (d1->length < d2->length) ? d1->length : d2->length;
         i = memcmp(d1->data, d2->data, cmplen);
-        if(i) return i;
+        if (i)
+                return i;
         return d1->length - d2->length;
-}
+        }
 
 /* Output the content octets of SET OF or SEQUENCE OF */
 
-static int asn1_set_seq_out(STACK_OF(ASN1_VALUE) *sk, unsigned char **out, int skcontlen, const ASN1_ITEM *item, int do_sort)
-{
+static int asn1_set_seq_out(STACK_OF(ASN1_VALUE) *sk, unsigned char **out,
+                                        int skcontlen, const ASN1_ITEM *item,
+                                        int do_sort, int iclass)
+        {
         int i;
         ASN1_VALUE *skitem;
         unsigned char *tmpdat = NULL, *p = NULL;
         DER_ENC *derlst = NULL, *tder;
-        if(do_sort) {
+        if (do_sort)
+                 {
                 /* Don't need to sort less than 2 items */
-                if(sk_ASN1_VALUE_num(sk) < 2) do_sort = 0;
-                else {
-                        derlst = OPENSSL_malloc(sk_ASN1_VALUE_num(sk) * sizeof(*derlst));
+                if (sk_ASN1_VALUE_num(sk) < 2)
+                        do_sort = 0;
+                else
+                        {
+                        derlst = OPENSSL_malloc(sk_ASN1_VALUE_num(sk)
+                                                * sizeof(*derlst));
                         tmpdat = OPENSSL_malloc(skcontlen);
-                        if(!derlst || !tmpdat) return 0;
+                        if (!derlst || !tmpdat)
+                                return 0;
+                        }
                 }
-        }
         /* If not sorting just output each item */
-        if(!do_sort) {
-                for(i = 0; i < sk_ASN1_VALUE_num(sk); i++) {
+        if (!do_sort)
+                {
+                for (i = 0; i < sk_ASN1_VALUE_num(sk); i++)
+                        {
                         skitem = sk_ASN1_VALUE_value(sk, i);
-                        ASN1_item_i2d(skitem, out, item);
-                }
+                        ASN1_item_ex_i2d(&skitem, out, item, -1, iclass);
+                        }
                 return 1;
-        }
+                }
         p = tmpdat;
+
         /* Doing sort: build up a list of each member's DER encoding */
-        for(i = 0, tder = derlst; i < sk_ASN1_VALUE_num(sk); i++, tder++) {
+        for (i = 0, tder = derlst; i < sk_ASN1_VALUE_num(sk); i++, tder++)
+                {
                 skitem = sk_ASN1_VALUE_value(sk, i);
                 tder->data = p;
-                tder->length = ASN1_item_i2d(skitem, &p, item);
+                tder->length = ASN1_item_ex_i2d(&skitem, &p, item, -1, iclass);
                 tder->field = skitem;
-        }
+                }
+
         /* Now sort them */
         qsort(derlst, sk_ASN1_VALUE_num(sk), sizeof(*derlst), der_cmp);
         /* Output sorted DER encoding */        
         p = *out;
-        for(i = 0, tder = derlst; i < sk_ASN1_VALUE_num(sk); i++, tder++) {
+        for (i = 0, tder = derlst; i < sk_ASN1_VALUE_num(sk); i++, tder++)
+                {
                 memcpy(p, tder->data, tder->length);
                 p += tder->length;
-        }
+                }
         *out = p;
         /* If do_sort is 2 then reorder the STACK */
-        if(do_sort == 2) {
-                for(i = 0, tder = derlst; i < sk_ASN1_VALUE_num(sk); i++, tder++)
-                        sk_ASN1_VALUE_set(sk, i, tder->field);
-        }
+        if (do_sort == 2)
+                {
+                for (i = 0, tder = derlst; i < sk_ASN1_VALUE_num(sk);
+                                                        i++, tder++)
+                        (void)sk_ASN1_VALUE_set(sk, i, tder->field);
+                }
         OPENSSL_free(derlst);
         OPENSSL_free(tmpdat);
         return 1;
-}
+        }
 
-static int asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it, int tag, int aclass)
-{
+static int asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out,
+                                const ASN1_ITEM *it, int tag, int aclass)
+        {
         int len;
         int utype;
         int usetag;
+        int ndef = 0;
 
         utype = it->utype;
 
@@ -374,33 +523,48 @@ static int asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out, const A
          * because the call to asn1_ex_i2c() could change
          * utype.
          */
-        if((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) ||
+        if ((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) ||
            (utype == V_ASN1_OTHER))
                 usetag = 0;
         else usetag = 1;
 
         /* -1 means omit type */
 
-        if(len == -1) return 0;
+        if (len == -1)
+                return 0;
+
+        /* -2 return is special meaning use ndef */
+        if (len == -2)
+                {
+                ndef = 2;
+                len = 0;
+                }
 
         /* If not implicitly tagged get tag from underlying type */
-        if(tag == -1) tag = utype;
+        if (tag == -1) tag = utype;
 
         /* Output tag+length followed by content octets */
-        if(out) {
-                if(usetag) ASN1_put_object(out, 0, len, tag, aclass);
+        if (out)
+                {
+                if (usetag)
+                        ASN1_put_object(out, ndef, len, tag, aclass);
                 asn1_ex_i2c(pval, *out, &utype, it);
-                *out += len;
-        }
+                if (ndef)
+                        ASN1_put_eoc(out);
+                else
+                        *out += len;
+                }
 
-        if(usetag) return ASN1_object_size(0, len, tag);
+        if (usetag)
+                return ASN1_object_size(ndef, len, tag);
         return len;
-}
+        }
 
 /* Produce content octets from a structure */
 
-int asn1_ex_i2c(ASN1_VALUE **pval, unsigned char *cout, int *putype, const ASN1_ITEM *it)
-{
+int asn1_ex_i2c(ASN1_VALUE **pval, unsigned char *cout, int *putype,
+                                const ASN1_ITEM *it)
+        {
         ASN1_BOOLEAN *tbool = NULL;
         ASN1_STRING *strtmp;
         ASN1_OBJECT *otmp;
@@ -409,28 +573,36 @@ int asn1_ex_i2c(ASN1_VALUE **pval, unsigned char *cout, int *putype, const ASN1_
         int len;
         const ASN1_PRIMITIVE_FUNCS *pf;
         pf = it->funcs;
-        if(pf && pf->prim_i2c) return pf->prim_i2c(pval, cout, putype, it);
+        if (pf && pf->prim_i2c)
+                return pf->prim_i2c(pval, cout, putype, it);
 
         /* Should type be omitted? */
-        if((it->itype != ASN1_ITYPE_PRIMITIVE) || (it->utype != V_ASN1_BOOLEAN)) {
-                if(!*pval) return -1;
-        }
+        if ((it->itype != ASN1_ITYPE_PRIMITIVE)
+                || (it->utype != V_ASN1_BOOLEAN))
+                {
+                if (!*pval) return -1;
+                }
 
-        if(it->itype == ASN1_ITYPE_MSTRING) {
+        if (it->itype == ASN1_ITYPE_MSTRING)
+                {
                 /* If MSTRING type set the underlying type */
                 strtmp = (ASN1_STRING *)*pval;
                 utype = strtmp->type;
                 *putype = utype;
-        } else if(it->utype == V_ASN1_ANY) {
+                }
+        else if (it->utype == V_ASN1_ANY)
+                {
                 /* If ANY set type and pointer to value */
                 ASN1_TYPE *typ;
                 typ = (ASN1_TYPE *)*pval;
                 utype = typ->type;
                 *putype = utype;
-                pval = (ASN1_VALUE **)&typ->value.ptr;
-        } else utype = *putype;
+                pval = &typ->value.asn1_value;
+                }
+        else utype = *putype;
 
-        switch(utype) {
+        switch(utype)
+                {
                 case V_ASN1_OBJECT:
                 otmp = (ASN1_OBJECT *)*pval;
                 cont = otmp->data;
@@ -444,12 +616,15 @@ int asn1_ex_i2c(ASN1_VALUE **pval, unsigned char *cout, int *putype, const ASN1_
 
                 case V_ASN1_BOOLEAN:
                 tbool = (ASN1_BOOLEAN *)pval;
-                if(*tbool == -1) return -1;
+                if (*tbool == -1)
+                        return -1;
                 if (it->utype != V_ASN1_ANY)
                         {
                         /* Default handling if value == size field then omit */
-                        if(*tbool && (it->size > 0)) return -1;
-                        if(!*tbool && !it->size) return -1;
+                        if (*tbool && (it->size > 0))
+                                return -1;
+                        if (!*tbool && !it->size)
+                                return -1;
                         }
                 c = (unsigned char)*tbool;
                 cont = &c;
@@ -457,7 +632,8 @@ int asn1_ex_i2c(ASN1_VALUE **pval, unsigned char *cout, int *putype, const ASN1_
                 break;
 
                 case V_ASN1_BIT_STRING:
-                return i2c_ASN1_BIT_STRING((ASN1_BIT_STRING *)*pval, cout ? &cout : NULL);
+                return i2c_ASN1_BIT_STRING((ASN1_BIT_STRING *)*pval,
+                                                        cout ? &cout : NULL);
                 break;
 
                 case V_ASN1_INTEGER:
@@ -467,7 +643,8 @@ int asn1_ex_i2c(ASN1_VALUE **pval, unsigned char *cout, int *putype, const ASN1_
                 /* These are all have the same content format
                  * as ASN1_INTEGER
                  */
-                return i2c_ASN1_INTEGER((ASN1_INTEGER *)*pval, cout ? &cout : NULL);
+                return i2c_ASN1_INTEGER((ASN1_INTEGER *)*pval,
+                                                        cout ? &cout : NULL);
                 break;
 
                 case V_ASN1_OCTET_STRING:
@@ -489,12 +666,25 @@ int asn1_ex_i2c(ASN1_VALUE **pval, unsigned char *cout, int *putype, const ASN1_
                 default:
                 /* All based on ASN1_STRING and handled the same */
                 strtmp = (ASN1_STRING *)*pval;
+                /* Special handling for NDEF */
+                if ((it->size == ASN1_TFLG_NDEF)
+                        && (strtmp->flags & ASN1_STRING_FLAG_NDEF))
+                        {
+                        if (cout)
+                                {
+                                strtmp->data = cout;
+                                strtmp->length = 0;
+                                }
+                        /* Special return code */
+                        return -2;
+                        }
                 cont = strtmp->data;
                 len = strtmp->length;
 
                 break;
 
-        }
-        if(cout && len) memcpy(cout, cont, len);
+                }
+        if (cout && len)
+                memcpy(cout, cont, len);
         return len;
-}
+        }
diff --git a/src/lib/libssl/src/crypto/asn1/tasn_fre.c b/src/lib/libssl/src/crypto/asn1/tasn_fre.c
index 2dd844159e..bb7c1e2af4 100644
--- a/src/lib/libssl/src/crypto/asn1/tasn_fre.c
+++ b/src/lib/libssl/src/crypto/asn1/tasn_fre.c
@@ -67,33 +67,40 @@ static void asn1_item_combine_free(ASN1_VALUE **pval, const ASN1_ITEM *it, int c
 /* Free up an ASN1 structure */
 
 void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)
-{
+        {
         asn1_item_combine_free(&val, it, 0);
-}
+        }
 
 void ASN1_item_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
+        {
         asn1_item_combine_free(pval, it, 0);
-}
+        }
 
 static void asn1_item_combine_free(ASN1_VALUE **pval, const ASN1_ITEM *it, int combine)
-{
+        {
         const ASN1_TEMPLATE *tt = NULL, *seqtt;
         const ASN1_EXTERN_FUNCS *ef;
         const ASN1_COMPAT_FUNCS *cf;
         const ASN1_AUX *aux = it->funcs;
         ASN1_aux_cb *asn1_cb;
         int i;
-        if(!pval) return;
-        if((it->itype != ASN1_ITYPE_PRIMITIVE) && !*pval) return;
-        if(aux && aux->asn1_cb) asn1_cb = aux->asn1_cb;
-        else asn1_cb = 0;
+        if (!pval)
+                return;
+        if ((it->itype != ASN1_ITYPE_PRIMITIVE) && !*pval)
+                return;
+        if (aux && aux->asn1_cb)
+                asn1_cb = aux->asn1_cb;
+        else
+                asn1_cb = 0;
 
-        switch(it->itype) {
+        switch(it->itype)
+                {
 
                 case ASN1_ITYPE_PRIMITIVE:
-                if(it->templates) ASN1_template_free(pval, it->templates);
-                else ASN1_primitive_free(pval, it);
+                if (it->templates)
+                        ASN1_template_free(pval, it->templates);
+                else
+                        ASN1_primitive_free(pval, it);
                 break;
 
                 case ASN1_ITYPE_MSTRING:
@@ -101,41 +108,51 @@ static void asn1_item_combine_free(ASN1_VALUE **pval, const ASN1_ITEM *it, int c
                 break;
 
                 case ASN1_ITYPE_CHOICE:
-                if(asn1_cb) {
+                if (asn1_cb)
+                        {
                         i = asn1_cb(ASN1_OP_FREE_PRE, pval, it);
-                        if(i == 2) return;
-                }
+                        if (i == 2)
+                                return;
+                        }
                 i = asn1_get_choice_selector(pval, it);
-                if(asn1_cb) asn1_cb(ASN1_OP_FREE_PRE, pval, it);
-                if((i >= 0) && (i < it->tcount)) {
+                if ((i >= 0) && (i < it->tcount))
+                        {
                         ASN1_VALUE **pchval;
                         tt = it->templates + i;
                         pchval = asn1_get_field_ptr(pval, tt);
                         ASN1_template_free(pchval, tt);
-                }
-                if(asn1_cb) asn1_cb(ASN1_OP_FREE_POST, pval, it);
-                if(!combine) {
+                        }
+                if (asn1_cb)
+                        asn1_cb(ASN1_OP_FREE_POST, pval, it);
+                if (!combine)
+                        {
                         OPENSSL_free(*pval);
                         *pval = NULL;
-                }
+                        }
                 break;
 
                 case ASN1_ITYPE_COMPAT:
                 cf = it->funcs;
-                if(cf && cf->asn1_free) cf->asn1_free(*pval);
+                if (cf && cf->asn1_free)
+                        cf->asn1_free(*pval);
                 break;
 
                 case ASN1_ITYPE_EXTERN:
                 ef = it->funcs;
-                if(ef && ef->asn1_ex_free) ef->asn1_ex_free(pval, it);
+                if (ef && ef->asn1_ex_free)
+                        ef->asn1_ex_free(pval, it);
                 break;
 
+                case ASN1_ITYPE_NDEF_SEQUENCE:
                 case ASN1_ITYPE_SEQUENCE:
-                if(asn1_do_lock(pval, -1, it) > 0) return;
-                if(asn1_cb) {
+                if (asn1_do_lock(pval, -1, it) > 0)
+                        return;
+                if (asn1_cb)
+                        {
                         i = asn1_cb(ASN1_OP_FREE_PRE, pval, it);
-                        if(i == 2) return;
-                }               
+                        if (i == 2)
+                                return;
+                        }               
                 asn1_enc_free(pval, it);
                 /* If we free up as normal we will invalidate any
                  * ANY DEFINED BY field and we wont be able to 
@@ -143,64 +160,84 @@ static void asn1_item_combine_free(ASN1_VALUE **pval, const ASN1_ITEM *it, int c
                  * free up in reverse order.
                  */
                 tt = it->templates + it->tcount - 1;
-                for(i = 0; i < it->tcount; tt--, i++) {
+                for (i = 0; i < it->tcount; tt--, i++)
+                        {
                         ASN1_VALUE **pseqval;
                         seqtt = asn1_do_adb(pval, tt, 0);
-                        if(!seqtt) continue;
+                        if (!seqtt)
+                                continue;
                         pseqval = asn1_get_field_ptr(pval, seqtt);
                         ASN1_template_free(pseqval, seqtt);
-                }
-                if(asn1_cb) asn1_cb(ASN1_OP_FREE_POST, pval, it);
-                if(!combine) {
+                        }
+                if (asn1_cb)
+                        asn1_cb(ASN1_OP_FREE_POST, pval, it);
+                if (!combine)
+                        {
                         OPENSSL_free(*pval);
                         *pval = NULL;
-                }
+                        }
                 break;
+                }
         }
-}
 
 void ASN1_template_free(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt)
-{
+        {
         int i;
-        if(tt->flags & ASN1_TFLG_SK_MASK) {
+        if (tt->flags & ASN1_TFLG_SK_MASK)
+                {
                 STACK_OF(ASN1_VALUE) *sk = (STACK_OF(ASN1_VALUE) *)*pval;
-                for(i = 0; i < sk_ASN1_VALUE_num(sk); i++) {
+                for (i = 0; i < sk_ASN1_VALUE_num(sk); i++)
+                        {
                         ASN1_VALUE *vtmp;
                         vtmp = sk_ASN1_VALUE_value(sk, i);
-                        asn1_item_combine_free(&vtmp, ASN1_ITEM_ptr(tt->item), 0);
-                }
+                        asn1_item_combine_free(&vtmp, ASN1_ITEM_ptr(tt->item),
+                                                                        0);
+                        }
                 sk_ASN1_VALUE_free(sk);
                 *pval = NULL;
-        } else asn1_item_combine_free(pval, ASN1_ITEM_ptr(tt->item),
+                }
+        else
+                asn1_item_combine_free(pval, ASN1_ITEM_ptr(tt->item),
                                                 tt->flags & ASN1_TFLG_COMBINE);
-}
+        }
 
 void ASN1_primitive_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
+        {
         int utype;
-        if(it) {
+        if (it)
+                {
                 const ASN1_PRIMITIVE_FUNCS *pf;
                 pf = it->funcs;
-                if(pf && pf->prim_free) {
+                if (pf && pf->prim_free)
+                        {
                         pf->prim_free(pval, it);
                         return;
+                        }
                 }
-        }
         /* Special case: if 'it' is NULL free contents of ASN1_TYPE */
-        if(!it) {
+        if (!it)
+                {
                 ASN1_TYPE *typ = (ASN1_TYPE *)*pval;
                 utype = typ->type;
-                pval = (ASN1_VALUE **)&typ->value.ptr;
-                if(!*pval) return;
-        } else if(it->itype == ASN1_ITYPE_MSTRING) {
+                pval = &typ->value.asn1_value;
+                if (!*pval)
+                        return;
+                }
+        else if (it->itype == ASN1_ITYPE_MSTRING)
+                {
                 utype = -1;
-                if(!*pval) return;
-        } else {
+                if (!*pval)
+                        return;
+                }
+        else
+                {
                 utype = it->utype;
-                if((utype != V_ASN1_BOOLEAN) && !*pval) return;
-        }
+                if ((utype != V_ASN1_BOOLEAN) && !*pval)
+                        return;
+                }
 
-        switch(utype) {
+        switch(utype)
+                {
                 case V_ASN1_OBJECT:
                 ASN1_OBJECT_free((ASN1_OBJECT *)*pval);
                 break;
@@ -224,6 +261,6 @@ void ASN1_primitive_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
                 ASN1_STRING_free((ASN1_STRING *)*pval);
                 *pval = NULL;
                 break;
-        }
+                }
         *pval = NULL;
-}
+        }
diff --git a/src/lib/libssl/src/crypto/asn1/tasn_new.c b/src/lib/libssl/src/crypto/asn1/tasn_new.c
index a0e3db574f..531dad365c 100644
--- a/src/lib/libssl/src/crypto/asn1/tasn_new.c
+++ b/src/lib/libssl/src/crypto/asn1/tasn_new.c
@@ -3,7 +3,7 @@
  * project 2000.
  */
 /* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -64,27 +64,30 @@
 #include <openssl/asn1t.h>
 #include <string.h>
 
-static int asn1_item_ex_combine_new(ASN1_VALUE **pval, const ASN1_ITEM *it, int combine);
+static int asn1_item_ex_combine_new(ASN1_VALUE **pval, const ASN1_ITEM *it,
+                                                                int combine);
 static void asn1_item_clear(ASN1_VALUE **pval, const ASN1_ITEM *it);
 static void asn1_template_clear(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt);
 void asn1_primitive_clear(ASN1_VALUE **pval, const ASN1_ITEM *it);
 
 ASN1_VALUE *ASN1_item_new(const ASN1_ITEM *it)
-{
+        {
         ASN1_VALUE *ret = NULL;
-        if(ASN1_item_ex_new(&ret, it) > 0) return ret;
+        if (ASN1_item_ex_new(&ret, it) > 0)
+                return ret;
         return NULL;
-}
+        }
 
 /* Allocate an ASN1 structure */
 
 int ASN1_item_ex_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
+        {
         return asn1_item_ex_combine_new(pval, it, 0);
-}
+        }
 
-static int asn1_item_ex_combine_new(ASN1_VALUE **pval, const ASN1_ITEM *it, int combine)
-{
+static int asn1_item_ex_combine_new(ASN1_VALUE **pval, const ASN1_ITEM *it,
+                                                                int combine)
+        {
         const ASN1_TEMPLATE *tt = NULL;
         const ASN1_COMPAT_FUNCS *cf;
         const ASN1_EXTERN_FUNCS *ef;
@@ -92,133 +95,155 @@ static int asn1_item_ex_combine_new(ASN1_VALUE **pval, const ASN1_ITEM *it, int
         ASN1_aux_cb *asn1_cb;
         ASN1_VALUE **pseqval;
         int i;
-        if(aux && aux->asn1_cb) asn1_cb = aux->asn1_cb;
-        else asn1_cb = 0;
+        if (aux && aux->asn1_cb)
+                asn1_cb = aux->asn1_cb;
+        else
+                asn1_cb = 0;
 
-        if(!combine) *pval = NULL;
+        if (!combine) *pval = NULL;
 
 #ifdef CRYPTO_MDEBUG
-        if(it->sname) CRYPTO_push_info(it->sname);
+        if (it->sname)
+                CRYPTO_push_info(it->sname);
 #endif
 
-        switch(it->itype) {
+        switch(it->itype)
+                {
 
                 case ASN1_ITYPE_EXTERN:
                 ef = it->funcs;
-                if(ef && ef->asn1_ex_new) {
-                        if(!ef->asn1_ex_new(pval, it))
+                if (ef && ef->asn1_ex_new)
+                        {
+                        if (!ef->asn1_ex_new(pval, it))
                                 goto memerr;
-                }
+                        }
                 break;
 
                 case ASN1_ITYPE_COMPAT:
                 cf = it->funcs;
-                if(cf && cf->asn1_new) {
+                if (cf && cf->asn1_new) {
                         *pval = cf->asn1_new();
-                        if(!*pval) goto memerr;
+                        if (!*pval)
+                                goto memerr;
                 }
                 break;
 
                 case ASN1_ITYPE_PRIMITIVE:
-                if(it->templates) {
-                        if(!ASN1_template_new(pval, it->templates))
+                if (it->templates)
+                        {
+                        if (!ASN1_template_new(pval, it->templates))
                                 goto memerr;
-                } else {
-                        if(!ASN1_primitive_new(pval, it))
+                        }
+                else if (!ASN1_primitive_new(pval, it))
                                 goto memerr;
-                }
                 break;
 
                 case ASN1_ITYPE_MSTRING:
-                if(!ASN1_primitive_new(pval, it))
+                if (!ASN1_primitive_new(pval, it))
                                 goto memerr;
                 break;
 
                 case ASN1_ITYPE_CHOICE:
-                if(asn1_cb) {
+                if (asn1_cb)
+                        {
                         i = asn1_cb(ASN1_OP_NEW_PRE, pval, it);
-                        if(!i) goto auxerr;
-                        if(i==2) {
+                        if (!i)
+                                goto auxerr;
+                        if (i==2)
+                                {
 #ifdef CRYPTO_MDEBUG
-                                if(it->sname) CRYPTO_pop_info();
+                                if (it->sname)
+                                        CRYPTO_pop_info();
 #endif
                                 return 1;
+                                }
                         }
-                }
-                if(!combine) {
+                if (!combine)
+                        {
                         *pval = OPENSSL_malloc(it->size);
-                        if(!*pval) goto memerr;
+                        if (!*pval)
+                                goto memerr;
                         memset(*pval, 0, it->size);
-                }
+                        }
                 asn1_set_choice_selector(pval, -1, it);
-                if(asn1_cb && !asn1_cb(ASN1_OP_NEW_POST, pval, it))
+                if (asn1_cb && !asn1_cb(ASN1_OP_NEW_POST, pval, it))
                                 goto auxerr;
                 break;
 
+                case ASN1_ITYPE_NDEF_SEQUENCE:
                 case ASN1_ITYPE_SEQUENCE:
-                if(asn1_cb) {
+                if (asn1_cb)
+                        {
                         i = asn1_cb(ASN1_OP_NEW_PRE, pval, it);
-                        if(!i) goto auxerr;
-                        if(i==2) {
+                        if (!i)
+                                goto auxerr;
+                        if (i==2)
+                                {
 #ifdef CRYPTO_MDEBUG
-                                if(it->sname) CRYPTO_pop_info();
+                                if (it->sname)
+                                        CRYPTO_pop_info();
 #endif
                                 return 1;
+                                }
                         }
-                }
-                if(!combine) {
+                if (!combine)
+                        {
                         *pval = OPENSSL_malloc(it->size);
-                        if(!*pval) goto memerr;
+                        if (!*pval)
+                                goto memerr;
                         memset(*pval, 0, it->size);
                         asn1_do_lock(pval, 0, it);
                         asn1_enc_init(pval, it);
-                }
-                for(i = 0, tt = it->templates; i < it->tcount; tt++, i++) {
+                        }
+                for (i = 0, tt = it->templates; i < it->tcount; tt++, i++)
+                        {
                         pseqval = asn1_get_field_ptr(pval, tt);
-                        if(!ASN1_template_new(pseqval, tt)) goto memerr;
-                }
-                if(asn1_cb && !asn1_cb(ASN1_OP_NEW_POST, pval, it))
+                        if (!ASN1_template_new(pseqval, tt))
+                                goto memerr;
+                        }
+                if (asn1_cb && !asn1_cb(ASN1_OP_NEW_POST, pval, it))
                                 goto auxerr;
                 break;
         }
 #ifdef CRYPTO_MDEBUG
-        if(it->sname) CRYPTO_pop_info();
+        if (it->sname) CRYPTO_pop_info();
 #endif
         return 1;
 
         memerr:
-        ASN1err(ASN1_F_ASN1_ITEM_NEW, ERR_R_MALLOC_FAILURE);
+        ASN1err(ASN1_F_ASN1_ITEM_EX_COMBINE_NEW, ERR_R_MALLOC_FAILURE);
 #ifdef CRYPTO_MDEBUG
-        if(it->sname) CRYPTO_pop_info();
+        if (it->sname) CRYPTO_pop_info();
 #endif
         return 0;
 
         auxerr:
-        ASN1err(ASN1_F_ASN1_ITEM_NEW, ASN1_R_AUX_ERROR);
+        ASN1err(ASN1_F_ASN1_ITEM_EX_COMBINE_NEW, ASN1_R_AUX_ERROR);
         ASN1_item_ex_free(pval, it);
 #ifdef CRYPTO_MDEBUG
-        if(it->sname) CRYPTO_pop_info();
+        if (it->sname) CRYPTO_pop_info();
 #endif
         return 0;
 
-}
+        }
 
 static void asn1_item_clear(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
+        {
         const ASN1_EXTERN_FUNCS *ef;
 
-        switch(it->itype) {
+        switch(it->itype)
+                {
 
                 case ASN1_ITYPE_EXTERN:
                 ef = it->funcs;
-                if(ef && ef->asn1_ex_clear) 
+                if (ef && ef->asn1_ex_clear) 
                         ef->asn1_ex_clear(pval, it);
                 else *pval = NULL;
                 break;
 
 
                 case ASN1_ITYPE_PRIMITIVE:
-                if(it->templates) 
+                if (it->templates) 
                         asn1_template_clear(pval, it->templates);
                 else
                         asn1_primitive_clear(pval, it);
@@ -231,75 +256,90 @@ static void asn1_item_clear(ASN1_VALUE **pval, const ASN1_ITEM *it)
                 case ASN1_ITYPE_COMPAT:
                 case ASN1_ITYPE_CHOICE:
                 case ASN1_ITYPE_SEQUENCE:
+                case ASN1_ITYPE_NDEF_SEQUENCE:
                 *pval = NULL;
                 break;
+                }
         }
-}
 
 
 int ASN1_template_new(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt)
-{
+        {
         const ASN1_ITEM *it = ASN1_ITEM_ptr(tt->item);
         int ret;
-        if(tt->flags & ASN1_TFLG_OPTIONAL) {
+        if (tt->flags & ASN1_TFLG_OPTIONAL)
+                {
                 asn1_template_clear(pval, tt);
                 return 1;
-        }
+                }
         /* If ANY DEFINED BY nothing to do */
 
-        if(tt->flags & ASN1_TFLG_ADB_MASK) {
+        if (tt->flags & ASN1_TFLG_ADB_MASK)
+                {
                 *pval = NULL;
                 return 1;
-        }
+                }
 #ifdef CRYPTO_MDEBUG
-        if(tt->field_name) CRYPTO_push_info(tt->field_name);
+        if (tt->field_name)
+                CRYPTO_push_info(tt->field_name);
 #endif
         /* If SET OF or SEQUENCE OF, its a STACK */
-        if(tt->flags & ASN1_TFLG_SK_MASK) {
+        if (tt->flags & ASN1_TFLG_SK_MASK)
+                {
                 STACK_OF(ASN1_VALUE) *skval;
                 skval = sk_ASN1_VALUE_new_null();
-                if(!skval) {
+                if (!skval)
+                        {
                         ASN1err(ASN1_F_ASN1_TEMPLATE_NEW, ERR_R_MALLOC_FAILURE);
                         ret = 0;
                         goto done;
-                }
+                        }
                 *pval = (ASN1_VALUE *)skval;
                 ret = 1;
                 goto done;
-        }
+                }
         /* Otherwise pass it back to the item routine */
         ret = asn1_item_ex_combine_new(pval, it, tt->flags & ASN1_TFLG_COMBINE);
         done:
 #ifdef CRYPTO_MDEBUG
-        if(it->sname) CRYPTO_pop_info();
+        if (it->sname)
+                CRYPTO_pop_info();
 #endif
         return ret;
-}
+        }
 
 static void asn1_template_clear(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt)
-{
+        {
         /* If ADB or STACK just NULL the field */
-        if(tt->flags & (ASN1_TFLG_ADB_MASK|ASN1_TFLG_SK_MASK)) 
+        if (tt->flags & (ASN1_TFLG_ADB_MASK|ASN1_TFLG_SK_MASK)) 
                 *pval = NULL;
         else
                 asn1_item_clear(pval, ASN1_ITEM_ptr(tt->item));
-}
+        }
 
 
-/* NB: could probably combine most of the real XXX_new() behaviour and junk all the old
- * functions.
+/* NB: could probably combine most of the real XXX_new() behaviour and junk
+ * all the old functions.
  */
 
 int ASN1_primitive_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
+        {
         ASN1_TYPE *typ;
         int utype;
-        const ASN1_PRIMITIVE_FUNCS *pf;
-        pf = it->funcs;
-        if(pf && pf->prim_new) return pf->prim_new(pval, it);
-        if(!it || (it->itype == ASN1_ITYPE_MSTRING)) utype = -1;
-        else utype = it->utype;
-        switch(utype) {
+
+        if (it && it->funcs)
+                {
+                const ASN1_PRIMITIVE_FUNCS *pf = it->funcs;
+                if (pf->prim_new)
+                        return pf->prim_new(pval, it);
+                }
+
+        if (!it || (it->itype == ASN1_ITYPE_MSTRING))
+                utype = -1;
+        else
+                utype = it->utype;
+        switch(utype)
+                {
                 case V_ASN1_OBJECT:
                 *pval = (ASN1_VALUE *)OBJ_nid2obj(NID_undef);
                 return 1;
@@ -317,7 +357,8 @@ int ASN1_primitive_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
 
                 case V_ASN1_ANY:
                 typ = OPENSSL_malloc(sizeof(ASN1_TYPE));
-                if(!typ) return 0;
+                if (!typ)
+                        return 0;
                 typ->value.ptr = NULL;
                 typ->type = -1;
                 *pval = (ASN1_VALUE *)typ;
@@ -326,26 +367,29 @@ int ASN1_primitive_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
                 default:
                 *pval = (ASN1_VALUE *)ASN1_STRING_type_new(utype);
                 break;
-        }
-        if(*pval) return 1;
+                }
+        if (*pval)
+                return 1;
         return 0;
-}
+        }
 
 void asn1_primitive_clear(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
+        {
         int utype;
-        const ASN1_PRIMITIVE_FUNCS *pf;
-        pf = it->funcs;
-        if(pf) {
-                if(pf->prim_clear)
+        if (it && it->funcs)
+                {
+                const ASN1_PRIMITIVE_FUNCS *pf = it->funcs;
+                if (pf->prim_clear)
                         pf->prim_clear(pval, it);
                 else 
                         *pval = NULL;
                 return;
-        }
-        if(!it || (it->itype == ASN1_ITYPE_MSTRING)) utype = -1;
-        else utype = it->utype;
-        if(utype == V_ASN1_BOOLEAN)
+                }
+        if (!it || (it->itype == ASN1_ITYPE_MSTRING))
+                utype = -1;
+        else
+                utype = it->utype;
+        if (utype == V_ASN1_BOOLEAN)
                 *(ASN1_BOOLEAN *)pval = it->size;
         else *pval = NULL;
-}
+        }
diff --git a/src/lib/libssl/src/crypto/asn1/tasn_typ.c b/src/lib/libssl/src/crypto/asn1/tasn_typ.c
index 804d2eeba2..6f17f1bec7 100644
--- a/src/lib/libssl/src/crypto/asn1/tasn_typ.c
+++ b/src/lib/libssl/src/crypto/asn1/tasn_typ.c
@@ -131,3 +131,7 @@ IMPLEMENT_ASN1_FUNCTIONS_name(ASN1_STRING, DIRECTORYSTRING)
 IMPLEMENT_ASN1_TYPE_ex(ASN1_BOOLEAN, ASN1_BOOLEAN, -1)
 IMPLEMENT_ASN1_TYPE_ex(ASN1_TBOOLEAN, ASN1_BOOLEAN, 1)
 IMPLEMENT_ASN1_TYPE_ex(ASN1_FBOOLEAN, ASN1_BOOLEAN, 0)
+
+/* Special, OCTET STRING with indefinite length constructed support */
+
+IMPLEMENT_ASN1_TYPE_ex(ASN1_OCTET_STRING_NDEF, ASN1_OCTET_STRING, ASN1_TFLG_NDEF)
diff --git a/src/lib/libssl/src/crypto/asn1/tasn_utl.c b/src/lib/libssl/src/crypto/asn1/tasn_utl.c
index 8996ce8c13..34d520b180 100644
--- a/src/lib/libssl/src/crypto/asn1/tasn_utl.c
+++ b/src/lib/libssl/src/crypto/asn1/tasn_utl.c
@@ -3,7 +3,7 @@
  * project 2000.
  */
 /* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2000-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -74,23 +74,23 @@
  */
 
 int asn1_get_choice_selector(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
+        {
         int *sel = offset2ptr(*pval, it->utype);
         return *sel;
-}
+        }
 
 /* Given an ASN1_ITEM CHOICE type set
  * the selector value, return old value.
  */
 
 int asn1_set_choice_selector(ASN1_VALUE **pval, int value, const ASN1_ITEM *it)
-{       
+        {       
         int *sel, ret;
         sel = offset2ptr(*pval, it->utype);
         ret = *sel;
         *sel = value;
         return ret;
-}
+        }
 
 /* Do reference counting. The value 'op' decides what to do. 
  * if it is +1 then the count is incremented. If op is 0 count is
@@ -99,114 +99,134 @@ int asn1_set_choice_selector(ASN1_VALUE **pval, int value, const ASN1_ITEM *it)
  */
 
 int asn1_do_lock(ASN1_VALUE **pval, int op, const ASN1_ITEM *it)
-{
+        {
         const ASN1_AUX *aux;
         int *lck, ret;
-        if(it->itype != ASN1_ITYPE_SEQUENCE) return 0;
+        if ((it->itype != ASN1_ITYPE_SEQUENCE)
+           && (it->itype != ASN1_ITYPE_NDEF_SEQUENCE))
+                return 0;
         aux = it->funcs;
-        if(!aux || !(aux->flags & ASN1_AFLG_REFCOUNT)) return 0;
+        if (!aux || !(aux->flags & ASN1_AFLG_REFCOUNT))
+                return 0;
         lck = offset2ptr(*pval, aux->ref_offset);
-        if(op == 0) {
+        if (op == 0)
+                {
                 *lck = 1;
                 return 1;
-        }
+                }
         ret = CRYPTO_add(lck, op, aux->ref_lock);
 #ifdef REF_PRINT
         fprintf(stderr, "%s: Reference Count: %d\n", it->sname, *lck);
 #endif
 #ifdef REF_CHECK
-        if(ret < 0) 
+        if (ret < 0) 
                 fprintf(stderr, "%s, bad reference count\n", it->sname);
 #endif
         return ret;
-}
+        }
 
 static ASN1_ENCODING *asn1_get_enc_ptr(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
+        {
         const ASN1_AUX *aux;
-        if(!pval || !*pval) return NULL;
+        if (!pval || !*pval)
+                return NULL;
         aux = it->funcs;
-        if(!aux || !(aux->flags & ASN1_AFLG_ENCODING)) return NULL;
+        if (!aux || !(aux->flags & ASN1_AFLG_ENCODING))
+                return NULL;
         return offset2ptr(*pval, aux->enc_offset);
-}
+        }
 
 void asn1_enc_init(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
+        {
         ASN1_ENCODING *enc;
         enc = asn1_get_enc_ptr(pval, it);
-        if(enc) {
+        if (enc)
+                {
                 enc->enc = NULL;
                 enc->len = 0;
                 enc->modified = 1;
+                }
         }
-}
 
 void asn1_enc_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
+        {
         ASN1_ENCODING *enc;
         enc = asn1_get_enc_ptr(pval, it);
-        if(enc) {
-                if(enc->enc) OPENSSL_free(enc->enc);
+        if (enc)
+                {
+                if (enc->enc)
+                        OPENSSL_free(enc->enc);
                 enc->enc = NULL;
                 enc->len = 0;
                 enc->modified = 1;
+                }
         }
-}
 
-int asn1_enc_save(ASN1_VALUE **pval, unsigned char *in, int inlen, const ASN1_ITEM *it)
-{
+int asn1_enc_save(ASN1_VALUE **pval, const unsigned char *in, int inlen,
+                                                         const ASN1_ITEM *it)
+        {
         ASN1_ENCODING *enc;
         enc = asn1_get_enc_ptr(pval, it);
-        if(!enc) return 1;
+        if (!enc)
+                return 1;
 
-        if(enc->enc) OPENSSL_free(enc->enc);
+        if (enc->enc)
+                OPENSSL_free(enc->enc);
         enc->enc = OPENSSL_malloc(inlen);
-        if(!enc->enc) return 0;
+        if (!enc->enc)
+                return 0;
         memcpy(enc->enc, in, inlen);
         enc->len = inlen;
         enc->modified = 0;
 
         return 1;
-}
+        }
                 
-int asn1_enc_restore(int *len, unsigned char **out, ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
+int asn1_enc_restore(int *len, unsigned char **out, ASN1_VALUE **pval,
+                                                        const ASN1_ITEM *it)
+        {
         ASN1_ENCODING *enc;
         enc = asn1_get_enc_ptr(pval, it);
-        if(!enc || enc->modified) return 0;
-        if(out) {
+        if (!enc || enc->modified)
+                return 0;
+        if (out)
+                {
                 memcpy(*out, enc->enc, enc->len);
                 *out += enc->len;
-        }
-        if(len) *len = enc->len;
+                }
+        if (len)
+                *len = enc->len;
         return 1;
-}
+        }
 
 /* Given an ASN1_TEMPLATE get a pointer to a field */
 ASN1_VALUE ** asn1_get_field_ptr(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt)
-{
+        {
         ASN1_VALUE **pvaltmp;
-        if(tt->flags & ASN1_TFLG_COMBINE) return pval;
+        if (tt->flags & ASN1_TFLG_COMBINE)
+                return pval;
         pvaltmp = offset2ptr(*pval, tt->offset);
         /* NOTE for BOOLEAN types the field is just a plain
          * int so we can't return int **, so settle for
          * (int *).
          */
         return pvaltmp;
-}
+        }
 
 /* Handle ANY DEFINED BY template, find the selector, look up
  * the relevant ASN1_TEMPLATE in the table and return it.
  */
 
-const ASN1_TEMPLATE *asn1_do_adb(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt, int nullerr)
-{
+const ASN1_TEMPLATE *asn1_do_adb(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt,
+                                                                int nullerr)
+        {
         const ASN1_ADB *adb;
         const ASN1_ADB_TABLE *atbl;
         long selector;
         ASN1_VALUE **sfld;
         int i;
-        if(!(tt->flags & ASN1_TFLG_ADB_MASK)) return tt;
+        if (!(tt->flags & ASN1_TFLG_ADB_MASK))
+                return tt;
 
         /* Else ANY DEFINED BY ... get the table */
         adb = ASN1_ADB_ptr(tt->item);
@@ -215,16 +235,18 @@ const ASN1_TEMPLATE *asn1_do_adb(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt, int
         sfld = offset2ptr(*pval, adb->offset);
 
         /* Check if NULL */
-        if(!sfld) {
-                if(!adb->null_tt) goto err;
+        if (!sfld)
+                {
+                if (!adb->null_tt)
+                        goto err;
                 return adb->null_tt;
-        }
+                }
 
         /* Convert type to a long:
          * NB: don't check for NID_undef here because it
          * might be a legitimate value in the table
          */
-        if(tt->flags & ASN1_TFLG_ADB_OID) 
+        if (tt->flags & ASN1_TFLG_ADB_OID) 
                 selector = OBJ_obj2nid((ASN1_OBJECT *)*sfld);
         else 
                 selector = ASN1_INTEGER_get((ASN1_INTEGER *)*sfld);
@@ -237,17 +259,21 @@ const ASN1_TEMPLATE *asn1_do_adb(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt, int
          * linear search.
          */
 
-        for(atbl = adb->tbl, i = 0; i < adb->tblcount; i++, atbl++)
-                if(atbl->value == selector) return &atbl->tt;
+        for (atbl = adb->tbl, i = 0; i < adb->tblcount; i++, atbl++)
+                if (atbl->value == selector)
+                        return &atbl->tt;
 
         /* FIXME: need to search application table too */
 
         /* No match, return default type */
-        if(!adb->default_tt) goto err;          
+        if (!adb->default_tt)
+                goto err;               
         return adb->default_tt;
         
         err:
         /* FIXME: should log the value or OID of unsupported type */
-        if(nullerr) ASN1err(ASN1_F_ASN1_DO_ADB, ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE);
+        if (nullerr)
+                ASN1err(ASN1_F_ASN1_DO_ADB,
+                        ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE);
         return NULL;
-}
+        }
diff --git a/src/lib/libssl/src/crypto/asn1/x_algor.c b/src/lib/libssl/src/crypto/asn1/x_algor.c
index 00b9ea54a1..33533aba86 100644
--- a/src/lib/libssl/src/crypto/asn1/x_algor.c
+++ b/src/lib/libssl/src/crypto/asn1/x_algor.c
@@ -66,8 +66,65 @@ ASN1_SEQUENCE(X509_ALGOR) = {
         ASN1_OPT(X509_ALGOR, parameter, ASN1_ANY)
 } ASN1_SEQUENCE_END(X509_ALGOR)
 
+ASN1_ITEM_TEMPLATE(X509_ALGORS) = 
+        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, algorithms, X509_ALGOR)
+ASN1_ITEM_TEMPLATE_END(X509_ALGORS)
+
 IMPLEMENT_ASN1_FUNCTIONS(X509_ALGOR)
+IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(X509_ALGORS, X509_ALGORS, X509_ALGORS)
 IMPLEMENT_ASN1_DUP_FUNCTION(X509_ALGOR)
 
 IMPLEMENT_STACK_OF(X509_ALGOR)
 IMPLEMENT_ASN1_SET_OF(X509_ALGOR)
+
+int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval)
+        {
+        if (!alg)
+                return 0;
+        if (ptype != V_ASN1_UNDEF)
+                {
+                if (alg->parameter == NULL)
+                        alg->parameter = ASN1_TYPE_new();
+                if (alg->parameter == NULL)
+                        return 0;
+                }
+        if (alg)
+                {
+                if (alg->algorithm)
+                        ASN1_OBJECT_free(alg->algorithm);
+                alg->algorithm = aobj;
+                }
+        if (ptype == 0)
+                return 1;       
+        if (ptype == V_ASN1_UNDEF)
+                {
+                if (alg->parameter)
+                        {
+                        ASN1_TYPE_free(alg->parameter);
+                        alg->parameter = NULL;
+                        }
+                }
+        else
+                ASN1_TYPE_set(alg->parameter, ptype, pval);
+        return 1;
+        }
+
+void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,
+                                                X509_ALGOR *algor)
+        {
+        if (paobj)
+                *paobj = algor->algorithm;
+        if (pptype)
+                {
+                if (algor->parameter == NULL)
+                        {
+                        *pptype = V_ASN1_UNDEF;
+                        return;
+                        }
+                else
+                        *pptype = algor->parameter->type;
+                if (ppval)
+                        *ppval = algor->parameter->value.ptr;
+                }
+        }
+
diff --git a/src/lib/libssl/src/crypto/asn1/x_bignum.c b/src/lib/libssl/src/crypto/asn1/x_bignum.c
index 848c7a0877..869c05d931 100644
--- a/src/lib/libssl/src/crypto/asn1/x_bignum.c
+++ b/src/lib/libssl/src/crypto/asn1/x_bignum.c
@@ -59,6 +59,7 @@
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/asn1t.h>
+#include <openssl/bn.h>
 
 /* Custom primitive type for BIGNUM handling. This reads in an ASN1_INTEGER as a
  * BIGNUM directly. Currently it ignores the sign which isn't a problem since all
@@ -72,7 +73,7 @@ static int bn_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
 static void bn_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
 
 static int bn_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype, const ASN1_ITEM *it);
-static int bn_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it);
+static int bn_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it);
 
 static ASN1_PRIMITIVE_FUNCS bignum_pf = {
         NULL, 0,
@@ -122,7 +123,8 @@ static int bn_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype, const ASN
         return pad + BN_num_bytes(bn);
 }
 
-static int bn_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it)
+static int bn_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
+                  int utype, char *free_cont, const ASN1_ITEM *it)
 {
         BIGNUM *bn;
         if(!*pval) bn_new(pval, it);
diff --git a/src/lib/libssl/src/crypto/asn1/x_crl.c b/src/lib/libssl/src/crypto/asn1/x_crl.c
index b99f8fc522..70d56a67f2 100644
--- a/src/lib/libssl/src/crypto/asn1/x_crl.c
+++ b/src/lib/libssl/src/crypto/asn1/x_crl.c
@@ -84,7 +84,7 @@ static int crl_inf_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it)
                  * would affect the output of X509_CRL_print().
                  */
                 case ASN1_OP_D2I_POST:
-                sk_X509_REVOKED_set_cmp_func(a->revoked,X509_REVOKED_cmp);
+                (void)sk_X509_REVOKED_set_cmp_func(a->revoked,X509_REVOKED_cmp);
                 break;
         }
         return 1;
diff --git a/src/lib/libssl/src/crypto/asn1/x_exten.c b/src/lib/libssl/src/crypto/asn1/x_exten.c
index 702421b6c8..1732e66712 100644
--- a/src/lib/libssl/src/crypto/asn1/x_exten.c
+++ b/src/lib/libssl/src/crypto/asn1/x_exten.c
@@ -67,5 +67,10 @@ ASN1_SEQUENCE(X509_EXTENSION) = {
         ASN1_SIMPLE(X509_EXTENSION, value, ASN1_OCTET_STRING)
 } ASN1_SEQUENCE_END(X509_EXTENSION)
 
+ASN1_ITEM_TEMPLATE(X509_EXTENSIONS) = 
+        ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, Extension, X509_EXTENSION)
+ASN1_ITEM_TEMPLATE_END(X509_EXTENSIONS)
+
 IMPLEMENT_ASN1_FUNCTIONS(X509_EXTENSION)
+IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(X509_EXTENSIONS, X509_EXTENSIONS, X509_EXTENSIONS)
 IMPLEMENT_ASN1_DUP_FUNCTION(X509_EXTENSION)
diff --git a/src/lib/libssl/src/crypto/asn1/x_long.c b/src/lib/libssl/src/crypto/asn1/x_long.c
index c5f25956cb..0db233cb95 100644
--- a/src/lib/libssl/src/crypto/asn1/x_long.c
+++ b/src/lib/libssl/src/crypto/asn1/x_long.c
@@ -59,6 +59,7 @@
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/asn1t.h>
+#include <openssl/bn.h>
 
 /* Custom primitive type for long handling. This converts between an ASN1_INTEGER
  * and a long directly.
@@ -69,7 +70,7 @@ static int long_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
 static void long_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
 
 static int long_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype, const ASN1_ITEM *it);
-static int long_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it);
+static int long_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it);
 
 static ASN1_PRIMITIVE_FUNCS long_pf = {
         NULL, 0,
@@ -136,13 +137,14 @@ static int long_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype, const A
         return clen + pad;
 }
 
-static int long_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it)
+static int long_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
+                    int utype, char *free_cont, const ASN1_ITEM *it)
 {
         int neg, i;
         long ltmp;
         unsigned long utmp = 0;
         char *cp = (char *)pval;
-        if(len > sizeof(long)) {
+        if(len > (int)sizeof(long)) {
                 ASN1err(ASN1_F_LONG_C2I, ASN1_R_INTEGER_TOO_LARGE_FOR_LONG);
                 return 0;
         }
diff --git a/src/lib/libssl/src/crypto/asn1/x_name.c b/src/lib/libssl/src/crypto/asn1/x_name.c
index 31f3377b64..04380abc3f 100644
--- a/src/lib/libssl/src/crypto/asn1/x_name.c
+++ b/src/lib/libssl/src/crypto/asn1/x_name.c
@@ -61,7 +61,7 @@
 #include <openssl/asn1t.h>
 #include <openssl/x509.h>
 
-static int x509_name_ex_d2i(ASN1_VALUE **val, unsigned char **in, long len, const ASN1_ITEM *it,
+static int x509_name_ex_d2i(ASN1_VALUE **val, const unsigned char **in, long len, const ASN1_ITEM *it,
                                         int tag, int aclass, char opt, ASN1_TLC *ctx);
 
 static int x509_name_ex_i2d(ASN1_VALUE **val, unsigned char **out, const ASN1_ITEM *it, int tag, int aclass);
@@ -123,7 +123,7 @@ static int x509_name_ex_new(ASN1_VALUE **val, const ASN1_ITEM *it)
         return 1;
 
  memerr:
-        ASN1err(ASN1_F_X509_NAME_NEW, ERR_R_MALLOC_FAILURE);
+        ASN1err(ASN1_F_X509_NAME_EX_NEW, ERR_R_MALLOC_FAILURE);
         if (ret)
                 {
                 if (ret->entries)
@@ -156,48 +156,48 @@ static void sk_internal_free(void *a)
         sk_free(a);
 }
 
-static int x509_name_ex_d2i(ASN1_VALUE **val, unsigned char **in, long len, const ASN1_ITEM *it,
+static int x509_name_ex_d2i(ASN1_VALUE **val, const unsigned char **in, long len, const ASN1_ITEM *it,
                                         int tag, int aclass, char opt, ASN1_TLC *ctx)
 {
-        unsigned char *p = *in, *q;
-        STACK *intname = NULL, **intname_pp = &intname;
+        const unsigned char *p = *in, *q;
+        union { STACK *s; ASN1_VALUE *a; } intname = {NULL};
+        union { X509_NAME *x; ASN1_VALUE *a; } nm = {NULL};
         int i, j, ret;
-        X509_NAME *nm = NULL, **nm_pp = &nm;
         STACK_OF(X509_NAME_ENTRY) *entries;
         X509_NAME_ENTRY *entry;
         q = p;
 
         /* Get internal representation of Name */
-        ret = ASN1_item_ex_d2i((ASN1_VALUE **)intname_pp,
+        ret = ASN1_item_ex_d2i(&intname.a,
                                &p, len, ASN1_ITEM_rptr(X509_NAME_INTERNAL),
                                tag, aclass, opt, ctx);
         
         if(ret <= 0) return ret;
 
         if(*val) x509_name_ex_free(val, NULL);
-        if(!x509_name_ex_new((ASN1_VALUE **)nm_pp, NULL)) goto err;
+        if(!x509_name_ex_new(&nm.a, NULL)) goto err;
         /* We've decoded it: now cache encoding */
-        if(!BUF_MEM_grow(nm->bytes, p - q)) goto err;
-        memcpy(nm->bytes->data, q, p - q);
+        if(!BUF_MEM_grow(nm.x->bytes, p - q)) goto err;
+        memcpy(nm.x->bytes->data, q, p - q);
 
         /* Convert internal representation to X509_NAME structure */
-        for(i = 0; i < sk_num(intname); i++) {
-                entries = (STACK_OF(X509_NAME_ENTRY) *)sk_value(intname, i);
+        for(i = 0; i < sk_num(intname.s); i++) {
+                entries = (STACK_OF(X509_NAME_ENTRY) *)sk_value(intname.s, i);
                 for(j = 0; j < sk_X509_NAME_ENTRY_num(entries); j++) {
                         entry = sk_X509_NAME_ENTRY_value(entries, j);
                         entry->set = i;
-                        if(!sk_X509_NAME_ENTRY_push(nm->entries, entry))
+                        if(!sk_X509_NAME_ENTRY_push(nm.x->entries, entry))
                                 goto err;
                 }
                 sk_X509_NAME_ENTRY_free(entries);
         }
-        sk_free(intname);
-        nm->modified = 0;
-        *val = (ASN1_VALUE *)nm;
+        sk_free(intname.s);
+        nm.x->modified = 0;
+        *val = nm.a;
         *in = p;
         return ret;
         err:
-        ASN1err(ASN1_F_D2I_X509_NAME, ERR_R_NESTED_ASN1_ERROR);
+        ASN1err(ASN1_F_X509_NAME_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
         return 0;
 }
 
@@ -219,36 +219,36 @@ static int x509_name_ex_i2d(ASN1_VALUE **val, unsigned char **out, const ASN1_IT
 
 static int x509_name_encode(X509_NAME *a)
 {
-        STACK *intname = NULL, **intname_pp = &intname;
+        union { STACK *s; ASN1_VALUE *a; } intname = {NULL};
         int len;
         unsigned char *p;
         STACK_OF(X509_NAME_ENTRY) *entries = NULL;
         X509_NAME_ENTRY *entry;
         int i, set = -1;
-        intname = sk_new_null();
-        if(!intname) goto memerr;
+        intname.s = sk_new_null();
+        if(!intname.s) goto memerr;
         for(i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
                 entry = sk_X509_NAME_ENTRY_value(a->entries, i);
                 if(entry->set != set) {
                         entries = sk_X509_NAME_ENTRY_new_null();
                         if(!entries) goto memerr;
-                        if(!sk_push(intname, (char *)entries)) goto memerr;
+                        if(!sk_push(intname.s, (char *)entries)) goto memerr;
                         set = entry->set;
                 }
                 if(!sk_X509_NAME_ENTRY_push(entries, entry)) goto memerr;
         }
-        len = ASN1_item_ex_i2d((ASN1_VALUE **)intname_pp, NULL,
+        len = ASN1_item_ex_i2d(&intname.a, NULL,
                                ASN1_ITEM_rptr(X509_NAME_INTERNAL), -1, -1);
         if (!BUF_MEM_grow(a->bytes,len)) goto memerr;
         p=(unsigned char *)a->bytes->data;
-        ASN1_item_ex_i2d((ASN1_VALUE **)intname_pp,
+        ASN1_item_ex_i2d(&intname.a,
                          &p, ASN1_ITEM_rptr(X509_NAME_INTERNAL), -1, -1);
-        sk_pop_free(intname, sk_internal_free);
+        sk_pop_free(intname.s, sk_internal_free);
         a->modified = 0;
         return len;
         memerr:
-        sk_pop_free(intname, sk_internal_free);
-        ASN1err(ASN1_F_D2I_X509_NAME, ERR_R_MALLOC_FAILURE);
+        sk_pop_free(intname.s, sk_internal_free);
+        ASN1err(ASN1_F_X509_NAME_ENCODE, ERR_R_MALLOC_FAILURE);
         return -1;
 }
 
diff --git a/src/lib/libssl/src/crypto/asn1/x_pkey.c b/src/lib/libssl/src/crypto/asn1/x_pkey.c
index f1c6221ac3..8453618426 100644
--- a/src/lib/libssl/src/crypto/asn1/x_pkey.c
+++ b/src/lib/libssl/src/crypto/asn1/x_pkey.c
@@ -69,15 +69,15 @@ int i2d_X509_PKEY(X509_PKEY *a, unsigned char **pp)
         return(0);
         }
 
-X509_PKEY *d2i_X509_PKEY(X509_PKEY **a, unsigned char **pp, long length)
+X509_PKEY *d2i_X509_PKEY(X509_PKEY **a, const unsigned char **pp, long length)
         {
         int i;
         M_ASN1_D2I_vars(a,X509_PKEY *,X509_PKEY_new);
 
         M_ASN1_D2I_Init();
         M_ASN1_D2I_start_sequence();
-        M_ASN1_D2I_get(ret->enc_algor,d2i_X509_ALGOR);
-        M_ASN1_D2I_get(ret->enc_pkey,d2i_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_x(X509_ALGOR,ret->enc_algor,d2i_X509_ALGOR);
+        M_ASN1_D2I_get_x(ASN1_OCTET_STRING,ret->enc_pkey,d2i_ASN1_OCTET_STRING);
 
         ret->cipher.cipher=EVP_get_cipherbyname(
                 OBJ_nid2ln(OBJ_obj2nid(ret->enc_algor->algorithm)));
diff --git a/src/lib/libssl/src/crypto/asn1/x_pubkey.c b/src/lib/libssl/src/crypto/asn1/x_pubkey.c
index 7d6d71af88..91c2756116 100644
--- a/src/lib/libssl/src/crypto/asn1/x_pubkey.c
+++ b/src/lib/libssl/src/crypto/asn1/x_pubkey.c
@@ -60,16 +60,23 @@
 #include "cryptlib.h"
 #include <openssl/asn1t.h>
 #include <openssl/x509.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
 
 /* Minor tweak to operation: free up EVP_PKEY */
 static int pubkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        if(operation == ASN1_OP_FREE_POST) {
+        {
+        if (operation == ASN1_OP_FREE_POST)
+                {
                 X509_PUBKEY *pubkey = (X509_PUBKEY *)*pval;
                 EVP_PKEY_free(pubkey->pkey);
-        }
+                }
         return 1;
-}
+        }
 
 ASN1_SEQUENCE_cb(X509_PUBKEY, pubkey_cb) = {
         ASN1_SIMPLE(X509_PUBKEY, algor, X509_ALGOR),
@@ -111,13 +118,12 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
                         a->parameter->type=V_ASN1_NULL;
                         }
                 }
-        else
 #ifndef OPENSSL_NO_DSA
-                if (pkey->type == EVP_PKEY_DSA)
+        else if (pkey->type == EVP_PKEY_DSA)
                 {
                 unsigned char *pp;
                 DSA *dsa;
-
+                
                 dsa=pkey->pkey.dsa;
                 dsa->write_params=0;
                 ASN1_TYPE_free(a->parameter);
@@ -151,8 +157,64 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
                         }
                 OPENSSL_free(p);
                 }
-        else
 #endif
+#ifndef OPENSSL_NO_EC
+        else if (pkey->type == EVP_PKEY_EC)
+                {
+                int nid=0;
+                unsigned char *pp;
+                EC_KEY *ec_key;
+                const EC_GROUP *group;
+                
+                ec_key = pkey->pkey.ec;
+                ASN1_TYPE_free(a->parameter);
+
+                if ((a->parameter = ASN1_TYPE_new()) == NULL)
+                        {
+                        X509err(X509_F_X509_PUBKEY_SET, ERR_R_ASN1_LIB);
+                        goto err;
+                        }
+
+                group = EC_KEY_get0_group(ec_key);
+                if (EC_GROUP_get_asn1_flag(group)
+                     && (nid = EC_GROUP_get_curve_name(group)))
+                        {
+                        /* just set the OID */
+                        a->parameter->type = V_ASN1_OBJECT;
+                        a->parameter->value.object = OBJ_nid2obj(nid);
+                        }
+                else /* explicit parameters */
+                        {
+                        if ((i = i2d_ECParameters(ec_key, NULL)) == 0)
+                                {
+                                X509err(X509_F_X509_PUBKEY_SET, ERR_R_EC_LIB);
+                                goto err;
+                                }
+                        if ((p = (unsigned char *) OPENSSL_malloc(i)) == NULL)
+                                {
+                                X509err(X509_F_X509_PUBKEY_SET, ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }       
+                        pp = p;
+                        if (!i2d_ECParameters(ec_key, &pp))
+                                {
+                                X509err(X509_F_X509_PUBKEY_SET, ERR_R_EC_LIB);
+                                OPENSSL_free(p);
+                                goto err;
+                                }
+                        a->parameter->type = V_ASN1_SEQUENCE;
+                        if ((a->parameter->value.sequence = ASN1_STRING_new()) == NULL)
+                                {
+                                X509err(X509_F_X509_PUBKEY_SET, ERR_R_ASN1_LIB);
+                                OPENSSL_free(p);
+                                goto err;
+                                }
+                        ASN1_STRING_set(a->parameter->value.sequence, p, i);
+                        OPENSSL_free(p);
+                        }
+                }
+#endif
+        else if (1)
                 {
                 X509err(X509_F_X509_PUBKEY_SET,X509_R_UNSUPPORTED_ALGORITHM);
                 goto err;
@@ -171,7 +233,7 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
                 X509err(X509_F_X509_PUBKEY_SET,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
-        /* Set number of unused bits to zero */
+        /* Set number of unused bits to zero */
         pk->public_key->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
         pk->public_key->flags|=ASN1_STRING_FLAG_BITS_LEFT;
 
@@ -198,8 +260,8 @@ EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
         EVP_PKEY *ret=NULL;
         long j;
         int type;
-        unsigned char *p;
-#ifndef OPENSSL_NO_DSA
+        const unsigned char *p;
+#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
         const unsigned char *cp;
         X509_ALGOR *a;
 #endif
@@ -207,40 +269,106 @@ EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
         if (key == NULL) goto err;
 
         if (key->pkey != NULL)
-            {
-            CRYPTO_add(&key->pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
-            return(key->pkey);
-            }
+                {
+                CRYPTO_add(&key->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);
+                return(key->pkey);
+                }
 
         if (key->public_key == NULL) goto err;
 
         type=OBJ_obj2nid(key->algor->algorithm);
-        p=key->public_key->data;
-        j=key->public_key->length;
-        if ((ret=d2i_PublicKey(type,NULL,&p,(long)j)) == NULL)
+        if ((ret = EVP_PKEY_new()) == NULL)
                 {
-                X509err(X509_F_X509_PUBKEY_GET,X509_R_ERR_ASN1_LIB);
+                X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
-        ret->save_parameters=0;
+        ret->type = EVP_PKEY_type(type);
 
-#ifndef OPENSSL_NO_DSA
+        /* the parameters must be extracted before the public key (ECDSA!) */
+        
+#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
         a=key->algor;
-        if (ret->type == EVP_PKEY_DSA)
+#endif
+
+        if (0)
+                ;
+#ifndef OPENSSL_NO_DSA
+        else if (ret->type == EVP_PKEY_DSA)
                 {
                 if (a->parameter && (a->parameter->type == V_ASN1_SEQUENCE))
                         {
+                        if ((ret->pkey.dsa = DSA_new()) == NULL)
+                                {
+                                X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
                         ret->pkey.dsa->write_params=0;
                         cp=p=a->parameter->value.sequence->data;
                         j=a->parameter->value.sequence->length;
-                        if (!d2i_DSAparams(&ret->pkey.dsa,&cp,(long)j))
+                        if (!d2i_DSAparams(&ret->pkey.dsa, &cp, (long)j))
                                 goto err;
                         }
                 ret->save_parameters=1;
                 }
 #endif
-        key->pkey=ret;
-        CRYPTO_add(&ret->references,1,CRYPTO_LOCK_EVP_PKEY);
+#ifndef OPENSSL_NO_EC
+        else if (ret->type == EVP_PKEY_EC)
+                {
+                if (a->parameter && (a->parameter->type == V_ASN1_SEQUENCE))
+                        {
+                        /* type == V_ASN1_SEQUENCE => we have explicit parameters
+                         * (e.g. parameters in the X9_62_EC_PARAMETERS-structure )
+                         */
+                        if ((ret->pkey.ec= EC_KEY_new()) == NULL)
+                                {
+                                X509err(X509_F_X509_PUBKEY_GET, 
+                                        ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+                        cp = p = a->parameter->value.sequence->data;
+                        j = a->parameter->value.sequence->length;
+                        if (!d2i_ECParameters(&ret->pkey.ec, &cp, (long)j))
+                                {
+                                X509err(X509_F_X509_PUBKEY_GET, ERR_R_EC_LIB);
+                                goto err;
+                                }
+                        }
+                else if (a->parameter && (a->parameter->type == V_ASN1_OBJECT))
+                        {
+                        /* type == V_ASN1_OBJECT => the parameters are given
+                         * by an asn1 OID
+                         */
+                        EC_KEY   *ec_key;
+                        EC_GROUP *group;
+
+                        if (ret->pkey.ec == NULL)
+                                ret->pkey.ec = EC_KEY_new();
+                        ec_key = ret->pkey.ec;
+                        if (ec_key == NULL)
+                                goto err;
+                        group = EC_GROUP_new_by_curve_name(OBJ_obj2nid(a->parameter->value.object));
+                        if (group == NULL)
+                                goto err;
+                        EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE);
+                        if (EC_KEY_set_group(ec_key, group) == 0)
+                                goto err;
+                        EC_GROUP_free(group);
+                        }
+                        /* the case implicitlyCA is currently not implemented */
+                ret->save_parameters = 1;
+                }
+#endif
+
+        p=key->public_key->data;
+        j=key->public_key->length;
+        if (!d2i_PublicKey(type, &ret, &p, (long)j))
+                {
+                X509err(X509_F_X509_PUBKEY_GET, X509_R_ERR_ASN1_LIB);
+                goto err;
+                }
+
+        key->pkey = ret;
+        CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_EVP_PKEY);
         return(ret);
 err:
         if (ret != NULL)
@@ -252,9 +380,9 @@ err:
  * and encode or decode as X509_PUBKEY
  */
 
-EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, unsigned char **pp,
+EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, const unsigned char **pp,
              long length)
-{
+        {
         X509_PUBKEY *xpk;
         EVP_PKEY *pktmp;
         xpk = d2i_X509_PUBKEY(NULL, pp, length);
@@ -262,15 +390,16 @@ EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, unsigned char **pp,
         pktmp = X509_PUBKEY_get(xpk);
         X509_PUBKEY_free(xpk);
         if(!pktmp) return NULL;
-        if(a) {
+        if(a)
+                {
                 EVP_PKEY_free(*a);
                 *a = pktmp;
-        }
+                }
         return pktmp;
-}
+        }
 
 int i2d_PUBKEY(EVP_PKEY *a, unsigned char **pp)
-{
+        {
         X509_PUBKEY *xpk=NULL;
         int ret;
         if(!a) return 0;
@@ -278,83 +407,125 @@ int i2d_PUBKEY(EVP_PKEY *a, unsigned char **pp)
         ret = i2d_X509_PUBKEY(xpk, pp);
         X509_PUBKEY_free(xpk);
         return ret;
-}
+        }
 
 /* The following are equivalents but which return RSA and DSA
  * keys
  */
 #ifndef OPENSSL_NO_RSA
-RSA *d2i_RSA_PUBKEY(RSA **a, unsigned char **pp,
+RSA *d2i_RSA_PUBKEY(RSA **a, const unsigned char **pp,
              long length)
-{
+        {
         EVP_PKEY *pkey;
         RSA *key;
-        unsigned char *q;
+        const unsigned char *q;
         q = *pp;
         pkey = d2i_PUBKEY(NULL, &q, length);
-        if(!pkey) return NULL;
+        if (!pkey) return NULL;
         key = EVP_PKEY_get1_RSA(pkey);
         EVP_PKEY_free(pkey);
-        if(!key) return NULL;
+        if (!key) return NULL;
         *pp = q;
-        if(a) {
+        if (a)
+                {
                 RSA_free(*a);
                 *a = key;
-        }
+                }
         return key;
-}
+        }
 
 int i2d_RSA_PUBKEY(RSA *a, unsigned char **pp)
-{
+        {
         EVP_PKEY *pktmp;
         int ret;
-        if(!a) return 0;
+        if (!a) return 0;
         pktmp = EVP_PKEY_new();
-        if(!pktmp) {
+        if (!pktmp)
+                {
                 ASN1err(ASN1_F_I2D_RSA_PUBKEY, ERR_R_MALLOC_FAILURE);
                 return 0;
-        }
+                }
         EVP_PKEY_set1_RSA(pktmp, a);
         ret = i2d_PUBKEY(pktmp, pp);
         EVP_PKEY_free(pktmp);
         return ret;
-}
+        }
 #endif
 
 #ifndef OPENSSL_NO_DSA
-DSA *d2i_DSA_PUBKEY(DSA **a, unsigned char **pp,
+DSA *d2i_DSA_PUBKEY(DSA **a, const unsigned char **pp,
              long length)
-{
+        {
         EVP_PKEY *pkey;
         DSA *key;
-        unsigned char *q;
+        const unsigned char *q;
         q = *pp;
         pkey = d2i_PUBKEY(NULL, &q, length);
-        if(!pkey) return NULL;
+        if (!pkey) return NULL;
         key = EVP_PKEY_get1_DSA(pkey);
         EVP_PKEY_free(pkey);
-        if(!key) return NULL;
+        if (!key) return NULL;
         *pp = q;
-        if(a) {
+        if (a)
+                {
                 DSA_free(*a);
                 *a = key;
-        }
+                }
         return key;
-}
+        }
 
 int i2d_DSA_PUBKEY(DSA *a, unsigned char **pp)
-{
+        {
         EVP_PKEY *pktmp;
         int ret;
         if(!a) return 0;
         pktmp = EVP_PKEY_new();
-        if(!pktmp) {
+        if(!pktmp)
+                {
                 ASN1err(ASN1_F_I2D_DSA_PUBKEY, ERR_R_MALLOC_FAILURE);
                 return 0;
-        }
+                }
         EVP_PKEY_set1_DSA(pktmp, a);
         ret = i2d_PUBKEY(pktmp, pp);
         EVP_PKEY_free(pktmp);
         return ret;
-}
+        }
+#endif
+
+#ifndef OPENSSL_NO_EC
+EC_KEY *d2i_EC_PUBKEY(EC_KEY **a, const unsigned char **pp, long length)
+        {
+        EVP_PKEY *pkey;
+        EC_KEY *key;
+        const unsigned char *q;
+        q = *pp;
+        pkey = d2i_PUBKEY(NULL, &q, length);
+        if (!pkey) return(NULL);
+        key = EVP_PKEY_get1_EC_KEY(pkey);
+        EVP_PKEY_free(pkey);
+        if (!key)  return(NULL);
+        *pp = q;
+        if (a)
+                {
+                EC_KEY_free(*a);
+                *a = key;
+                }
+        return(key);
+        }
+
+int i2d_EC_PUBKEY(EC_KEY *a, unsigned char **pp)
+        {
+        EVP_PKEY *pktmp;
+        int ret;
+        if (!a) return(0);
+        if ((pktmp = EVP_PKEY_new()) == NULL)
+                {
+                ASN1err(ASN1_F_I2D_EC_PUBKEY, ERR_R_MALLOC_FAILURE);
+                return(0);
+                }
+        EVP_PKEY_set1_EC_KEY(pktmp, a);
+        ret = i2d_PUBKEY(pktmp, pp);
+        EVP_PKEY_free(pktmp);
+        return(ret);
+        }
 #endif
diff --git a/src/lib/libssl/src/crypto/asn1/x_req.c b/src/lib/libssl/src/crypto/asn1/x_req.c
index b3f18ebc12..59ca8ce329 100644
--- a/src/lib/libssl/src/crypto/asn1/x_req.c
+++ b/src/lib/libssl/src/crypto/asn1/x_req.c
@@ -102,7 +102,7 @@ ASN1_SEQUENCE_enc(X509_REQ_INFO, enc, rinf_cb) = {
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_REQ_INFO)
 
-ASN1_SEQUENCE_ref(X509_REQ, 0, CRYPTO_LOCK_X509_INFO) = {
+ASN1_SEQUENCE_ref(X509_REQ, 0, CRYPTO_LOCK_X509_REQ) = {
         ASN1_SIMPLE(X509_REQ, req_info, X509_REQ_INFO),
         ASN1_SIMPLE(X509_REQ, sig_alg, X509_ALGOR),
         ASN1_SIMPLE(X509_REQ, signature, ASN1_BIT_STRING)
diff --git a/src/lib/libssl/src/crypto/asn1/x_x509.c b/src/lib/libssl/src/crypto/asn1/x_x509.c
index b50167ce43..e118696625 100644
--- a/src/lib/libssl/src/crypto/asn1/x_x509.c
+++ b/src/lib/libssl/src/crypto/asn1/x_x509.c
@@ -79,6 +79,8 @@ ASN1_SEQUENCE(X509_CINF) = {
 IMPLEMENT_ASN1_FUNCTIONS(X509_CINF)
 /* X509 top level structure needs a bit of customisation */
 
+extern void policy_cache_free(X509_POLICY_CACHE *cache);
+
 static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it)
 {
         X509 *ret = (X509 *)*pval;
@@ -92,6 +94,10 @@ static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it)
                 ret->ex_pathlen = -1;
                 ret->skid = NULL;
                 ret->akid = NULL;
+#ifndef OPENSSL_NO_RFC3779
+                ret->rfc3779_addr = NULL;
+                ret->rfc3779_asid = NULL;
+#endif
                 ret->aux = NULL;
                 CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509, ret, &ret->ex_data);
                 break;
@@ -106,6 +112,11 @@ static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it)
                 X509_CERT_AUX_free(ret->aux);
                 ASN1_OCTET_STRING_free(ret->skid);
                 AUTHORITY_KEYID_free(ret->akid);
+                policy_cache_free(ret->policy_cache);
+#ifndef OPENSSL_NO_RFC3779
+                sk_IPAddressFamily_pop_free(ret->rfc3779_addr, IPAddressFamily_free);
+                ASIdentifiers_free(ret->rfc3779_asid);
+#endif
 
                 if (ret->name != NULL) OPENSSL_free(ret->name);
                 break;
@@ -125,11 +136,13 @@ ASN1_SEQUENCE_ref(X509, x509_cb, CRYPTO_LOCK_X509) = {
 IMPLEMENT_ASN1_FUNCTIONS(X509)
 IMPLEMENT_ASN1_DUP_FUNCTION(X509)
 
-static ASN1_METHOD meth={
-        (int (*)())  i2d_X509,
-        (char *(*)())d2i_X509,
-        (char *(*)())X509_new,
-        (void (*)()) X509_free};
+static ASN1_METHOD meth=
+    {
+    (I2D_OF(void))  i2d_X509,
+    (D2I_OF(void)) d2i_X509,
+    (void *(*)(void))X509_new,
+    (void (*)(void *)) X509_free
+    };
 
 ASN1_METHOD *X509_asn1_meth(void)
         {
@@ -161,9 +174,9 @@ void *X509_get_ex_data(X509 *r, int idx)
  *
  */
 
-X509 *d2i_X509_AUX(X509 **a, unsigned char **pp, long length)
+X509 *d2i_X509_AUX(X509 **a, const unsigned char **pp, long length)
 {
-        unsigned char *q;
+        const unsigned char *q;
         X509 *ret;
         /* Save start position */
         q = *pp;
diff --git a/src/lib/libssl/src/crypto/asn1/x_x509a.c b/src/lib/libssl/src/crypto/asn1/x_x509a.c
index f244768b7e..13db5fd03f 100644
--- a/src/lib/libssl/src/crypto/asn1/x_x509a.c
+++ b/src/lib/libssl/src/crypto/asn1/x_x509a.c
@@ -91,6 +91,14 @@ static X509_CERT_AUX *aux_get(X509 *x)
 int X509_alias_set1(X509 *x, unsigned char *name, int len)
 {
         X509_CERT_AUX *aux;
+        if (!name)
+                {
+                if (!x || !x->aux || !x->aux->alias)
+                        return 1;
+                ASN1_UTF8STRING_free(x->aux->alias);
+                x->aux->alias = NULL;
+                return 1;
+                }
         if(!(aux = aux_get(x))) return 0;
         if(!aux->alias && !(aux->alias = ASN1_UTF8STRING_new())) return 0;
         return ASN1_STRING_set(aux->alias, name, len);
@@ -99,6 +107,14 @@ int X509_alias_set1(X509 *x, unsigned char *name, int len)
 int X509_keyid_set1(X509 *x, unsigned char *id, int len)
 {
         X509_CERT_AUX *aux;
+        if (!id)
+                {
+                if (!x || !x->aux || !x->aux->keyid)
+                        return 1;
+                ASN1_OCTET_STRING_free(x->aux->keyid);
+                x->aux->keyid = NULL;
+                return 1;
+                }
         if(!(aux = aux_get(x))) return 0;
         if(!aux->keyid && !(aux->keyid = ASN1_OCTET_STRING_new())) return 0;
         return ASN1_STRING_set(aux->keyid, id, len);
@@ -111,6 +127,13 @@ unsigned char *X509_alias_get0(X509 *x, int *len)
         return x->aux->alias->data;
 }
 
+unsigned char *X509_keyid_get0(X509 *x, int *len)
+{
+        if(!x->aux || !x->aux->keyid) return NULL;
+        if(len) *len = x->aux->keyid->length;
+        return x->aux->keyid->data;
+}
+
 int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj)
 {
         X509_CERT_AUX *aux;
@@ -149,3 +172,9 @@ void X509_reject_clear(X509 *x)
         }
 }
 
+ASN1_SEQUENCE(X509_CERT_PAIR) = {
+        ASN1_EXP_OPT(X509_CERT_PAIR, forward, X509, 0),
+        ASN1_EXP_OPT(X509_CERT_PAIR, reverse, X509, 1)
+} ASN1_SEQUENCE_END(X509_CERT_PAIR)
+
+IMPLEMENT_ASN1_FUNCTIONS(X509_CERT_PAIR)
diff --git a/src/lib/libssl/src/crypto/bf/bf_ecb.c b/src/lib/libssl/src/crypto/bf/bf_ecb.c
index 341991636f..1607cefa32 100644
--- a/src/lib/libssl/src/crypto/bf/bf_ecb.c
+++ b/src/lib/libssl/src/crypto/bf/bf_ecb.c
@@ -65,7 +65,7 @@
  * CAMBRIDGE SECURITY WORKSHOP, CAMBRIDGE, U.K., DECEMBER 9-11, 1993)
  */
 
-const char *BF_version="Blowfish" OPENSSL_VERSION_PTEXT;
+const char BF_version[]="Blowfish" OPENSSL_VERSION_PTEXT;
 
 const char *BF_options(void)
         {
diff --git a/src/lib/libssl/src/crypto/bf/bf_enc.c b/src/lib/libssl/src/crypto/bf/bf_enc.c
index b380acf959..2d21d09f42 100644
--- a/src/lib/libssl/src/crypto/bf/bf_enc.c
+++ b/src/lib/libssl/src/crypto/bf/bf_enc.c
@@ -73,7 +73,7 @@ void BF_encrypt(BF_LONG *data, const BF_KEY *key)
         {
 #ifndef BF_PTR2
         register BF_LONG l,r;
-    const register BF_LONG *p,*s;
+        register const BF_LONG *p,*s;
 
         p=key->P;
         s= &(key->S[0]);
@@ -150,7 +150,7 @@ void BF_decrypt(BF_LONG *data, const BF_KEY *key)
         {
 #ifndef BF_PTR2
         register BF_LONG l,r;
-    const register BF_LONG *p,*s;
+        register const BF_LONG *p,*s;
 
         p=key->P;
         s= &(key->S[0]);
diff --git a/src/lib/libssl/src/crypto/bf/bf_opts.c b/src/lib/libssl/src/crypto/bf/bf_opts.c
index 171dada2ca..1721bb99b4 100644
--- a/src/lib/libssl/src/crypto/bf/bf_opts.c
+++ b/src/lib/libssl/src/crypto/bf/bf_opts.c
@@ -69,7 +69,10 @@
 #include OPENSSL_UNISTD_IO
 OPENSSL_DECLARE_EXIT
 
+#ifndef OPENSSL_SYS_NETWARE
 #include <signal.h>
+#endif
+
 #ifndef _IRIX
 #include <time.h>
 #endif
diff --git a/src/lib/libssl/src/crypto/bf/bf_skey.c b/src/lib/libssl/src/crypto/bf/bf_skey.c
index 1931aba83f..3673cdee6e 100644
--- a/src/lib/libssl/src/crypto/bf/bf_skey.c
+++ b/src/lib/libssl/src/crypto/bf/bf_skey.c
@@ -58,13 +58,11 @@
 
 #include <stdio.h>
 #include <string.h>
-#include <openssl/crypto.h>
 #include <openssl/blowfish.h>
-#include <openssl/fips.h>
 #include "bf_locl.h"
 #include "bf_pi.h"
 
-FIPS_NON_FIPS_VCIPHER_Init(BF)
+void BF_set_key(BF_KEY *key, int len, const unsigned char *data)
         {
         int i;
         BF_LONG *p,ri,in[2];
diff --git a/src/lib/libssl/src/crypto/bf/bfspeed.c b/src/lib/libssl/src/crypto/bf/bfspeed.c
index f346af64f3..c41ef3b403 100644
--- a/src/lib/libssl/src/crypto/bf/bfspeed.c
+++ b/src/lib/libssl/src/crypto/bf/bfspeed.c
@@ -69,7 +69,10 @@
 #include OPENSSL_UNISTD_IO
 OPENSSL_DECLARE_EXIT
 
+#ifndef OPENSSL_SYS_NETWARE
 #include <signal.h>
+#endif
+
 #ifndef _IRIX
 #include <time.h>
 #endif
diff --git a/src/lib/libssl/src/crypto/bf/bftest.c b/src/lib/libssl/src/crypto/bf/bftest.c
index 24d526b14b..97e6634d37 100644
--- a/src/lib/libssl/src/crypto/bf/bftest.c
+++ b/src/lib/libssl/src/crypto/bf/bftest.c
@@ -62,6 +62,7 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
+#include <openssl/opensslconf.h> /* To see if OPENSSL_NO_BF is defined */
 
 #include "../e_os.h"
 
@@ -277,6 +278,9 @@ int main(int argc, char *argv[])
         else
                 ret=test();
 
+#ifdef OPENSSL_SYS_NETWARE
+    if (ret) printf("ERROR: %d\n", ret);
+#endif
         EXIT(ret);
         return(0);
         }
diff --git a/src/lib/libssl/src/crypto/bf/blowfish.h b/src/lib/libssl/src/crypto/bf/blowfish.h
index b4d8774961..cd49e85ab2 100644
--- a/src/lib/libssl/src/crypto/bf/blowfish.h
+++ b/src/lib/libssl/src/crypto/bf/blowfish.h
@@ -104,10 +104,7 @@ typedef struct bf_key_st
         BF_LONG S[4*256];
         } BF_KEY;
 
-
-#ifdef OPENSSL_FIPS 
-void private_BF_set_key(BF_KEY *key, int len, const unsigned char *data);
-#endif
+ 
 void BF_set_key(BF_KEY *key, int len, const unsigned char *data);
 
 void BF_encrypt(BF_LONG *data,const BF_KEY *key);
diff --git a/src/lib/libssl/src/crypto/bio/b_dump.c b/src/lib/libssl/src/crypto/bio/b_dump.c
index f671e722fa..c80ecc4295 100644
--- a/src/lib/libssl/src/crypto/bio/b_dump.c
+++ b/src/lib/libssl/src/crypto/bio/b_dump.c
@@ -62,30 +62,32 @@
 
 #include <stdio.h>
 #include "cryptlib.h"
-#include <openssl/bio.h>
+#include "bio_lcl.h"
 
 #define TRUNCATE
 #define DUMP_WIDTH      16
 #define DUMP_WIDTH_LESS_INDENT(i) (DUMP_WIDTH-((i-(i>6?6:i)+3)/4))
 
-int BIO_dump(BIO *bio, const char *s, int len)
+int BIO_dump_cb(int (*cb)(const void *data, size_t len, void *u),
+        void *u, const char *s, int len)
         {
-        return BIO_dump_indent(bio, s, len, 0);
+        return BIO_dump_indent_cb(cb, u, s, len, 0);
         }
 
-int BIO_dump_indent(BIO *bio, const char *s, int len, int indent)
+int BIO_dump_indent_cb(int (*cb)(const void *data, size_t len, void *u),
+        void *u, const char *s, int len, int indent)
         {
         int ret=0;
         char buf[288+1],tmp[20],str[128+1];
-        int i,j,rows,trunc;
+        int i,j,rows,trc;
         unsigned char ch;
         int dump_width;
-        
-        trunc=0;
-        
+
+        trc=0;
+
 #ifdef TRUNCATE
-        for(; (len > 0) && ((s[len-1] == ' ') || (s[len-1] == '\0')); len--) 
-                trunc++;
+        for(; (len > 0) && ((s[len-1] == ' ') || (s[len-1] == '\0')); len--)
+                trc++;
 #endif
 
         if (indent < 0)
@@ -96,7 +98,7 @@ int BIO_dump_indent(BIO *bio, const char *s, int len, int indent)
                 memset(str,' ',indent);
                 }
         str[indent]='\0';
-        
+
         dump_width=DUMP_WIDTH_LESS_INDENT(indent);
         rows=(len/dump_width);
         if ((rows*dump_width)<len)
@@ -117,7 +119,7 @@ int BIO_dump_indent(BIO *bio, const char *s, int len, int indent)
                                 {
                                 ch=((unsigned char)*(s+i*dump_width+j)) & 0xff;
                                 BIO_snprintf(tmp,sizeof tmp,"%02x%c",ch,
-                                         j==7?'-':' ');
+                                        j==7?'-':' ');
                                 BUF_strlcat(buf,tmp,sizeof buf);
                                 }
                         }
@@ -129,28 +131,57 @@ int BIO_dump_indent(BIO *bio, const char *s, int len, int indent)
                         ch=((unsigned char)*(s+i*dump_width+j)) & 0xff;
 #ifndef CHARSET_EBCDIC
                         BIO_snprintf(tmp,sizeof tmp,"%c",
-                                 ((ch>=' ')&&(ch<='~'))?ch:'.');
+                                ((ch>=' ')&&(ch<='~'))?ch:'.');
 #else
                         BIO_snprintf(tmp,sizeof tmp,"%c",
-                                 ((ch>=os_toascii[' '])&&(ch<=os_toascii['~']))
-                                 ? os_toebcdic[ch]
-                                 : '.');
+                                ((ch>=os_toascii[' '])&&(ch<=os_toascii['~']))
+                                ? os_toebcdic[ch]
+                                : '.');
 #endif
                         BUF_strlcat(buf,tmp,sizeof buf);
                         }
                 BUF_strlcat(buf,"\n",sizeof buf);
-                /* if this is the last call then update the ddt_dump thing so that
-                 * we will move the selection point in the debug window 
+                /* if this is the last call then update the ddt_dump thing so
+                 * that we will move the selection point in the debug window
                  */
-                ret+=BIO_write(bio,(char *)buf,strlen(buf));
+                ret+=cb((void *)buf,strlen(buf),u);
                 }
 #ifdef TRUNCATE
-        if (trunc > 0)
+        if (trc > 0)
                 {
                 BIO_snprintf(buf,sizeof buf,"%s%04x - <SPACES/NULS>\n",str,
-                         len+trunc);
-                ret+=BIO_write(bio,(char *)buf,strlen(buf));
+                        len+trc);
+                ret+=cb((void *)buf,strlen(buf),u);
                 }
 #endif
         return(ret);
         }
+
+#ifndef OPENSSL_NO_FP_API
+static int write_fp(const void *data, size_t len, void *fp)
+        {
+        return UP_fwrite(data, len, 1, fp);
+        }
+int BIO_dump_fp(FILE *fp, const char *s, int len)
+        {
+        return BIO_dump_cb(write_fp, fp, s, len);
+        }
+int BIO_dump_indent_fp(FILE *fp, const char *s, int len, int indent)
+        {
+        return BIO_dump_indent_cb(write_fp, fp, s, len, indent);
+        }
+#endif
+
+static int write_bio(const void *data, size_t len, void *bp)
+        {
+        return BIO_write((BIO *)bp, (const char *)data, len);
+        }
+int BIO_dump(BIO *bp, const char *s, int len)
+        {
+        return BIO_dump_cb(write_bio, bp, s, len);
+        }
+int BIO_dump_indent(BIO *bp, const char *s, int len, int indent)
+        {
+        return BIO_dump_indent_cb(write_bio, bp, s, len, indent);
+        }
+
diff --git a/src/lib/libssl/src/crypto/bio/b_print.c b/src/lib/libssl/src/crypto/bio/b_print.c
index f2bd91d5a0..2fffcfc025 100644
--- a/src/lib/libssl/src/crypto/bio/b_print.c
+++ b/src/lib/libssl/src/crypto/bio/b_print.c
@@ -79,7 +79,7 @@
 #include <openssl/bn.h>         /* To get BN_LLONG properly defined */
 #include <openssl/bio.h>
 
-#ifdef BN_LLONG
+#if defined(BN_LLONG) || defined(SIXTY_FOUR_BIT)
 # ifndef HAVE_LONG_LONG
 #  define HAVE_LONG_LONG 1
 # endif
@@ -117,7 +117,7 @@
 
 #if HAVE_LONG_LONG
 # if defined(OPENSSL_SYS_WIN32) && !defined(__GNUC__)
-# define LLONG _int64
+# define LLONG __int64
 # else
 # define LLONG long long
 # endif
@@ -482,7 +482,7 @@ fmtint(
     int flags)
 {
     int signvalue = 0;
-    char *prefix = "";
+    const char *prefix = "";
     unsigned LLONG uvalue;
     char convert[DECIMAL_SIZE(value)+3];
     int place = 0;
@@ -513,8 +513,8 @@ fmtint(
             (caps ? "0123456789ABCDEF" : "0123456789abcdef")
             [uvalue % (unsigned) base];
         uvalue = (uvalue / (unsigned) base);
-    } while (uvalue && (place < sizeof convert));
-    if (place == sizeof convert)
+    } while (uvalue && (place < (int)sizeof(convert)));
+    if (place == sizeof(convert))
         place--;
     convert[place] = 0;
 
@@ -619,6 +619,7 @@ fmtfp(
     int caps = 0;
     long intpart;
     long fracpart;
+    long max10;
 
     if (max < 0)
         max = 6;
@@ -639,11 +640,12 @@ fmtfp(
 
     /* we "cheat" by converting the fractional part to integer by
        multiplying by a factor of 10 */
-    fracpart = roundv((pow_10(max)) * (ufvalue - intpart));
+    max10 = roundv(pow_10(max));
+    fracpart = roundv(pow_10(max) * (ufvalue - intpart));
 
-    if (fracpart >= (long)pow_10(max)) {
+    if (fracpart >= max10) {
         intpart++;
-        fracpart -= (long)pow_10(max);
+        fracpart -= max10;
     }
 
     /* convert integer part */
@@ -652,7 +654,7 @@ fmtfp(
             (caps ? "0123456789ABCDEF"
               : "0123456789abcdef")[intpart % 10];
         intpart = (intpart / 10);
-    } while (intpart && (iplace < sizeof iconvert));
+    } while (intpart && (iplace < (int)sizeof(iconvert)));
     if (iplace == sizeof iconvert)
         iplace--;
     iconvert[iplace] = 0;
diff --git a/src/lib/libssl/src/crypto/bio/b_sock.c b/src/lib/libssl/src/crypto/bio/b_sock.c
index c851298d1e..ead477d8a2 100644
--- a/src/lib/libssl/src/crypto/bio/b_sock.c
+++ b/src/lib/libssl/src/crypto/bio/b_sock.c
@@ -56,14 +56,21 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_SOCK
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <errno.h>
 #define USE_SOCKETS
 #include "cryptlib.h"
 #include <openssl/bio.h>
+#if defined(OPENSSL_SYS_NETWARE) && defined(NETWARE_BSDSOCK)
+#include <netdb.h>
+#if defined(NETWARE_CLIB)
+#include <sys/ioctl.h>
+NETDB_DEFINE_CONTEXT
+#endif
+#endif
+
+#ifndef OPENSSL_NO_SOCK
 
 #ifdef OPENSSL_SYS_WIN16
 #define SOCKET_PROTOCOL 0 /* more microsoft stupidity */
@@ -79,7 +86,7 @@
 #define MAX_LISTEN  32
 #endif
 
-#ifdef OPENSSL_SYS_WINDOWS
+#if defined(OPENSSL_SYS_WINDOWS) || (defined(OPENSSL_SYS_NETWARE) && !defined(NETWARE_BSDSOCK))
 static int wsa_init_done=0;
 #endif
 
@@ -175,11 +182,11 @@ int BIO_get_port(const char *str, unsigned short *port_ptr)
                 /* Note: under VMS with SOCKETSHR, it seems like the first
                  * parameter is 'char *', instead of 'const char *'
                  */
-                s=getservbyname(
 #ifndef CONST_STRICT
-                    (char *)
+                s=getservbyname((char *)str,"tcp");
+#else
+                s=getservbyname(str,"tcp");
 #endif
-                    str,"tcp");
                 if(s != NULL)
                         *port_ptr=ntohs((unsigned short)s->s_port);
                 CRYPTO_w_unlock(CRYPTO_LOCK_GETSERVBYNAME);
@@ -357,7 +364,11 @@ struct hostent *BIO_gethostbyname(const char *name)
 #if 1
         /* Caching gethostbyname() results forever is wrong,
          * so we have to let the true gethostbyname() worry about this */
+#if (defined(NETWARE_BSDSOCK) && !defined(__NOVELL_LIBC__))
+        return gethostbyname((char*)name);
+#else
         return gethostbyname(name);
+#endif
 #else
         struct hostent *ret;
         int i,lowi=0,j;
@@ -397,11 +408,11 @@ struct hostent *BIO_gethostbyname(const char *name)
                 /* Note: under VMS with SOCKETSHR, it seems like the first
                  * parameter is 'char *', instead of 'const char *'
                  */
-                ret=gethostbyname(
 #  ifndef CONST_STRICT
-                    (char *)
+                ret=gethostbyname((char *)name);
+#  else
+                ret=gethostbyname(name);
 #  endif
-                    name);
 
                 if (ret == NULL)
                         goto end;
@@ -453,9 +464,6 @@ int BIO_sock_init(void)
                 {
                 int err;
           
-#ifdef SIGINT
-                signal(SIGINT,(void (*)(int))BIO_sock_cleanup);
-#endif
                 wsa_init_done=1;
                 memset(&wsa_state,0,sizeof(wsa_state));
                 if (WSAStartup(0x0101,&wsa_state)!=0)
@@ -473,6 +481,26 @@ int BIO_sock_init(void)
         if (sock_init())
                 return (-1);
 #endif
+
+#if defined(OPENSSL_SYS_NETWARE) && !defined(NETWARE_BSDSOCK)
+    WORD wVerReq;
+    WSADATA wsaData;
+    int err;
+
+    if (!wsa_init_done)
+    {
+        wsa_init_done=1;
+        wVerReq = MAKEWORD( 2, 0 );
+        err = WSAStartup(wVerReq,&wsaData);
+        if (err != 0)
+        {
+            SYSerr(SYS_F_WSASTARTUP,err);
+            BIOerr(BIO_F_BIO_SOCK_INIT,BIO_R_WSASTARTUP);
+            return(-1);
+                        }
+                }
+#endif
+
         return(1);
         }
 
@@ -483,10 +511,16 @@ void BIO_sock_cleanup(void)
                 {
                 wsa_init_done=0;
 #ifndef OPENSSL_SYS_WINCE
-                WSACancelBlockingCall();
+                WSACancelBlockingCall();        /* Winsock 1.1 specific */
 #endif
                 WSACleanup();
                 }
+#elif defined(OPENSSL_SYS_NETWARE) && !defined(NETWARE_BSDSOCK)
+   if (wsa_init_done)
+        {
+        wsa_init_done=0;
+        WSACleanup();
+                }
 #endif
         }
 
diff --git a/src/lib/libssl/src/crypto/bio/bf_nbio.c b/src/lib/libssl/src/crypto/bio/bf_nbio.c
index 1ce2bfacc0..c72a23c2e1 100644
--- a/src/lib/libssl/src/crypto/bio/bf_nbio.c
+++ b/src/lib/libssl/src/crypto/bio/bf_nbio.c
@@ -127,7 +127,7 @@ static int nbiof_read(BIO *b, char *out, int outl)
         {
         NBIO_TEST *nt;
         int ret=0;
-#if 0
+#if 1
         int num;
         unsigned char n;
 #endif
@@ -137,7 +137,7 @@ static int nbiof_read(BIO *b, char *out, int outl)
         nt=(NBIO_TEST *)b->ptr;
 
         BIO_clear_retry_flags(b);
-#if 0
+#if 1
         RAND_pseudo_bytes(&n,1);
         num=(n&0x07);
 
diff --git a/src/lib/libssl/src/crypto/bio/bio.h b/src/lib/libssl/src/crypto/bio/bio.h
index 2eb703830f..cecb6a7207 100644
--- a/src/lib/libssl/src/crypto/bio/bio.h
+++ b/src/lib/libssl/src/crypto/bio/bio.h
@@ -59,13 +59,14 @@
 #ifndef HEADER_BIO_H
 #define HEADER_BIO_H
 
+#include <openssl/e_os2.h>
+
 #ifndef OPENSSL_NO_FP_API
 # include <stdio.h>
 #endif
 #include <stdarg.h>
 
 #include <openssl/crypto.h>
-#include <openssl/e_os2.h>
 
 #ifdef  __cplusplus
 extern "C" {
@@ -93,6 +94,8 @@ extern "C" {
 #define BIO_TYPE_BER            (18|0x0200)             /* BER -> bin filter */
 #define BIO_TYPE_BIO            (19|0x0400)             /* (half a) BIO pair */
 #define BIO_TYPE_LINEBUFFER     (20|0x0200)             /* filter */
+#define BIO_TYPE_DGRAM          (21|0x0400|0x0100)
+#define BIO_TYPE_COMP           (23|0x0200)             /* filter */
 
 #define BIO_TYPE_DESCRIPTOR     0x0100  /* socket, fd, connect or accept */
 #define BIO_TYPE_FILTER         0x0200
@@ -124,6 +127,38 @@ extern "C" {
 
 #define BIO_CTRL_SET_FILENAME   30      /* BIO_s_file special */
 
+/* dgram BIO stuff */
+#define BIO_CTRL_DGRAM_CONNECT       31  /* BIO dgram special */
+#define BIO_CTRL_DGRAM_SET_CONNECTED 32  /* allow for an externally
+                                          * connected socket to be
+                                          * passed in */ 
+#define BIO_CTRL_DGRAM_SET_RECV_TIMEOUT 33 /* setsockopt, essentially */
+#define BIO_CTRL_DGRAM_GET_RECV_TIMEOUT 34 /* getsockopt, essentially */
+#define BIO_CTRL_DGRAM_SET_SEND_TIMEOUT 35 /* setsockopt, essentially */
+#define BIO_CTRL_DGRAM_GET_SEND_TIMEOUT 36 /* getsockopt, essentially */
+
+#define BIO_CTRL_DGRAM_GET_RECV_TIMER_EXP 37 /* flag whether the last */
+#define BIO_CTRL_DGRAM_GET_SEND_TIMER_EXP 38 /* I/O operation tiemd out */
+                                        
+/* #ifdef IP_MTU_DISCOVER */
+#define BIO_CTRL_DGRAM_MTU_DISCOVER       39 /* set DF bit on egress packets */
+/* #endif */
+
+#define BIO_CTRL_DGRAM_QUERY_MTU          40 /* as kernel for current MTU */
+#define BIO_CTRL_DGRAM_GET_MTU            41 /* get cached value for MTU */
+#define BIO_CTRL_DGRAM_SET_MTU            42 /* set cached value for
+                                              * MTU. want to use this
+                                              * if asking the kernel
+                                              * fails */
+
+#define BIO_CTRL_DGRAM_MTU_EXCEEDED       43 /* check whether the MTU
+                                              * was exceed in the
+                                              * previous write
+                                              * operation */
+
+#define BIO_CTRL_DGRAM_SET_PEER           44 /* Destination for the data */
+
+
 /* modifiers */
 #define BIO_FP_READ             0x02
 #define BIO_FP_WRITE            0x04
@@ -135,6 +170,11 @@ extern "C" {
 #define BIO_FLAGS_IO_SPECIAL    0x04
 #define BIO_FLAGS_RWS (BIO_FLAGS_READ|BIO_FLAGS_WRITE|BIO_FLAGS_IO_SPECIAL)
 #define BIO_FLAGS_SHOULD_RETRY  0x08
+#ifndef BIO_FLAGS_UPLINK
+/* "UPLINK" flag denotes file descriptors provided by application.
+   It defaults to 0, as most platforms don't require UPLINK interface. */
+#define BIO_FLAGS_UPLINK        0
+#endif
 
 /* Used in BIO_gethostbyname() */
 #define BIO_GHBN_CTRL_HITS              1
@@ -157,28 +197,32 @@ extern "C" {
  */
 #define BIO_FLAGS_MEM_RDONLY    0x200
 
-#define BIO_set_flags(b,f) ((b)->flags|=(f))
-#define BIO_get_flags(b) ((b)->flags)
+typedef struct bio_st BIO;
+
+void BIO_set_flags(BIO *b, int flags);
+int  BIO_test_flags(const BIO *b, int flags);
+void BIO_clear_flags(BIO *b, int flags);
+
+#define BIO_get_flags(b) BIO_test_flags(b, ~(0x0))
 #define BIO_set_retry_special(b) \
-                ((b)->flags|=(BIO_FLAGS_IO_SPECIAL|BIO_FLAGS_SHOULD_RETRY))
+                BIO_set_flags(b, (BIO_FLAGS_IO_SPECIAL|BIO_FLAGS_SHOULD_RETRY))
 #define BIO_set_retry_read(b) \
-                ((b)->flags|=(BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY))
+                BIO_set_flags(b, (BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY))
 #define BIO_set_retry_write(b) \
-                ((b)->flags|=(BIO_FLAGS_WRITE|BIO_FLAGS_SHOULD_RETRY))
+                BIO_set_flags(b, (BIO_FLAGS_WRITE|BIO_FLAGS_SHOULD_RETRY))
 
 /* These are normally used internally in BIOs */
-#define BIO_clear_flags(b,f) ((b)->flags&= ~(f))
 #define BIO_clear_retry_flags(b) \
-                ((b)->flags&= ~(BIO_FLAGS_RWS|BIO_FLAGS_SHOULD_RETRY))
+                BIO_clear_flags(b, (BIO_FLAGS_RWS|BIO_FLAGS_SHOULD_RETRY))
 #define BIO_get_retry_flags(b) \
-                ((b)->flags&(BIO_FLAGS_RWS|BIO_FLAGS_SHOULD_RETRY))
+                BIO_test_flags(b, (BIO_FLAGS_RWS|BIO_FLAGS_SHOULD_RETRY))
 
 /* These should be used by the application to tell why we should retry */
-#define BIO_should_read(a)              ((a)->flags & BIO_FLAGS_READ)
-#define BIO_should_write(a)             ((a)->flags & BIO_FLAGS_WRITE)
-#define BIO_should_io_special(a)        ((a)->flags & BIO_FLAGS_IO_SPECIAL)
-#define BIO_retry_type(a)               ((a)->flags & BIO_FLAGS_RWS)
-#define BIO_should_retry(a)             ((a)->flags & BIO_FLAGS_SHOULD_RETRY)
+#define BIO_should_read(a)              BIO_test_flags(a, BIO_FLAGS_READ)
+#define BIO_should_write(a)             BIO_test_flags(a, BIO_FLAGS_WRITE)
+#define BIO_should_io_special(a)        BIO_test_flags(a, BIO_FLAGS_IO_SPECIAL)
+#define BIO_retry_type(a)               BIO_test_flags(a, BIO_FLAGS_RWS)
+#define BIO_should_retry(a)             BIO_test_flags(a, BIO_FLAGS_SHOULD_RETRY)
 
 /* The next three are used in conjunction with the
  * BIO_should_io_special() condition.  After this returns true,
@@ -207,14 +251,14 @@ extern "C" {
 #define BIO_cb_pre(a)   (!((a)&BIO_CB_RETURN))
 #define BIO_cb_post(a)  ((a)&BIO_CB_RETURN)
 
-#define BIO_set_callback(b,cb)          ((b)->callback=(cb))
-#define BIO_set_callback_arg(b,arg)     ((b)->cb_arg=(char *)(arg))
-#define BIO_get_callback_arg(b)         ((b)->cb_arg)
-#define BIO_get_callback(b)             ((b)->callback)
-#define BIO_method_name(b)              ((b)->method->name)
-#define BIO_method_type(b)              ((b)->method->type)
+long (*BIO_get_callback(const BIO *b)) (struct bio_st *,int,const char *,int, long,long);
+void BIO_set_callback(BIO *b, 
+        long (*callback)(struct bio_st *,int,const char *,int, long,long));
+char *BIO_get_callback_arg(const BIO *b);
+void BIO_set_callback_arg(BIO *b, char *arg);
 
-typedef struct bio_st BIO;
+const char * BIO_method_name(const BIO *b);
+int BIO_method_type(const BIO *b);
 
 typedef void bio_info_cb(struct bio_st *, int, const char *, int, long, long);
 
@@ -488,6 +532,18 @@ size_t BIO_ctrl_get_write_guarantee(BIO *b);
 size_t BIO_ctrl_get_read_request(BIO *b);
 int BIO_ctrl_reset_read_request(BIO *b);
 
+/* ctrl macros for dgram */
+#define BIO_ctrl_dgram_connect(b,peer)  \
+                     (int)BIO_ctrl(b,BIO_CTRL_DGRAM_CONNECT,0, (char *)peer)
+#define BIO_ctrl_set_connected(b, state, peer) \
+         (int)BIO_ctrl(b, BIO_CTRL_DGRAM_SET_CONNECTED, state, (char *)peer)
+#define BIO_dgram_recv_timedout(b) \
+         (int)BIO_ctrl(b, BIO_CTRL_DGRAM_GET_RECV_TIMER_EXP, 0, NULL)
+#define BIO_dgram_send_timedout(b) \
+         (int)BIO_ctrl(b, BIO_CTRL_DGRAM_GET_SEND_TIMER_EXP, 0, NULL)
+#define BIO_dgram_set_peer(b,peer) \
+         (int)BIO_ctrl(b, BIO_CTRL_DGRAM_SET_PEER, 0, (char *)peer)
+
 /* These two aren't currently implemented */
 /* int BIO_get_ex_num(BIO *bio); */
 /* void BIO_set_ex_free_func(BIO *bio,int idx,void (*cb)()); */
@@ -567,15 +623,28 @@ BIO_METHOD *BIO_f_buffer(void);
 BIO_METHOD *BIO_f_linebuffer(void);
 #endif
 BIO_METHOD *BIO_f_nbio_test(void);
+#ifndef OPENSSL_NO_DGRAM
+BIO_METHOD *BIO_s_datagram(void);
+#endif
+
 /* BIO_METHOD *BIO_f_ber(void); */
 
 int BIO_sock_should_retry(int i);
 int BIO_sock_non_fatal_error(int error);
+int BIO_dgram_non_fatal_error(int error);
+
 int BIO_fd_should_retry(int i);
 int BIO_fd_non_fatal_error(int error);
+int BIO_dump_cb(int (*cb)(const void *data, size_t len, void *u),
+                void *u, const char *s, int len);
+int BIO_dump_indent_cb(int (*cb)(const void *data, size_t len, void *u),
+                       void *u, const char *s, int len, int indent);
 int BIO_dump(BIO *b,const char *bytes,int len);
 int BIO_dump_indent(BIO *b,const char *bytes,int len,int indent);
-
+#ifndef OPENSSL_NO_FP_API
+int BIO_dump_fp(FILE *fp, const char *s, int len);
+int BIO_dump_indent_fp(FILE *fp, const char *s, int len, int indent);
+#endif
 struct hostent *BIO_gethostbyname(const char *name);
 /* We might want a thread-safe interface too:
  * struct hostent *BIO_gethostbyname_r(const char *name,
@@ -597,6 +666,7 @@ void BIO_sock_cleanup(void);
 int BIO_set_tcp_ndelay(int sock,int turn_on);
 
 BIO *BIO_new_socket(int sock, int close_flag);
+BIO *BIO_new_dgram(int fd, int close_flag);
 BIO *BIO_new_fd(int fd, int close_flag);
 BIO *BIO_new_connect(char *host_port);
 BIO *BIO_new_accept(char *host_port);
@@ -612,10 +682,20 @@ void BIO_copy_next_retry(BIO *b);
 
 /*long BIO_ghbn_ctrl(int cmd,int iarg,char *parg);*/
 
-int BIO_printf(BIO *bio, const char *format, ...);
-int BIO_vprintf(BIO *bio, const char *format, va_list args);
-int BIO_snprintf(char *buf, size_t n, const char *format, ...);
-int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args);
+#ifdef __GNUC__
+#  define __bio_h__attr__ __attribute__
+#else
+#  define __bio_h__attr__(x)
+#endif
+int BIO_printf(BIO *bio, const char *format, ...)
+        __bio_h__attr__((__format__(__printf__,2,3)));
+int BIO_vprintf(BIO *bio, const char *format, va_list args)
+        __bio_h__attr__((__format__(__printf__,2,0)));
+int BIO_snprintf(char *buf, size_t n, const char *format, ...)
+        __bio_h__attr__((__format__(__printf__,3,4)));
+int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
+        __bio_h__attr__((__format__(__printf__,3,0)));
+#undef __bio_h__attr__
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -629,6 +709,7 @@ void ERR_load_BIO_strings(void);
 #define BIO_F_ACPT_STATE                                 100
 #define BIO_F_BIO_ACCEPT                                 101
 #define BIO_F_BIO_BER_GET_HEADER                         102
+#define BIO_F_BIO_CALLBACK_CTRL                          131
 #define BIO_F_BIO_CTRL                                   103
 #define BIO_F_BIO_GETHOSTBYNAME                          120
 #define BIO_F_BIO_GETS                                   104
diff --git a/src/lib/libssl/src/crypto/bio/bio_err.c b/src/lib/libssl/src/crypto/bio/bio_err.c
index 8859a58ae4..6603f1c74d 100644
--- a/src/lib/libssl/src/crypto/bio/bio_err.c
+++ b/src/lib/libssl/src/crypto/bio/bio_err.c
@@ -73,6 +73,7 @@ static ERR_STRING_DATA BIO_str_functs[]=
 {ERR_FUNC(BIO_F_ACPT_STATE),    "ACPT_STATE"},
 {ERR_FUNC(BIO_F_BIO_ACCEPT),    "BIO_accept"},
 {ERR_FUNC(BIO_F_BIO_BER_GET_HEADER),    "BIO_BER_GET_HEADER"},
+{ERR_FUNC(BIO_F_BIO_CALLBACK_CTRL),     "BIO_callback_ctrl"},
 {ERR_FUNC(BIO_F_BIO_CTRL),      "BIO_ctrl"},
 {ERR_FUNC(BIO_F_BIO_GETHOSTBYNAME),     "BIO_gethostbyname"},
 {ERR_FUNC(BIO_F_BIO_GETS),      "BIO_gets"},
@@ -142,15 +143,12 @@ static ERR_STRING_DATA BIO_str_reasons[]=
 
 void ERR_load_BIO_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(BIO_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,BIO_str_functs);
                 ERR_load_strings(0,BIO_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/bio/bio_lib.c b/src/lib/libssl/src/crypto/bio/bio_lib.c
index 692c8fb5c6..3f52ae953c 100644
--- a/src/lib/libssl/src/crypto/bio/bio_lib.c
+++ b/src/lib/libssl/src/crypto/bio/bio_lib.c
@@ -141,10 +141,56 @@ int BIO_free(BIO *a)
 void BIO_vfree(BIO *a)
     { BIO_free(a); }
 
+void BIO_clear_flags(BIO *b, int flags)
+        {
+        b->flags &= ~flags;
+        }
+
+int     BIO_test_flags(const BIO *b, int flags)
+        {
+        return (b->flags & flags);
+        }
+
+void    BIO_set_flags(BIO *b, int flags)
+        {
+        b->flags |= flags;
+        }
+
+long (*BIO_get_callback(const BIO *b))(struct bio_st *,int,const char *,int, long,long)
+        {
+        return b->callback;
+        }
+
+void BIO_set_callback(BIO *b, long (*cb)(struct bio_st *,int,const char *,int, long,long))
+        {
+        b->callback = cb;
+        }
+
+void BIO_set_callback_arg(BIO *b, char *arg)
+        {
+        b->cb_arg = arg;
+        }
+
+char * BIO_get_callback_arg(const BIO *b)
+        {
+        return b->cb_arg;
+        }
+
+const char * BIO_method_name(const BIO *b)
+        {
+        return b->method->name;
+        }
+
+int BIO_method_type(const BIO *b)
+        {
+        return b->method->type;
+        }
+
+
 int BIO_read(BIO *b, void *out, int outl)
         {
         int i;
-        long (*cb)();
+        long (*cb)(BIO *,int,const char *,int,long,long);
 
         if ((b == NULL) || (b->method == NULL) || (b->method->bread == NULL))
                 {
@@ -176,7 +222,7 @@ int BIO_read(BIO *b, void *out, int outl)
 int BIO_write(BIO *b, const void *in, int inl)
         {
         int i;
-        long (*cb)();
+        long (*cb)(BIO *,int,const char *,int,long,long);
 
         if (b == NULL)
                 return(0);
@@ -211,7 +257,7 @@ int BIO_write(BIO *b, const void *in, int inl)
 int BIO_puts(BIO *b, const char *in)
         {
         int i;
-        long (*cb)();
+        long (*cb)(BIO *,int,const char *,int,long,long);
 
         if ((b == NULL) || (b->method == NULL) || (b->method->bputs == NULL))
                 {
@@ -244,7 +290,7 @@ int BIO_puts(BIO *b, const char *in)
 int BIO_gets(BIO *b, char *in, int inl)
         {
         int i;
-        long (*cb)();
+        long (*cb)(BIO *,int,const char *,int,long,long);
 
         if ((b == NULL) || (b->method == NULL) || (b->method->bgets == NULL))
                 {
@@ -305,7 +351,7 @@ char *BIO_ptr_ctrl(BIO *b, int cmd, long larg)
 long BIO_ctrl(BIO *b, int cmd, long larg, void *parg)
         {
         long ret;
-        long (*cb)();
+        long (*cb)(BIO *,int,const char *,int,long,long);
 
         if (b == NULL) return(0);
 
@@ -332,13 +378,13 @@ long BIO_ctrl(BIO *b, int cmd, long larg, void *parg)
 long BIO_callback_ctrl(BIO *b, int cmd, void (*fp)(struct bio_st *, int, const char *, int, long, long))
         {
         long ret;
-        long (*cb)();
+        long (*cb)(BIO *,int,const char *,int,long,long);
 
         if (b == NULL) return(0);
 
         if ((b->method == NULL) || (b->method->callback_ctrl == NULL))
                 {
-                BIOerr(BIO_F_BIO_CTRL,BIO_R_UNSUPPORTED_METHOD);
+                BIOerr(BIO_F_BIO_CALLBACK_CTRL,BIO_R_UNSUPPORTED_METHOD);
                 return(-2);
                 }
 
diff --git a/src/lib/libssl/src/crypto/bio/bss_acpt.c b/src/lib/libssl/src/crypto/bio/bss_acpt.c
index 8ea1db158b..d090b7272f 100644
--- a/src/lib/libssl/src/crypto/bio/bss_acpt.c
+++ b/src/lib/libssl/src/crypto/bio/bss_acpt.c
@@ -56,14 +56,14 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_SOCK
-
 #include <stdio.h>
 #include <errno.h>
 #define USE_SOCKETS
 #include "cryptlib.h"
 #include <openssl/bio.h>
 
+#ifndef OPENSSL_NO_SOCK
+
 #ifdef OPENSSL_SYS_WIN16
 #define SOCKET_PROTOCOL 0 /* more microsoft stupidity */
 #else
diff --git a/src/lib/libssl/src/crypto/bio/bss_conn.c b/src/lib/libssl/src/crypto/bio/bss_conn.c
index 216780ed5e..c14727855b 100644
--- a/src/lib/libssl/src/crypto/bio/bss_conn.c
+++ b/src/lib/libssl/src/crypto/bio/bss_conn.c
@@ -56,14 +56,14 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_SOCK
-
 #include <stdio.h>
 #include <errno.h>
 #define USE_SOCKETS
 #include "cryptlib.h"
 #include <openssl/bio.h>
 
+#ifndef OPENSSL_NO_SOCK
+
 #ifdef OPENSSL_SYS_WIN16
 #define SOCKET_PROTOCOL 0 /* more microsoft stupidity */
 #else
@@ -130,7 +130,7 @@ static int conn_state(BIO *b, BIO_CONNECT *c)
         int ret= -1,i;
         unsigned long l;
         char *p,*q;
-        int (*cb)()=NULL;
+        int (*cb)(const BIO *,int,int)=NULL;
 
         if (c->info_callback != NULL)
                 cb=c->info_callback;
@@ -590,9 +590,9 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
                 break;
         case BIO_CTRL_GET_CALLBACK:
                 {
-                int (**fptr)();
+                int (**fptr)(const BIO *bio,int state,int xret);
 
-                fptr=(int (**)())ptr;
+                fptr=(int (**)(const BIO *bio,int state,int xret))ptr;
                 *fptr=data->info_callback;
                 }
                 break;
diff --git a/src/lib/libssl/src/crypto/bio/bss_fd.c b/src/lib/libssl/src/crypto/bio/bss_fd.c
index 5e3e187de6..4c229bf641 100644
--- a/src/lib/libssl/src/crypto/bio/bss_fd.c
+++ b/src/lib/libssl/src/crypto/bio/bss_fd.c
@@ -60,7 +60,19 @@
 #include <errno.h>
 #define USE_SOCKETS
 #include "cryptlib.h"
-#include <openssl/bio.h>
+/*
+ * As for unconditional usage of "UPLINK" interface in this module.
+ * Trouble is that unlike Unix file descriptors [which are indexes
+ * in kernel-side per-process table], corresponding descriptors on
+ * platforms which require "UPLINK" interface seem to be indexes
+ * in a user-land, non-global table. Well, in fact they are indexes
+ * in stdio _iob[], and recall that _iob[] was the very reason why
+ * "UPLINK" interface was introduced in first place. But one way on
+ * another. Neither libcrypto or libssl use this BIO meaning that
+ * file descriptors can only be provided by application. Therefore
+ * "UPLINK" calls are due...
+ */
+#include "bio_lcl.h"
 
 static int fd_write(BIO *h, const char *buf, int num);
 static int fd_read(BIO *h, char *buf, int size);
@@ -100,9 +112,9 @@ BIO *BIO_new_fd(int fd,int close_flag)
 static int fd_new(BIO *bi)
         {
         bi->init=0;
-        bi->num=0;
+        bi->num=-1;
         bi->ptr=NULL;
-        bi->flags=0;
+        bi->flags=BIO_FLAGS_UPLINK; /* essentially redundant */
         return(1);
         }
 
@@ -113,10 +125,10 @@ static int fd_free(BIO *a)
                 {
                 if (a->init)
                         {
-                        close(a->num);
+                        UP_close(a->num);
                         }
                 a->init=0;
-                a->flags=0;
+                a->flags=BIO_FLAGS_UPLINK;
                 }
         return(1);
         }
@@ -128,7 +140,7 @@ static int fd_read(BIO *b, char *out,int outl)
         if (out != NULL)
                 {
                 clear_sys_error();
-                ret=read(b->num,out,outl);
+                ret=UP_read(b->num,out,outl);
                 BIO_clear_retry_flags(b);
                 if (ret <= 0)
                         {
@@ -143,7 +155,7 @@ static int fd_write(BIO *b, const char *in, int inl)
         {
         int ret;
         clear_sys_error();
-        ret=write(b->num,in,inl);
+        ret=UP_write(b->num,in,inl);
         BIO_clear_retry_flags(b);
         if (ret <= 0)
                 {
@@ -163,11 +175,11 @@ static long fd_ctrl(BIO *b, int cmd, long num, void *ptr)
         case BIO_CTRL_RESET:
                 num=0;
         case BIO_C_FILE_SEEK:
-                ret=(long)lseek(b->num,num,0);
+                ret=(long)UP_lseek(b->num,num,0);
                 break;
         case BIO_C_FILE_TELL:
         case BIO_CTRL_INFO:
-                ret=(long)lseek(b->num,0,1);
+                ret=(long)UP_lseek(b->num,0,1);
                 break;
         case BIO_C_SET_FD:
                 fd_free(b);
diff --git a/src/lib/libssl/src/crypto/bio/bss_file.c b/src/lib/libssl/src/crypto/bio/bss_file.c
index 58fade9f29..0c8c8115fa 100644
--- a/src/lib/libssl/src/crypto/bio/bss_file.c
+++ b/src/lib/libssl/src/crypto/bio/bss_file.c
@@ -65,12 +65,34 @@
 #ifndef HEADER_BSS_FILE_C
 #define HEADER_BSS_FILE_C
 
+#if defined(__linux) || defined(__sun) || defined(__hpux)
+/* Following definition aliases fopen to fopen64 on above mentioned
+ * platforms. This makes it possible to open and sequentially access
+ * files larger than 2GB from 32-bit application. It does not allow to
+ * traverse them beyond 2GB with fseek/ftell, but on the other hand *no*
+ * 32-bit platform permits that, not with fseek/ftell. Not to mention
+ * that breaking 2GB limit for seeking would require surgery to *our*
+ * API. But sequential access suffices for practical cases when you
+ * can run into large files, such as fingerprinting, so we can let API
+ * alone. For reference, the list of 32-bit platforms which allow for
+ * sequential access of large files without extra "magic" comprise *BSD,
+ * Darwin, IRIX...
+ */
+#ifndef _FILE_OFFSET_BITS
+#define _FILE_OFFSET_BITS 64
+#endif
+#endif
+
 #include <stdio.h>
 #include <errno.h>
 #include "cryptlib.h"
-#include <openssl/bio.h>
+#include "bio_lcl.h"
 #include <openssl/err.h>
 
+#if defined(OPENSSL_SYS_NETWARE) && defined(NETWARE_CLIB)
+#include <nwfileio.h>
+#endif
+
 #if !defined(OPENSSL_NO_STDIO)
 
 static int MS_CALLBACK file_write(BIO *h, const char *buf, int num);
@@ -110,8 +132,12 @@ BIO *BIO_new_file(const char *filename, const char *mode)
                 return(NULL);
                 }
         if ((ret=BIO_new(BIO_s_file_internal())) == NULL)
+                {
+                fclose(file);
                 return(NULL);
+                }
 
+        BIO_clear_flags(ret,BIO_FLAGS_UPLINK); /* we did fopen -> we disengage UPLINK */
         BIO_set_fp(ret,file,BIO_CLOSE);
         return(ret);
         }
@@ -123,6 +149,7 @@ BIO *BIO_new_fp(FILE *stream, int close_flag)
         if ((ret=BIO_new(BIO_s_file())) == NULL)
                 return(NULL);
 
+        BIO_set_flags(ret,BIO_FLAGS_UPLINK); /* redundant, left for documentation puposes */
         BIO_set_fp(ret,stream,close_flag);
         return(ret);
         }
@@ -137,6 +164,7 @@ static int MS_CALLBACK file_new(BIO *bi)
         bi->init=0;
         bi->num=0;
         bi->ptr=NULL;
+        bi->flags=BIO_FLAGS_UPLINK; /* default to UPLINK */
         return(1);
         }
 
@@ -147,8 +175,12 @@ static int MS_CALLBACK file_free(BIO *a)
                 {
                 if ((a->init) && (a->ptr != NULL))
                         {
-                        fclose((FILE *)a->ptr);
+                        if (a->flags&BIO_FLAGS_UPLINK)
+                                UP_fclose (a->ptr);
+                        else
+                                fclose (a->ptr);
                         a->ptr=NULL;
+                        a->flags=BIO_FLAGS_UPLINK;
                         }
                 a->init=0;
                 }
@@ -161,8 +193,11 @@ static int MS_CALLBACK file_read(BIO *b, char *out, int outl)
 
         if (b->init && (out != NULL))
                 {
-                ret=fread(out,1,(int)outl,(FILE *)b->ptr);
-                if(ret == 0 && ferror((FILE *)b->ptr))
+                if (b->flags&BIO_FLAGS_UPLINK)
+                        ret=UP_fread(out,1,(int)outl,b->ptr);
+                else
+                        ret=fread(out,1,(int)outl,(FILE *)b->ptr);
+                if(ret == 0 && (b->flags&BIO_FLAGS_UPLINK)?UP_ferror((FILE *)b->ptr):ferror((FILE *)b->ptr))
                         {
                         SYSerr(SYS_F_FREAD,get_last_sys_error());
                         BIOerr(BIO_F_FILE_READ,ERR_R_SYS_LIB);
@@ -178,7 +213,11 @@ static int MS_CALLBACK file_write(BIO *b, const char *in, int inl)
 
         if (b->init && (in != NULL))
                 {
-                if (fwrite(in,(int)inl,1,(FILE *)b->ptr))
+                if (b->flags&BIO_FLAGS_UPLINK)
+                        ret=UP_fwrite(in,(int)inl,1,b->ptr);
+                else
+                        ret=fwrite(in,(int)inl,1,(FILE *)b->ptr);
+                if (ret)
                         ret=inl;
                 /* ret=fwrite(in,1,(int)inl,(FILE *)b->ptr); */
                 /* according to Tim Hudson <tjh@cryptsoft.com>, the commented
@@ -199,20 +238,45 @@ static long MS_CALLBACK file_ctrl(BIO *b, int cmd, long num, void *ptr)
                 {
         case BIO_C_FILE_SEEK:
         case BIO_CTRL_RESET:
-                ret=(long)fseek(fp,num,SEEK_SET);
+                if (b->flags&BIO_FLAGS_UPLINK)
+                        ret=(long)UP_fseek(b->ptr,num,0);
+                else
+                        ret=(long)fseek(fp,num,SEEK_SET);
                 break;
         case BIO_CTRL_EOF:
-                ret=(long)feof(fp);
+                if (b->flags&BIO_FLAGS_UPLINK)
+                        ret=(long)UP_feof(fp);
+                else
+                        ret=(long)feof(fp);
                 break;
         case BIO_C_FILE_TELL:
         case BIO_CTRL_INFO:
-                ret=ftell(fp);
+                if (b->flags&BIO_FLAGS_UPLINK)
+                        ret=UP_ftell(b->ptr);
+                else
+                        ret=ftell(fp);
                 break;
         case BIO_C_SET_FILE_PTR:
                 file_free(b);
                 b->shutdown=(int)num&BIO_CLOSE;
-                b->ptr=(char *)ptr;
+                b->ptr=ptr;
                 b->init=1;
+#if BIO_FLAGS_UPLINK!=0
+#if defined(__MINGW32__) && defined(__MSVCRT__) && !defined(_IOB_ENTRIES)
+#define _IOB_ENTRIES 20
+#endif
+#if defined(_IOB_ENTRIES)
+                /* Safety net to catch purely internal BIO_set_fp calls */
+                if ((size_t)ptr >= (size_t)stdin &&
+                    (size_t)ptr <  (size_t)(stdin+_IOB_ENTRIES))
+                        BIO_clear_flags(b,BIO_FLAGS_UPLINK);
+#endif
+#endif
+#ifdef UP_fsetmode
+                if (b->flags&BIO_FLAGS_UPLINK)
+                        UP_fsetmode(b->ptr,num&BIO_FP_TEXT?'t':'b');
+                else
+#endif
                 {
 #if defined(OPENSSL_SYS_WINDOWS)
                 int fd = fileno((FILE*)ptr);
@@ -220,6 +284,14 @@ static long MS_CALLBACK file_ctrl(BIO *b, int cmd, long num, void *ptr)
                         _setmode(fd,_O_TEXT);
                 else
                         _setmode(fd,_O_BINARY);
+#elif defined(OPENSSL_SYS_NETWARE) && defined(NETWARE_CLIB)
+                int fd = fileno((FILE*)ptr);
+         /* Under CLib there are differences in file modes
+         */
+                if (num & BIO_FP_TEXT)
+                        setmode(fd,O_TEXT);
+                else
+                        setmode(fd,O_BINARY);
 #elif defined(OPENSSL_SYS_MSDOS)
                 int fd = fileno((FILE*)ptr);
                 /* Set correct text/binary mode */
@@ -272,6 +344,12 @@ static long MS_CALLBACK file_ctrl(BIO *b, int cmd, long num, void *ptr)
                 else
                         strcat(p,"t");
 #endif
+#if defined(OPENSSL_SYS_NETWARE)
+                if (!(num & BIO_FP_TEXT))
+                        strcat(p,"b");
+                else
+                        strcat(p,"t");
+#endif
                 fp=fopen(ptr,p);
                 if (fp == NULL)
                         {
@@ -281,8 +359,9 @@ static long MS_CALLBACK file_ctrl(BIO *b, int cmd, long num, void *ptr)
                         ret=0;
                         break;
                         }
-                b->ptr=(char *)fp;
+                b->ptr=fp;
                 b->init=1;
+                BIO_clear_flags(b,BIO_FLAGS_UPLINK); /* we did fopen -> we disengage UPLINK */
                 break;
         case BIO_C_GET_FILE_PTR:
                 /* the ptr parameter is actually a FILE ** in this case. */
@@ -299,7 +378,10 @@ static long MS_CALLBACK file_ctrl(BIO *b, int cmd, long num, void *ptr)
                 b->shutdown=(int)num;
                 break;
         case BIO_CTRL_FLUSH:
-                fflush((FILE *)b->ptr);
+                if (b->flags&BIO_FLAGS_UPLINK)
+                        UP_fflush(b->ptr);
+                else
+                        fflush((FILE *)b->ptr);
                 break;
         case BIO_CTRL_DUP:
                 ret=1;
@@ -321,7 +403,10 @@ static int MS_CALLBACK file_gets(BIO *bp, char *buf, int size)
         int ret=0;
 
         buf[0]='\0';
-        fgets(buf,size,(FILE *)bp->ptr);
+        if (bp->flags&BIO_FLAGS_UPLINK)
+                UP_fgets(buf,size,bp->ptr);
+        else
+                fgets(buf,size,(FILE *)bp->ptr);
         if (buf[0] != '\0')
                 ret=strlen(buf);
         return(ret);
diff --git a/src/lib/libssl/src/crypto/bio/bss_log.c b/src/lib/libssl/src/crypto/bio/bss_log.c
index 1eb678cac0..6360dbc820 100644
--- a/src/lib/libssl/src/crypto/bio/bss_log.c
+++ b/src/lib/libssl/src/crypto/bio/bss_log.c
@@ -78,6 +78,8 @@
 #  include <starlet.h>
 #elif defined(__ultrix)
 #  include <sys/syslog.h>
+#elif defined(OPENSSL_SYS_NETWARE)
+#  define NO_SYSLOG
 #elif (!defined(MSDOS) || defined(WATT32)) && !defined(OPENSSL_SYS_VXWORKS) && !defined(NO_SYSLOG)
 #  include <syslog.h>
 #endif
diff --git a/src/lib/libssl/src/crypto/bio/bss_sock.c b/src/lib/libssl/src/crypto/bio/bss_sock.c
index 2c1c405ec7..472dd75821 100644
--- a/src/lib/libssl/src/crypto/bio/bss_sock.c
+++ b/src/lib/libssl/src/crypto/bio/bss_sock.c
@@ -56,8 +56,6 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_SOCK
-
 #include <stdio.h>
 #include <errno.h>
 #define USE_SOCKETS
@@ -248,7 +246,7 @@ int BIO_sock_non_fatal_error(int err)
         {
         switch (err)
                 {
-#if defined(OPENSSL_SYS_WINDOWS)
+#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_NETWARE)
 # if defined(WSAEWOULDBLOCK)
         case WSAEWOULDBLOCK:
 # endif
@@ -279,7 +277,7 @@ int BIO_sock_non_fatal_error(int err)
 #endif
 
 #ifdef EAGAIN
-#if EWOULDBLOCK != EAGAIN
+# if EWOULDBLOCK != EAGAIN
         case EAGAIN:
 # endif
 #endif
@@ -302,4 +300,3 @@ int BIO_sock_non_fatal_error(int err)
                 }
         return(0);
         }
-#endif
diff --git a/src/lib/libssl/src/crypto/bn/asm/bn-586.pl b/src/lib/libssl/src/crypto/bn/asm/bn-586.pl
index c4de4a2bee..26c2685a72 100644
--- a/src/lib/libssl/src/crypto/bn/asm/bn-586.pl
+++ b/src/lib/libssl/src/crypto/bn/asm/bn-586.pl
@@ -5,13 +5,18 @@ require "x86asm.pl";
 
 &asm_init($ARGV[0],$0);
 
+$sse2=0;
+for (@ARGV) { $sse2=1 if (/-DOPENSSL_IA32_SSE2/); }
+
+&external_label("OPENSSL_ia32cap_P") if ($sse2);
+
 &bn_mul_add_words("bn_mul_add_words");
 &bn_mul_words("bn_mul_words");
 &bn_sqr_words("bn_sqr_words");
 &bn_div_words("bn_div_words");
 &bn_add_words("bn_add_words");
 &bn_sub_words("bn_sub_words");
-#&bn_sub_part_words("bn_sub_part_words");
+&bn_sub_part_words("bn_sub_part_words");
 
 &asm_finish();
 
@@ -19,7 +24,7 @@ sub bn_mul_add_words
         {
         local($name)=@_;
 
-        &function_begin($name,"");
+        &function_begin($name,$sse2?"EXTRN\t_OPENSSL_ia32cap_P:DWORD":"");
 
         &comment("");
         $Low="eax";
@@ -42,6 +47,83 @@ sub bn_mul_add_words
 
         &jz(&label("maw_finish"));
 
+        if ($sse2) {
+                &picmeup("eax","OPENSSL_ia32cap_P");
+                &bt(&DWP(0,"eax"),26);
+                &jnc(&label("maw_loop"));
+
+                &movd("mm0",$w);                # mm0 = w
+                &pxor("mm1","mm1");             # mm1 = carry_in
+
+                &set_label("maw_sse2_loop",0);
+                &movd("mm3",&DWP(0,$r,"",0));   # mm3 = r[0]
+                &paddq("mm1","mm3");            # mm1 = carry_in + r[0]
+                &movd("mm2",&DWP(0,$a,"",0));   # mm2 = a[0]
+                &pmuludq("mm2","mm0");          # mm2 = w*a[0]
+                &movd("mm4",&DWP(4,$a,"",0));   # mm4 = a[1]
+                &pmuludq("mm4","mm0");          # mm4 = w*a[1]
+                &movd("mm6",&DWP(8,$a,"",0));   # mm6 = a[2]
+                &pmuludq("mm6","mm0");          # mm6 = w*a[2]
+                &movd("mm7",&DWP(12,$a,"",0));  # mm7 = a[3]
+                &pmuludq("mm7","mm0");          # mm7 = w*a[3]
+                &paddq("mm1","mm2");            # mm1 = carry_in + r[0] + w*a[0]
+                &movd("mm3",&DWP(4,$r,"",0));   # mm3 = r[1]
+                &paddq("mm3","mm4");            # mm3 = r[1] + w*a[1]
+                &movd("mm5",&DWP(8,$r,"",0));   # mm5 = r[2]
+                &paddq("mm5","mm6");            # mm5 = r[2] + w*a[2]
+                &movd("mm4",&DWP(12,$r,"",0));  # mm4 = r[3]
+                &paddq("mm7","mm4");            # mm7 = r[3] + w*a[3]
+                &movd(&DWP(0,$r,"",0),"mm1");
+                &movd("mm2",&DWP(16,$a,"",0));  # mm2 = a[4]
+                &pmuludq("mm2","mm0");          # mm2 = w*a[4]
+                &psrlq("mm1",32);               # mm1 = carry0
+                &movd("mm4",&DWP(20,$a,"",0));  # mm4 = a[5]
+                &pmuludq("mm4","mm0");          # mm4 = w*a[5]
+                &paddq("mm1","mm3");            # mm1 = carry0 + r[1] + w*a[1]
+                &movd("mm6",&DWP(24,$a,"",0));  # mm6 = a[6]
+                &pmuludq("mm6","mm0");          # mm6 = w*a[6]
+                &movd(&DWP(4,$r,"",0),"mm1");
+                &psrlq("mm1",32);               # mm1 = carry1
+                &movd("mm3",&DWP(28,$a,"",0));  # mm3 = a[7]
+                &add($a,32);
+                &pmuludq("mm3","mm0");          # mm3 = w*a[7]
+                &paddq("mm1","mm5");            # mm1 = carry1 + r[2] + w*a[2]
+                &movd("mm5",&DWP(16,$r,"",0));  # mm5 = r[4]
+                &paddq("mm2","mm5");            # mm2 = r[4] + w*a[4]
+                &movd(&DWP(8,$r,"",0),"mm1");
+                &psrlq("mm1",32);               # mm1 = carry2
+                &paddq("mm1","mm7");            # mm1 = carry2 + r[3] + w*a[3]
+                &movd("mm5",&DWP(20,$r,"",0));  # mm5 = r[5]
+                &paddq("mm4","mm5");            # mm4 = r[5] + w*a[5]
+                &movd(&DWP(12,$r,"",0),"mm1");
+                &psrlq("mm1",32);               # mm1 = carry3
+                &paddq("mm1","mm2");            # mm1 = carry3 + r[4] + w*a[4]
+                &movd("mm5",&DWP(24,$r,"",0));  # mm5 = r[6]
+                &paddq("mm6","mm5");            # mm6 = r[6] + w*a[6]
+                &movd(&DWP(16,$r,"",0),"mm1");
+                &psrlq("mm1",32);               # mm1 = carry4
+                &paddq("mm1","mm4");            # mm1 = carry4 + r[5] + w*a[5]
+                &movd("mm5",&DWP(28,$r,"",0));  # mm5 = r[7]
+                &paddq("mm3","mm5");            # mm3 = r[7] + w*a[7]
+                &movd(&DWP(20,$r,"",0),"mm1");
+                &psrlq("mm1",32);               # mm1 = carry5
+                &paddq("mm1","mm6");            # mm1 = carry5 + r[6] + w*a[6]
+                &movd(&DWP(24,$r,"",0),"mm1");
+                &psrlq("mm1",32);               # mm1 = carry6
+                &paddq("mm1","mm3");            # mm1 = carry6 + r[7] + w*a[7]
+                &movd(&DWP(28,$r,"",0),"mm1");
+                &add($r,32);
+                &psrlq("mm1",32);               # mm1 = carry_out
+
+                &sub("ecx",8);
+                &jnz(&label("maw_sse2_loop"));
+
+                &movd($c,"mm1");                # c = carry_out
+                &emms();
+
+                &jmp(&label("maw_finish"));
+        }
+
         &set_label("maw_loop",0);
 
         &mov(&swtmp(0),"ecx");  #
diff --git a/src/lib/libssl/src/crypto/bn/asm/ia64.S b/src/lib/libssl/src/crypto/bn/asm/ia64.S
index 7b82b820e6..951abc53ea 100644
--- a/src/lib/libssl/src/crypto/bn/asm/ia64.S
+++ b/src/lib/libssl/src/crypto/bn/asm/ia64.S
@@ -171,21 +171,21 @@
 .skip   32      // makes the loop body aligned at 64-byte boundary
 bn_add_words:
         .prologue
-        .fframe 0
         .save   ar.pfs,r2
 { .mii; alloc           r2=ar.pfs,4,12,0,16
         cmp4.le         p6,p0=r35,r0    };;
 { .mfb; mov             r8=r0                   // return value
 (p6)    br.ret.spnt.many        b0      };;
 
-        .save   ar.lc,r3
 { .mib; sub             r10=r35,r0,1
+        .save   ar.lc,r3
         mov             r3=ar.lc
         brp.loop.imp    .L_bn_add_words_ctop,.L_bn_add_words_cend-16
                                         }
-        .body
 { .mib; ADDP            r14=0,r32               // rp
+        .save   pr,r9
         mov             r9=pr           };;
+        .body
 { .mii; ADDP            r15=0,r33               // ap
         mov             ar.lc=r10
         mov             ar.ec=6         }
@@ -224,21 +224,21 @@ bn_add_words:
 .skip   32      // makes the loop body aligned at 64-byte boundary
 bn_sub_words:
         .prologue
-        .fframe 0
         .save   ar.pfs,r2
 { .mii; alloc           r2=ar.pfs,4,12,0,16
         cmp4.le         p6,p0=r35,r0    };;
 { .mfb; mov             r8=r0                   // return value
 (p6)    br.ret.spnt.many        b0      };;
 
-        .save   ar.lc,r3
 { .mib; sub             r10=r35,r0,1
+        .save   ar.lc,r3
         mov             r3=ar.lc
         brp.loop.imp    .L_bn_sub_words_ctop,.L_bn_sub_words_cend-16
                                         }
-        .body
 { .mib; ADDP            r14=0,r32               // rp
+        .save   pr,r9
         mov             r9=pr           };;
+        .body
 { .mii; ADDP            r15=0,r33               // ap
         mov             ar.lc=r10
         mov             ar.ec=6         }
@@ -283,7 +283,6 @@ bn_sub_words:
 .skip   32      // makes the loop body aligned at 64-byte boundary
 bn_mul_words:
         .prologue
-        .fframe 0
         .save   ar.pfs,r2
 #ifdef XMA_TEMPTATION
 { .mfi; alloc           r2=ar.pfs,4,0,0,0       };;
@@ -294,9 +293,10 @@ bn_mul_words:
         cmp4.le         p6,p0=r34,r0
 (p6)    br.ret.spnt.many        b0              };;
 
-        .save   ar.lc,r3
 { .mii; sub     r10=r34,r0,1
+        .save   ar.lc,r3
         mov     r3=ar.lc
+        .save   pr,r9
         mov     r9=pr                   };;
 
         .body
@@ -397,22 +397,21 @@ bn_mul_words:
 .skip   48      // makes the loop body aligned at 64-byte boundary
 bn_mul_add_words:
         .prologue
-        .fframe 0
         .save   ar.pfs,r2
-        .save   ar.lc,r3
-        .save   pr,r9
 { .mmi; alloc           r2=ar.pfs,4,4,0,8
         cmp4.le         p6,p0=r34,r0
+        .save   ar.lc,r3
         mov             r3=ar.lc        };;
 { .mib; mov             r8=r0           // return value
         sub             r10=r34,r0,1
 (p6)    br.ret.spnt.many        b0      };;
 
-        .body
 { .mib; setf.sig        f8=r35          // w
+        .save   pr,r9
         mov             r9=pr
         brp.loop.imp    .L_bn_mul_add_words_ctop,.L_bn_mul_add_words_cend-16
                                         }
+        .body
 { .mmi; ADDP            r14=0,r32       // rp
         ADDP            r15=0,r33       // ap
         mov             ar.lc=r10       }
@@ -466,7 +465,6 @@ bn_mul_add_words:
 .skip   32      // makes the loop body aligned at 64-byte boundary 
 bn_sqr_words:
         .prologue
-        .fframe 0
         .save   ar.pfs,r2
 { .mii; alloc           r2=ar.pfs,3,0,0,0
         sxt4            r34=r34         };;
@@ -476,9 +474,10 @@ bn_sqr_words:
         nop.f           0x0
 (p6)    br.ret.spnt.many        b0      };;
 
-        .save   ar.lc,r3
 { .mii; sub     r10=r34,r0,1
+        .save   ar.lc,r3
         mov     r3=ar.lc
+        .save   pr,r9
         mov     r9=pr                   };;
 
         .body
@@ -545,7 +544,6 @@ bn_sqr_words:
 .align  64
 bn_sqr_comba8:
         .prologue
-        .fframe 0
         .save   ar.pfs,r2
 #if defined(_HPUX_SOURCE) && !defined(_LP64)
 { .mii; alloc   r2=ar.pfs,2,1,0,0
@@ -617,7 +615,6 @@ bn_sqr_comba8:
 .align  64
 bn_mul_comba8:
         .prologue
-        .fframe 0
         .save   ar.pfs,r2
 #if defined(_HPUX_SOURCE) && !defined(_LP64)
 { .mii; alloc   r2=ar.pfs,3,0,0,0
@@ -1175,7 +1172,6 @@ bn_mul_comba8:
 .align  64
 bn_sqr_comba4:
         .prologue
-        .fframe 0
         .save   ar.pfs,r2
 #if defined(_HPUX_SOURCE) && !defined(_LP64)
 { .mii; alloc   r2=ar.pfs,2,1,0,0
@@ -1208,7 +1204,6 @@ bn_sqr_comba4:
 .align  64
 bn_mul_comba4:
         .prologue
-        .fframe 0
         .save   ar.pfs,r2
 #if defined(_HPUX_SOURCE) && !defined(_LP64)
 { .mii; alloc   r2=ar.pfs,3,0,0,0
@@ -1411,11 +1406,11 @@ equ=p24
 .align  64
 bn_div_words:
         .prologue
-        .fframe 0
         .save   ar.pfs,r2
-        .save   b0,r3
 { .mii; alloc           r2=ar.pfs,3,5,0,8
+        .save   b0,r3
         mov             r3=b0
+        .save   pr,r10
         mov             r10=pr          };;
 { .mmb; cmp.eq          p6,p0=r34,r0
         mov             r8=-1
diff --git a/src/lib/libssl/src/crypto/bn/bn.h b/src/lib/libssl/src/crypto/bn/bn.h
index 1251521c54..6d754d5547 100644
--- a/src/lib/libssl/src/crypto/bn/bn.h
+++ b/src/lib/libssl/src/crypto/bn/bn.h
@@ -55,6 +55,19 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the Eric Young open source
+ * license provided above.
+ *
+ * The binary polynomial arithmetic software is originally written by 
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
 
 #ifndef HEADER_BN_H
 #define HEADER_BN_H
@@ -63,14 +76,23 @@
 #ifndef OPENSSL_NO_FP_API
 #include <stdio.h> /* FILE */
 #endif
+#include <openssl/ossl_typ.h>
 
 #ifdef  __cplusplus
 extern "C" {
 #endif
 
-#ifdef OPENSSL_SYS_VMS
-#undef BN_LLONG /* experimental, so far... */
-#endif
+/* These preprocessor symbols control various aspects of the bignum headers and
+ * library code. They're not defined by any "normal" configuration, as they are
+ * intended for development and testing purposes. NB: defining all three can be
+ * useful for debugging application code as well as openssl itself.
+ *
+ * BN_DEBUG - turn on various debugging alterations to the bignum code
+ * BN_DEBUG_RAND - uses random poisoning of unused words to trip up
+ * mismanagement of bignum internals. You must also define BN_DEBUG.
+ */
+/* #define BN_DEBUG */
+/* #define BN_DEBUG_RAND */
 
 #define BN_MUL_COMBA
 #define BN_SQR_COMBA
@@ -143,10 +165,12 @@ extern "C" {
 #endif
 
 #ifdef THIRTY_TWO_BIT
-#if defined(OPENSSL_SYS_WIN32) && !defined(__GNUC__)
-#define BN_ULLONG       unsigned _int64
-#else
-#define BN_ULLONG       unsigned long long
+#ifdef BN_LLONG
+# if defined(OPENSSL_SYS_WIN32) && !defined(__GNUC__)
+#  define BN_ULLONG     unsigned __int64
+# else
+#  define BN_ULLONG     unsigned long long
+# endif
 #endif
 #define BN_ULONG        unsigned long
 #define BN_LONG         long
@@ -219,15 +243,23 @@ extern "C" {
 
 #define BN_DEFAULT_BITS 1280
 
-#ifdef BIGNUM
-#undef BIGNUM
-#endif
-
 #define BN_FLG_MALLOCED         0x01
 #define BN_FLG_STATIC_DATA      0x02
-#define BN_FLG_EXP_CONSTTIME    0x04 /* avoid leaking exponent information through timings
-                                      * (BN_mod_exp_mont() will call BN_mod_exp_mont_consttime) */
+#define BN_FLG_CONSTTIME        0x04 /* avoid leaking exponent information through timing,
+                                      * BN_mod_exp_mont() will call BN_mod_exp_mont_consttime,
+                                      * BN_div() will call BN_div_no_branch,
+                                      * BN_mod_inverse() will call BN_mod_inverse_no_branch.
+                                      */
+
+#ifndef OPENSSL_NO_DEPRECATED
+#define BN_FLG_EXP_CONSTTIME BN_FLG_CONSTTIME /* deprecated name for the flag */
+                                      /* avoid leaking exponent information through timings
+                                      * (BN_mod_exp_mont() will call BN_mod_exp_mont_consttime) */
+#endif
+
+#ifndef OPENSSL_NO_DEPRECATED
 #define BN_FLG_FREE             0x8000  /* used for debuging */
+#endif
 #define BN_set_flags(b,n)       ((b)->flags|=(n))
 #define BN_get_flags(b,n)       ((b)->flags&(n))
 
@@ -242,7 +274,18 @@ extern "C" {
                                                  |  BN_FLG_STATIC_DATA \
                                                  |  (n)))
 
-typedef struct bignum_st
+/* Already declared in ossl_typ.h */
+#if 0
+typedef struct bignum_st BIGNUM;
+/* Used for temp variables (declaration hidden in bn_lcl.h) */
+typedef struct bignum_ctx BN_CTX;
+typedef struct bn_blinding_st BN_BLINDING;
+typedef struct bn_mont_ctx_st BN_MONT_CTX;
+typedef struct bn_recp_ctx_st BN_RECP_CTX;
+typedef struct bn_gencb_st BN_GENCB;
+#endif
+
+struct bignum_st
         {
         BN_ULONG *d;    /* Pointer to an array of 'BN_BITS2' bit chunks. */
         int top;        /* Index of last used d +1. */
@@ -250,44 +293,64 @@ typedef struct bignum_st
         int dmax;       /* Size of the d array. */
         int neg;        /* one if the number is negative */
         int flags;
-        } BIGNUM;
-
-/* Used for temp variables (declaration hidden in bn_lcl.h) */
-typedef struct bignum_ctx BN_CTX;
-
-typedef struct bn_blinding_st
-        {
-        int init;
-        BIGNUM *A;
-        BIGNUM *Ai;
-        BIGNUM *mod; /* just a reference */
-        unsigned long thread_id; /* added in OpenSSL 0.9.6j and 0.9.7b;
-                                  * used only by crypto/rsa/rsa_eay.c, rsa_lib.c */
-        } BN_BLINDING;
+        };
 
 /* Used for montgomery multiplication */
-typedef struct bn_mont_ctx_st
+struct bn_mont_ctx_st
         {
         int ri;        /* number of bits in R */
         BIGNUM RR;     /* used to convert to montgomery form */
         BIGNUM N;      /* The modulus */
         BIGNUM Ni;     /* R*(1/R mod N) - N*Ni = 1
                         * (Ni is only stored for bignum algorithm) */
+#if 0
+        /* OpenSSL 0.9.9 preview: */
+        BN_ULONG n0[2];/* least significant word(s) of Ni */
+#else
         BN_ULONG n0;   /* least significant word of Ni */
+#endif
         int flags;
-        } BN_MONT_CTX;
+        };
 
 /* Used for reciprocal division/mod functions
  * It cannot be shared between threads
  */
-typedef struct bn_recp_ctx_st
+struct bn_recp_ctx_st
         {
         BIGNUM N;       /* the divisor */
         BIGNUM Nr;      /* the reciprocal */
         int num_bits;
         int shift;
         int flags;
-        } BN_RECP_CTX;
+        };
+
+/* Used for slow "generation" functions. */
+struct bn_gencb_st
+        {
+        unsigned int ver;       /* To handle binary (in)compatibility */
+        void *arg;              /* callback-specific data */
+        union
+                {
+                /* if(ver==1) - handles old style callbacks */
+                void (*cb_1)(int, int, void *);
+                /* if(ver==2) - new callback style */
+                int (*cb_2)(int, int, BN_GENCB *);
+                } cb;
+        };
+/* Wrapper function to make using BN_GENCB easier,  */
+int BN_GENCB_call(BN_GENCB *cb, int a, int b);
+/* Macro to populate a BN_GENCB structure with an "old"-style callback */
+#define BN_GENCB_set_old(gencb, callback, cb_arg) { \
+                BN_GENCB *tmp_gencb = (gencb); \
+                tmp_gencb->ver = 1; \
+                tmp_gencb->arg = (cb_arg); \
+                tmp_gencb->cb.cb_1 = (callback); }
+/* Macro to populate a BN_GENCB structure with a "new"-style callback */
+#define BN_GENCB_set(gencb, callback, cb_arg) { \
+                BN_GENCB *tmp_gencb = (gencb); \
+                tmp_gencb->ver = 2; \
+                tmp_gencb->arg = (cb_arg); \
+                tmp_gencb->cb.cb_2 = (callback); }
 
 #define BN_prime_checks 0 /* default: select number of iterations
                              based on the size of the number */
@@ -312,24 +375,33 @@ typedef struct bn_recp_ctx_st
 
 #define BN_num_bytes(a) ((BN_num_bits(a)+7)/8)
 
-/* Note that BN_abs_is_word does not work reliably for w == 0 */
-#define BN_abs_is_word(a,w) (((a)->top == 1) && ((a)->d[0] == (BN_ULONG)(w)))
-#define BN_is_zero(a)       (((a)->top == 0) || BN_abs_is_word(a,0))
+/* Note that BN_abs_is_word didn't work reliably for w == 0 until 0.9.8 */
+#define BN_abs_is_word(a,w) ((((a)->top == 1) && ((a)->d[0] == (BN_ULONG)(w))) || \
+                                (((w) == 0) && ((a)->top == 0)))
+#define BN_is_zero(a)       ((a)->top == 0)
 #define BN_is_one(a)        (BN_abs_is_word((a),1) && !(a)->neg)
-#define BN_is_word(a,w)     ((w) ? BN_abs_is_word((a),(w)) && !(a)->neg : \
-                                   BN_is_zero((a)))
+#define BN_is_word(a,w)     (BN_abs_is_word((a),(w)) && (!(w) || !(a)->neg))
 #define BN_is_odd(a)        (((a)->top > 0) && ((a)->d[0] & 1))
 
 #define BN_one(a)       (BN_set_word((a),1))
+#define BN_zero_ex(a) \
+        do { \
+                BIGNUM *_tmp_bn = (a); \
+                _tmp_bn->top = 0; \
+                _tmp_bn->neg = 0; \
+        } while(0)
+#ifdef OPENSSL_NO_DEPRECATED
+#define BN_zero(a)      BN_zero_ex(a)
+#else
 #define BN_zero(a)      (BN_set_word((a),0))
-
-/*#define BN_ascii2bn(a)        BN_hex2bn(a) */
-/*#define BN_bn2ascii(a)        BN_bn2hex(a) */
+#endif
 
 const BIGNUM *BN_value_one(void);
 char *  BN_options(void);
 BN_CTX *BN_CTX_new(void);
+#ifndef OPENSSL_NO_DEPRECATED
 void    BN_CTX_init(BN_CTX *c);
+#endif
 void    BN_CTX_free(BN_CTX *c);
 void    BN_CTX_start(BN_CTX *ctx);
 BIGNUM *BN_CTX_get(BN_CTX *ctx);
@@ -355,6 +427,16 @@ int	BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
 int     BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
 int     BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx);
 int     BN_sqr(BIGNUM *r, const BIGNUM *a,BN_CTX *ctx);
+/** BN_set_negative sets sign of a BIGNUM
+ * \param  b  pointer to the BIGNUM object
+ * \param  n  0 if the BIGNUM b should be positive and a value != 0 otherwise 
+ */
+void    BN_set_negative(BIGNUM *b, int n);
+/** BN_is_negative returns 1 if the BIGNUM is negative
+ * \param  a  pointer to the BIGNUM object
+ * \return 1 if a < 0 and 0 otherwise
+ */
+#define BN_is_negative(a) ((a)->neg != 0)
 
 int     BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d,
         BN_CTX *ctx);
@@ -428,6 +510,9 @@ BIGNUM *BN_mod_inverse(BIGNUM *ret,
         const BIGNUM *a, const BIGNUM *n,BN_CTX *ctx);
 BIGNUM *BN_mod_sqrt(BIGNUM *ret,
         const BIGNUM *a, const BIGNUM *n,BN_CTX *ctx);
+
+/* Deprecated versions */
+#ifndef OPENSSL_NO_DEPRECATED
 BIGNUM *BN_generate_prime(BIGNUM *ret,int bits,int safe,
         const BIGNUM *add, const BIGNUM *rem,
         void (*callback)(int,int,void *),void *cb_arg);
@@ -437,19 +522,14 @@ int	BN_is_prime(const BIGNUM *p,int nchecks,
 int     BN_is_prime_fasttest(const BIGNUM *p,int nchecks,
         void (*callback)(int,int,void *),BN_CTX *ctx,void *cb_arg,
         int do_trial_division);
+#endif /* !defined(OPENSSL_NO_DEPRECATED) */
 
-#ifdef OPENSSL_FIPS
-int BN_X931_derive_prime(BIGNUM *p, BIGNUM *p1, BIGNUM *p2,
-                        void (*cb)(int, int, void *), void *cb_arg,
-                        const BIGNUM *Xp, const BIGNUM *Xp1, const BIGNUM *Xp2,
-                        const BIGNUM *e, BN_CTX *ctx);
-int BN_X931_generate_Xpq(BIGNUM *Xp, BIGNUM *Xq, int nbits, BN_CTX *ctx);
-int BN_X931_generate_prime(BIGNUM *p, BIGNUM *p1, BIGNUM *p2,
-                        BIGNUM *Xp1, BIGNUM *Xp2,
-                        const BIGNUM *Xp,
-                        const BIGNUM *e, BN_CTX *ctx,
-                        void (*cb)(int, int, void *), void *cb_arg);
-#endif
+/* Newer versions */
+int     BN_generate_prime_ex(BIGNUM *ret,int bits,int safe, const BIGNUM *add,
+                const BIGNUM *rem, BN_GENCB *cb);
+int     BN_is_prime_ex(const BIGNUM *p,int nchecks, BN_CTX *ctx, BN_GENCB *cb);
+int     BN_is_prime_fasttest_ex(const BIGNUM *p,int nchecks, BN_CTX *ctx,
+                int do_trial_division, BN_GENCB *cb);
 
 BN_MONT_CTX *BN_MONT_CTX_new(void );
 void BN_MONT_CTX_init(BN_MONT_CTX *ctx);
@@ -465,14 +545,31 @@ BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to,BN_MONT_CTX *from);
 BN_MONT_CTX *BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, int lock,
                                         const BIGNUM *mod, BN_CTX *ctx);
 
-BN_BLINDING *BN_BLINDING_new(BIGNUM *A,BIGNUM *Ai,BIGNUM *mod);
+/* BN_BLINDING flags */
+#define BN_BLINDING_NO_UPDATE   0x00000001
+#define BN_BLINDING_NO_RECREATE 0x00000002
+
+BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, /* const */ BIGNUM *mod);
 void BN_BLINDING_free(BN_BLINDING *b);
 int BN_BLINDING_update(BN_BLINDING *b,BN_CTX *ctx);
-int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *r, BN_CTX *ctx);
+int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx);
 int BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx);
-
+int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *);
+int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b, BN_CTX *);
+unsigned long BN_BLINDING_get_thread_id(const BN_BLINDING *);
+void BN_BLINDING_set_thread_id(BN_BLINDING *, unsigned long);
+unsigned long BN_BLINDING_get_flags(const BN_BLINDING *);
+void BN_BLINDING_set_flags(BN_BLINDING *, unsigned long);
+BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b,
+        const BIGNUM *e, /* const */ BIGNUM *m, BN_CTX *ctx,
+        int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                          const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx),
+        BN_MONT_CTX *m_ctx);
+
+#ifndef OPENSSL_NO_DEPRECATED
 void BN_set_params(int mul,int high,int low,int mont);
 int BN_get_params(int which); /* 0, mul, 1 high, 2 low, 3 mont */
+#endif
 
 void    BN_RECP_CTX_init(BN_RECP_CTX *recp);
 BN_RECP_CTX *BN_RECP_CTX_new(void);
@@ -485,15 +582,162 @@ int	BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
 int     BN_div_recp(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m,
         BN_RECP_CTX *recp, BN_CTX *ctx);
 
+/* Functions for arithmetic over binary polynomials represented by BIGNUMs. 
+ *
+ * The BIGNUM::neg property of BIGNUMs representing binary polynomials is
+ * ignored.
+ *
+ * Note that input arguments are not const so that their bit arrays can
+ * be expanded to the appropriate size if needed.
+ */
+
+int     BN_GF2m_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b); /*r = a + b*/
+#define BN_GF2m_sub(r, a, b) BN_GF2m_add(r, a, b)
+int     BN_GF2m_mod(BIGNUM *r, const BIGNUM *a, const BIGNUM *p); /*r=a mod p*/
+int     BN_GF2m_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
+        const BIGNUM *p, BN_CTX *ctx); /* r = (a * b) mod p */
+int     BN_GF2m_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        BN_CTX *ctx); /* r = (a * a) mod p */
+int     BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *b, const BIGNUM *p,
+        BN_CTX *ctx); /* r = (1 / b) mod p */
+int     BN_GF2m_mod_div(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
+        const BIGNUM *p, BN_CTX *ctx); /* r = (a / b) mod p */
+int     BN_GF2m_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
+        const BIGNUM *p, BN_CTX *ctx); /* r = (a ^ b) mod p */
+int     BN_GF2m_mod_sqrt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        BN_CTX *ctx); /* r = sqrt(a) mod p */
+int     BN_GF2m_mod_solve_quad(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+        BN_CTX *ctx); /* r^2 + r = a mod p */
+#define BN_GF2m_cmp(a, b) BN_ucmp((a), (b))
+/* Some functions allow for representation of the irreducible polynomials
+ * as an unsigned int[], say p.  The irreducible f(t) is then of the form:
+ *     t^p[0] + t^p[1] + ... + t^p[k]
+ * where m = p[0] > p[1] > ... > p[k] = 0.
+ */
+int     BN_GF2m_mod_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[]);
+        /* r = a mod p */
+int     BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
+        const unsigned int p[], BN_CTX *ctx); /* r = (a * b) mod p */
+int     BN_GF2m_mod_sqr_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[],
+        BN_CTX *ctx); /* r = (a * a) mod p */
+int     BN_GF2m_mod_inv_arr(BIGNUM *r, const BIGNUM *b, const unsigned int p[],
+        BN_CTX *ctx); /* r = (1 / b) mod p */
+int     BN_GF2m_mod_div_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
+        const unsigned int p[], BN_CTX *ctx); /* r = (a / b) mod p */
+int     BN_GF2m_mod_exp_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
+        const unsigned int p[], BN_CTX *ctx); /* r = (a ^ b) mod p */
+int     BN_GF2m_mod_sqrt_arr(BIGNUM *r, const BIGNUM *a,
+        const unsigned int p[], BN_CTX *ctx); /* r = sqrt(a) mod p */
+int     BN_GF2m_mod_solve_quad_arr(BIGNUM *r, const BIGNUM *a,
+        const unsigned int p[], BN_CTX *ctx); /* r^2 + r = a mod p */
+int     BN_GF2m_poly2arr(const BIGNUM *a, unsigned int p[], int max);
+int     BN_GF2m_arr2poly(const unsigned int p[], BIGNUM *a);
+
+/* faster mod functions for the 'NIST primes' 
+ * 0 <= a < p^2 */
+int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);
+int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);
+int BN_nist_mod_256(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);
+int BN_nist_mod_384(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);
+int BN_nist_mod_521(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);
+
+const BIGNUM *BN_get0_nist_prime_192(void);
+const BIGNUM *BN_get0_nist_prime_224(void);
+const BIGNUM *BN_get0_nist_prime_256(void);
+const BIGNUM *BN_get0_nist_prime_384(void);
+const BIGNUM *BN_get0_nist_prime_521(void);
+
 /* library internal functions */
 
 #define bn_expand(a,bits) ((((((bits+BN_BITS2-1))/BN_BITS2)) <= (a)->dmax)?\
-        (a):bn_expand2((a),(bits)/BN_BITS2+1))
+        (a):bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2))
 #define bn_wexpand(a,words) (((words) <= (a)->dmax)?(a):bn_expand2((a),(words)))
 BIGNUM *bn_expand2(BIGNUM *a, int words);
-BIGNUM *bn_dup_expand(const BIGNUM *a, int words);
+#ifndef OPENSSL_NO_DEPRECATED
+BIGNUM *bn_dup_expand(const BIGNUM *a, int words); /* unused */
+#endif
+
+/* Bignum consistency macros
+ * There is one "API" macro, bn_fix_top(), for stripping leading zeroes from
+ * bignum data after direct manipulations on the data. There is also an
+ * "internal" macro, bn_check_top(), for verifying that there are no leading
+ * zeroes. Unfortunately, some auditing is required due to the fact that
+ * bn_fix_top() has become an overabused duct-tape because bignum data is
+ * occasionally passed around in an inconsistent state. So the following
+ * changes have been made to sort this out;
+ * - bn_fix_top()s implementation has been moved to bn_correct_top()
+ * - if BN_DEBUG isn't defined, bn_fix_top() maps to bn_correct_top(), and
+ *   bn_check_top() is as before.
+ * - if BN_DEBUG *is* defined;
+ *   - bn_check_top() tries to pollute unused words even if the bignum 'top' is
+ *     consistent. (ed: only if BN_DEBUG_RAND is defined)
+ *   - bn_fix_top() maps to bn_check_top() rather than "fixing" anything.
+ * The idea is to have debug builds flag up inconsistent bignums when they
+ * occur. If that occurs in a bn_fix_top(), we examine the code in question; if
+ * the use of bn_fix_top() was appropriate (ie. it follows directly after code
+ * that manipulates the bignum) it is converted to bn_correct_top(), and if it
+ * was not appropriate, we convert it permanently to bn_check_top() and track
+ * down the cause of the bug. Eventually, no internal code should be using the
+ * bn_fix_top() macro. External applications and libraries should try this with
+ * their own code too, both in terms of building against the openssl headers
+ * with BN_DEBUG defined *and* linking with a version of OpenSSL built with it
+ * defined. This not only improves external code, it provides more test
+ * coverage for openssl's own code.
+ */
+
+#ifdef BN_DEBUG
 
-#define bn_fix_top(a) \
+/* We only need assert() when debugging */
+#include <assert.h>
+
+#ifdef BN_DEBUG_RAND
+/* To avoid "make update" cvs wars due to BN_DEBUG, use some tricks */
+#ifndef RAND_pseudo_bytes
+int RAND_pseudo_bytes(unsigned char *buf,int num);
+#define BN_DEBUG_TRIX
+#endif
+#define bn_pollute(a) \
+        do { \
+                const BIGNUM *_bnum1 = (a); \
+                if(_bnum1->top < _bnum1->dmax) { \
+                        unsigned char _tmp_char; \
+                        /* We cast away const without the compiler knowing, any \
+                         * *genuinely* constant variables that aren't mutable \
+                         * wouldn't be constructed with top!=dmax. */ \
+                        BN_ULONG *_not_const; \
+                        memcpy(&_not_const, &_bnum1->d, sizeof(BN_ULONG*)); \
+                        RAND_pseudo_bytes(&_tmp_char, 1); \
+                        memset((unsigned char *)(_not_const + _bnum1->top), _tmp_char, \
+                                (_bnum1->dmax - _bnum1->top) * sizeof(BN_ULONG)); \
+                } \
+        } while(0)
+#ifdef BN_DEBUG_TRIX
+#undef RAND_pseudo_bytes
+#endif
+#else
+#define bn_pollute(a)
+#endif
+#define bn_check_top(a) \
+        do { \
+                const BIGNUM *_bnum2 = (a); \
+                if (_bnum2 != NULL) { \
+                        assert((_bnum2->top == 0) || \
+                                (_bnum2->d[_bnum2->top - 1] != 0)); \
+                        bn_pollute(_bnum2); \
+                } \
+        } while(0)
+
+#define bn_fix_top(a)           bn_check_top(a)
+
+#else /* !BN_DEBUG */
+
+#define bn_pollute(a)
+#define bn_check_top(a)
+#define bn_fix_top(a)           bn_correct_top(a)
+
+#endif
+
+#define bn_correct_top(a) \
         { \
         BN_ULONG *ftl; \
         if ((a)->top > 0) \
@@ -501,6 +745,7 @@ BIGNUM *bn_dup_expand(const BIGNUM *a, int words);
                 for (ftl= &((a)->d[(a)->top-1]); (a)->top > 0; (a)->top--) \
                 if (*(ftl--)) break; \
                 } \
+        bn_pollute(a); \
         }
 
 BN_ULONG bn_mul_add_words(BN_ULONG *rp, const BN_ULONG *ap, int num, BN_ULONG w);
@@ -510,15 +755,17 @@ BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d);
 BN_ULONG bn_add_words(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,int num);
 BN_ULONG bn_sub_words(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,int num);
 
-#ifdef BN_DEBUG
-void bn_dump1(FILE *o, const char *a, const BN_ULONG *b,int n);
-# define bn_print(a) {fprintf(stderr, #a "="); BN_print_fp(stderr,a); \
-   fprintf(stderr,"\n");}
-# define bn_dump(a,n) bn_dump1(stderr,#a,a,n);
-#else
-# define bn_print(a)
-# define bn_dump(a,b)
-#endif
+/* Primes from RFC 2409 */
+BIGNUM *get_rfc2409_prime_768(BIGNUM *bn);
+BIGNUM *get_rfc2409_prime_1024(BIGNUM *bn);
+
+/* Primes from RFC 3526 */
+BIGNUM *get_rfc3526_prime_1536(BIGNUM *bn);
+BIGNUM *get_rfc3526_prime_2048(BIGNUM *bn);
+BIGNUM *get_rfc3526_prime_3072(BIGNUM *bn);
+BIGNUM *get_rfc3526_prime_4096(BIGNUM *bn);
+BIGNUM *get_rfc3526_prime_6144(BIGNUM *bn);
+BIGNUM *get_rfc3526_prime_8192(BIGNUM *bn);
 
 int BN_bntest_rand(BIGNUM *rnd, int bits, int top,int bottom);
 
@@ -531,18 +778,30 @@ void ERR_load_BN_strings(void);
 /* Error codes for the BN functions. */
 
 /* Function codes. */
-#define BN_F_BN_BLINDING_CONVERT                         100
-#define BN_F_BN_BLINDING_INVERT                          101
+#define BN_F_BNRAND                                      127
+#define BN_F_BN_BLINDING_CONVERT_EX                      100
+#define BN_F_BN_BLINDING_CREATE_PARAM                    128
+#define BN_F_BN_BLINDING_INVERT_EX                       101
 #define BN_F_BN_BLINDING_NEW                             102
 #define BN_F_BN_BLINDING_UPDATE                          103
 #define BN_F_BN_BN2DEC                                   104
 #define BN_F_BN_BN2HEX                                   105
 #define BN_F_BN_CTX_GET                                  116
 #define BN_F_BN_CTX_NEW                                  106
+#define BN_F_BN_CTX_START                                129
 #define BN_F_BN_DIV                                      107
+#define BN_F_BN_DIV_NO_BRANCH                            138
+#define BN_F_BN_DIV_RECP                                 130
 #define BN_F_BN_EXP                                      123
 #define BN_F_BN_EXPAND2                                  108
 #define BN_F_BN_EXPAND_INTERNAL                          120
+#define BN_F_BN_GF2M_MOD                                 131
+#define BN_F_BN_GF2M_MOD_EXP                             132
+#define BN_F_BN_GF2M_MOD_MUL                             133
+#define BN_F_BN_GF2M_MOD_SOLVE_QUAD                      134
+#define BN_F_BN_GF2M_MOD_SOLVE_QUAD_ARR                  135
+#define BN_F_BN_GF2M_MOD_SQR                             136
+#define BN_F_BN_GF2M_MOD_SQRT                            137
 #define BN_F_BN_MOD_EXP2_MONT                            118
 #define BN_F_BN_MOD_EXP_MONT                             109
 #define BN_F_BN_MOD_EXP_MONT_CONSTTIME                   124
@@ -550,6 +809,7 @@ void ERR_load_BN_strings(void);
 #define BN_F_BN_MOD_EXP_RECP                             125
 #define BN_F_BN_MOD_EXP_SIMPLE                           126
 #define BN_F_BN_MOD_INVERSE                              110
+#define BN_F_BN_MOD_INVERSE_NO_BRANCH                    139
 #define BN_F_BN_MOD_LSHIFT_QUICK                         119
 #define BN_F_BN_MOD_MUL_RECIPROCAL                       111
 #define BN_F_BN_MOD_SQRT                                 121
@@ -573,6 +833,7 @@ void ERR_load_BN_strings(void);
 #define BN_R_NOT_A_SQUARE                                111
 #define BN_R_NOT_INITIALIZED                             107
 #define BN_R_NO_INVERSE                                  108
+#define BN_R_NO_SOLUTION                                 116
 #define BN_R_P_IS_NOT_PRIME                              112
 #define BN_R_TOO_MANY_ITERATIONS                         113
 #define BN_R_TOO_MANY_TEMPORARY_VARIABLES                109
diff --git a/src/lib/libssl/src/crypto/bn/bn_add.c b/src/lib/libssl/src/crypto/bn/bn_add.c
index 6cba07e9f6..9405163706 100644
--- a/src/lib/libssl/src/crypto/bn/bn_add.c
+++ b/src/lib/libssl/src/crypto/bn/bn_add.c
@@ -64,7 +64,7 @@
 int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
         {
         const BIGNUM *tmp;
-        int a_neg = a->neg;
+        int a_neg = a->neg, ret;
 
         bn_check_top(a);
         bn_check_top(b);
@@ -95,20 +95,17 @@ int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
                 return(1);
                 }
 
-        if (!BN_uadd(r,a,b)) return(0);
-        if (a_neg) /* both are neg */
-                r->neg=1;
-        else
-                r->neg=0;
-        return(1);
+        ret = BN_uadd(r,a,b);
+        r->neg = a_neg;
+        bn_check_top(r);
+        return ret;
         }
 
-/* unsigned add of b to a, r must be large enough */
+/* unsigned add of b to a */
 int BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
         {
-        register int i;
-        int max,min;
-        BN_ULONG *ap,*bp,*rp,carry,t1;
+        int max,min,dif;
+        BN_ULONG *ap,*bp,*rp,carry,t1,t2;
         const BIGNUM *tmp;
 
         bn_check_top(a);
@@ -116,11 +113,12 @@ int BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
 
         if (a->top < b->top)
                 { tmp=a; a=b; b=tmp; }
-        max=a->top;
-        min=b->top;
+        max = a->top;
+        min = b->top;
+        dif = max - min;
 
         if (bn_wexpand(r,max+1) == NULL)
-                return(0);
+                return 0;
 
         r->top=max;
 
@@ -128,46 +126,46 @@ int BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
         ap=a->d;
         bp=b->d;
         rp=r->d;
-        carry=0;
 
         carry=bn_add_words(rp,ap,bp,min);
         rp+=min;
         ap+=min;
         bp+=min;
-        i=min;
 
         if (carry)
                 {
-                while (i < max)
+                while (dif)
                         {
-                        i++;
-                        t1= *(ap++);
-                        if ((*(rp++)=(t1+1)&BN_MASK2) >= t1)
+                        dif--;
+                        t1 = *(ap++);
+                        t2 = (t1+1) & BN_MASK2;
+                        *(rp++) = t2;
+                        if (t2)
                                 {
                                 carry=0;
                                 break;
                                 }
                         }
-                if ((i >= max) && carry)
+                if (carry)
                         {
-                        *(rp++)=1;
+                        /* carry != 0 => dif == 0 */
+                        *rp = 1;
                         r->top++;
                         }
                 }
-        if (rp != ap)
-                {
-                for (; i<max; i++)
-                        *(rp++)= *(ap++);
-                }
-        /* memcpy(rp,ap,sizeof(*ap)*(max-i));*/
+        if (dif && rp != ap)
+                while (dif--)
+                        /* copy remaining words if ap != rp */
+                        *(rp++) = *(ap++);
         r->neg = 0;
-        return(1);
+        bn_check_top(r);
+        return 1;
         }
 
 /* unsigned subtraction of b from a, a must be larger than b. */
 int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
         {
-        int max,min;
+        int max,min,dif;
         register BN_ULONG t1,t2,*ap,*bp,*rp;
         int i,carry;
 #if defined(IRIX_CC_BUG) && !defined(LINT)
@@ -177,14 +175,16 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
         bn_check_top(a);
         bn_check_top(b);
 
-        if (a->top < b->top) /* hmm... should not be happening */
+        max = a->top;
+        min = b->top;
+        dif = max - min;
+
+        if (dif < 0)    /* hmm... should not be happening */
                 {
                 BNerr(BN_F_BN_USUB,BN_R_ARG2_LT_ARG3);
                 return(0);
                 }
 
-        max=a->top;
-        min=b->top;
         if (bn_wexpand(r,max) == NULL) return(0);
 
         ap=a->d;
@@ -193,7 +193,7 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
 
 #if 1
         carry=0;
-        for (i=0; i<min; i++)
+        for (i = min; i != 0; i--)
                 {
                 t1= *(ap++);
                 t2= *(bp++);
@@ -217,17 +217,20 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
         ap+=min;
         bp+=min;
         rp+=min;
-        i=min;
 #endif
         if (carry) /* subtracted */
                 {
-                while (i < max)
+                if (!dif)
+                        /* error: a < b */
+                        return 0;
+                while (dif)
                         {
-                        i++;
-                        t1= *(ap++);
-                        t2=(t1-1)&BN_MASK2;
-                        *(rp++)=t2;
-                        if (t1 > t2) break;
+                        dif--;
+                        t1 = *(ap++);
+                        t2 = (t1-1)&BN_MASK2;
+                        *(rp++) = t2;
+                        if (t1)
+                                break;
                         }
                 }
 #if 0
@@ -237,13 +240,13 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
                 {
                 for (;;)
                         {
-                        if (i++ >= max) break;
+                        if (!dif--) break;
                         rp[0]=ap[0];
-                        if (i++ >= max) break;
+                        if (!dif--) break;
                         rp[1]=ap[1];
-                        if (i++ >= max) break;
+                        if (!dif--) break;
                         rp[2]=ap[2];
-                        if (i++ >= max) break;
+                        if (!dif--) break;
                         rp[3]=ap[3];
                         rp+=4;
                         ap+=4;
@@ -253,7 +256,7 @@ int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
 
         r->top=max;
         r->neg=0;
-        bn_fix_top(r);
+        bn_correct_top(r);
         return(1);
         }
 
@@ -304,6 +307,7 @@ int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
                 if (!BN_usub(r,a,b)) return(0);
                 r->neg=0;
                 }
+        bn_check_top(r);
         return(1);
         }
 
diff --git a/src/lib/libssl/src/crypto/bn/bn_asm.c b/src/lib/libssl/src/crypto/bn/bn_asm.c
index 19978085b2..99bc2de491 100644
--- a/src/lib/libssl/src/crypto/bn/bn_asm.c
+++ b/src/lib/libssl/src/crypto/bn/bn_asm.c
@@ -459,6 +459,34 @@ BN_ULONG bn_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, int n)
 #define sqr_add_c2(a,i,j,c0,c1,c2) \
         mul_add_c2((a)[i],(a)[j],c0,c1,c2)
 
+#elif defined(BN_UMULT_LOHI)
+
+#define mul_add_c(a,b,c0,c1,c2) {       \
+        BN_ULONG ta=(a),tb=(b);         \
+        BN_UMULT_LOHI(t1,t2,ta,tb);     \
+        c0 += t1; t2 += (c0<t1)?1:0;    \
+        c1 += t2; c2 += (c1<t2)?1:0;    \
+        }
+
+#define mul_add_c2(a,b,c0,c1,c2) {      \
+        BN_ULONG ta=(a),tb=(b),t0;      \
+        BN_UMULT_LOHI(t0,t1,ta,tb);     \
+        t2 = t1+t1; c2 += (t2<t1)?1:0;  \
+        t1 = t0+t0; t2 += (t1<t0)?1:0;  \
+        c0 += t1; t2 += (c0<t1)?1:0;    \
+        c1 += t2; c2 += (c1<t2)?1:0;    \
+        }
+
+#define sqr_add_c(a,i,c0,c1,c2) {       \
+        BN_ULONG ta=(a)[i];             \
+        BN_UMULT_LOHI(t1,t2,ta,ta);     \
+        c0 += t1; t2 += (c0<t1)?1:0;    \
+        c1 += t2; c2 += (c1<t2)?1:0;    \
+        }
+
+#define sqr_add_c2(a,i,j,c0,c1,c2)      \
+        mul_add_c2((a)[i],(a)[j],c0,c1,c2)
+
 #elif defined(BN_UMULT_HIGH)
 
 #define mul_add_c(a,b,c0,c1,c2) {       \
diff --git a/src/lib/libssl/src/crypto/bn/bn_blind.c b/src/lib/libssl/src/crypto/bn/bn_blind.c
index 2d287e6d1b..c11fb4ccc2 100644
--- a/src/lib/libssl/src/crypto/bn/bn_blind.c
+++ b/src/lib/libssl/src/crypto/bn/bn_blind.c
@@ -1,4 +1,57 @@
 /* crypto/bn/bn_blind.c */
+/* ====================================================================
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -60,11 +113,28 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
-BN_BLINDING *BN_BLINDING_new(BIGNUM *A, BIGNUM *Ai, BIGNUM *mod)
+#define BN_BLINDING_COUNTER     32
+
+struct bn_blinding_st
+        {
+        BIGNUM *A;
+        BIGNUM *Ai;
+        BIGNUM *e;
+        BIGNUM *mod; /* just a reference */
+        unsigned long thread_id; /* added in OpenSSL 0.9.6j and 0.9.7b;
+                                  * used only by crypto/rsa/rsa_eay.c, rsa_lib.c */
+        unsigned int  counter;
+        unsigned long flags;
+        BN_MONT_CTX *m_ctx;
+        int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                          const BIGNUM *m, BN_CTX *ctx,
+                          BN_MONT_CTX *m_ctx);
+        };
+
+BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, /* const */ BIGNUM *mod)
         {
         BN_BLINDING *ret=NULL;
 
-        bn_check_top(Ai);
         bn_check_top(mod);
 
         if ((ret=(BN_BLINDING *)OPENSSL_malloc(sizeof(BN_BLINDING))) == NULL)
@@ -73,11 +143,21 @@ BN_BLINDING *BN_BLINDING_new(BIGNUM *A, BIGNUM *Ai, BIGNUM *mod)
                 return(NULL);
                 }
         memset(ret,0,sizeof(BN_BLINDING));
-        if ((ret->A=BN_new()) == NULL) goto err;
-        if ((ret->Ai=BN_new()) == NULL) goto err;
-        if (!BN_copy(ret->A,A)) goto err;
-        if (!BN_copy(ret->Ai,Ai)) goto err;
-        ret->mod=mod;
+        if (A != NULL)
+                {
+                if ((ret->A  = BN_dup(A))  == NULL) goto err;
+                }
+        if (Ai != NULL)
+                {
+                if ((ret->Ai = BN_dup(Ai)) == NULL) goto err;
+                }
+
+        /* save a copy of mod in the BN_BLINDING structure */
+        if ((ret->mod = BN_dup(mod)) == NULL) goto err;
+        if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)
+                BN_set_flags(ret->mod, BN_FLG_CONSTTIME);
+
+        ret->counter = BN_BLINDING_COUNTER;
         return(ret);
 err:
         if (ret != NULL) BN_BLINDING_free(ret);
@@ -91,6 +171,8 @@ void BN_BLINDING_free(BN_BLINDING *r)
 
         if (r->A  != NULL) BN_free(r->A );
         if (r->Ai != NULL) BN_free(r->Ai);
+        if (r->e  != NULL) BN_free(r->e );
+        if (r->mod != NULL) BN_free(r->mod); 
         OPENSSL_free(r);
         }
 
@@ -103,42 +185,181 @@ int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx)
                 BNerr(BN_F_BN_BLINDING_UPDATE,BN_R_NOT_INITIALIZED);
                 goto err;
                 }
-                
-        if (!BN_mod_mul(b->A,b->A,b->A,b->mod,ctx)) goto err;
-        if (!BN_mod_mul(b->Ai,b->Ai,b->Ai,b->mod,ctx)) goto err;
+
+        if (--(b->counter) == 0 && b->e != NULL &&
+                !(b->flags & BN_BLINDING_NO_RECREATE))
+                {
+                /* re-create blinding parameters */
+                if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL))
+                        goto err;
+                }
+        else if (!(b->flags & BN_BLINDING_NO_UPDATE))
+                {
+                if (!BN_mod_mul(b->A,b->A,b->A,b->mod,ctx)) goto err;
+                if (!BN_mod_mul(b->Ai,b->Ai,b->Ai,b->mod,ctx)) goto err;
+                }
 
         ret=1;
 err:
+        if (b->counter == 0)
+                b->counter = BN_BLINDING_COUNTER;
         return(ret);
         }
 
 int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx)
         {
+        return BN_BLINDING_convert_ex(n, NULL, b, ctx);
+        }
+
+int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx)
+        {
+        int ret = 1;
+
         bn_check_top(n);
 
         if ((b->A == NULL) || (b->Ai == NULL))
                 {
-                BNerr(BN_F_BN_BLINDING_CONVERT,BN_R_NOT_INITIALIZED);
+                BNerr(BN_F_BN_BLINDING_CONVERT_EX,BN_R_NOT_INITIALIZED);
                 return(0);
                 }
-        return(BN_mod_mul(n,n,b->A,b->mod,ctx));
+
+        if (r != NULL)
+                {
+                if (!BN_copy(r, b->Ai)) ret=0;
+                }
+
+        if (!BN_mod_mul(n,n,b->A,b->mod,ctx)) ret=0;
+        
+        return ret;
         }
 
 int BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx)
         {
+        return BN_BLINDING_invert_ex(n, NULL, b, ctx);
+        }
+
+int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx)
+        {
         int ret;
 
         bn_check_top(n);
         if ((b->A == NULL) || (b->Ai == NULL))
                 {
-                BNerr(BN_F_BN_BLINDING_INVERT,BN_R_NOT_INITIALIZED);
+                BNerr(BN_F_BN_BLINDING_INVERT_EX,BN_R_NOT_INITIALIZED);
                 return(0);
                 }
-        if ((ret=BN_mod_mul(n,n,b->Ai,b->mod,ctx)) >= 0)
+
+        if (r != NULL)
+                ret = BN_mod_mul(n, n, r, b->mod, ctx);
+        else
+                ret = BN_mod_mul(n, n, b->Ai, b->mod, ctx);
+
+        if (ret >= 0)
                 {
                 if (!BN_BLINDING_update(b,ctx))
                         return(0);
                 }
+        bn_check_top(n);
         return(ret);
         }
 
+unsigned long BN_BLINDING_get_thread_id(const BN_BLINDING *b)
+        {
+        return b->thread_id;
+        }
+
+void BN_BLINDING_set_thread_id(BN_BLINDING *b, unsigned long n)
+        {
+        b->thread_id = n;
+        }
+
+unsigned long BN_BLINDING_get_flags(const BN_BLINDING *b)
+        {
+        return b->flags;
+        }
+
+void BN_BLINDING_set_flags(BN_BLINDING *b, unsigned long flags)
+        {
+        b->flags = flags;
+        }
+
+BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b,
+        const BIGNUM *e, /* const */ BIGNUM *m, BN_CTX *ctx,
+        int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                          const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx),
+        BN_MONT_CTX *m_ctx)
+{
+        int    retry_counter = 32;
+        BN_BLINDING *ret = NULL;
+
+        if (b == NULL)
+                ret = BN_BLINDING_new(NULL, NULL, m);
+        else
+                ret = b;
+
+        if (ret == NULL)
+                goto err;
+
+        if (ret->A  == NULL && (ret->A  = BN_new()) == NULL)
+                goto err;
+        if (ret->Ai == NULL && (ret->Ai = BN_new()) == NULL)
+                goto err;
+
+        if (e != NULL)
+                {
+                if (ret->e != NULL)
+                        BN_free(ret->e);
+                ret->e = BN_dup(e);
+                }
+        if (ret->e == NULL)
+                goto err;
+
+        if (bn_mod_exp != NULL)
+                ret->bn_mod_exp = bn_mod_exp;
+        if (m_ctx != NULL)
+                ret->m_ctx = m_ctx;
+
+        do {
+                if (!BN_rand_range(ret->A, ret->mod)) goto err;
+                if (BN_mod_inverse(ret->Ai, ret->A, ret->mod, ctx) == NULL)
+                        {
+                        /* this should almost never happen for good RSA keys */
+                        unsigned long error = ERR_peek_last_error();
+                        if (ERR_GET_REASON(error) == BN_R_NO_INVERSE)
+                                {
+                                if (retry_counter-- == 0)
+                                {
+                                        BNerr(BN_F_BN_BLINDING_CREATE_PARAM,
+                                                BN_R_TOO_MANY_ITERATIONS);
+                                        goto err;
+                                }
+                                ERR_clear_error();
+                                }
+                        else
+                                goto err;
+                        }
+                else
+                        break;
+        } while (1);
+
+        if (ret->bn_mod_exp != NULL && ret->m_ctx != NULL)
+                {
+                if (!ret->bn_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx, ret->m_ctx))
+                        goto err;
+                }
+        else
+                {
+                if (!BN_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx))
+                        goto err;
+                }
+
+        return ret;
+err:
+        if (b == NULL && ret != NULL)
+                {
+                BN_BLINDING_free(ret);
+                ret = NULL;
+                }
+
+        return ret;
+}
diff --git a/src/lib/libssl/src/crypto/bn/bn_ctx.c b/src/lib/libssl/src/crypto/bn/bn_ctx.c
index 7daf19eb84..b3452f1a91 100644
--- a/src/lib/libssl/src/crypto/bn/bn_ctx.c
+++ b/src/lib/libssl/src/crypto/bn/bn_ctx.c
@@ -1,7 +1,7 @@
 /* crypto/bn/bn_ctx.c */
 /* Written by Ulf Moeller for the OpenSSL project. */
 /* ====================================================================
- * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -54,9 +54,10 @@
  *
  */
 
-#ifndef BN_CTX_DEBUG
-# undef NDEBUG /* avoid conflicting definitions */
-# define NDEBUG
+#if !defined(BN_CTX_DEBUG) && !defined(BN_DEBUG)
+#ifndef NDEBUG
+#define NDEBUG
+#endif
 #endif
 
 #include <stdio.h>
@@ -65,91 +66,389 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
+/* TODO list
+ *
+ * 1. Check a bunch of "(words+1)" type hacks in various bignum functions and
+ * check they can be safely removed.
+ *  - Check +1 and other ugliness in BN_from_montgomery()
+ *
+ * 2. Consider allowing a BN_new_ex() that, at least, lets you specify an
+ * appropriate 'block' size that will be honoured by bn_expand_internal() to
+ * prevent piddly little reallocations. OTOH, profiling bignum expansions in
+ * BN_CTX doesn't show this to be a big issue.
+ */
+
+/* How many bignums are in each "pool item"; */
+#define BN_CTX_POOL_SIZE        16
+/* The stack frame info is resizing, set a first-time expansion size; */
+#define BN_CTX_START_FRAMES     32
 
-BN_CTX *BN_CTX_new(void)
+/***********/
+/* BN_POOL */
+/***********/
+
+/* A bundle of bignums that can be linked with other bundles */
+typedef struct bignum_pool_item
+        {
+        /* The bignum values */
+        BIGNUM vals[BN_CTX_POOL_SIZE];
+        /* Linked-list admin */
+        struct bignum_pool_item *prev, *next;
+        } BN_POOL_ITEM;
+/* A linked-list of bignums grouped in bundles */
+typedef struct bignum_pool
+        {
+        /* Linked-list admin */
+        BN_POOL_ITEM *head, *current, *tail;
+        /* Stack depth and allocation size */
+        unsigned used, size;
+        } BN_POOL;
+static void             BN_POOL_init(BN_POOL *);
+static void             BN_POOL_finish(BN_POOL *);
+#ifndef OPENSSL_NO_DEPRECATED
+static void             BN_POOL_reset(BN_POOL *);
+#endif
+static BIGNUM *         BN_POOL_get(BN_POOL *);
+static void             BN_POOL_release(BN_POOL *, unsigned int);
+
+/************/
+/* BN_STACK */
+/************/
+
+/* A wrapper to manage the "stack frames" */
+typedef struct bignum_ctx_stack
         {
-        BN_CTX *ret;
+        /* Array of indexes into the bignum stack */
+        unsigned int *indexes;
+        /* Number of stack frames, and the size of the allocated array */
+        unsigned int depth, size;
+        } BN_STACK;
+static void             BN_STACK_init(BN_STACK *);
+static void             BN_STACK_finish(BN_STACK *);
+#ifndef OPENSSL_NO_DEPRECATED
+static void             BN_STACK_reset(BN_STACK *);
+#endif
+static int              BN_STACK_push(BN_STACK *, unsigned int);
+static unsigned int     BN_STACK_pop(BN_STACK *);
+
+/**********/
+/* BN_CTX */
+/**********/
+
+/* The opaque BN_CTX type */
+struct bignum_ctx
+        {
+        /* The bignum bundles */
+        BN_POOL pool;
+        /* The "stack frames", if you will */
+        BN_STACK stack;
+        /* The number of bignums currently assigned */
+        unsigned int used;
+        /* Depth of stack overflow */
+        int err_stack;
+        /* Block "gets" until an "end" (compatibility behaviour) */
+        int too_many;
+        };
 
-        ret=(BN_CTX *)OPENSSL_malloc(sizeof(BN_CTX));
-        if (ret == NULL)
+/* Enable this to find BN_CTX bugs */
+#ifdef BN_CTX_DEBUG
+static const char *ctxdbg_cur = NULL;
+static void ctxdbg(BN_CTX *ctx)
+        {
+        unsigned int bnidx = 0, fpidx = 0;
+        BN_POOL_ITEM *item = ctx->pool.head;
+        BN_STACK *stack = &ctx->stack;
+        fprintf(stderr,"(%08x): ", (unsigned int)ctx);
+        while(bnidx < ctx->used)
                 {
-                BNerr(BN_F_BN_CTX_NEW,ERR_R_MALLOC_FAILURE);
-                return(NULL);
+                fprintf(stderr,"%02x ", item->vals[bnidx++ % BN_CTX_POOL_SIZE].dmax);
+                if(!(bnidx % BN_CTX_POOL_SIZE))
+                        item = item->next;
                 }
-
-        BN_CTX_init(ret);
-        ret->flags=BN_FLG_MALLOCED;
-        return(ret);
+        fprintf(stderr,"\n");
+        bnidx = 0;
+        fprintf(stderr,"          : ");
+        while(fpidx < stack->depth)
+                {
+                while(bnidx++ < stack->indexes[fpidx])
+                        fprintf(stderr,"   ");
+                fprintf(stderr,"^^ ");
+                bnidx++;
+                fpidx++;
+                }
+        fprintf(stderr,"\n");
         }
+#define CTXDBG_ENTRY(str, ctx)  do { \
+                                ctxdbg_cur = (str); \
+                                fprintf(stderr,"Starting %s\n", ctxdbg_cur); \
+                                ctxdbg(ctx); \
+                                } while(0)
+#define CTXDBG_EXIT(ctx)        do { \
+                                fprintf(stderr,"Ending %s\n", ctxdbg_cur); \
+                                ctxdbg(ctx); \
+                                } while(0)
+#define CTXDBG_RET(ctx,ret)
+#else
+#define CTXDBG_ENTRY(str, ctx)
+#define CTXDBG_EXIT(ctx)
+#define CTXDBG_RET(ctx,ret)
+#endif
 
+/* This function is an evil legacy and should not be used. This implementation
+ * is WYSIWYG, though I've done my best. */
+#ifndef OPENSSL_NO_DEPRECATED
 void BN_CTX_init(BN_CTX *ctx)
         {
-#if 0 /* explicit version */
-        int i;
-        ctx->tos = 0;
-        ctx->flags = 0;
-        ctx->depth = 0;
+        /* Assume the caller obtained the context via BN_CTX_new() and so is
+         * trying to reset it for use. Nothing else makes sense, least of all
+         * binary compatibility from a time when they could declare a static
+         * variable. */
+        BN_POOL_reset(&ctx->pool);
+        BN_STACK_reset(&ctx->stack);
+        ctx->used = 0;
+        ctx->err_stack = 0;
         ctx->too_many = 0;
-        for (i = 0; i < BN_CTX_NUM; i++)
-                BN_init(&(ctx->bn[i]));
-#else
-        memset(ctx, 0, sizeof *ctx);
+        }
 #endif
+
+BN_CTX *BN_CTX_new(void)
+        {
+        BN_CTX *ret = OPENSSL_malloc(sizeof(BN_CTX));
+        if(!ret)
+                {
+                BNerr(BN_F_BN_CTX_NEW,ERR_R_MALLOC_FAILURE);
+                return NULL;
+                }
+        /* Initialise the structure */
+        BN_POOL_init(&ret->pool);
+        BN_STACK_init(&ret->stack);
+        ret->used = 0;
+        ret->err_stack = 0;
+        ret->too_many = 0;
+        return ret;
         }
 
 void BN_CTX_free(BN_CTX *ctx)
         {
-        int i;
-
-        if (ctx == NULL) return;
-        assert(ctx->depth == 0);
-
-        for (i=0; i < BN_CTX_NUM; i++)
-                BN_clear_free(&(ctx->bn[i]));
-        if (ctx->flags & BN_FLG_MALLOCED)
-                OPENSSL_free(ctx);
+        if (ctx == NULL)
+                return;
+#ifdef BN_CTX_DEBUG
+        {
+        BN_POOL_ITEM *pool = ctx->pool.head;
+        fprintf(stderr,"BN_CTX_free, stack-size=%d, pool-bignums=%d\n",
+                ctx->stack.size, ctx->pool.size);
+        fprintf(stderr,"dmaxs: ");
+        while(pool) {
+                unsigned loop = 0;
+                while(loop < BN_CTX_POOL_SIZE)
+                        fprintf(stderr,"%02x ", pool->vals[loop++].dmax);
+                pool = pool->next;
+        }
+        fprintf(stderr,"\n");
+        }
+#endif
+        BN_STACK_finish(&ctx->stack);
+        BN_POOL_finish(&ctx->pool);
+        OPENSSL_free(ctx);
         }
 
 void BN_CTX_start(BN_CTX *ctx)
         {
-        if (ctx->depth < BN_CTX_NUM_POS)
-                ctx->pos[ctx->depth] = ctx->tos;
-        ctx->depth++;
+        CTXDBG_ENTRY("BN_CTX_start", ctx);
+        /* If we're already overflowing ... */
+        if(ctx->err_stack || ctx->too_many)
+                ctx->err_stack++;
+        /* (Try to) get a new frame pointer */
+        else if(!BN_STACK_push(&ctx->stack, ctx->used))
+                {
+                BNerr(BN_F_BN_CTX_START,BN_R_TOO_MANY_TEMPORARY_VARIABLES);
+                ctx->err_stack++;
+                }
+        CTXDBG_EXIT(ctx);
         }
 
+void BN_CTX_end(BN_CTX *ctx)
+        {
+        CTXDBG_ENTRY("BN_CTX_end", ctx);
+        if(ctx->err_stack)
+                ctx->err_stack--;
+        else
+                {
+                unsigned int fp = BN_STACK_pop(&ctx->stack);
+                /* Does this stack frame have anything to release? */
+                if(fp < ctx->used)
+                        BN_POOL_release(&ctx->pool, ctx->used - fp);
+                ctx->used = fp;
+                /* Unjam "too_many" in case "get" had failed */
+                ctx->too_many = 0;
+                }
+        CTXDBG_EXIT(ctx);
+        }
 
 BIGNUM *BN_CTX_get(BN_CTX *ctx)
         {
-        /* Note: If BN_CTX_get is ever changed to allocate BIGNUMs dynamically,
-         * make sure that if BN_CTX_get fails once it will return NULL again
-         * until BN_CTX_end is called.  (This is so that callers have to check
-         * only the last return value.)
-         */
-        if (ctx->depth > BN_CTX_NUM_POS || ctx->tos >= BN_CTX_NUM)
+        BIGNUM *ret;
+        CTXDBG_ENTRY("BN_CTX_get", ctx);
+        if(ctx->err_stack || ctx->too_many) return NULL;
+        if((ret = BN_POOL_get(&ctx->pool)) == NULL)
+                {
+                /* Setting too_many prevents repeated "get" attempts from
+                 * cluttering the error stack. */
+                ctx->too_many = 1;
+                BNerr(BN_F_BN_CTX_GET,BN_R_TOO_MANY_TEMPORARY_VARIABLES);
+                return NULL;
+                }
+        /* OK, make sure the returned bignum is "zero" */
+        BN_zero(ret);
+        ctx->used++;
+        CTXDBG_RET(ctx, ret);
+        return ret;
+        }
+
+/************/
+/* BN_STACK */
+/************/
+
+static void BN_STACK_init(BN_STACK *st)
+        {
+        st->indexes = NULL;
+        st->depth = st->size = 0;
+        }
+
+static void BN_STACK_finish(BN_STACK *st)
+        {
+        if(st->size) OPENSSL_free(st->indexes);
+        }
+
+#ifndef OPENSSL_NO_DEPRECATED
+static void BN_STACK_reset(BN_STACK *st)
+        {
+        st->depth = 0;
+        }
+#endif
+
+static int BN_STACK_push(BN_STACK *st, unsigned int idx)
+        {
+        if(st->depth == st->size)
+                /* Need to expand */
+                {
+                unsigned int newsize = (st->size ?
+                                (st->size * 3 / 2) : BN_CTX_START_FRAMES);
+                unsigned int *newitems = OPENSSL_malloc(newsize *
+                                                sizeof(unsigned int));
+                if(!newitems) return 0;
+                if(st->depth)
+                        memcpy(newitems, st->indexes, st->depth *
+                                                sizeof(unsigned int));
+                if(st->size) OPENSSL_free(st->indexes);
+                st->indexes = newitems;
+                st->size = newsize;
+                }
+        st->indexes[(st->depth)++] = idx;
+        return 1;
+        }
+
+static unsigned int BN_STACK_pop(BN_STACK *st)
+        {
+        return st->indexes[--(st->depth)];
+        }
+
+/***********/
+/* BN_POOL */
+/***********/
+
+static void BN_POOL_init(BN_POOL *p)
+        {
+        p->head = p->current = p->tail = NULL;
+        p->used = p->size = 0;
+        }
+
+static void BN_POOL_finish(BN_POOL *p)
+        {
+        while(p->head)
                 {
-                if (!ctx->too_many)
+                unsigned int loop = 0;
+                BIGNUM *bn = p->head->vals;
+                while(loop++ < BN_CTX_POOL_SIZE)
                         {
-                        BNerr(BN_F_BN_CTX_GET,BN_R_TOO_MANY_TEMPORARY_VARIABLES);
-                        /* disable error code until BN_CTX_end is called: */
-                        ctx->too_many = 1;
+                        if(bn->d) BN_clear_free(bn);
+                        bn++;
                         }
-                return NULL;
+                p->current = p->head->next;
+                OPENSSL_free(p->head);
+                p->head = p->current;
                 }
-        return (&(ctx->bn[ctx->tos++]));
         }
 
-void BN_CTX_end(BN_CTX *ctx)
+#ifndef OPENSSL_NO_DEPRECATED
+static void BN_POOL_reset(BN_POOL *p)
         {
-        if (ctx == NULL) return;
-        assert(ctx->depth > 0);
-        if (ctx->depth == 0)
-                /* should never happen, but we can tolerate it if not in
-                 * debug mode (could be a 'goto err' in the calling function
-                 * before BN_CTX_start was reached) */
-                BN_CTX_start(ctx);
+        BN_POOL_ITEM *item = p->head;
+        while(item)
+                {
+                unsigned int loop = 0;
+                BIGNUM *bn = item->vals;
+                while(loop++ < BN_CTX_POOL_SIZE)
+                        {
+                        if(bn->d) BN_clear(bn);
+                        bn++;
+                        }
+                item = item->next;
+                }
+        p->current = p->head;
+        p->used = 0;
+        }
+#endif
 
-        ctx->too_many = 0;
-        ctx->depth--;
-        if (ctx->depth < BN_CTX_NUM_POS)
-                ctx->tos = ctx->pos[ctx->depth];
+static BIGNUM *BN_POOL_get(BN_POOL *p)
+        {
+        if(p->used == p->size)
+                {
+                BIGNUM *bn;
+                unsigned int loop = 0;
+                BN_POOL_ITEM *item = OPENSSL_malloc(sizeof(BN_POOL_ITEM));
+                if(!item) return NULL;
+                /* Initialise the structure */
+                bn = item->vals;
+                while(loop++ < BN_CTX_POOL_SIZE)
+                        BN_init(bn++);
+                item->prev = p->tail;
+                item->next = NULL;
+                /* Link it in */
+                if(!p->head)
+                        p->head = p->current = p->tail = item;
+                else
+                        {
+                        p->tail->next = item;
+                        p->tail = item;
+                        p->current = item;
+                        }
+                p->size += BN_CTX_POOL_SIZE;
+                p->used++;
+                /* Return the first bignum from the new pool */
+                return item->vals;
+                }
+        if(!p->used)
+                p->current = p->head;
+        else if((p->used % BN_CTX_POOL_SIZE) == 0)
+                p->current = p->current->next;
+        return p->current->vals + ((p->used++) % BN_CTX_POOL_SIZE);
+        }
+
+static void BN_POOL_release(BN_POOL *p, unsigned int num)
+        {
+        unsigned int offset = (p->used - 1) % BN_CTX_POOL_SIZE;
+        p->used -= num;
+        while(num--)
+                {
+                bn_check_top(p->current->vals + offset);
+                if(!offset)
+                        {
+                        offset = BN_CTX_POOL_SIZE - 1;
+                        p->current = p->current->prev;
+                        }
+                else
+                        offset--;
+                }
         }
+
diff --git a/src/lib/libssl/src/crypto/bn/bn_div.c b/src/lib/libssl/src/crypto/bn/bn_div.c
index 580d1201bc..8655eb118e 100644
--- a/src/lib/libssl/src/crypto/bn/bn_div.c
+++ b/src/lib/libssl/src/crypto/bn/bn_div.c
@@ -169,22 +169,31 @@ int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d,
 #endif /* OPENSSL_NO_ASM */
 
 
-/* BN_div computes  dv := num / divisor,  rounding towards zero, and sets up
- * rm  such that  dv*divisor + rm = num  holds.
+/* BN_div[_no_branch] computes  dv := num / divisor,  rounding towards
+ * zero, and sets up rm  such that  dv*divisor + rm = num  holds.
  * Thus:
  *     dv->neg == num->neg ^ divisor->neg  (unless the result is zero)
  *     rm->neg == num->neg                 (unless the remainder is zero)
  * If 'dv' or 'rm' is NULL, the respective value is not returned.
  */
+static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
+        const BIGNUM *divisor, BN_CTX *ctx);
 int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
            BN_CTX *ctx)
         {
-        int norm_shift,i,j,loop;
+        int norm_shift,i,loop;
         BIGNUM *tmp,wnum,*snum,*sdiv,*res;
         BN_ULONG *resp,*wnump;
         BN_ULONG d0,d1;
         int num_n,div_n;
 
+        if ((BN_get_flags(num, BN_FLG_CONSTTIME) != 0) || (BN_get_flags(divisor, BN_FLG_CONSTTIME) != 0))
+                {
+                return BN_div_no_branch(dv, rm, num, divisor, ctx);
+                }
+
+        bn_check_top(dv);
+        bn_check_top(rm);
         bn_check_top(num);
         bn_check_top(divisor);
 
@@ -210,7 +219,6 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                 res=BN_CTX_get(ctx);
         else    res=dv;
         if (sdiv == NULL || res == NULL) goto err;
-        tmp->neg=0;
 
         /* First we normalise the numbers */
         norm_shift=BN_BITS2-((BN_num_bits(divisor))%BN_BITS2);
@@ -222,17 +230,17 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
         div_n=sdiv->top;
         num_n=snum->top;
         loop=num_n-div_n;
-
         /* Lets setup a 'window' into snum
          * This is the part that corresponds to the current
          * 'area' being divided */
-        BN_init(&wnum);
-        wnum.d=  &(snum->d[loop]);
-        wnum.top= div_n;
-        wnum.dmax= snum->dmax+1; /* a bit of a lie */
+        wnum.neg   = 0;
+        wnum.d     = &(snum->d[loop]);
+        wnum.top   = div_n;
+        /* only needed when BN_ucmp messes up the values between top and max */
+        wnum.dmax  = snum->dmax - loop; /* so we don't step out of bounds */
 
         /* Get the top 2 words of sdiv */
-        /* i=sdiv->top; */
+        /* div_n=sdiv->top; */
         d0=sdiv->d[div_n-1];
         d1=(div_n == 1)?0:sdiv->d[div_n-2];
 
@@ -250,19 +258,28 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
 
         if (BN_ucmp(&wnum,sdiv) >= 0)
                 {
-                if (!BN_usub(&wnum,&wnum,sdiv)) goto err;
+                /* If BN_DEBUG_RAND is defined BN_ucmp changes (via
+                 * bn_pollute) the const bignum arguments =>
+                 * clean the values between top and max again */
+                bn_clear_top2max(&wnum);
+                bn_sub_words(wnum.d, wnum.d, sdiv->d, div_n);
                 *resp=1;
-                res->d[res->top-1]=1;
                 }
         else
                 res->top--;
+        /* if res->top == 0 then clear the neg value otherwise decrease
+         * the resp pointer */
         if (res->top == 0)
                 res->neg = 0;
-        resp--;
+        else
+                resp--;
 
-        for (i=0; i<loop-1; i++)
+        for (i=0; i<loop-1; i++, wnump--, resp--)
                 {
                 BN_ULONG q,l0;
+                /* the first part of the loop uses the top two words of
+                 * snum and sdiv to calculate a BN_ULONG q such that
+                 * | wnum - sdiv * q | < sdiv */
 #if defined(BN_DIV3W) && !defined(OPENSSL_NO_ASM)
                 BN_ULONG bn_div_3_words(BN_ULONG*,BN_ULONG,BN_ULONG);
                 q=bn_div_3_words(wnump,d1,d0);
@@ -346,27 +363,252 @@ X) -> 0x%08X\n",
 #endif /* !BN_DIV3W */
 
                 l0=bn_mul_words(tmp->d,sdiv->d,div_n,q);
-                wnum.d--; wnum.top++;
                 tmp->d[div_n]=l0;
-                for (j=div_n+1; j>0; j--)
-                        if (tmp->d[j-1]) break;
-                tmp->top=j;
+                wnum.d--;
+                /* ingore top values of the bignums just sub the two 
+                 * BN_ULONG arrays with bn_sub_words */
+                if (bn_sub_words(wnum.d, wnum.d, tmp->d, div_n+1))
+                        {
+                        /* Note: As we have considered only the leading
+                         * two BN_ULONGs in the calculation of q, sdiv * q
+                         * might be greater than wnum (but then (q-1) * sdiv
+                         * is less or equal than wnum)
+                         */
+                        q--;
+                        if (bn_add_words(wnum.d, wnum.d, sdiv->d, div_n))
+                                /* we can't have an overflow here (assuming
+                                 * that q != 0, but if q == 0 then tmp is
+                                 * zero anyway) */
+                                (*wnump)++;
+                        }
+                /* store part of the result */
+                *resp = q;
+                }
+        bn_correct_top(snum);
+        if (rm != NULL)
+                {
+                /* Keep a copy of the neg flag in num because if rm==num
+                 * BN_rshift() will overwrite it.
+                 */
+                int neg = num->neg;
+                BN_rshift(rm,snum,norm_shift);
+                if (!BN_is_zero(rm))
+                        rm->neg = neg;
+                bn_check_top(rm);
+                }
+        BN_CTX_end(ctx);
+        return(1);
+err:
+        bn_check_top(rm);
+        BN_CTX_end(ctx);
+        return(0);
+        }
+
+
+/* BN_div_no_branch is a special version of BN_div. It does not contain
+ * branches that may leak sensitive information.
+ */
+static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, 
+        const BIGNUM *divisor, BN_CTX *ctx)
+        {
+        int norm_shift,i,loop;
+        BIGNUM *tmp,wnum,*snum,*sdiv,*res;
+        BN_ULONG *resp,*wnump;
+        BN_ULONG d0,d1;
+        int num_n,div_n;
+
+        bn_check_top(dv);
+        bn_check_top(rm);
+        bn_check_top(num);
+        bn_check_top(divisor);
+
+        if (BN_is_zero(divisor))
+                {
+                BNerr(BN_F_BN_DIV_NO_BRANCH,BN_R_DIV_BY_ZERO);
+                return(0);
+                }
+
+        BN_CTX_start(ctx);
+        tmp=BN_CTX_get(ctx);
+        snum=BN_CTX_get(ctx);
+        sdiv=BN_CTX_get(ctx);
+        if (dv == NULL)
+                res=BN_CTX_get(ctx);
+        else    res=dv;
+        if (sdiv == NULL || res == NULL) goto err;
+
+        /* First we normalise the numbers */
+        norm_shift=BN_BITS2-((BN_num_bits(divisor))%BN_BITS2);
+        if (!(BN_lshift(sdiv,divisor,norm_shift))) goto err;
+        sdiv->neg=0;
+        norm_shift+=BN_BITS2;
+        if (!(BN_lshift(snum,num,norm_shift))) goto err;
+        snum->neg=0;
+
+        /* Since we don't know whether snum is larger than sdiv,
+         * we pad snum with enough zeroes without changing its
+         * value. 
+         */
+        if (snum->top <= sdiv->top+1) 
+                {
+                if (bn_wexpand(snum, sdiv->top + 2) == NULL) goto err;
+                for (i = snum->top; i < sdiv->top + 2; i++) snum->d[i] = 0;
+                snum->top = sdiv->top + 2;
+                }
+        else
+                {
+                if (bn_wexpand(snum, snum->top + 1) == NULL) goto err;
+                snum->d[snum->top] = 0;
+                snum->top ++;
+                }
+
+        div_n=sdiv->top;
+        num_n=snum->top;
+        loop=num_n-div_n;
+        /* Lets setup a 'window' into snum
+         * This is the part that corresponds to the current
+         * 'area' being divided */
+        wnum.neg   = 0;
+        wnum.d     = &(snum->d[loop]);
+        wnum.top   = div_n;
+        /* only needed when BN_ucmp messes up the values between top and max */
+        wnum.dmax  = snum->dmax - loop; /* so we don't step out of bounds */
+
+        /* Get the top 2 words of sdiv */
+        /* div_n=sdiv->top; */
+        d0=sdiv->d[div_n-1];
+        d1=(div_n == 1)?0:sdiv->d[div_n-2];
+
+        /* pointer to the 'top' of snum */
+        wnump= &(snum->d[num_n-1]);
+
+        /* Setup to 'res' */
+        res->neg= (num->neg^divisor->neg);
+        if (!bn_wexpand(res,(loop+1))) goto err;
+        res->top=loop-1;
+        resp= &(res->d[loop-1]);
+
+        /* space for temp */
+        if (!bn_wexpand(tmp,(div_n+1))) goto err;
+
+        /* if res->top == 0 then clear the neg value otherwise decrease
+         * the resp pointer */
+        if (res->top == 0)
+                res->neg = 0;
+        else
+                resp--;
+
+        for (i=0; i<loop-1; i++, wnump--, resp--)
+                {
+                BN_ULONG q,l0;
+                /* the first part of the loop uses the top two words of
+                 * snum and sdiv to calculate a BN_ULONG q such that
+                 * | wnum - sdiv * q | < sdiv */
+#if defined(BN_DIV3W) && !defined(OPENSSL_NO_ASM)
+                BN_ULONG bn_div_3_words(BN_ULONG*,BN_ULONG,BN_ULONG);
+                q=bn_div_3_words(wnump,d1,d0);
+#else
+                BN_ULONG n0,n1,rem=0;
+
+                n0=wnump[0];
+                n1=wnump[-1];
+                if (n0 == d0)
+                        q=BN_MASK2;
+                else                    /* n0 < d0 */
+                        {
+#ifdef BN_LLONG
+                        BN_ULLONG t2;
+
+#if defined(BN_LLONG) && defined(BN_DIV2W) && !defined(bn_div_words)
+                        q=(BN_ULONG)(((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0);
+#else
+                        q=bn_div_words(n0,n1,d0);
+#ifdef BN_DEBUG_LEVITTE
+                        fprintf(stderr,"DEBUG: bn_div_words(0x%08X,0x%08X,0x%08\
+X) -> 0x%08X\n",
+                                n0, n1, d0, q);
+#endif
+#endif
+
+#ifndef REMAINDER_IS_ALREADY_CALCULATED
+                        /*
+                         * rem doesn't have to be BN_ULLONG. The least we
+                         * know it's less that d0, isn't it?
+                         */
+                        rem=(n1-q*d0)&BN_MASK2;
+#endif
+                        t2=(BN_ULLONG)d1*q;
+
+                        for (;;)
+                                {
+                                if (t2 <= ((((BN_ULLONG)rem)<<BN_BITS2)|wnump[-2]))
+                                        break;
+                                q--;
+                                rem += d0;
+                                if (rem < d0) break; /* don't let rem overflow */
+                                t2 -= d1;
+                                }
+#else /* !BN_LLONG */
+                        BN_ULONG t2l,t2h,ql,qh;
+
+                        q=bn_div_words(n0,n1,d0);
+#ifdef BN_DEBUG_LEVITTE
+                        fprintf(stderr,"DEBUG: bn_div_words(0x%08X,0x%08X,0x%08\
+X) -> 0x%08X\n",
+                                n0, n1, d0, q);
+#endif
+#ifndef REMAINDER_IS_ALREADY_CALCULATED
+                        rem=(n1-q*d0)&BN_MASK2;
+#endif
 
-                j=wnum.top;
-                if (!BN_sub(&wnum,&wnum,tmp)) goto err;
+#if defined(BN_UMULT_LOHI)
+                        BN_UMULT_LOHI(t2l,t2h,d1,q);
+#elif defined(BN_UMULT_HIGH)
+                        t2l = d1 * q;
+                        t2h = BN_UMULT_HIGH(d1,q);
+#else
+                        t2l=LBITS(d1); t2h=HBITS(d1);
+                        ql =LBITS(q);  qh =HBITS(q);
+                        mul64(t2l,t2h,ql,qh); /* t2=(BN_ULLONG)d1*q; */
+#endif
 
-                snum->top=snum->top+wnum.top-j;
+                        for (;;)
+                                {
+                                if ((t2h < rem) ||
+                                        ((t2h == rem) && (t2l <= wnump[-2])))
+                                        break;
+                                q--;
+                                rem += d0;
+                                if (rem < d0) break; /* don't let rem overflow */
+                                if (t2l < d1) t2h--; t2l -= d1;
+                                }
+#endif /* !BN_LLONG */
+                        }
+#endif /* !BN_DIV3W */
 
-                if (wnum.neg)
+                l0=bn_mul_words(tmp->d,sdiv->d,div_n,q);
+                tmp->d[div_n]=l0;
+                wnum.d--;
+                /* ingore top values of the bignums just sub the two 
+                 * BN_ULONG arrays with bn_sub_words */
+                if (bn_sub_words(wnum.d, wnum.d, tmp->d, div_n+1))
                         {
+                        /* Note: As we have considered only the leading
+                         * two BN_ULONGs in the calculation of q, sdiv * q
+                         * might be greater than wnum (but then (q-1) * sdiv
+                         * is less or equal than wnum)
+                         */
                         q--;
-                        j=wnum.top;
-                        if (!BN_add(&wnum,&wnum,sdiv)) goto err;
-                        snum->top+=wnum.top-j;
+                        if (bn_add_words(wnum.d, wnum.d, sdiv->d, div_n))
+                                /* we can't have an overflow here (assuming
+                                 * that q != 0, but if q == 0 then tmp is
+                                 * zero anyway) */
+                                (*wnump)++;
                         }
-                *(resp--)=q;
-                wnump--;
+                /* store part of the result */
+                *resp = q;
                 }
+        bn_correct_top(snum);
         if (rm != NULL)
                 {
                 /* Keep a copy of the neg flag in num because if rm==num
@@ -376,10 +618,13 @@ X) -> 0x%08X\n",
                 BN_rshift(rm,snum,norm_shift);
                 if (!BN_is_zero(rm))
                         rm->neg = neg;
+                bn_check_top(rm);
                 }
+        bn_correct_top(res);
         BN_CTX_end(ctx);
         return(1);
 err:
+        bn_check_top(rm);
         BN_CTX_end(ctx);
         return(0);
         }
diff --git a/src/lib/libssl/src/crypto/bn/bn_err.c b/src/lib/libssl/src/crypto/bn/bn_err.c
index 5dfac00c88..cfe2eb94a0 100644
--- a/src/lib/libssl/src/crypto/bn/bn_err.c
+++ b/src/lib/libssl/src/crypto/bn/bn_err.c
@@ -1,6 +1,6 @@
 /* crypto/bn/bn_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -70,18 +70,30 @@
 
 static ERR_STRING_DATA BN_str_functs[]=
         {
-{ERR_FUNC(BN_F_BN_BLINDING_CONVERT),    "BN_BLINDING_convert"},
-{ERR_FUNC(BN_F_BN_BLINDING_INVERT),     "BN_BLINDING_invert"},
+{ERR_FUNC(BN_F_BNRAND), "BNRAND"},
+{ERR_FUNC(BN_F_BN_BLINDING_CONVERT_EX), "BN_BLINDING_convert_ex"},
+{ERR_FUNC(BN_F_BN_BLINDING_CREATE_PARAM),       "BN_BLINDING_create_param"},
+{ERR_FUNC(BN_F_BN_BLINDING_INVERT_EX),  "BN_BLINDING_invert_ex"},
 {ERR_FUNC(BN_F_BN_BLINDING_NEW),        "BN_BLINDING_new"},
 {ERR_FUNC(BN_F_BN_BLINDING_UPDATE),     "BN_BLINDING_update"},
 {ERR_FUNC(BN_F_BN_BN2DEC),      "BN_bn2dec"},
 {ERR_FUNC(BN_F_BN_BN2HEX),      "BN_bn2hex"},
 {ERR_FUNC(BN_F_BN_CTX_GET),     "BN_CTX_get"},
 {ERR_FUNC(BN_F_BN_CTX_NEW),     "BN_CTX_new"},
+{ERR_FUNC(BN_F_BN_CTX_START),   "BN_CTX_start"},
 {ERR_FUNC(BN_F_BN_DIV), "BN_div"},
+{ERR_FUNC(BN_F_BN_DIV_NO_BRANCH),       "BN_div_no_branch"},
+{ERR_FUNC(BN_F_BN_DIV_RECP),    "BN_div_recp"},
 {ERR_FUNC(BN_F_BN_EXP), "BN_exp"},
 {ERR_FUNC(BN_F_BN_EXPAND2),     "bn_expand2"},
 {ERR_FUNC(BN_F_BN_EXPAND_INTERNAL),     "BN_EXPAND_INTERNAL"},
+{ERR_FUNC(BN_F_BN_GF2M_MOD),    "BN_GF2m_mod"},
+{ERR_FUNC(BN_F_BN_GF2M_MOD_EXP),        "BN_GF2m_mod_exp"},
+{ERR_FUNC(BN_F_BN_GF2M_MOD_MUL),        "BN_GF2m_mod_mul"},
+{ERR_FUNC(BN_F_BN_GF2M_MOD_SOLVE_QUAD), "BN_GF2m_mod_solve_quad"},
+{ERR_FUNC(BN_F_BN_GF2M_MOD_SOLVE_QUAD_ARR),     "BN_GF2m_mod_solve_quad_arr"},
+{ERR_FUNC(BN_F_BN_GF2M_MOD_SQR),        "BN_GF2m_mod_sqr"},
+{ERR_FUNC(BN_F_BN_GF2M_MOD_SQRT),       "BN_GF2m_mod_sqrt"},
 {ERR_FUNC(BN_F_BN_MOD_EXP2_MONT),       "BN_mod_exp2_mont"},
 {ERR_FUNC(BN_F_BN_MOD_EXP_MONT),        "BN_mod_exp_mont"},
 {ERR_FUNC(BN_F_BN_MOD_EXP_MONT_CONSTTIME),      "BN_mod_exp_mont_consttime"},
@@ -89,6 +101,7 @@ static ERR_STRING_DATA BN_str_functs[]=
 {ERR_FUNC(BN_F_BN_MOD_EXP_RECP),        "BN_mod_exp_recp"},
 {ERR_FUNC(BN_F_BN_MOD_EXP_SIMPLE),      "BN_mod_exp_simple"},
 {ERR_FUNC(BN_F_BN_MOD_INVERSE), "BN_mod_inverse"},
+{ERR_FUNC(BN_F_BN_MOD_INVERSE_NO_BRANCH),       "BN_mod_inverse_no_branch"},
 {ERR_FUNC(BN_F_BN_MOD_LSHIFT_QUICK),    "BN_mod_lshift_quick"},
 {ERR_FUNC(BN_F_BN_MOD_MUL_RECIPROCAL),  "BN_mod_mul_reciprocal"},
 {ERR_FUNC(BN_F_BN_MOD_SQRT),    "BN_mod_sqrt"},
@@ -115,6 +128,7 @@ static ERR_STRING_DATA BN_str_reasons[]=
 {ERR_REASON(BN_R_NOT_A_SQUARE)           ,"not a square"},
 {ERR_REASON(BN_R_NOT_INITIALIZED)        ,"not initialized"},
 {ERR_REASON(BN_R_NO_INVERSE)             ,"no inverse"},
+{ERR_REASON(BN_R_NO_SOLUTION)            ,"no solution"},
 {ERR_REASON(BN_R_P_IS_NOT_PRIME)         ,"p is not prime"},
 {ERR_REASON(BN_R_TOO_MANY_ITERATIONS)    ,"too many iterations"},
 {ERR_REASON(BN_R_TOO_MANY_TEMPORARY_VARIABLES),"too many temporary variables"},
@@ -125,15 +139,12 @@ static ERR_STRING_DATA BN_str_reasons[]=
 
 void ERR_load_BN_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(BN_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,BN_str_functs);
                 ERR_load_strings(0,BN_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/bn/bn_exp.c b/src/lib/libssl/src/crypto/bn/bn_exp.c
index 9e1e88abe8..70a33f0d93 100644
--- a/src/lib/libssl/src/crypto/bn/bn_exp.c
+++ b/src/lib/libssl/src/crypto/bn/bn_exp.c
@@ -122,9 +122,9 @@ int BN_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
         int i,bits,ret=0;
         BIGNUM *v,*rr;
 
-        if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
+        if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0)
                 {
-                /* BN_FLG_EXP_CONSTTIME only supported by BN_mod_exp_mont() */
+                /* BN_FLG_CONSTTIME only supported by BN_mod_exp_mont() */
                 BNerr(BN_F_BN_EXP,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return -1;
                 }
@@ -155,6 +155,7 @@ int BN_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
 err:
         if (r != rr) BN_copy(r,rr);
         BN_CTX_end(ctx);
+        bn_check_top(r);
         return(ret);
         }
 
@@ -212,7 +213,7 @@ int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
         if (BN_is_odd(m))
                 {
 #  ifdef MONT_EXP_WORD
-                if (a->top == 1 && !a->neg && (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) == 0))
+                if (a->top == 1 && !a->neg && (BN_get_flags(p, BN_FLG_CONSTTIME) == 0))
                         {
                         BN_ULONG A = a->d[0];
                         ret=BN_mod_exp_mont_word(r,A,p,m,ctx,NULL);
@@ -229,6 +230,7 @@ int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
                 { ret=BN_mod_exp_simple(r,a,p,m,ctx); }
 #endif
 
+        bn_check_top(r);
         return(ret);
         }
 
@@ -237,14 +239,15 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                     const BIGNUM *m, BN_CTX *ctx)
         {
         int i,j,bits,ret=0,wstart,wend,window,wvalue;
-        int start=1,ts=0;
+        int start=1;
         BIGNUM *aa;
-        BIGNUM val[TABLE_SIZE];
+        /* Table of variables obtained from 'ctx' */
+        BIGNUM *val[TABLE_SIZE];
         BN_RECP_CTX recp;
 
-        if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
+        if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0)
                 {
-                /* BN_FLG_EXP_CONSTTIME only supported by BN_mod_exp_mont() */
+                /* BN_FLG_CONSTTIME only supported by BN_mod_exp_mont() */
                 BNerr(BN_F_BN_MOD_EXP_RECP,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return -1;
                 }
@@ -258,7 +261,9 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                 }
 
         BN_CTX_start(ctx);
-        if ((aa = BN_CTX_get(ctx)) == NULL) goto err;
+        aa = BN_CTX_get(ctx);
+        val[0] = BN_CTX_get(ctx);
+        if(!aa || !val[0]) goto err;
 
         BN_RECP_CTX_init(&recp);
         if (m->neg)
@@ -273,29 +278,27 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                 if (BN_RECP_CTX_set(&recp,m,ctx) <= 0) goto err;
                 }
 
-        BN_init(&(val[0]));
-        ts=1;
-
-        if (!BN_nnmod(&(val[0]),a,m,ctx)) goto err;             /* 1 */
-        if (BN_is_zero(&(val[0])))
+        if (!BN_nnmod(val[0],a,m,ctx)) goto err;                /* 1 */
+        if (BN_is_zero(val[0]))
                 {
-                ret = BN_zero(r);
+                BN_zero(r);
+                ret = 1;
                 goto err;
                 }
 
         window = BN_window_bits_for_exponent_size(bits);
         if (window > 1)
                 {
-                if (!BN_mod_mul_reciprocal(aa,&(val[0]),&(val[0]),&recp,ctx))
+                if (!BN_mod_mul_reciprocal(aa,val[0],val[0],&recp,ctx))
                         goto err;                               /* 2 */
                 j=1<<(window-1);
                 for (i=1; i<j; i++)
                         {
-                        BN_init(&val[i]);
-                        if (!BN_mod_mul_reciprocal(&(val[i]),&(val[i-1]),aa,&recp,ctx))
+                        if(((val[i] = BN_CTX_get(ctx)) == NULL) ||
+                                        !BN_mod_mul_reciprocal(val[i],val[i-1],
+                                                aa,&recp,ctx))
                                 goto err;
                         }
-                ts=i;
                 }
                 
         start=1;        /* This is used to avoid multiplication etc
@@ -347,7 +350,7 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                                 }
                 
                 /* wvalue will be an odd number < 2^window */
-                if (!BN_mod_mul_reciprocal(r,r,&(val[wvalue>>1]),&recp,ctx))
+                if (!BN_mod_mul_reciprocal(r,r,val[wvalue>>1],&recp,ctx))
                         goto err;
 
                 /* move the 'window' down further */
@@ -359,9 +362,8 @@ int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
         ret=1;
 err:
         BN_CTX_end(ctx);
-        for (i=0; i<ts; i++)
-                BN_clear_free(&(val[i]));
         BN_RECP_CTX_free(&recp);
+        bn_check_top(r);
         return(ret);
         }
 
@@ -370,13 +372,14 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                     const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
         {
         int i,j,bits,ret=0,wstart,wend,window,wvalue;
-        int start=1,ts=0;
+        int start=1;
         BIGNUM *d,*r;
         const BIGNUM *aa;
-        BIGNUM val[TABLE_SIZE];
+        /* Table of variables obtained from 'ctx' */
+        BIGNUM *val[TABLE_SIZE];
         BN_MONT_CTX *mont=NULL;
 
-        if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
+        if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0)
                 {
                 return BN_mod_exp_mont_consttime(rr, a, p, m, ctx, in_mont);
                 }
@@ -385,7 +388,7 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         bn_check_top(p);
         bn_check_top(m);
 
-        if (!(m->d[0] & 1))
+        if (!BN_is_odd(m))
                 {
                 BNerr(BN_F_BN_MOD_EXP_MONT,BN_R_CALLED_WITH_EVEN_MODULUS);
                 return(0);
@@ -400,7 +403,8 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         BN_CTX_start(ctx);
         d = BN_CTX_get(ctx);
         r = BN_CTX_get(ctx);
-        if (d == NULL || r == NULL) goto err;
+        val[0] = BN_CTX_get(ctx);
+        if (!d || !r || !val[0]) goto err;
 
         /* If this is not done, things will break in the montgomery
          * part */
@@ -413,35 +417,34 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                 if (!BN_MONT_CTX_set(mont,m,ctx)) goto err;
                 }
 
-        BN_init(&val[0]);
-        ts=1;
         if (a->neg || BN_ucmp(a,m) >= 0)
                 {
-                if (!BN_nnmod(&(val[0]),a,m,ctx))
+                if (!BN_nnmod(val[0],a,m,ctx))
                         goto err;
-                aa= &(val[0]);
+                aa= val[0];
                 }
         else
                 aa=a;
         if (BN_is_zero(aa))
                 {
-                ret = BN_zero(rr);
+                BN_zero(rr);
+                ret = 1;
                 goto err;
                 }
-        if (!BN_to_montgomery(&(val[0]),aa,mont,ctx)) goto err; /* 1 */
+        if (!BN_to_montgomery(val[0],aa,mont,ctx)) goto err; /* 1 */
 
         window = BN_window_bits_for_exponent_size(bits);
         if (window > 1)
                 {
-                if (!BN_mod_mul_montgomery(d,&(val[0]),&(val[0]),mont,ctx)) goto err; /* 2 */
+                if (!BN_mod_mul_montgomery(d,val[0],val[0],mont,ctx)) goto err; /* 2 */
                 j=1<<(window-1);
                 for (i=1; i<j; i++)
                         {
-                        BN_init(&(val[i]));
-                        if (!BN_mod_mul_montgomery(&(val[i]),&(val[i-1]),d,mont,ctx))
+                        if(((val[i] = BN_CTX_get(ctx)) == NULL) ||
+                                        !BN_mod_mul_montgomery(val[i],val[i-1],
+                                                d,mont,ctx))
                                 goto err;
                         }
-                ts=i;
                 }
 
         start=1;        /* This is used to avoid multiplication etc
@@ -494,7 +497,7 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                                 }
                 
                 /* wvalue will be an odd number < 2^window */
-                if (!BN_mod_mul_montgomery(r,r,&(val[wvalue>>1]),mont,ctx))
+                if (!BN_mod_mul_montgomery(r,r,val[wvalue>>1],mont,ctx))
                         goto err;
 
                 /* move the 'window' down further */
@@ -508,8 +511,7 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
 err:
         if ((in_mont == NULL) && (mont != NULL)) BN_MONT_CTX_free(mont);
         BN_CTX_end(ctx);
-        for (i=0; i<ts; i++)
-                BN_clear_free(&(val[i]));
+        bn_check_top(rr);
         return(ret);
         }
 
@@ -535,7 +537,7 @@ static int MOD_EXP_CTIME_COPY_TO_PREBUF(BIGNUM *b, int top, unsigned char *buf,
                 buf[j] = ((unsigned char*)b->d)[i];
                 }
 
-        bn_fix_top(b);
+        bn_correct_top(b);
         return 1;
         }
 
@@ -552,7 +554,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top, unsigned char *buf
                 }
 
         b->top = top;
-        bn_fix_top(b);
+        bn_correct_top(b);
         return 1;
         }       
 
@@ -743,9 +745,9 @@ int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
 #define BN_TO_MONTGOMERY_WORD(r, w, mont) \
                 (BN_set_word(r, (w)) && BN_to_montgomery(r, r, (mont), ctx))
 
-        if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
+        if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0)
                 {
-                /* BN_FLG_EXP_CONSTTIME only supported by BN_mod_exp_mont() */
+                /* BN_FLG_CONSTTIME only supported by BN_mod_exp_mont() */
                 BNerr(BN_F_BN_MOD_EXP_MONT_WORD,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return -1;
                 }
@@ -753,7 +755,7 @@ int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
         bn_check_top(p);
         bn_check_top(m);
 
-        if (m->top == 0 || !(m->d[0] & 1))
+        if (!BN_is_odd(m))
                 {
                 BNerr(BN_F_BN_MOD_EXP_MONT_WORD,BN_R_CALLED_WITH_EVEN_MODULUS);
                 return(0);
@@ -769,7 +771,8 @@ int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
                 }
         if (a == 0)
                 {
-                ret = BN_zero(rr);
+                BN_zero(rr);
+                ret = 1;
                 return ret;
                 }
 
@@ -863,23 +866,24 @@ int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
 err:
         if ((in_mont == NULL) && (mont != NULL)) BN_MONT_CTX_free(mont);
         BN_CTX_end(ctx);
+        bn_check_top(rr);
         return(ret);
         }
 
 
 /* The old fallback, simple version :-) */
-int BN_mod_exp_simple(BIGNUM *r,
-        const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
-        BN_CTX *ctx)
+int BN_mod_exp_simple(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx)
         {
-        int i,j,bits,ret=0,wstart,wend,window,wvalue,ts=0;
+        int i,j,bits,ret=0,wstart,wend,window,wvalue;
         int start=1;
         BIGNUM *d;
-        BIGNUM val[TABLE_SIZE];
+        /* Table of variables obtained from 'ctx' */
+        BIGNUM *val[TABLE_SIZE];
 
-        if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
+        if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0)
                 {
-                /* BN_FLG_EXP_CONSTTIME only supported by BN_mod_exp_mont() */
+                /* BN_FLG_CONSTTIME only supported by BN_mod_exp_mont() */
                 BNerr(BN_F_BN_MOD_EXP_SIMPLE,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return -1;
                 }
@@ -893,30 +897,30 @@ int BN_mod_exp_simple(BIGNUM *r,
                 }
 
         BN_CTX_start(ctx);
-        if ((d = BN_CTX_get(ctx)) == NULL) goto err;
+        d = BN_CTX_get(ctx);
+        val[0] = BN_CTX_get(ctx);
+        if(!d || !val[0]) goto err;
 
-        BN_init(&(val[0]));
-        ts=1;
-        if (!BN_nnmod(&(val[0]),a,m,ctx)) goto err;             /* 1 */
-        if (BN_is_zero(&(val[0])))
+        if (!BN_nnmod(val[0],a,m,ctx)) goto err;                /* 1 */
+        if (BN_is_zero(val[0]))
                 {
-                ret = BN_zero(r);
+                BN_zero(r);
+                ret = 1;
                 goto err;
                 }
 
         window = BN_window_bits_for_exponent_size(bits);
         if (window > 1)
                 {
-                if (!BN_mod_mul(d,&(val[0]),&(val[0]),m,ctx))
+                if (!BN_mod_mul(d,val[0],val[0],m,ctx))
                         goto err;                               /* 2 */
                 j=1<<(window-1);
                 for (i=1; i<j; i++)
                         {
-                        BN_init(&(val[i]));
-                        if (!BN_mod_mul(&(val[i]),&(val[i-1]),d,m,ctx))
+                        if(((val[i] = BN_CTX_get(ctx)) == NULL) ||
+                                        !BN_mod_mul(val[i],val[i-1],d,m,ctx))
                                 goto err;
                         }
-                ts=i;
                 }
 
         start=1;        /* This is used to avoid multiplication etc
@@ -968,7 +972,7 @@ int BN_mod_exp_simple(BIGNUM *r,
                                 }
                 
                 /* wvalue will be an odd number < 2^window */
-                if (!BN_mod_mul(r,r,&(val[wvalue>>1]),m,ctx))
+                if (!BN_mod_mul(r,r,val[wvalue>>1],m,ctx))
                         goto err;
 
                 /* move the 'window' down further */
@@ -980,8 +984,7 @@ int BN_mod_exp_simple(BIGNUM *r,
         ret=1;
 err:
         BN_CTX_end(ctx);
-        for (i=0; i<ts; i++)
-                BN_clear_free(&(val[i]));
+        bn_check_top(r);
         return(ret);
         }
 
diff --git a/src/lib/libssl/src/crypto/bn/bn_exp2.c b/src/lib/libssl/src/crypto/bn/bn_exp2.c
index 73ccd58a83..b3f43cec8c 100644
--- a/src/lib/libssl/src/crypto/bn/bn_exp2.c
+++ b/src/lib/libssl/src/crypto/bn/bn_exp2.c
@@ -120,10 +120,11 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
         BN_CTX *ctx, BN_MONT_CTX *in_mont)
         {
         int i,j,bits,b,bits1,bits2,ret=0,wpos1,wpos2,window1,window2,wvalue1,wvalue2;
-        int r_is_one=1,ts1=0,ts2=0;
+        int r_is_one=1;
         BIGNUM *d,*r;
         const BIGNUM *a_mod_m;
-        BIGNUM val1[TABLE_SIZE], val2[TABLE_SIZE];
+        /* Tables of variables obtained from 'ctx' */
+        BIGNUM *val1[TABLE_SIZE], *val2[TABLE_SIZE];
         BN_MONT_CTX *mont=NULL;
 
         bn_check_top(a1);
@@ -150,7 +151,9 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
         BN_CTX_start(ctx);
         d = BN_CTX_get(ctx);
         r = BN_CTX_get(ctx);
-        if (d == NULL || r == NULL) goto err;
+        val1[0] = BN_CTX_get(ctx);
+        val2[0] = BN_CTX_get(ctx);
+        if(!d || !r || !val1[0] || !val2[0]) goto err;
 
         if (in_mont != NULL)
                 mont=in_mont;
@@ -166,69 +169,67 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
         /*
          * Build table for a1:   val1[i] := a1^(2*i + 1) mod m  for i = 0 .. 2^(window1-1)
          */
-        BN_init(&val1[0]);
-        ts1=1;
         if (a1->neg || BN_ucmp(a1,m) >= 0)
                 {
-                if (!BN_mod(&(val1[0]),a1,m,ctx))
+                if (!BN_mod(val1[0],a1,m,ctx))
                         goto err;
-                a_mod_m = &(val1[0]);
+                a_mod_m = val1[0];
                 }
         else
                 a_mod_m = a1;
         if (BN_is_zero(a_mod_m))
                 {
-                ret = BN_zero(rr);
+                BN_zero(rr);
+                ret = 1;
                 goto err;
                 }
 
-        if (!BN_to_montgomery(&(val1[0]),a_mod_m,mont,ctx)) goto err;
+        if (!BN_to_montgomery(val1[0],a_mod_m,mont,ctx)) goto err;
         if (window1 > 1)
                 {
-                if (!BN_mod_mul_montgomery(d,&(val1[0]),&(val1[0]),mont,ctx)) goto err;
+                if (!BN_mod_mul_montgomery(d,val1[0],val1[0],mont,ctx)) goto err;
 
                 j=1<<(window1-1);
                 for (i=1; i<j; i++)
                         {
-                        BN_init(&(val1[i]));
-                        if (!BN_mod_mul_montgomery(&(val1[i]),&(val1[i-1]),d,mont,ctx))
+                        if(((val1[i] = BN_CTX_get(ctx)) == NULL) ||
+                                        !BN_mod_mul_montgomery(val1[i],val1[i-1],
+                                                d,mont,ctx))
                                 goto err;
                         }
-                ts1=i;
                 }
 
 
         /*
          * Build table for a2:   val2[i] := a2^(2*i + 1) mod m  for i = 0 .. 2^(window2-1)
          */
-        BN_init(&val2[0]);
-        ts2=1;
         if (a2->neg || BN_ucmp(a2,m) >= 0)
                 {
-                if (!BN_mod(&(val2[0]),a2,m,ctx))
+                if (!BN_mod(val2[0],a2,m,ctx))
                         goto err;
-                a_mod_m = &(val2[0]);
+                a_mod_m = val2[0];
                 }
         else
                 a_mod_m = a2;
         if (BN_is_zero(a_mod_m))
                 {
-                ret = BN_zero(rr);
+                BN_zero(rr);
+                ret = 1;
                 goto err;
                 }
-        if (!BN_to_montgomery(&(val2[0]),a_mod_m,mont,ctx)) goto err;
+        if (!BN_to_montgomery(val2[0],a_mod_m,mont,ctx)) goto err;
         if (window2 > 1)
                 {
-                if (!BN_mod_mul_montgomery(d,&(val2[0]),&(val2[0]),mont,ctx)) goto err;
+                if (!BN_mod_mul_montgomery(d,val2[0],val2[0],mont,ctx)) goto err;
 
                 j=1<<(window2-1);
                 for (i=1; i<j; i++)
                         {
-                        BN_init(&(val2[i]));
-                        if (!BN_mod_mul_montgomery(&(val2[i]),&(val2[i-1]),d,mont,ctx))
+                        if(((val2[i] = BN_CTX_get(ctx)) == NULL) ||
+                                        !BN_mod_mul_montgomery(val2[i],val2[i-1],
+                                                d,mont,ctx))
                                 goto err;
                         }
-                ts2=i;
                 }
 
 
@@ -285,7 +286,7 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
                 if (wvalue1 && b == wpos1)
                         {
                         /* wvalue1 is odd and < 2^window1 */
-                        if (!BN_mod_mul_montgomery(r,r,&(val1[wvalue1>>1]),mont,ctx))
+                        if (!BN_mod_mul_montgomery(r,r,val1[wvalue1>>1],mont,ctx))
                                 goto err;
                         wvalue1 = 0;
                         r_is_one = 0;
@@ -294,7 +295,7 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
                 if (wvalue2 && b == wpos2)
                         {
                         /* wvalue2 is odd and < 2^window2 */
-                        if (!BN_mod_mul_montgomery(r,r,&(val2[wvalue2>>1]),mont,ctx))
+                        if (!BN_mod_mul_montgomery(r,r,val2[wvalue2>>1],mont,ctx))
                                 goto err;
                         wvalue2 = 0;
                         r_is_one = 0;
@@ -305,9 +306,6 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
 err:
         if ((in_mont == NULL) && (mont != NULL)) BN_MONT_CTX_free(mont);
         BN_CTX_end(ctx);
-        for (i=0; i<ts1; i++)
-                BN_clear_free(&(val1[i]));
-        for (i=0; i<ts2; i++)
-                BN_clear_free(&(val2[i]));
+        bn_check_top(rr);
         return(ret);
         }
diff --git a/src/lib/libssl/src/crypto/bn/bn_gcd.c b/src/lib/libssl/src/crypto/bn/bn_gcd.c
index 7649f63fd2..4a352119ba 100644
--- a/src/lib/libssl/src/crypto/bn/bn_gcd.c
+++ b/src/lib/libssl/src/crypto/bn/bn_gcd.c
@@ -140,6 +140,7 @@ int BN_gcd(BIGNUM *r, const BIGNUM *in_a, const BIGNUM *in_b, BN_CTX *ctx)
         ret=1;
 err:
         BN_CTX_end(ctx);
+        bn_check_top(r);
         return(ret);
         }
 
@@ -194,6 +195,7 @@ static BIGNUM *euclid(BIGNUM *a, BIGNUM *b)
                 {
                 if (!BN_lshift(a,a,shifts)) goto err;
                 }
+        bn_check_top(a);
         return(a);
 err:
         return(NULL);
@@ -201,6 +203,8 @@ err:
 
 
 /* solves ax == 1 (mod n) */
+static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
+        const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx);
 BIGNUM *BN_mod_inverse(BIGNUM *in,
         const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
         {
@@ -208,6 +212,11 @@ BIGNUM *BN_mod_inverse(BIGNUM *in,
         BIGNUM *ret=NULL;
         int sign;
 
+        if ((BN_get_flags(a, BN_FLG_CONSTTIME) != 0) || (BN_get_flags(n, BN_FLG_CONSTTIME) != 0))
+                {
+                return BN_mod_inverse_no_branch(in, a, n, ctx);
+                }
+
         bn_check_top(a);
         bn_check_top(n);
 
@@ -486,5 +495,160 @@ BIGNUM *BN_mod_inverse(BIGNUM *in,
 err:
         if ((ret == NULL) && (in == NULL)) BN_free(R);
         BN_CTX_end(ctx);
+        bn_check_top(ret);
+        return(ret);
+        }
+
+
+/* BN_mod_inverse_no_branch is a special version of BN_mod_inverse. 
+ * It does not contain branches that may leak sensitive information.
+ */
+static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
+        const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
+        {
+        BIGNUM *A,*B,*X,*Y,*M,*D,*T,*R=NULL;
+        BIGNUM local_A, local_B;
+        BIGNUM *pA, *pB;
+        BIGNUM *ret=NULL;
+        int sign;
+
+        bn_check_top(a);
+        bn_check_top(n);
+
+        BN_CTX_start(ctx);
+        A = BN_CTX_get(ctx);
+        B = BN_CTX_get(ctx);
+        X = BN_CTX_get(ctx);
+        D = BN_CTX_get(ctx);
+        M = BN_CTX_get(ctx);
+        Y = BN_CTX_get(ctx);
+        T = BN_CTX_get(ctx);
+        if (T == NULL) goto err;
+
+        if (in == NULL)
+                R=BN_new();
+        else
+                R=in;
+        if (R == NULL) goto err;
+
+        BN_one(X);
+        BN_zero(Y);
+        if (BN_copy(B,a) == NULL) goto err;
+        if (BN_copy(A,n) == NULL) goto err;
+        A->neg = 0;
+
+        if (B->neg || (BN_ucmp(B, A) >= 0))
+                {
+                /* Turn BN_FLG_CONSTTIME flag on, so that when BN_div is invoked,
+                 * BN_div_no_branch will be called eventually.
+                 */
+                pB = &local_B;
+                BN_with_flags(pB, B, BN_FLG_CONSTTIME); 
+                if (!BN_nnmod(B, pB, A, ctx)) goto err;
+                }
+        sign = -1;
+        /* From  B = a mod |n|,  A = |n|  it follows that
+         *
+         *      0 <= B < A,
+         *     -sign*X*a  ==  B   (mod |n|),
+         *      sign*Y*a  ==  A   (mod |n|).
+         */
+
+        while (!BN_is_zero(B))
+                {
+                BIGNUM *tmp;
+                
+                /*
+                 *      0 < B < A,
+                 * (*) -sign*X*a  ==  B   (mod |n|),
+                 *      sign*Y*a  ==  A   (mod |n|)
+                 */
+
+                /* Turn BN_FLG_CONSTTIME flag on, so that when BN_div is invoked,
+                 * BN_div_no_branch will be called eventually.
+                 */
+                pA = &local_A;
+                BN_with_flags(pA, A, BN_FLG_CONSTTIME); 
+                
+                /* (D, M) := (A/B, A%B) ... */          
+                if (!BN_div(D,M,pA,B,ctx)) goto err;
+                
+                /* Now
+                 *      A = D*B + M;
+                 * thus we have
+                 * (**)  sign*Y*a  ==  D*B + M   (mod |n|).
+                 */
+                
+                tmp=A; /* keep the BIGNUM object, the value does not matter */
+                
+                /* (A, B) := (B, A mod B) ... */
+                A=B;
+                B=M;
+                /* ... so we have  0 <= B < A  again */
+                
+                /* Since the former  M  is now  B  and the former  B  is now  A,
+                 * (**) translates into
+                 *       sign*Y*a  ==  D*A + B    (mod |n|),
+                 * i.e.
+                 *       sign*Y*a - D*A  ==  B    (mod |n|).
+                 * Similarly, (*) translates into
+                 *      -sign*X*a  ==  A          (mod |n|).
+                 *
+                 * Thus,
+                 *   sign*Y*a + D*sign*X*a  ==  B  (mod |n|),
+                 * i.e.
+                 *        sign*(Y + D*X)*a  ==  B  (mod |n|).
+                 *
+                 * So if we set  (X, Y, sign) := (Y + D*X, X, -sign),  we arrive back at
+                 *      -sign*X*a  ==  B   (mod |n|),
+                 *       sign*Y*a  ==  A   (mod |n|).
+                 * Note that  X  and  Y  stay non-negative all the time.
+                 */
+                        
+                if (!BN_mul(tmp,D,X,ctx)) goto err;
+                if (!BN_add(tmp,tmp,Y)) goto err;
+
+                M=Y; /* keep the BIGNUM object, the value does not matter */
+                Y=X;
+                X=tmp;
+                sign = -sign;
+                }
+                
+        /*
+         * The while loop (Euclid's algorithm) ends when
+         *      A == gcd(a,n);
+         * we have
+         *       sign*Y*a  ==  A  (mod |n|),
+         * where  Y  is non-negative.
+         */
+
+        if (sign < 0)
+                {
+                if (!BN_sub(Y,n,Y)) goto err;
+                }
+        /* Now  Y*a  ==  A  (mod |n|).  */
+
+        if (BN_is_one(A))
+                {
+                /* Y*a == 1  (mod |n|) */
+                if (!Y->neg && BN_ucmp(Y,n) < 0)
+                        {
+                        if (!BN_copy(R,Y)) goto err;
+                        }
+                else
+                        {
+                        if (!BN_nnmod(R,Y,n,ctx)) goto err;
+                        }
+                }
+        else
+                {
+                BNerr(BN_F_BN_MOD_INVERSE_NO_BRANCH,BN_R_NO_INVERSE);
+                goto err;
+                }
+        ret=R;
+err:
+        if ((ret == NULL) && (in == NULL)) BN_free(R);
+        BN_CTX_end(ctx);
+        bn_check_top(ret);
         return(ret);
         }
diff --git a/src/lib/libssl/src/crypto/bn/bn_kron.c b/src/lib/libssl/src/crypto/bn/bn_kron.c
index 49f75594ae..740359b752 100644
--- a/src/lib/libssl/src/crypto/bn/bn_kron.c
+++ b/src/lib/libssl/src/crypto/bn/bn_kron.c
@@ -53,9 +53,9 @@
  *
  */
 
+#include "cryptlib.h"
 #include "bn_lcl.h"
 
-
 /* least significant word */
 #define BN_lsw(n) (((n)->top == 0) ? (BN_ULONG) 0 : (n)->d[0])
 
@@ -74,6 +74,9 @@ int BN_kronecker(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
          */
         static const int tab[8] = {0, 1, 0, -1, 0, -1, 0, 1};
 
+        bn_check_top(a);
+        bn_check_top(b);
+
         BN_CTX_start(ctx);
         A = BN_CTX_get(ctx);
         B = BN_CTX_get(ctx);
@@ -172,8 +175,7 @@ int BN_kronecker(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
                 tmp = A; A = B; B = tmp;
                 tmp->neg = 0;
                 }
-        
- end:
+end:
         BN_CTX_end(ctx);
         if (err)
                 return -2;
diff --git a/src/lib/libssl/src/crypto/bn/bn_lcl.h b/src/lib/libssl/src/crypto/bn/bn_lcl.h
index a84998f2bd..27ac4397a1 100644
--- a/src/lib/libssl/src/crypto/bn/bn_lcl.h
+++ b/src/lib/libssl/src/crypto/bn/bn_lcl.h
@@ -119,20 +119,6 @@ extern "C" {
 #endif
 
 
-/* Used for temp variables */
-#define BN_CTX_NUM      32
-#define BN_CTX_NUM_POS  12
-struct bignum_ctx
-        {
-        int tos;
-        BIGNUM bn[BN_CTX_NUM];
-        int flags;
-        int depth;
-        int pos[BN_CTX_NUM_POS];
-        int too_many;
-        } /* BN_CTX */;
-
-
 /*
  * BN_window_bits_for_exponent_size -- macro for sliding window mod_exp functions
  *
@@ -284,6 +270,15 @@ struct bignum_ctx
                 : "a"(a),"g"(b)         \
                 : "cc");
 #  endif
+# elif (defined(_M_AMD64) || defined(_M_X64)) && defined(SIXTY_FOUR_BIT)
+#  if defined(_MSC_VER) && _MSC_VER>=1400
+    unsigned __int64 __umulh    (unsigned __int64 a,unsigned __int64 b);
+    unsigned __int64 _umul128   (unsigned __int64 a,unsigned __int64 b,
+                                 unsigned __int64 *h);
+#   pragma intrinsic(__umulh,_umul128)
+#   define BN_UMULT_HIGH(a,b)           __umulh((a),(b))
+#   define BN_UMULT_LOHI(low,high,a,b)  ((low)=_umul128((a),(b),&(high)))
+#  endif
 # endif         /* cpu */
 #endif          /* OPENSSL_NO_ASM */
 
@@ -293,44 +288,17 @@ struct bignum_ctx
 #define Lw(t)    (((BN_ULONG)(t))&BN_MASK2)
 #define Hw(t)    (((BN_ULONG)((t)>>BN_BITS2))&BN_MASK2)
 
-/* This is used for internal error checking and is not normally used */
-#ifdef BN_DEBUG
-# include <assert.h>
-# define bn_check_top(a) assert ((a)->top >= 0 && (a)->top <= (a)->dmax);
-#else
-# define bn_check_top(a)
-#endif
-
-/* This macro is to add extra stuff for development checking */
-#ifdef BN_DEBUG
-#define bn_set_max(r) ((r)->max=(r)->top,BN_set_flags((r),BN_FLG_STATIC_DATA))
-#else
-#define bn_set_max(r)
-#endif
-
-/* These macros are used to 'take' a section of a bignum for read only use */
-#define bn_set_low(r,a,n) \
-        { \
-        (r)->top=((a)->top > (n))?(n):(a)->top; \
-        (r)->d=(a)->d; \
-        (r)->neg=(a)->neg; \
-        (r)->flags|=BN_FLG_STATIC_DATA; \
-        bn_set_max(r); \
-        }
-
-#define bn_set_high(r,a,n) \
+#ifdef BN_DEBUG_RAND
+#define bn_clear_top2max(a) \
         { \
-        if ((a)->top > (n)) \
-                { \
-                (r)->top=(a)->top-n; \
-                (r)->d= &((a)->d[n]); \
-                } \
-        else \
-                (r)->top=0; \
-        (r)->neg=(a)->neg; \
-        (r)->flags|=BN_FLG_STATIC_DATA; \
-        bn_set_max(r); \
+        int      ind = (a)->dmax - (a)->top; \
+        BN_ULONG *ftl = &(a)->d[(a)->top-1]; \
+        for (; ind != 0; ind--) \
+                *(++ftl) = 0x0; \
         }
+#else
+#define bn_clear_top2max(a)
+#endif
 
 #ifdef BN_LLONG
 #define mul_add(r,a,w,c) { \
@@ -354,6 +322,33 @@ struct bignum_ctx
         (r1)=Hw(t); \
         }
 
+#elif defined(BN_UMULT_LOHI)
+#define mul_add(r,a,w,c) {              \
+        BN_ULONG high,low,ret,tmp=(a);  \
+        ret =  (r);                     \
+        BN_UMULT_LOHI(low,high,w,tmp);  \
+        ret += (c);                     \
+        (c) =  (ret<(c))?1:0;           \
+        (c) += high;                    \
+        ret += low;                     \
+        (c) += (ret<low)?1:0;           \
+        (r) =  ret;                     \
+        }
+
+#define mul(r,a,w,c)    {               \
+        BN_ULONG high,low,ret,ta=(a);   \
+        BN_UMULT_LOHI(low,high,w,ta);   \
+        ret =  low + (c);               \
+        (c) =  high;                    \
+        (c) += (ret<low)?1:0;           \
+        (r) =  ret;                     \
+        }
+
+#define sqr(r0,r1,a)    {               \
+        BN_ULONG tmp=(a);               \
+        BN_UMULT_LOHI(r0,r1,tmp,tmp);   \
+        }
+
 #elif defined(BN_UMULT_HIGH)
 #define mul_add(r,a,w,c) {              \
         BN_ULONG high,low,ret,tmp=(a);  \
@@ -472,18 +467,21 @@ void bn_sqr_comba4(BN_ULONG *r,const BN_ULONG *a);
 int bn_cmp_words(const BN_ULONG *a,const BN_ULONG *b,int n);
 int bn_cmp_part_words(const BN_ULONG *a, const BN_ULONG *b,
         int cl, int dl);
-#ifdef BN_RECURSION
-void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
-        BN_ULONG *t);
-void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int tn,
-        int n, BN_ULONG *t);
+void bn_mul_recursive(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b,int n2,
+        int dna,int dnb,BN_ULONG *t);
+void bn_mul_part_recursive(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b,
+        int n,int tna,int tnb,BN_ULONG *t);
+void bn_sqr_recursive(BN_ULONG *r,const BN_ULONG *a, int n2, BN_ULONG *t);
+void bn_mul_low_normal(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b, int n);
 void bn_mul_low_recursive(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b,int n2,
         BN_ULONG *t);
 void bn_mul_high(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b,BN_ULONG *l,int n2,
         BN_ULONG *t);
-void bn_sqr_recursive(BN_ULONG *r,const BN_ULONG *a, int n2, BN_ULONG *t);
-#endif
-void bn_mul_low_normal(BN_ULONG *r,BN_ULONG *a,BN_ULONG *b, int n);
+BN_ULONG bn_add_part_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
+        int cl, int dl);
+BN_ULONG bn_sub_part_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
+        int cl, int dl);
+int bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp, const BN_ULONG *np,const BN_ULONG *n0, int num);
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/bn/bn_lib.c b/src/lib/libssl/src/crypto/bn/bn_lib.c
index e1660450bc..2649b8c538 100644
--- a/src/lib/libssl/src/crypto/bn/bn_lib.c
+++ b/src/lib/libssl/src/crypto/bn/bn_lib.c
@@ -67,8 +67,10 @@
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
-const char *BN_version="Big Number" OPENSSL_VERSION_PTEXT;
+const char BN_version[]="Big Number" OPENSSL_VERSION_PTEXT;
 
+/* This stuff appears to be completely unused, so is deprecated */
+#ifndef OPENSSL_NO_DEPRECATED
 /* For a 32 bit machine
  * 2 -   4 ==  128
  * 3 -   8 ==  256
@@ -91,28 +93,28 @@ void BN_set_params(int mult, int high, int low, int mont)
         {
         if (mult >= 0)
                 {
-                if (mult > (sizeof(int)*8)-1)
+                if (mult > (int)(sizeof(int)*8)-1)
                         mult=sizeof(int)*8-1;
                 bn_limit_bits=mult;
                 bn_limit_num=1<<mult;
                 }
         if (high >= 0)
                 {
-                if (high > (sizeof(int)*8)-1)
+                if (high > (int)(sizeof(int)*8)-1)
                         high=sizeof(int)*8-1;
                 bn_limit_bits_high=high;
                 bn_limit_num_high=1<<high;
                 }
         if (low >= 0)
                 {
-                if (low > (sizeof(int)*8)-1)
+                if (low > (int)(sizeof(int)*8)-1)
                         low=sizeof(int)*8-1;
                 bn_limit_bits_low=low;
                 bn_limit_num_low=1<<low;
                 }
         if (mont >= 0)
                 {
-                if (mont > (sizeof(int)*8)-1)
+                if (mont > (int)(sizeof(int)*8)-1)
                         mont=sizeof(int)*8-1;
                 bn_limit_bits_mont=mont;
                 bn_limit_num_mont=1<<mont;
@@ -127,11 +129,12 @@ int BN_get_params(int which)
         else if (which == 3) return(bn_limit_bits_mont);
         else return(0);
         }
+#endif
 
 const BIGNUM *BN_value_one(void)
         {
         static BN_ULONG data_one=1L;
-        static BIGNUM const_one={&data_one,1,1,0};
+        static BIGNUM const_one={&data_one,1,1,0,BN_FLG_STATIC_DATA};
 
         return(&const_one);
         }
@@ -244,16 +247,11 @@ int BN_num_bits_word(BN_ULONG l)
 
 int BN_num_bits(const BIGNUM *a)
         {
-        BN_ULONG l;
-        int i;
-
+        int i = a->top - 1;
         bn_check_top(a);
 
-        if (a->top == 0) return(0);
-        l=a->d[a->top-1];
-        assert(l != 0);
-        i=(a->top-1)*BN_BITS2;
-        return(i+BN_num_bits_word(l));
+        if (BN_is_zero(a)) return 0;
+        return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
         }
 
 void BN_clear_free(BIGNUM *a)
@@ -261,6 +259,7 @@ void BN_clear_free(BIGNUM *a)
         int i;
 
         if (a == NULL) return;
+        bn_check_top(a);
         if (a->d != NULL)
                 {
                 OPENSSL_cleanse(a->d,a->dmax*sizeof(a->d[0]));
@@ -276,16 +275,24 @@ void BN_clear_free(BIGNUM *a)
 void BN_free(BIGNUM *a)
         {
         if (a == NULL) return;
+        bn_check_top(a);
         if ((a->d != NULL) && !(BN_get_flags(a,BN_FLG_STATIC_DATA)))
                 OPENSSL_free(a->d);
-        a->flags|=BN_FLG_FREE; /* REMOVE? */
         if (a->flags & BN_FLG_MALLOCED)
                 OPENSSL_free(a);
+        else
+                {
+#ifndef OPENSSL_NO_DEPRECATED
+                a->flags|=BN_FLG_FREE;
+#endif
+                a->d = NULL;
+                }
         }
 
 void BN_init(BIGNUM *a)
         {
         memset(a,0,sizeof(BIGNUM));
+        bn_check_top(a);
         }
 
 BIGNUM *BN_new(void)
@@ -302,6 +309,7 @@ BIGNUM *BN_new(void)
         ret->neg=0;
         ret->dmax=0;
         ret->d=NULL;
+        bn_check_top(ret);
         return(ret);
         }
 
@@ -313,19 +321,19 @@ static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
         const BN_ULONG *B;
         int i;
 
+        bn_check_top(b);
+
         if (words > (INT_MAX/(4*BN_BITS2)))
                 {
                 BNerr(BN_F_BN_EXPAND_INTERNAL,BN_R_BIGNUM_TOO_LONG);
                 return NULL;
                 }
-
-        bn_check_top(b);        
         if (BN_get_flags(b,BN_FLG_STATIC_DATA))
                 {
                 BNerr(BN_F_BN_EXPAND_INTERNAL,BN_R_EXPAND_ON_STATIC_BIGNUM_DATA);
                 return(NULL);
                 }
-        a=A=(BN_ULONG *)OPENSSL_malloc(sizeof(BN_ULONG)*(words+1));
+        a=A=(BN_ULONG *)OPENSSL_malloc(sizeof(BN_ULONG)*words);
         if (A == NULL)
                 {
                 BNerr(BN_F_BN_EXPAND_INTERNAL,ERR_R_MALLOC_FAILURE);
@@ -363,19 +371,8 @@ static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
                         }
                 }
 
-        /* Now need to zero any data between b->top and b->max */
-        /* XXX Why? */
-
-        A= &(a[b->top]);
-        for (i=(words - b->top)>>3; i>0; i--,A+=8)
-                {
-                A[0]=0; A[1]=0; A[2]=0; A[3]=0;
-                A[4]=0; A[5]=0; A[6]=0; A[7]=0;
-                }
-        for (i=(words - b->top)&7; i>0; i--,A++)
-                A[0]=0;
 #else
-        memset(A,0,sizeof(BN_ULONG)*(words+1));
+        memset(A,0,sizeof(BN_ULONG)*words);
         memcpy(A,b->d,sizeof(b->d[0])*b->top);
 #endif
                 
@@ -393,16 +390,19 @@ static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
  * while bn_dup_expand() makes sure allocation is made only once.
  */
 
+#ifndef OPENSSL_NO_DEPRECATED
 BIGNUM *bn_dup_expand(const BIGNUM *b, int words)
         {
         BIGNUM *r = NULL;
 
+        bn_check_top(b);
+
         /* This function does not work if
          *      words <= b->dmax && top < words
          * because BN_dup() does not preserve 'dmax'!
          * (But bn_dup_expand() is not used anywhere yet.)
          */
-        
+
         if (words > b->dmax)
                 {
                 BN_ULONG *a = bn_expand_internal(b, words);
@@ -431,48 +431,67 @@ BIGNUM *bn_dup_expand(const BIGNUM *b, int words)
                 r = BN_dup(b);
                 }
 
+        bn_check_top(r);
         return r;
         }
+#endif
 
 /* This is an internal function that should not be used in applications.
- * It ensures that 'b' has enough room for a 'words' word number number.
+ * It ensures that 'b' has enough room for a 'words' word number
+ * and initialises any unused part of b->d with leading zeros.
  * It is mostly used by the various BIGNUM routines. If there is an error,
  * NULL is returned. If not, 'b' is returned. */
 
 BIGNUM *bn_expand2(BIGNUM *b, int words)
         {
+        bn_check_top(b);
+
         if (words > b->dmax)
                 {
                 BN_ULONG *a = bn_expand_internal(b, words);
+                if(!a) return NULL;
+                if(b->d) OPENSSL_free(b->d);
+                b->d=a;
+                b->dmax=words;
+                }
 
-                if (a)
+/* None of this should be necessary because of what b->top means! */
+#if 0
+        /* NB: bn_wexpand() calls this only if the BIGNUM really has to grow */
+        if (b->top < b->dmax)
+                {
+                int i;
+                BN_ULONG *A = &(b->d[b->top]);
+                for (i=(b->dmax - b->top)>>3; i>0; i--,A+=8)
                         {
-                        if (b->d)
-                                OPENSSL_free(b->d);
-                        b->d=a;
-                        b->dmax=words;
+                        A[0]=0; A[1]=0; A[2]=0; A[3]=0;
+                        A[4]=0; A[5]=0; A[6]=0; A[7]=0;
                         }
-                else
-                        b = NULL;
+                for (i=(b->dmax - b->top)&7; i>0; i--,A++)
+                        A[0]=0;
+                assert(A == &(b->d[b->dmax]));
                 }
+#endif
+        bn_check_top(b);
         return b;
         }
 
 BIGNUM *BN_dup(const BIGNUM *a)
         {
-        BIGNUM *r, *t;
+        BIGNUM *t;
 
         if (a == NULL) return NULL;
-
         bn_check_top(a);
 
         t = BN_new();
-        if (t == NULL) return(NULL);
-        r = BN_copy(t, a);
-        /* now  r == t || r == NULL */
-        if (r == NULL)
+        if (t == NULL) return NULL;
+        if(!BN_copy(t, a))
+                {
                 BN_free(t);
-        return r;
+                return NULL;
+                }
+        bn_check_top(t);
+        return t;
         }
 
 BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
@@ -506,11 +525,9 @@ BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
         memcpy(a->d,b->d,sizeof(b->d[0])*b->top);
 #endif
 
-/*      memset(&(a->d[b->top]),0,sizeof(a->d[0])*(a->max-b->top));*/
         a->top=b->top;
-        if ((a->top == 0) && (a->d != NULL))
-                a->d[0]=0;
         a->neg=b->neg;
+        bn_check_top(a);
         return(a);
         }
 
@@ -520,6 +537,9 @@ void BN_swap(BIGNUM *a, BIGNUM *b)
         BN_ULONG *tmp_d;
         int tmp_top, tmp_dmax, tmp_neg;
         
+        bn_check_top(a);
+        bn_check_top(b);
+
         flags_old_a = a->flags;
         flags_old_b = b->flags;
 
@@ -540,11 +560,13 @@ void BN_swap(BIGNUM *a, BIGNUM *b)
         
         a->flags = (flags_old_a & BN_FLG_MALLOCED) | (flags_old_b & BN_FLG_STATIC_DATA);
         b->flags = (flags_old_b & BN_FLG_MALLOCED) | (flags_old_a & BN_FLG_STATIC_DATA);
+        bn_check_top(a);
+        bn_check_top(b);
         }
 
-
 void BN_clear(BIGNUM *a)
         {
+        bn_check_top(a);
         if (a->d != NULL)
                 memset(a->d,0,a->dmax*sizeof(a->d[0]));
         a->top=0;
@@ -553,49 +575,22 @@ void BN_clear(BIGNUM *a)
 
 BN_ULONG BN_get_word(const BIGNUM *a)
         {
-        int i,n;
-        BN_ULONG ret=0;
-
-        n=BN_num_bytes(a);
-        if (n > sizeof(BN_ULONG))
-                return(BN_MASK2);
-        for (i=a->top-1; i>=0; i--)
-                {
-#ifndef SIXTY_FOUR_BIT /* the data item > unsigned long */
-                ret<<=BN_BITS4; /* stops the compiler complaining */
-                ret<<=BN_BITS4;
-#else
-                ret=0;
-#endif
-                ret|=a->d[i];
-                }
-        return(ret);
+        if (a->top > 1)
+                return BN_MASK2;
+        else if (a->top == 1)
+                return a->d[0];
+        /* a->top == 0 */
+        return 0;
         }
 
 int BN_set_word(BIGNUM *a, BN_ULONG w)
         {
-        int i,n;
-        if (bn_expand(a,sizeof(BN_ULONG)*8) == NULL) return(0);
-
-        n=sizeof(BN_ULONG)/BN_BYTES;
-        a->neg=0;
-        a->top=0;
-        a->d[0]=(BN_ULONG)w&BN_MASK2;
-        if (a->d[0] != 0) a->top=1;
-        for (i=1; i<n; i++)
-                {
-                /* the following is done instead of
-                 * w>>=BN_BITS2 so compilers don't complain
-                 * on builds where sizeof(long) == BN_TYPES */
-#ifndef SIXTY_FOUR_BIT /* the data item > unsigned long */
-                w>>=BN_BITS4;
-                w>>=BN_BITS4;
-#else
-                w=0;
-#endif
-                a->d[i]=(BN_ULONG)w&BN_MASK2;
-                if (a->d[i] != 0) a->top=i+1;
-                }
+        bn_check_top(a);
+        if (bn_expand(a,(int)sizeof(BN_ULONG)*8) == NULL) return(0);
+        a->neg = 0;
+        a->d[0] = w;
+        a->top = (w ? 1 : 0);
+        bn_check_top(a);
         return(1);
         }
 
@@ -604,9 +599,12 @@ BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
         unsigned int i,m;
         unsigned int n;
         BN_ULONG l;
+        BIGNUM  *bn = NULL;
 
-        if (ret == NULL) ret=BN_new();
+        if (ret == NULL)
+                ret = bn = BN_new();
         if (ret == NULL) return(NULL);
+        bn_check_top(ret);
         l=0;
         n=len;
         if (n == 0)
@@ -614,13 +612,16 @@ BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
                 ret->top=0;
                 return(ret);
                 }
-        if (bn_expand(ret,(int)(n+2)*8) == NULL)
-                return(NULL);
         i=((n-1)/BN_BYTES)+1;
         m=((n-1)%(BN_BYTES));
+        if (bn_wexpand(ret, (int)i) == NULL)
+                {
+                if (bn) BN_free(bn);
+                return NULL;
+                }
         ret->top=i;
         ret->neg=0;
-        while (n-- > 0)
+        while (n--)
                 {
                 l=(l<<8L)| *(s++);
                 if (m-- == 0)
@@ -632,7 +633,7 @@ BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
                 }
         /* need to call this due to clear byte at top if avoiding
          * having the top bit set (-ve number) */
-        bn_fix_top(ret);
+        bn_correct_top(ret);
         return(ret);
         }
 
@@ -642,8 +643,9 @@ int BN_bn2bin(const BIGNUM *a, unsigned char *to)
         int n,i;
         BN_ULONG l;
 
+        bn_check_top(a);
         n=i=BN_num_bytes(a);
-        while (i-- > 0)
+        while (i--)
                 {
                 l=a->d[i/BN_BYTES];
                 *(to++)=(unsigned char)(l>>(8*(i%BN_BYTES)))&0xff;
@@ -668,7 +670,7 @@ int BN_ucmp(const BIGNUM *a, const BIGNUM *b)
                 t1= ap[i];
                 t2= bp[i];
                 if (t1 != t2)
-                        return(t1 > t2?1:-1);
+                        return((t1 > t2) ? 1 : -1);
                 }
         return(0);
         }
@@ -718,6 +720,9 @@ int BN_set_bit(BIGNUM *a, int n)
         {
         int i,j,k;
 
+        if (n < 0)
+                return 0;
+
         i=n/BN_BITS2;
         j=n%BN_BITS2;
         if (a->top <= i)
@@ -729,6 +734,7 @@ int BN_set_bit(BIGNUM *a, int n)
                 }
 
         a->d[i]|=(((BN_ULONG)1)<<j);
+        bn_check_top(a);
         return(1);
         }
 
@@ -736,12 +742,15 @@ int BN_clear_bit(BIGNUM *a, int n)
         {
         int i,j;
 
+        bn_check_top(a);
+        if (n < 0) return 0;
+
         i=n/BN_BITS2;
         j=n%BN_BITS2;
         if (a->top <= i) return(0);
 
         a->d[i]&=(~(((BN_ULONG)1)<<j));
-        bn_fix_top(a);
+        bn_correct_top(a);
         return(1);
         }
 
@@ -749,20 +758,24 @@ int BN_is_bit_set(const BIGNUM *a, int n)
         {
         int i,j;
 
-        if (n < 0) return(0);
+        bn_check_top(a);
+        if (n < 0) return 0;
         i=n/BN_BITS2;
         j=n%BN_BITS2;
-        if (a->top <= i) return(0);
-        return((a->d[i]&(((BN_ULONG)1)<<j))?1:0);
+        if (a->top <= i) return 0;
+        return(((a->d[i])>>j)&((BN_ULONG)1));
         }
 
 int BN_mask_bits(BIGNUM *a, int n)
         {
         int b,w;
 
+        bn_check_top(a);
+        if (n < 0) return 0;
+
         w=n/BN_BITS2;
         b=n%BN_BITS2;
-        if (w >= a->top) return(0);
+        if (w >= a->top) return 0;
         if (b == 0)
                 a->top=w;
         else
@@ -770,10 +783,18 @@ int BN_mask_bits(BIGNUM *a, int n)
                 a->top=w+1;
                 a->d[w]&= ~(BN_MASK2<<b);
                 }
-        bn_fix_top(a);
+        bn_correct_top(a);
         return(1);
         }
 
+void BN_set_negative(BIGNUM *a, int b)
+        {
+        if (b && !BN_is_zero(a))
+                a->neg = 1;
+        else
+                a->neg = 0;
+        }
+
 int bn_cmp_words(const BN_ULONG *a, const BN_ULONG *b, int n)
         {
         int i;
diff --git a/src/lib/libssl/src/crypto/bn/bn_mod.c b/src/lib/libssl/src/crypto/bn/bn_mod.c
index 5cf82480d7..77d6ddb91a 100644
--- a/src/lib/libssl/src/crypto/bn/bn_mod.c
+++ b/src/lib/libssl/src/crypto/bn/bn_mod.c
@@ -149,7 +149,7 @@ int BN_mod_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m, BN_
  * and less than  m */
 int BN_mod_add_quick(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m)
         {
-        if (!BN_add(r, a, b)) return 0;
+        if (!BN_uadd(r, a, b)) return 0;
         if (BN_ucmp(r, m) >= 0)
                 return BN_usub(r, r, m);
         return 1;
@@ -192,6 +192,7 @@ int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
         else
                 { if (!BN_mul(t,a,b,ctx)) goto err; }
         if (!BN_nnmod(r,t,m,ctx)) goto err;
+        bn_check_top(r);
         ret=1;
 err:
         BN_CTX_end(ctx);
@@ -210,6 +211,7 @@ int BN_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx)
 int BN_mod_lshift1(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx)
         {
         if (!BN_lshift1(r, a)) return 0;
+        bn_check_top(r);
         return BN_nnmod(r, r, m, ctx);
         }
 
@@ -219,6 +221,7 @@ int BN_mod_lshift1(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx)
 int BN_mod_lshift1_quick(BIGNUM *r, const BIGNUM *a, const BIGNUM *m)
         {
         if (!BN_lshift1(r, a)) return 0;
+        bn_check_top(r);
         if (BN_cmp(r, m) >= 0)
                 return BN_sub(r, r, m);
         return 1;
@@ -240,6 +243,7 @@ int BN_mod_lshift(BIGNUM *r, const BIGNUM *a, int n, const BIGNUM *m, BN_CTX *ct
                 }
         
         ret = BN_mod_lshift_quick(r, r, n, (abs_m ? abs_m : m));
+        bn_check_top(r);
 
         if (abs_m)
                 BN_free(abs_m);
@@ -291,6 +295,7 @@ int BN_mod_lshift_quick(BIGNUM *r, const BIGNUM *a, int n, const BIGNUM *m)
                         if (!BN_sub(r, r, m)) return 0;
                         }
                 }
+        bn_check_top(r);
         
         return 1;
         }
diff --git a/src/lib/libssl/src/crypto/bn/bn_mont.c b/src/lib/libssl/src/crypto/bn/bn_mont.c
index 726d5f2b1b..4799b152dd 100644
--- a/src/lib/libssl/src/crypto/bn/bn_mont.c
+++ b/src/lib/libssl/src/crypto/bn/bn_mont.c
@@ -55,6 +55,59 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 
 /*
  * Details about Montgomery multiplication algorithms can be found at
@@ -69,11 +122,50 @@
 
 #define MONT_WORD /* use the faster word-based algorithm */
 
+#if defined(MONT_WORD) && defined(OPENSSL_BN_ASM_MONT) && (BN_BITS2<=32)
+/* This condition means we have a specific non-default build:
+ * In the 0.9.8 branch, OPENSSL_BN_ASM_MONT is normally not set for any
+ * BN_BITS2<=32 platform; an explicit "enable-montasm" is required.
+ * I.e., if we are here, the user intentionally deviates from the
+ * normal stable build to get better Montgomery performance from
+ * the 0.9.9-dev backport.
+ *
+ * In this case only, we also enable BN_from_montgomery_word()
+ * (another non-stable feature from 0.9.9-dev).
+ */
+#define MONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD
+#endif
+
+#ifdef MONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD
+static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont);
+#endif
+
+
+
 int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
                           BN_MONT_CTX *mont, BN_CTX *ctx)
         {
         BIGNUM *tmp;
         int ret=0;
+#if defined(OPENSSL_BN_ASM_MONT) && defined(MONT_WORD)
+        int num = mont->N.top;
+
+        if (num>1 && a->top==num && b->top==num)
+                {
+                if (bn_wexpand(r,num) == NULL) return(0);
+#if 0 /* for OpenSSL 0.9.9 mont->n0 */
+                if (bn_mul_mont(r->d,a->d,b->d,mont->N.d,mont->n0,num))
+#else
+                if (bn_mul_mont(r->d,a->d,b->d,mont->N.d,&mont->n0,num))
+#endif
+                        {
+                        r->neg = a->neg^b->neg;
+                        r->top = num;
+                        bn_correct_top(r);
+                        return(1);
+                        }
+                }
+#endif
 
         BN_CTX_start(ctx);
         tmp = BN_CTX_get(ctx);
@@ -89,13 +181,162 @@ int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
                 if (!BN_mul(tmp,a,b,ctx)) goto err;
                 }
         /* reduce from aRR to aR */
+#ifdef MONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD
+        if (!BN_from_montgomery_word(r,tmp,mont)) goto err;
+#else
         if (!BN_from_montgomery(r,tmp,mont,ctx)) goto err;
+#endif
+        bn_check_top(r);
         ret=1;
 err:
         BN_CTX_end(ctx);
         return(ret);
         }
 
+#ifdef MONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD
+static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
+        {
+        BIGNUM *n;
+        BN_ULONG *ap,*np,*rp,n0,v,*nrp;
+        int al,nl,max,i,x,ri;
+
+        n= &(mont->N);
+        /* mont->ri is the size of mont->N in bits (rounded up
+           to the word size) */
+        al=ri=mont->ri/BN_BITS2;
+
+        nl=n->top;
+        if ((al == 0) || (nl == 0)) { ret->top=0; return(1); }
+
+        max=(nl+al+1); /* allow for overflow (no?) XXX */
+        if (bn_wexpand(r,max) == NULL) return(0);
+
+        r->neg^=n->neg;
+        np=n->d;
+        rp=r->d;
+        nrp= &(r->d[nl]);
+
+        /* clear the top words of T */
+        for (i=r->top; i<max; i++) /* memset? XXX */
+                r->d[i]=0;
+
+        r->top=max;
+#if 0 /* for OpenSSL 0.9.9 mont->n0 */
+        n0=mont->n0[0];
+#else
+        n0=mont->n0;
+#endif
+
+#ifdef BN_COUNT
+        fprintf(stderr,"word BN_from_montgomery_word %d * %d\n",nl,nl);
+#endif
+        for (i=0; i<nl; i++)
+                {
+#ifdef __TANDEM
+                {
+                   long long t1;
+                   long long t2;
+                   long long t3;
+                   t1 = rp[0] * (n0 & 0177777);
+                   t2 = 037777600000l;
+                   t2 = n0 & t2;
+                   t3 = rp[0] & 0177777;
+                   t2 = (t3 * t2) & BN_MASK2;
+                   t1 = t1 + t2;
+                   v=bn_mul_add_words(rp,np,nl,(BN_ULONG) t1);
+                }
+#else
+                v=bn_mul_add_words(rp,np,nl,(rp[0]*n0)&BN_MASK2);
+#endif
+                nrp++;
+                rp++;
+                if (((nrp[-1]+=v)&BN_MASK2) >= v)
+                        continue;
+                else
+                        {
+                        if (((++nrp[0])&BN_MASK2) != 0) continue;
+                        if (((++nrp[1])&BN_MASK2) != 0) continue;
+                        for (x=2; (((++nrp[x])&BN_MASK2) == 0); x++) ;
+                        }
+                }
+        bn_correct_top(r);
+
+        /* mont->ri will be a multiple of the word size and below code
+         * is kind of BN_rshift(ret,r,mont->ri) equivalent */
+        if (r->top <= ri)
+                {
+                ret->top=0;
+                return(1);
+                }
+        al=r->top-ri;
+
+        if (bn_wexpand(ret,ri) == NULL) return(0);
+        x=0-(((al-ri)>>(sizeof(al)*8-1))&1);
+        ret->top=x=(ri&~x)|(al&x);      /* min(ri,al) */
+        ret->neg=r->neg;
+
+        rp=ret->d;
+        ap=&(r->d[ri]);
+
+        {
+        size_t m1,m2;
+
+        v=bn_sub_words(rp,ap,np,ri);
+        /* this ----------------^^ works even in al<ri case
+         * thanks to zealous zeroing of top of the vector in the
+         * beginning. */
+
+        /* if (al==ri && !v) || al>ri) nrp=rp; else nrp=ap; */
+        /* in other words if subtraction result is real, then
+         * trick unconditional memcpy below to perform in-place
+         * "refresh" instead of actual copy. */
+        m1=0-(size_t)(((al-ri)>>(sizeof(al)*8-1))&1);   /* al<ri */
+        m2=0-(size_t)(((ri-al)>>(sizeof(al)*8-1))&1);   /* al>ri */
+        m1|=m2;                 /* (al!=ri) */
+        m1|=(0-(size_t)v);      /* (al!=ri || v) */
+        m1&=~m2;                /* (al!=ri || v) && !al>ri */
+        nrp=(BN_ULONG *)(((size_t)rp&~m1)|((size_t)ap&m1));
+        }
+
+        /* 'i<ri' is chosen to eliminate dependency on input data, even
+         * though it results in redundant copy in al<ri case. */
+        for (i=0,ri-=4; i<ri; i+=4)
+                {
+                BN_ULONG t1,t2,t3,t4;
+                
+                t1=nrp[i+0];
+                t2=nrp[i+1];
+                t3=nrp[i+2];    ap[i+0]=0;
+                t4=nrp[i+3];    ap[i+1]=0;
+                rp[i+0]=t1;     ap[i+2]=0;
+                rp[i+1]=t2;     ap[i+3]=0;
+                rp[i+2]=t3;
+                rp[i+3]=t4;
+                }
+        for (ri+=4; i<ri; i++)
+                rp[i]=nrp[i], ap[i]=0;
+        bn_correct_top(r);
+        bn_correct_top(ret);
+        bn_check_top(ret);
+
+        return(1);
+        }
+
+int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
+             BN_CTX *ctx)
+        {
+        int retn=0;
+        BIGNUM *t;
+
+        BN_CTX_start(ctx);
+        if ((t = BN_CTX_get(ctx)) && BN_copy(t,a))
+                retn = BN_from_montgomery_word(ret,t,mont);
+        BN_CTX_end(ctx);
+        return retn;
+        }
+
+#else /* !MONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD */
+
 int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
              BN_CTX *ctx)
         {
@@ -171,7 +412,7 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
                         for (x=2; (((++nrp[x])&BN_MASK2) == 0); x++) ;
                         }
                 }
-        bn_fix_top(r);
+        bn_correct_top(r);
         
         /* mont->ri will be a multiple of the word size and below code
          * is kind of BN_rshift(ret,r,mont->ri) equivalent */
@@ -230,6 +471,8 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
                 }
         for (ri+=4; i<ri; i++)
                 rp[i]=nrp[i], ap[i]=0;
+        bn_correct_top(r);
+        bn_correct_top(ret);
 # else
         if (bn_wexpand(ret,al) == NULL) goto err;
         ret->top=al;
@@ -281,10 +524,12 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
                 }
 #endif
         retn=1;
+        bn_check_top(ret);
  err:
         BN_CTX_end(ctx);
         return(retn);
         }
+#endif /* MONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD */
 
 BN_MONT_CTX *BN_MONT_CTX_new(void)
         {
@@ -304,6 +549,11 @@ void BN_MONT_CTX_init(BN_MONT_CTX *ctx)
         BN_init(&(ctx->RR));
         BN_init(&(ctx->N));
         BN_init(&(ctx->Ni));
+#if 0 /* for OpenSSL 0.9.9 mont->n0 */
+        ctx->n0[0] = ctx->n0[1] = 0;
+#else
+        ctx->n0 = 0;
+#endif
         ctx->flags=0;
         }
 
@@ -321,9 +571,11 @@ void BN_MONT_CTX_free(BN_MONT_CTX *mont)
 
 int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
         {
-        BIGNUM Ri,*R;
+        int ret = 0;
+        BIGNUM *Ri,*R;
 
-        BN_init(&Ri);
+        BN_CTX_start(ctx);
+        if((Ri = BN_CTX_get(ctx)) == NULL) goto err;
         R= &(mont->RR);                                 /* grab RR as a temp */
         if (!BN_copy(&(mont->N),mod)) goto err;         /* Set N */
         mont->N.neg = 0;
@@ -334,57 +586,99 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
                 BN_ULONG buf[2];
 
                 mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
-                if (!(BN_zero(R))) goto err;
+                BN_zero(R);
+#if 0 /* for OpenSSL 0.9.9 mont->n0, would be "#if defined(OPENSSL_BN_ASM_MONT) && (BN_BITS2<=32)",
+         only certain BN_BITS2<=32 platforms actually need this */
+                if (!(BN_set_bit(R,2*BN_BITS2))) goto err;      /* R */
+#else
                 if (!(BN_set_bit(R,BN_BITS2))) goto err;        /* R */
+#endif
 
                 buf[0]=mod->d[0]; /* tmod = N mod word size */
                 buf[1]=0;
+
+                BN_init(&tmod);
                 tmod.d=buf;
-                tmod.top=1;
+                tmod.top = buf[0] != 0 ? 1 : 0;
                 tmod.dmax=2;
                 tmod.neg=0;
+
+#if 0 /* for OpenSSL 0.9.9 mont->n0, would be "#if defined(OPENSSL_BN_ASM_MONT) && (BN_BITS2<=32)";
+         only certain BN_BITS2<=32 platforms actually need this */
+                                                                tmod.top=0;
+                if ((buf[0] = mod->d[0]))                       tmod.top=1;
+                if ((buf[1] = mod->top>1 ? mod->d[1] : 0))      tmod.top=2;
+
+                if ((BN_mod_inverse(Ri,R,&tmod,ctx)) == NULL)
+                        goto err;
+                if (!BN_lshift(Ri,Ri,2*BN_BITS2)) goto err; /* R*Ri */
+                if (!BN_is_zero(Ri))
+                        {
+                        if (!BN_sub_word(Ri,1)) goto err;
+                        }
+                else /* if N mod word size == 1 */
+                        {
+                        if (bn_expand(Ri,(int)sizeof(BN_ULONG)*2) == NULL)
+                                goto err;
+                        /* Ri-- (mod double word size) */
+                        Ri->neg=0;
+                        Ri->d[0]=BN_MASK2;
+                        Ri->d[1]=BN_MASK2;
+                        Ri->top=2;
+                        }
+                if (!BN_div(Ri,NULL,Ri,&tmod,ctx)) goto err;
+                /* Ni = (R*Ri-1)/N,
+                 * keep only couple of least significant words: */
+                mont->n0[0] = (Ri->top > 0) ? Ri->d[0] : 0;
+                mont->n0[1] = (Ri->top > 1) ? Ri->d[1] : 0;
+#else
                                                         /* Ri = R^-1 mod N*/
-                if ((BN_mod_inverse(&Ri,R,&tmod,ctx)) == NULL)
+                if ((BN_mod_inverse(Ri,R,&tmod,ctx)) == NULL)
                         goto err;
-                if (!BN_lshift(&Ri,&Ri,BN_BITS2)) goto err; /* R*Ri */
-                if (!BN_is_zero(&Ri))
+                if (!BN_lshift(Ri,Ri,BN_BITS2)) goto err; /* R*Ri */
+                if (!BN_is_zero(Ri))
                         {
-                        if (!BN_sub_word(&Ri,1)) goto err;
+                        if (!BN_sub_word(Ri,1)) goto err;
                         }
                 else /* if N mod word size == 1 */
                         {
-                        if (!BN_set_word(&Ri,BN_MASK2)) goto err;  /* Ri-- (mod word size) */
+                        if (!BN_set_word(Ri,BN_MASK2)) goto err;  /* Ri-- (mod word size) */
                         }
-                if (!BN_div(&Ri,NULL,&Ri,&tmod,ctx)) goto err;
+                if (!BN_div(Ri,NULL,Ri,&tmod,ctx)) goto err;
                 /* Ni = (R*Ri-1)/N,
                  * keep only least significant word: */
-                mont->n0 = (Ri.top > 0) ? Ri.d[0] : 0;
-                BN_free(&Ri);
+# if 0 /* for OpenSSL 0.9.9 mont->n0 */
+                mont->n0[0] = (Ri->top > 0) ? Ri->d[0] : 0;
+                mont->n0[1] = 0;
+# else
+                mont->n0 = (Ri->top > 0) ? Ri->d[0] : 0;
+# endif
+#endif
                 }
 #else /* !MONT_WORD */
                 { /* bignum version */
                 mont->ri=BN_num_bits(&mont->N);
-                if (!BN_zero(R)) goto err;
+                BN_zero(R);
                 if (!BN_set_bit(R,mont->ri)) goto err;  /* R = 2^ri */
                                                         /* Ri = R^-1 mod N*/
-                if ((BN_mod_inverse(&Ri,R,&mont->N,ctx)) == NULL)
+                if ((BN_mod_inverse(Ri,R,&mont->N,ctx)) == NULL)
                         goto err;
-                if (!BN_lshift(&Ri,&Ri,mont->ri)) goto err; /* R*Ri */
-                if (!BN_sub_word(&Ri,1)) goto err;
+                if (!BN_lshift(Ri,Ri,mont->ri)) goto err; /* R*Ri */
+                if (!BN_sub_word(Ri,1)) goto err;
                                                         /* Ni = (R*Ri-1) / N */
-                if (!BN_div(&(mont->Ni),NULL,&Ri,&mont->N,ctx)) goto err;
-                BN_free(&Ri);
+                if (!BN_div(&(mont->Ni),NULL,Ri,&mont->N,ctx)) goto err;
                 }
 #endif
 
         /* setup RR for conversions */
-        if (!BN_zero(&(mont->RR))) goto err;
+        BN_zero(&(mont->RR));
         if (!BN_set_bit(&(mont->RR),mont->ri*2)) goto err;
         if (!BN_mod(&(mont->RR),&(mont->RR),&(mont->N),ctx)) goto err;
 
-        return(1);
+        ret = 1;
 err:
-        return(0);
+        BN_CTX_end(ctx);
+        return ret;
         }
 
 BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from)
@@ -395,27 +689,44 @@ BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from)
         if (!BN_copy(&(to->N),&(from->N))) return NULL;
         if (!BN_copy(&(to->Ni),&(from->Ni))) return NULL;
         to->ri=from->ri;
+#if 0 /* for OpenSSL 0.9.9 mont->n0 */
+        to->n0[0]=from->n0[0];
+        to->n0[1]=from->n0[1];
+#else
         to->n0=from->n0;
+#endif
         return(to);
         }
 
 BN_MONT_CTX *BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, int lock,
                                         const BIGNUM *mod, BN_CTX *ctx)
         {
-        if (*pmont)
-                return *pmont;
-        CRYPTO_w_lock(lock);
+        int got_write_lock = 0;
+        BN_MONT_CTX *ret;
+
+        CRYPTO_r_lock(lock);
         if (!*pmont)
                 {
-                *pmont = BN_MONT_CTX_new();
-                if (*pmont && !BN_MONT_CTX_set(*pmont, mod, ctx))
+                CRYPTO_r_unlock(lock);
+                CRYPTO_w_lock(lock);
+                got_write_lock = 1;
+
+                if (!*pmont)
                         {
-                        BN_MONT_CTX_free(*pmont);
-                        *pmont = NULL;
+                        ret = BN_MONT_CTX_new();
+                        if (ret && !BN_MONT_CTX_set(ret, mod, ctx))
+                                BN_MONT_CTX_free(ret);
+                        else
+                                *pmont = ret;
                         }
                 }
-        CRYPTO_w_unlock(lock);
-        return *pmont;
-        }
+        
+        ret = *pmont;
+        
+        if (got_write_lock)
+                CRYPTO_w_unlock(lock);
+        else
+                CRYPTO_r_unlock(lock);
                 
-
+        return ret;
+        }
diff --git a/src/lib/libssl/src/crypto/bn/bn_mpi.c b/src/lib/libssl/src/crypto/bn/bn_mpi.c
index 05fa9d1e9a..a054d21aed 100644
--- a/src/lib/libssl/src/crypto/bn/bn_mpi.c
+++ b/src/lib/libssl/src/crypto/bn/bn_mpi.c
@@ -124,6 +124,7 @@ BIGNUM *BN_mpi2bn(const unsigned char *d, int n, BIGNUM *a)
                 {
                 BN_clear_bit(a,BN_num_bits(a)-1);
                 }
+        bn_check_top(a);
         return(a);
         }
 
diff --git a/src/lib/libssl/src/crypto/bn/bn_mul.c b/src/lib/libssl/src/crypto/bn/bn_mul.c
index 3ae3822bc2..b848c8cc60 100644
--- a/src/lib/libssl/src/crypto/bn/bn_mul.c
+++ b/src/lib/libssl/src/crypto/bn/bn_mul.c
@@ -56,10 +56,325 @@
  * [including the GNU Public Licence.]
  */
 
+#ifndef BN_DEBUG
+# undef NDEBUG /* avoid conflicting definitions */
+# define NDEBUG
+#endif
+
 #include <stdio.h>
+#include <assert.h>
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
+#if defined(OPENSSL_NO_ASM) || !defined(OPENSSL_BN_ASM_PART_WORDS)
+/* Here follows specialised variants of bn_add_words() and
+   bn_sub_words().  They have the property performing operations on
+   arrays of different sizes.  The sizes of those arrays is expressed through
+   cl, which is the common length ( basicall, min(len(a),len(b)) ), and dl,
+   which is the delta between the two lengths, calculated as len(a)-len(b).
+   All lengths are the number of BN_ULONGs...  For the operations that require
+   a result array as parameter, it must have the length cl+abs(dl).
+   These functions should probably end up in bn_asm.c as soon as there are
+   assembler counterparts for the systems that use assembler files.  */
+
+BN_ULONG bn_sub_part_words(BN_ULONG *r,
+        const BN_ULONG *a, const BN_ULONG *b,
+        int cl, int dl)
+        {
+        BN_ULONG c, t;
+
+        assert(cl >= 0);
+        c = bn_sub_words(r, a, b, cl);
+
+        if (dl == 0)
+                return c;
+
+        r += cl;
+        a += cl;
+        b += cl;
+
+        if (dl < 0)
+                {
+#ifdef BN_COUNT
+                fprintf(stderr, "  bn_sub_part_words %d + %d (dl < 0, c = %d)\n", cl, dl, c);
+#endif
+                for (;;)
+                        {
+                        t = b[0];
+                        r[0] = (0-t-c)&BN_MASK2;
+                        if (t != 0) c=1;
+                        if (++dl >= 0) break;
+
+                        t = b[1];
+                        r[1] = (0-t-c)&BN_MASK2;
+                        if (t != 0) c=1;
+                        if (++dl >= 0) break;
+
+                        t = b[2];
+                        r[2] = (0-t-c)&BN_MASK2;
+                        if (t != 0) c=1;
+                        if (++dl >= 0) break;
+
+                        t = b[3];
+                        r[3] = (0-t-c)&BN_MASK2;
+                        if (t != 0) c=1;
+                        if (++dl >= 0) break;
+
+                        b += 4;
+                        r += 4;
+                        }
+                }
+        else
+                {
+                int save_dl = dl;
+#ifdef BN_COUNT
+                fprintf(stderr, "  bn_sub_part_words %d + %d (dl > 0, c = %d)\n", cl, dl, c);
+#endif
+                while(c)
+                        {
+                        t = a[0];
+                        r[0] = (t-c)&BN_MASK2;
+                        if (t != 0) c=0;
+                        if (--dl <= 0) break;
+
+                        t = a[1];
+                        r[1] = (t-c)&BN_MASK2;
+                        if (t != 0) c=0;
+                        if (--dl <= 0) break;
+
+                        t = a[2];
+                        r[2] = (t-c)&BN_MASK2;
+                        if (t != 0) c=0;
+                        if (--dl <= 0) break;
+
+                        t = a[3];
+                        r[3] = (t-c)&BN_MASK2;
+                        if (t != 0) c=0;
+                        if (--dl <= 0) break;
+
+                        save_dl = dl;
+                        a += 4;
+                        r += 4;
+                        }
+                if (dl > 0)
+                        {
+#ifdef BN_COUNT
+                        fprintf(stderr, "  bn_sub_part_words %d + %d (dl > 0, c == 0)\n", cl, dl);
+#endif
+                        if (save_dl > dl)
+                                {
+                                switch (save_dl - dl)
+                                        {
+                                case 1:
+                                        r[1] = a[1];
+                                        if (--dl <= 0) break;
+                                case 2:
+                                        r[2] = a[2];
+                                        if (--dl <= 0) break;
+                                case 3:
+                                        r[3] = a[3];
+                                        if (--dl <= 0) break;
+                                        }
+                                a += 4;
+                                r += 4;
+                                }
+                        }
+                if (dl > 0)
+                        {
+#ifdef BN_COUNT
+                        fprintf(stderr, "  bn_sub_part_words %d + %d (dl > 0, copy)\n", cl, dl);
+#endif
+                        for(;;)
+                                {
+                                r[0] = a[0];
+                                if (--dl <= 0) break;
+                                r[1] = a[1];
+                                if (--dl <= 0) break;
+                                r[2] = a[2];
+                                if (--dl <= 0) break;
+                                r[3] = a[3];
+                                if (--dl <= 0) break;
+
+                                a += 4;
+                                r += 4;
+                                }
+                        }
+                }
+        return c;
+        }
+#endif
+
+BN_ULONG bn_add_part_words(BN_ULONG *r,
+        const BN_ULONG *a, const BN_ULONG *b,
+        int cl, int dl)
+        {
+        BN_ULONG c, l, t;
+
+        assert(cl >= 0);
+        c = bn_add_words(r, a, b, cl);
+
+        if (dl == 0)
+                return c;
+
+        r += cl;
+        a += cl;
+        b += cl;
+
+        if (dl < 0)
+                {
+                int save_dl = dl;
+#ifdef BN_COUNT
+                fprintf(stderr, "  bn_add_part_words %d + %d (dl < 0, c = %d)\n", cl, dl, c);
+#endif
+                while (c)
+                        {
+                        l=(c+b[0])&BN_MASK2;
+                        c=(l < c);
+                        r[0]=l;
+                        if (++dl >= 0) break;
+
+                        l=(c+b[1])&BN_MASK2;
+                        c=(l < c);
+                        r[1]=l;
+                        if (++dl >= 0) break;
+
+                        l=(c+b[2])&BN_MASK2;
+                        c=(l < c);
+                        r[2]=l;
+                        if (++dl >= 0) break;
+
+                        l=(c+b[3])&BN_MASK2;
+                        c=(l < c);
+                        r[3]=l;
+                        if (++dl >= 0) break;
+
+                        save_dl = dl;
+                        b+=4;
+                        r+=4;
+                        }
+                if (dl < 0)
+                        {
+#ifdef BN_COUNT
+                        fprintf(stderr, "  bn_add_part_words %d + %d (dl < 0, c == 0)\n", cl, dl);
+#endif
+                        if (save_dl < dl)
+                                {
+                                switch (dl - save_dl)
+                                        {
+                                case 1:
+                                        r[1] = b[1];
+                                        if (++dl >= 0) break;
+                                case 2:
+                                        r[2] = b[2];
+                                        if (++dl >= 0) break;
+                                case 3:
+                                        r[3] = b[3];
+                                        if (++dl >= 0) break;
+                                        }
+                                b += 4;
+                                r += 4;
+                                }
+                        }
+                if (dl < 0)
+                        {
+#ifdef BN_COUNT
+                        fprintf(stderr, "  bn_add_part_words %d + %d (dl < 0, copy)\n", cl, dl);
+#endif
+                        for(;;)
+                                {
+                                r[0] = b[0];
+                                if (++dl >= 0) break;
+                                r[1] = b[1];
+                                if (++dl >= 0) break;
+                                r[2] = b[2];
+                                if (++dl >= 0) break;
+                                r[3] = b[3];
+                                if (++dl >= 0) break;
+
+                                b += 4;
+                                r += 4;
+                                }
+                        }
+                }
+        else
+                {
+                int save_dl = dl;
+#ifdef BN_COUNT
+                fprintf(stderr, "  bn_add_part_words %d + %d (dl > 0)\n", cl, dl);
+#endif
+                while (c)
+                        {
+                        t=(a[0]+c)&BN_MASK2;
+                        c=(t < c);
+                        r[0]=t;
+                        if (--dl <= 0) break;
+
+                        t=(a[1]+c)&BN_MASK2;
+                        c=(t < c);
+                        r[1]=t;
+                        if (--dl <= 0) break;
+
+                        t=(a[2]+c)&BN_MASK2;
+                        c=(t < c);
+                        r[2]=t;
+                        if (--dl <= 0) break;
+
+                        t=(a[3]+c)&BN_MASK2;
+                        c=(t < c);
+                        r[3]=t;
+                        if (--dl <= 0) break;
+
+                        save_dl = dl;
+                        a+=4;
+                        r+=4;
+                        }
+#ifdef BN_COUNT
+                fprintf(stderr, "  bn_add_part_words %d + %d (dl > 0, c == 0)\n", cl, dl);
+#endif
+                if (dl > 0)
+                        {
+                        if (save_dl > dl)
+                                {
+                                switch (save_dl - dl)
+                                        {
+                                case 1:
+                                        r[1] = a[1];
+                                        if (--dl <= 0) break;
+                                case 2:
+                                        r[2] = a[2];
+                                        if (--dl <= 0) break;
+                                case 3:
+                                        r[3] = a[3];
+                                        if (--dl <= 0) break;
+                                        }
+                                a += 4;
+                                r += 4;
+                                }
+                        }
+                if (dl > 0)
+                        {
+#ifdef BN_COUNT
+                        fprintf(stderr, "  bn_add_part_words %d + %d (dl > 0, copy)\n", cl, dl);
+#endif
+                        for(;;)
+                                {
+                                r[0] = a[0];
+                                if (--dl <= 0) break;
+                                r[1] = a[1];
+                                if (--dl <= 0) break;
+                                r[2] = a[2];
+                                if (--dl <= 0) break;
+                                r[3] = a[3];
+                                if (--dl <= 0) break;
+
+                                a += 4;
+                                r += 4;
+                                }
+                        }
+                }
+        return c;
+        }
+
 #ifdef BN_RECURSION
 /* Karatsuba recursive multiplication algorithm
  * (cf. Knuth, The Art of Computer Programming, Vol. 2) */
@@ -74,15 +389,17 @@
  * a[0]*b[0]+a[1]*b[1]+(a[0]-a[1])*(b[1]-b[0])
  * a[1]*b[1]
  */
+/* dnX may not be positive, but n2/2+dnX has to be */
 void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
-             BN_ULONG *t)
+        int dna, int dnb, BN_ULONG *t)
         {
         int n=n2/2,c1,c2;
+        int tna=n+dna, tnb=n+dnb;
         unsigned int neg,zero;
         BN_ULONG ln,lo,*p;
 
 # ifdef BN_COUNT
-        printf(" bn_mul_recursive %d * %d\n",n2,n2);
+        fprintf(stderr," bn_mul_recursive %d%+d * %d%+d\n",n2,dna,n2,dnb);
 # endif
 # ifdef BN_MUL_COMBA
 #  if 0
@@ -92,34 +409,40 @@ void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
                 return;
                 }
 #  endif
-        if (n2 == 8)
+        /* Only call bn_mul_comba 8 if n2 == 8 and the
+         * two arrays are complete [steve]
+         */
+        if (n2 == 8 && dna == 0 && dnb == 0)
                 {
                 bn_mul_comba8(r,a,b);
                 return; 
                 }
 # endif /* BN_MUL_COMBA */
+        /* Else do normal multiply */
         if (n2 < BN_MUL_RECURSIVE_SIZE_NORMAL)
                 {
-                /* This should not happen */
-                bn_mul_normal(r,a,n2,b,n2);
+                bn_mul_normal(r,a,n2+dna,b,n2+dnb);
+                if ((dna + dnb) < 0)
+                        memset(&r[2*n2 + dna + dnb], 0,
+                                sizeof(BN_ULONG) * -(dna + dnb));
                 return;
                 }
         /* r=(a[0]-a[1])*(b[1]-b[0]) */
-        c1=bn_cmp_words(a,&(a[n]),n);
-        c2=bn_cmp_words(&(b[n]),b,n);
+        c1=bn_cmp_part_words(a,&(a[n]),tna,n-tna);
+        c2=bn_cmp_part_words(&(b[n]),b,tnb,tnb-n);
         zero=neg=0;
         switch (c1*3+c2)
                 {
         case -4:
-                bn_sub_words(t,      &(a[n]),a,      n); /* - */
-                bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
+                bn_sub_part_words(t,      &(a[n]),a,      tna,tna-n); /* - */
+                bn_sub_part_words(&(t[n]),b,      &(b[n]),tnb,n-tnb); /* - */
                 break;
         case -3:
                 zero=1;
                 break;
         case -2:
-                bn_sub_words(t,      &(a[n]),a,      n); /* - */
-                bn_sub_words(&(t[n]),&(b[n]),b,      n); /* + */
+                bn_sub_part_words(t,      &(a[n]),a,      tna,tna-n); /* - */
+                bn_sub_part_words(&(t[n]),&(b[n]),b,      tnb,tnb-n); /* + */
                 neg=1;
                 break;
         case -1:
@@ -128,21 +451,22 @@ void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
                 zero=1;
                 break;
         case 2:
-                bn_sub_words(t,      a,      &(a[n]),n); /* + */
-                bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
+                bn_sub_part_words(t,      a,      &(a[n]),tna,n-tna); /* + */
+                bn_sub_part_words(&(t[n]),b,      &(b[n]),tnb,n-tnb); /* - */
                 neg=1;
                 break;
         case 3:
                 zero=1;
                 break;
         case 4:
-                bn_sub_words(t,      a,      &(a[n]),n);
-                bn_sub_words(&(t[n]),&(b[n]),b,      n);
+                bn_sub_part_words(t,      a,      &(a[n]),tna,n-tna);
+                bn_sub_part_words(&(t[n]),&(b[n]),b,      tnb,tnb-n);
                 break;
                 }
 
 # ifdef BN_MUL_COMBA
-        if (n == 4)
+        if (n == 4 && dna == 0 && dnb == 0) /* XXX: bn_mul_comba4 could take
+                                               extra args to do this well */
                 {
                 if (!zero)
                         bn_mul_comba4(&(t[n2]),t,&(t[n]));
@@ -152,7 +476,9 @@ void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
                 bn_mul_comba4(r,a,b);
                 bn_mul_comba4(&(r[n2]),&(a[n]),&(b[n]));
                 }
-        else if (n == 8)
+        else if (n == 8 && dna == 0 && dnb == 0) /* XXX: bn_mul_comba8 could
+                                                    take extra args to do this
+                                                    well */
                 {
                 if (!zero)
                         bn_mul_comba8(&(t[n2]),t,&(t[n]));
@@ -167,11 +493,11 @@ void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
                 {
                 p= &(t[n2*2]);
                 if (!zero)
-                        bn_mul_recursive(&(t[n2]),t,&(t[n]),n,p);
+                        bn_mul_recursive(&(t[n2]),t,&(t[n]),n,0,0,p);
                 else
                         memset(&(t[n2]),0,n2*sizeof(BN_ULONG));
-                bn_mul_recursive(r,a,b,n,p);
-                bn_mul_recursive(&(r[n2]),&(a[n]),&(b[n]),n,p);
+                bn_mul_recursive(r,a,b,n,0,0,p);
+                bn_mul_recursive(&(r[n2]),&(a[n]),&(b[n]),n,dna,dnb,p);
                 }
 
         /* t[32] holds (a[0]-a[1])*(b[1]-b[0]), c1 is the sign
@@ -220,39 +546,40 @@ void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
 
 /* n+tn is the word length
  * t needs to be n*4 is size, as does r */
-void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int tn,
-             int n, BN_ULONG *t)
+/* tnX may not be negative but less than n */
+void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n,
+             int tna, int tnb, BN_ULONG *t)
         {
         int i,j,n2=n*2;
         int c1,c2,neg,zero;
         BN_ULONG ln,lo,*p;
 
 # ifdef BN_COUNT
-        printf(" bn_mul_part_recursive %d * %d\n",tn+n,tn+n);
+        fprintf(stderr," bn_mul_part_recursive (%d%+d) * (%d%+d)\n",
+                n, tna, n, tnb);
 # endif
         if (n < 8)
                 {
-                i=tn+n;
-                bn_mul_normal(r,a,i,b,i);
+                bn_mul_normal(r,a,n+tna,b,n+tnb);
                 return;
                 }
 
         /* r=(a[0]-a[1])*(b[1]-b[0]) */
-        c1=bn_cmp_words(a,&(a[n]),n);
-        c2=bn_cmp_words(&(b[n]),b,n);
+        c1=bn_cmp_part_words(a,&(a[n]),tna,n-tna);
+        c2=bn_cmp_part_words(&(b[n]),b,tnb,tnb-n);
         zero=neg=0;
         switch (c1*3+c2)
                 {
         case -4:
-                bn_sub_words(t,      &(a[n]),a,      n); /* - */
-                bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
+                bn_sub_part_words(t,      &(a[n]),a,      tna,tna-n); /* - */
+                bn_sub_part_words(&(t[n]),b,      &(b[n]),tnb,n-tnb); /* - */
                 break;
         case -3:
                 zero=1;
                 /* break; */
         case -2:
-                bn_sub_words(t,      &(a[n]),a,      n); /* - */
-                bn_sub_words(&(t[n]),&(b[n]),b,      n); /* + */
+                bn_sub_part_words(t,      &(a[n]),a,      tna,tna-n); /* - */
+                bn_sub_part_words(&(t[n]),&(b[n]),b,      tnb,tnb-n); /* + */
                 neg=1;
                 break;
         case -1:
@@ -261,16 +588,16 @@ void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int tn,
                 zero=1;
                 /* break; */
         case 2:
-                bn_sub_words(t,      a,      &(a[n]),n); /* + */
-                bn_sub_words(&(t[n]),b,      &(b[n]),n); /* - */
+                bn_sub_part_words(t,      a,      &(a[n]),tna,n-tna); /* + */
+                bn_sub_part_words(&(t[n]),b,      &(b[n]),tnb,n-tnb); /* - */
                 neg=1;
                 break;
         case 3:
                 zero=1;
                 /* break; */
         case 4:
-                bn_sub_words(t,      a,      &(a[n]),n);
-                bn_sub_words(&(t[n]),&(b[n]),b,      n);
+                bn_sub_part_words(t,      a,      &(a[n]),tna,n-tna);
+                bn_sub_part_words(&(t[n]),&(b[n]),b,      tnb,tnb-n);
                 break;
                 }
                 /* The zero case isn't yet implemented here. The speedup
@@ -289,54 +616,62 @@ void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int tn,
                 {
                 bn_mul_comba8(&(t[n2]),t,&(t[n]));
                 bn_mul_comba8(r,a,b);
-                bn_mul_normal(&(r[n2]),&(a[n]),tn,&(b[n]),tn);
-                memset(&(r[n2+tn*2]),0,sizeof(BN_ULONG)*(n2-tn*2));
+                bn_mul_normal(&(r[n2]),&(a[n]),tna,&(b[n]),tnb);
+                memset(&(r[n2+tna+tnb]),0,sizeof(BN_ULONG)*(n2-tna-tnb));
                 }
         else
                 {
                 p= &(t[n2*2]);
-                bn_mul_recursive(&(t[n2]),t,&(t[n]),n,p);
-                bn_mul_recursive(r,a,b,n,p);
+                bn_mul_recursive(&(t[n2]),t,&(t[n]),n,0,0,p);
+                bn_mul_recursive(r,a,b,n,0,0,p);
                 i=n/2;
                 /* If there is only a bottom half to the number,
                  * just do it */
-                j=tn-i;
+                if (tna > tnb)
+                        j = tna - i;
+                else
+                        j = tnb - i;
                 if (j == 0)
                         {
-                        bn_mul_recursive(&(r[n2]),&(a[n]),&(b[n]),i,p);
+                        bn_mul_recursive(&(r[n2]),&(a[n]),&(b[n]),
+                                i,tna-i,tnb-i,p);
                         memset(&(r[n2+i*2]),0,sizeof(BN_ULONG)*(n2-i*2));
                         }
                 else if (j > 0) /* eg, n == 16, i == 8 and tn == 11 */
                                 {
                                 bn_mul_part_recursive(&(r[n2]),&(a[n]),&(b[n]),
-                                        j,i,p);
-                                memset(&(r[n2+tn*2]),0,
-                                        sizeof(BN_ULONG)*(n2-tn*2));
+                                        i,tna-i,tnb-i,p);
+                                memset(&(r[n2+tna+tnb]),0,
+                                        sizeof(BN_ULONG)*(n2-tna-tnb));
                                 }
                 else /* (j < 0) eg, n == 16, i == 8 and tn == 5 */
                         {
                         memset(&(r[n2]),0,sizeof(BN_ULONG)*n2);
-                        if (tn < BN_MUL_RECURSIVE_SIZE_NORMAL)
+                        if (tna < BN_MUL_RECURSIVE_SIZE_NORMAL
+                                && tnb < BN_MUL_RECURSIVE_SIZE_NORMAL)
                                 {
-                                bn_mul_normal(&(r[n2]),&(a[n]),tn,&(b[n]),tn);
+                                bn_mul_normal(&(r[n2]),&(a[n]),tna,&(b[n]),tnb);
                                 }
                         else
                                 {
                                 for (;;)
                                         {
                                         i/=2;
-                                        if (i < tn)
+                                        /* these simplified conditions work
+                                         * exclusively because difference
+                                         * between tna and tnb is 1 or 0 */
+                                        if (i < tna || i < tnb)
                                                 {
                                                 bn_mul_part_recursive(&(r[n2]),
                                                         &(a[n]),&(b[n]),
-                                                        tn-i,i,p);
+                                                        i,tna-i,tnb-i,p);
                                                 break;
                                                 }
-                                        else if (i == tn)
+                                        else if (i == tna || i == tnb)
                                                 {
                                                 bn_mul_recursive(&(r[n2]),
                                                         &(a[n]),&(b[n]),
-                                                        i,p);
+                                                        i,tna-i,tnb-i,p);
                                                 break;
                                                 }
                                         }
@@ -397,10 +732,10 @@ void bn_mul_low_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2,
         int n=n2/2;
 
 # ifdef BN_COUNT
-        printf(" bn_mul_low_recursive %d * %d\n",n2,n2);
+        fprintf(stderr," bn_mul_low_recursive %d * %d\n",n2,n2);
 # endif
 
-        bn_mul_recursive(r,a,b,n,&(t[0]));
+        bn_mul_recursive(r,a,b,n,0,0,&(t[0]));
         if (n >= BN_MUL_LOW_RECURSIVE_SIZE_NORMAL)
                 {
                 bn_mul_low_recursive(&(t[0]),&(a[0]),&(b[n]),n,&(t[n2]));
@@ -431,7 +766,7 @@ void bn_mul_high(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, BN_ULONG *l, int n2,
         BN_ULONG ll,lc,*lp,*mp;
 
 # ifdef BN_COUNT
-        printf(" bn_mul_high %d * %d\n",n2,n2);
+        fprintf(stderr," bn_mul_high %d * %d\n",n2,n2);
 # endif
         n=n2/2;
 
@@ -484,8 +819,8 @@ void bn_mul_high(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, BN_ULONG *l, int n2,
         else
 # endif
                 {
-                bn_mul_recursive(&(t[0]),&(r[0]),&(r[n]),n,&(t[n2]));
-                bn_mul_recursive(r,&(a[n]),&(b[n]),n,&(t[n2]));
+                bn_mul_recursive(&(t[0]),&(r[0]),&(r[n]),n,0,0,&(t[n2]));
+                bn_mul_recursive(r,&(a[n]),&(b[n]),n,0,0,&(t[n2]));
                 }
 
         /* s0 == low(al*bl)
@@ -610,19 +945,19 @@ void bn_mul_high(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, BN_ULONG *l, int n2,
 
 int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
         {
+        int ret=0;
         int top,al,bl;
         BIGNUM *rr;
-        int ret = 0;
 #if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
         int i;
 #endif
 #ifdef BN_RECURSION
-        BIGNUM *t;
-        int j,k;
+        BIGNUM *t=NULL;
+        int j=0,k;
 #endif
 
 #ifdef BN_COUNT
-        printf("BN_mul %d * %d\n",a->top,b->top);
+        fprintf(stderr,"BN_mul %d * %d\n",a->top,b->top);
 #endif
 
         bn_check_top(a);
@@ -634,7 +969,7 @@ int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
 
         if ((al == 0) || (bl == 0))
                 {
-                if (!BN_zero(r)) goto err;
+                BN_zero(r);
                 return(1);
                 }
         top=al+bl;
@@ -675,21 +1010,55 @@ int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
 #ifdef BN_RECURSION
         if ((al >= BN_MULL_SIZE_NORMAL) && (bl >= BN_MULL_SIZE_NORMAL))
                 {
-                if (i == 1 && !BN_get_flags(b,BN_FLG_STATIC_DATA) && bl<b->dmax)
+                if (i >= -1 && i <= 1)
                         {
-#if 0   /* tribute to const-ification, bl<b->dmax above covers for this */
-                        if (bn_wexpand(b,al) == NULL) goto err;
-#endif
-                        b->d[bl]=0;
+                        int sav_j =0;
+                        /* Find out the power of two lower or equal
+                           to the longest of the two numbers */
+                        if (i >= 0)
+                                {
+                                j = BN_num_bits_word((BN_ULONG)al);
+                                }
+                        if (i == -1)
+                                {
+                                j = BN_num_bits_word((BN_ULONG)bl);
+                                }
+                        sav_j = j;
+                        j = 1<<(j-1);
+                        assert(j <= al || j <= bl);
+                        k = j+j;
+                        t = BN_CTX_get(ctx);
+                        if (al > j || bl > j)
+                                {
+                                bn_wexpand(t,k*4);
+                                bn_wexpand(rr,k*4);
+                                bn_mul_part_recursive(rr->d,a->d,b->d,
+                                        j,al-j,bl-j,t->d);
+                                }
+                        else    /* al <= j || bl <= j */
+                                {
+                                bn_wexpand(t,k*2);
+                                bn_wexpand(rr,k*2);
+                                bn_mul_recursive(rr->d,a->d,b->d,
+                                        j,al-j,bl-j,t->d);
+                                }
+                        rr->top=top;
+                        goto end;
+                        }
+#if 0
+                if (i == 1 && !BN_get_flags(b,BN_FLG_STATIC_DATA))
+                        {
+                        BIGNUM *tmp_bn = (BIGNUM *)b;
+                        if (bn_wexpand(tmp_bn,al) == NULL) goto err;
+                        tmp_bn->d[bl]=0;
                         bl++;
                         i--;
                         }
-                else if (i == -1 && !BN_get_flags(a,BN_FLG_STATIC_DATA) && al<a->dmax)
+                else if (i == -1 && !BN_get_flags(a,BN_FLG_STATIC_DATA))
                         {
-#if 0   /* tribute to const-ification, al<a->dmax above covers for this */
-                        if (bn_wexpand(a,bl) == NULL) goto err;
-#endif
-                        a->d[al]=0;
+                        BIGNUM *tmp_bn = (BIGNUM *)a;
+                        if (bn_wexpand(tmp_bn,bl) == NULL) goto err;
+                        tmp_bn->d[al]=0;
                         al++;
                         i++;
                         }
@@ -706,26 +1075,17 @@ int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
                                 if (bn_wexpand(t,k*2) == NULL) goto err;
                                 if (bn_wexpand(rr,k*2) == NULL) goto err;
                                 bn_mul_recursive(rr->d,a->d,b->d,al,t->d);
-                                rr->top=top;
-                                goto end;
                                 }
-#if 0   /* tribute to const-ification, rsa/dsa performance is not affected */
                         else
                                 {
-                                if (bn_wexpand(a,k) == NULL ) goto err;
-                                if (bn_wexpand(b,k) == NULL ) goto err;
-                                if (bn_wexpand(t,k*4) == NULL ) goto err;
-                                if (bn_wexpand(rr,k*4) == NULL ) goto err;
-                                for (i=a->top; i<k; i++)
-                                        a->d[i]=0;
-                                for (i=b->top; i<k; i++)
-                                        b->d[i]=0;
+                                if (bn_wexpand(t,k*4) == NULL) goto err;
+                                if (bn_wexpand(rr,k*4) == NULL) goto err;
                                 bn_mul_part_recursive(rr->d,a->d,b->d,al-j,j,t->d);
                                 }
                         rr->top=top;
                         goto end;
-#endif
                         }
+#endif
                 }
 #endif /* BN_RECURSION */
         if (bn_wexpand(rr,top) == NULL) goto err;
@@ -735,10 +1095,11 @@ int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
 #if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
 end:
 #endif
-        bn_fix_top(rr);
+        bn_correct_top(rr);
         if (r != rr) BN_copy(r,rr);
         ret=1;
 err:
+        bn_check_top(r);
         BN_CTX_end(ctx);
         return(ret);
         }
@@ -748,7 +1109,7 @@ void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
         BN_ULONG *rr;
 
 #ifdef BN_COUNT
-        printf(" bn_mul_normal %d * %d\n",na,nb);
+        fprintf(stderr," bn_mul_normal %d * %d\n",na,nb);
 #endif
 
         if (na < nb)
@@ -761,7 +1122,13 @@ void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
 
                 }
         rr= &(r[na]);
-        rr[0]=bn_mul_words(r,a,na,b[0]);
+        if (nb <= 0)
+                {
+                (void)bn_mul_words(r,a,na,0);
+                return;
+                }
+        else
+                rr[0]=bn_mul_words(r,a,na,b[0]);
 
         for (;;)
                 {
@@ -782,7 +1149,7 @@ void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
 void bn_mul_low_normal(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n)
         {
 #ifdef BN_COUNT
-        printf(" bn_mul_low_normal %d * %d\n",n,n);
+        fprintf(stderr," bn_mul_low_normal %d * %d\n",n,n);
 #endif
         bn_mul_words(r,a,n,b[0]);
 
diff --git a/src/lib/libssl/src/crypto/bn/bn_prime.c b/src/lib/libssl/src/crypto/bn/bn_prime.c
index f422172f16..7b25979dd1 100644
--- a/src/lib/libssl/src/crypto/bn/bn_prime.c
+++ b/src/lib/libssl/src/crypto/bn/bn_prime.c
@@ -115,6 +115,11 @@
 #include "bn_lcl.h"
 #include <openssl/rand.h>
 
+/* NB: these functions have been "upgraded", the deprecated versions (which are
+ * compatibility wrappers using these functions) are in bn_depr.c.
+ * - Geoff
+ */
+
 /* The quick sieve algorithm approach to weeding out primes is
  * Philip Zimmermann's, as implemented in PGP.  I have had a read of
  * his comments and implemented my own version.
@@ -129,51 +134,69 @@ static int probable_prime_dh(BIGNUM *rnd, int bits,
 static int probable_prime_dh_safe(BIGNUM *rnd, int bits,
         const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
 
-BIGNUM *BN_generate_prime(BIGNUM *ret, int bits, int safe,
-        const BIGNUM *add, const BIGNUM *rem,
-        void (*callback)(int,int,void *), void *cb_arg)
+int BN_GENCB_call(BN_GENCB *cb, int a, int b)
+        {
+        /* No callback means continue */
+        if(!cb) return 1;
+        switch(cb->ver)
+                {
+        case 1:
+                /* Deprecated-style callbacks */
+                if(!cb->cb.cb_1)
+                        return 1;
+                cb->cb.cb_1(a, b, cb->arg);
+                return 1;
+        case 2:
+                /* New-style callbacks */
+                return cb->cb.cb_2(a, b, cb);
+        default:
+                break;
+                }
+        /* Unrecognised callback type */
+        return 0;
+        }
+
+int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe,
+        const BIGNUM *add, const BIGNUM *rem, BN_GENCB *cb)
         {
-        BIGNUM *rnd=NULL;
-        BIGNUM t;
+        BIGNUM *t;
         int found=0;
         int i,j,c1=0;
         BN_CTX *ctx;
         int checks = BN_prime_checks_for_size(bits);
 
-        BN_init(&t);
         ctx=BN_CTX_new();
         if (ctx == NULL) goto err;
-        if (ret == NULL)
-                {
-                if ((rnd=BN_new()) == NULL) goto err;
-                }
-        else
-                rnd=ret;
+        BN_CTX_start(ctx);
+        t = BN_CTX_get(ctx);
+        if(!t) goto err;
 loop: 
         /* make a random number and set the top and bottom bits */
         if (add == NULL)
                 {
-                if (!probable_prime(rnd,bits)) goto err;
+                if (!probable_prime(ret,bits)) goto err;
                 }
         else
                 {
                 if (safe)
                         {
-                        if (!probable_prime_dh_safe(rnd,bits,add,rem,ctx))
+                        if (!probable_prime_dh_safe(ret,bits,add,rem,ctx))
                                  goto err;
                         }
                 else
                         {
-                        if (!probable_prime_dh(rnd,bits,add,rem,ctx))
+                        if (!probable_prime_dh(ret,bits,add,rem,ctx))
                                 goto err;
                         }
                 }
-        /* if (BN_mod_word(rnd,(BN_ULONG)3) == 1) goto loop; */
-        if (callback != NULL) callback(0,c1++,cb_arg);
+        /* if (BN_mod_word(ret,(BN_ULONG)3) == 1) goto loop; */
+        if(!BN_GENCB_call(cb, 0, c1++))
+                /* aborted */
+                goto err;
 
         if (!safe)
                 {
-                i=BN_is_prime_fasttest(rnd,checks,callback,ctx,cb_arg,0);
+                i=BN_is_prime_fasttest_ex(ret,checks,ctx,0,cb);
                 if (i == -1) goto err;
                 if (i == 0) goto loop;
                 }
@@ -183,41 +206,42 @@ loop:
                  * check that (p-1)/2 is prime.
                  * Since a prime is odd, We just
                  * need to divide by 2 */
-                if (!BN_rshift1(&t,rnd)) goto err;
+                if (!BN_rshift1(t,ret)) goto err;
 
                 for (i=0; i<checks; i++)
                         {
-                        j=BN_is_prime_fasttest(rnd,1,callback,ctx,cb_arg,0);
+                        j=BN_is_prime_fasttest_ex(ret,1,ctx,0,cb);
                         if (j == -1) goto err;
                         if (j == 0) goto loop;
 
-                        j=BN_is_prime_fasttest(&t,1,callback,ctx,cb_arg,0);
+                        j=BN_is_prime_fasttest_ex(t,1,ctx,0,cb);
                         if (j == -1) goto err;
                         if (j == 0) goto loop;
 
-                        if (callback != NULL) callback(2,c1-1,cb_arg);
+                        if(!BN_GENCB_call(cb, 2, c1-1))
+                                goto err;
                         /* We have a safe prime test pass */
                         }
                 }
         /* we have a prime :-) */
         found = 1;
 err:
-        if (!found && (ret == NULL) && (rnd != NULL)) BN_free(rnd);
-        BN_free(&t);
-        if (ctx != NULL) BN_CTX_free(ctx);
-        return(found ? rnd : NULL);
+        if (ctx != NULL)
+                {
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
+                }
+        bn_check_top(ret);
+        return found;
         }
 
-int BN_is_prime(const BIGNUM *a, int checks, void (*callback)(int,int,void *),
-        BN_CTX *ctx_passed, void *cb_arg)
+int BN_is_prime_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed, BN_GENCB *cb)
         {
-        return BN_is_prime_fasttest(a, checks, callback, ctx_passed, cb_arg, 0);
+        return BN_is_prime_fasttest_ex(a, checks, ctx_passed, 0, cb);
         }
 
-int BN_is_prime_fasttest(const BIGNUM *a, int checks,
-                void (*callback)(int,int,void *),
-                BN_CTX *ctx_passed, void *cb_arg,
-                int do_trial_division)
+int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
+                int do_trial_division, BN_GENCB *cb)
         {
         int i, j, ret = -1;
         int k;
@@ -236,13 +260,13 @@ int BN_is_prime_fasttest(const BIGNUM *a, int checks,
         if (!BN_is_odd(a))
                 /* a is even => a is prime if and only if a == 2 */
                 return BN_is_word(a, 2);
-
         if (do_trial_division)
                 {
                 for (i = 1; i < NUMPRIMES; i++)
                         if (BN_mod_word(a, primes[i]) == 0) 
                                 return 0;
-                if (callback != NULL) callback(1, -1, cb_arg);
+                if(!BN_GENCB_call(cb, 1, -1))
+                        goto err;
                 }
 
         if (ctx_passed != NULL)
@@ -308,7 +332,8 @@ int BN_is_prime_fasttest(const BIGNUM *a, int checks,
                         ret=0;
                         goto err;
                         }
-                if (callback != NULL) callback(1,i,cb_arg);
+                if(!BN_GENCB_call(cb, 1, i))
+                        goto err;
                 }
         ret=1;
 err:
@@ -345,20 +370,22 @@ static int witness(BIGNUM *w, const BIGNUM *a, const BIGNUM *a1,
                 }
         /* If we get here, 'w' is the (a-1)/2-th power of the original 'w',
          * and it is neither -1 nor +1 -- so 'a' cannot be prime */
+        bn_check_top(w);
         return 1;
         }
 
 static int probable_prime(BIGNUM *rnd, int bits)
         {
         int i;
-        BN_ULONG mods[NUMPRIMES];
-        BN_ULONG delta,d;
+        prime_t mods[NUMPRIMES];
+        BN_ULONG delta,maxdelta;
 
 again:
         if (!BN_rand(rnd,bits,1,1)) return(0);
         /* we now have a random number 'rand' to test. */
         for (i=1; i<NUMPRIMES; i++)
-                mods[i]=BN_mod_word(rnd,(BN_ULONG)primes[i]);
+                mods[i]=(prime_t)BN_mod_word(rnd,(BN_ULONG)primes[i]);
+        maxdelta=BN_MASK2 - primes[NUMPRIMES-1];
         delta=0;
         loop: for (i=1; i<NUMPRIMES; i++)
                 {
@@ -366,16 +393,13 @@ again:
                  * that gcd(rnd-1,primes) == 1 (except for 2) */
                 if (((mods[i]+delta)%primes[i]) <= 1)
                         {
-                        d=delta;
                         delta+=2;
-                        /* perhaps need to check for overflow of
-                         * delta (but delta can be up to 2^32)
-                         * 21-May-98 eay - added overflow check */
-                        if (delta < d) goto again;
+                        if (delta > maxdelta) goto again;
                         goto loop;
                         }
                 }
         if (!BN_add_word(rnd,delta)) return(0);
+        bn_check_top(rnd);
         return(1);
         }
 
@@ -413,6 +437,7 @@ static int probable_prime_dh(BIGNUM *rnd, int bits,
         ret=1;
 err:
         BN_CTX_end(ctx);
+        bn_check_top(rnd);
         return(ret);
         }
 
@@ -464,5 +489,6 @@ static int probable_prime_dh_safe(BIGNUM *p, int bits, const BIGNUM *padd,
         ret=1;
 err:
         BN_CTX_end(ctx);
+        bn_check_top(p);
         return(ret);
         }
diff --git a/src/lib/libssl/src/crypto/bn/bn_prime.h b/src/lib/libssl/src/crypto/bn/bn_prime.h
index b7cf9a9bfe..51d2194feb 100644
--- a/src/lib/libssl/src/crypto/bn/bn_prime.h
+++ b/src/lib/libssl/src/crypto/bn/bn_prime.h
@@ -58,10 +58,12 @@
 
 #ifndef EIGHT_BIT
 #define NUMPRIMES 2048
+typedef unsigned short prime_t;
 #else
 #define NUMPRIMES 54
+typedef unsigned char prime_t;
 #endif
-static const unsigned int primes[NUMPRIMES]=
+static const prime_t primes[NUMPRIMES]=
         {
            2,   3,   5,   7,  11,  13,  17,  19,
           23,  29,  31,  37,  41,  43,  47,  53,
diff --git a/src/lib/libssl/src/crypto/bn/bn_prime.pl b/src/lib/libssl/src/crypto/bn/bn_prime.pl
index 9fc3765486..3fafb6f3e9 100644
--- a/src/lib/libssl/src/crypto/bn/bn_prime.pl
+++ b/src/lib/libssl/src/crypto/bn/bn_prime.pl
@@ -11,7 +11,7 @@ loop: while ($#primes < $num-1)
         $p+=2;
         $s=int(sqrt($p));
 
-        for ($i=0; $primes[$i]<=$s; $i++)
+        for ($i=0; defined($primes[$i]) && $primes[$i]<=$s; $i++)
                 {
                 next loop if (($p%$primes[$i]) == 0);
                 }
@@ -101,10 +101,12 @@ for ($i=0; $i <= $#primes; $i++)
 
 printf "#ifndef EIGHT_BIT\n";
 printf "#define NUMPRIMES %d\n",$num;
+printf "typedef unsigned short prime_t;\n";
 printf "#else\n";
 printf "#define NUMPRIMES %d\n",$eight;
+printf "typedef unsigned char prime_t;\n";
 printf "#endif\n";
-print "static const unsigned int primes[NUMPRIMES]=\n\t{\n\t";
+print "static const prime_t primes[NUMPRIMES]=\n\t{\n\t";
 $init=0;
 for ($i=0; $i <= $#primes; $i++)
         {
diff --git a/src/lib/libssl/src/crypto/bn/bn_print.c b/src/lib/libssl/src/crypto/bn/bn_print.c
index acba7ed7ee..810dde34e1 100644
--- a/src/lib/libssl/src/crypto/bn/bn_print.c
+++ b/src/lib/libssl/src/crypto/bn/bn_print.c
@@ -62,7 +62,7 @@
 #include <openssl/buffer.h>
 #include "bn_lcl.h"
 
-static const char *Hex="0123456789ABCDEF";
+static const char Hex[]="0123456789ABCDEF";
 
 /* Must 'OPENSSL_free' the returned data */
 char *BN_bn2hex(const BIGNUM *a)
@@ -102,14 +102,19 @@ err:
 /* Must 'OPENSSL_free' the returned data */
 char *BN_bn2dec(const BIGNUM *a)
         {
-        int i=0,num;
+        int i=0,num, ok = 0;
         char *buf=NULL;
         char *p;
         BIGNUM *t=NULL;
         BN_ULONG *bn_data=NULL,*lp;
 
+        /* get an upper bound for the length of the decimal integer
+         * num <= (BN_num_bits(a) + 1) * log(2)
+         *     <= 3 * BN_num_bits(a) * 0.1001 + log(2) + 1     (rounding error)
+         *     <= BN_num_bits(a)/10 + BN_num_bits/1000 + 1 + 1 
+         */
         i=BN_num_bits(a)*3;
-        num=(i/10+i/1000+3)+1;
+        num=(i/10+i/1000+1)+1;
         bn_data=(BN_ULONG *)OPENSSL_malloc((num/BN_DEC_NUM+1)*sizeof(BN_ULONG));
         buf=(char *)OPENSSL_malloc(num+3);
         if ((buf == NULL) || (bn_data == NULL))
@@ -122,7 +127,6 @@ char *BN_bn2dec(const BIGNUM *a)
 #define BUF_REMAIN (num+3 - (size_t)(p - buf))
         p=buf;
         lp=bn_data;
-        if (t->neg) *(p++)='-';
         if (BN_is_zero(t))
                 {
                 *(p++)='0';
@@ -130,6 +134,9 @@ char *BN_bn2dec(const BIGNUM *a)
                 }
         else
                 {
+                if (BN_is_negative(t))
+                        *p++ = '-';
+
                 i=0;
                 while (!BN_is_zero(t))
                         {
@@ -149,9 +156,16 @@ char *BN_bn2dec(const BIGNUM *a)
                         while (*p) p++;
                         }
                 }
+        ok = 1;
 err:
         if (bn_data != NULL) OPENSSL_free(bn_data);
         if (t != NULL) BN_free(t);
+        if (!ok && buf)
+                {
+                OPENSSL_free(buf);
+                buf = NULL;
+                }
+
         return(buf);
         }
 
@@ -211,10 +225,11 @@ int BN_hex2bn(BIGNUM **bn, const char *a)
                 j-=(BN_BYTES*2);
                 }
         ret->top=h;
-        bn_fix_top(ret);
+        bn_correct_top(ret);
         ret->neg=neg;
 
         *bn=ret;
+        bn_check_top(ret);
         return(num);
 err:
         if (*bn == NULL) BN_free(ret);
@@ -270,8 +285,9 @@ int BN_dec2bn(BIGNUM **bn, const char *a)
                 }
         ret->neg=neg;
 
-        bn_fix_top(ret);
+        bn_correct_top(ret);
         *bn=ret;
+        bn_check_top(ret);
         return(num);
 err:
         if (*bn == NULL) BN_free(ret);
@@ -300,7 +316,7 @@ int BN_print(BIO *bp, const BIGNUM *a)
         int ret=0;
 
         if ((a->neg) && (BIO_write(bp,"-",1) != 1)) goto end;
-        if ((BN_is_zero(a)) && (BIO_write(bp,"0",1) != 1)) goto end;
+        if (BN_is_zero(a) && (BIO_write(bp,"0",1) != 1)) goto end;
         for (i=a->top-1; i >=0; i--)
                 {
                 for (j=BN_BITS2-4; j >= 0; j-=4)
@@ -320,14 +336,3 @@ end:
         return(ret);
         }
 #endif
-
-#ifdef BN_DEBUG
-void bn_dump1(FILE *o, const char *a, const BN_ULONG *b,int n)
-        {
-        int i;
-        fprintf(o, "%s=", a);
-        for (i=n-1;i>=0;i--)
-                fprintf(o, "%08lX", b[i]); /* assumes 32-bit BN_ULONG */
-        fprintf(o, "\n");
-        }
-#endif
diff --git a/src/lib/libssl/src/crypto/bn/bn_rand.c b/src/lib/libssl/src/crypto/bn/bn_rand.c
index 893c9d2af9..f51830b12b 100644
--- a/src/lib/libssl/src/crypto/bn/bn_rand.c
+++ b/src/lib/libssl/src/crypto/bn/bn_rand.c
@@ -134,13 +134,13 @@ static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
         buf=(unsigned char *)OPENSSL_malloc(bytes);
         if (buf == NULL)
                 {
-                BNerr(BN_F_BN_RAND,ERR_R_MALLOC_FAILURE);
+                BNerr(BN_F_BNRAND,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
 
         /* make a random number and set the top and bottom bits */
         time(&tim);
-        RAND_add(&tim,sizeof(tim),0);
+        RAND_add(&tim,sizeof(tim),0.0);
 
         if (pseudorand)
                 {
@@ -204,6 +204,7 @@ err:
                 OPENSSL_cleanse(buf,bytes);
                 OPENSSL_free(buf);
                 }
+        bn_check_top(rnd);
         return(ret);
         }
 
@@ -230,6 +231,7 @@ static int bn_rand_range(int pseudo, BIGNUM *r, BIGNUM *range)
         {
         int (*bn_rand)(BIGNUM *, int, int, int) = pseudo ? BN_pseudo_rand : BN_rand;
         int n;
+        int count = 100;
 
         if (range->neg || BN_is_zero(range))
                 {
@@ -242,9 +244,7 @@ static int bn_rand_range(int pseudo, BIGNUM *r, BIGNUM *range)
         /* BN_is_bit_set(range, n - 1) always holds */
 
         if (n == 1)
-                {
-                if (!BN_zero(r)) return 0;
-                }
+                BN_zero(r);
         else if (!BN_is_bit_set(range, n - 2) && !BN_is_bit_set(range, n - 3))
                 {
                 /* range = 100..._2,
@@ -263,6 +263,13 @@ static int bn_rand_range(int pseudo, BIGNUM *r, BIGNUM *range)
                                 if (BN_cmp(r, range) >= 0)
                                         if (!BN_sub(r, r, range)) return 0;
                                 }
+
+                        if (!--count)
+                                {
+                                BNerr(BN_F_BN_RAND_RANGE, BN_R_TOO_MANY_ITERATIONS);
+                                return 0;
+                                }
+                        
                         }
                 while (BN_cmp(r, range) >= 0);
                 }
@@ -272,10 +279,17 @@ static int bn_rand_range(int pseudo, BIGNUM *r, BIGNUM *range)
                         {
                         /* range = 11..._2  or  range = 101..._2 */
                         if (!bn_rand(r, n, -1, 0)) return 0;
+
+                        if (!--count)
+                                {
+                                BNerr(BN_F_BN_RAND_RANGE, BN_R_TOO_MANY_ITERATIONS);
+                                return 0;
+                                }
                         }
                 while (BN_cmp(r, range) >= 0);
                 }
 
+        bn_check_top(r);
         return 1;
         }
 
diff --git a/src/lib/libssl/src/crypto/bn/bn_recp.c b/src/lib/libssl/src/crypto/bn/bn_recp.c
index ef5fdd4708..2e8efb8dae 100644
--- a/src/lib/libssl/src/crypto/bn/bn_recp.c
+++ b/src/lib/libssl/src/crypto/bn/bn_recp.c
@@ -94,7 +94,7 @@ void BN_RECP_CTX_free(BN_RECP_CTX *recp)
 int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)
         {
         if (!BN_copy(&(recp->N),d)) return 0;
-        if (!BN_zero(&(recp->Nr))) return 0;
+        BN_zero(&(recp->Nr));
         recp->num_bits=BN_num_bits(d);
         recp->shift=0;
         return(1);
@@ -123,6 +123,7 @@ int BN_mod_mul_reciprocal(BIGNUM *r, const BIGNUM *x, const BIGNUM *y,
         ret = BN_div_recp(NULL,r,ca,recp,ctx);
 err:
         BN_CTX_end(ctx);
+        bn_check_top(r);
         return(ret);
         }
 
@@ -147,7 +148,7 @@ int BN_div_recp(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m,
 
         if (BN_ucmp(m,&(recp->N)) < 0)
                 {
-                if (!BN_zero(d)) return 0;
+                BN_zero(d);
                 if (!BN_copy(r,m)) return 0;
                 BN_CTX_end(ctx);
                 return(1);
@@ -190,7 +191,7 @@ int BN_div_recp(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m,
                 {
                 if (j++ > 2)
                         {
-                        BNerr(BN_F_BN_MOD_MUL_RECIPROCAL,BN_R_BAD_RECIPROCAL);
+                        BNerr(BN_F_BN_DIV_RECP,BN_R_BAD_RECIPROCAL);
                         goto err;
                         }
                 if (!BN_usub(r,r,&(recp->N))) goto err;
@@ -203,6 +204,8 @@ int BN_div_recp(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m,
         ret=1;
 err:
         BN_CTX_end(ctx);
+        bn_check_top(dv);
+        bn_check_top(rem);
         return(ret);
         } 
 
@@ -214,17 +217,18 @@ err:
 int BN_reciprocal(BIGNUM *r, const BIGNUM *m, int len, BN_CTX *ctx)
         {
         int ret= -1;
-        BIGNUM t;
+        BIGNUM *t;
 
-        BN_init(&t);
+        BN_CTX_start(ctx);
+        if((t = BN_CTX_get(ctx)) == NULL) goto err;
 
-        if (!BN_zero(&t)) goto err;
-        if (!BN_set_bit(&t,len)) goto err;
+        if (!BN_set_bit(t,len)) goto err;
 
-        if (!BN_div(r,NULL,&t,m,ctx)) goto err;
+        if (!BN_div(r,NULL,t,m,ctx)) goto err;
 
         ret=len;
 err:
-        BN_free(&t);
+        bn_check_top(r);
+        BN_CTX_end(ctx);
         return(ret);
         }
diff --git a/src/lib/libssl/src/crypto/bn/bn_shift.c b/src/lib/libssl/src/crypto/bn/bn_shift.c
index 70f785ea18..de9312dce2 100644
--- a/src/lib/libssl/src/crypto/bn/bn_shift.c
+++ b/src/lib/libssl/src/crypto/bn/bn_shift.c
@@ -65,6 +65,9 @@ int BN_lshift1(BIGNUM *r, const BIGNUM *a)
         register BN_ULONG *ap,*rp,t,c;
         int i;
 
+        bn_check_top(r);
+        bn_check_top(a);
+
         if (r != a)
                 {
                 r->neg=a->neg;
@@ -89,6 +92,7 @@ int BN_lshift1(BIGNUM *r, const BIGNUM *a)
                 *rp=1;
                 r->top++;
                 }
+        bn_check_top(r);
         return(1);
         }
 
@@ -97,6 +101,9 @@ int BN_rshift1(BIGNUM *r, const BIGNUM *a)
         BN_ULONG *ap,*rp,t,c;
         int i;
 
+        bn_check_top(r);
+        bn_check_top(a);
+
         if (BN_is_zero(a))
                 {
                 BN_zero(r);
@@ -117,7 +124,8 @@ int BN_rshift1(BIGNUM *r, const BIGNUM *a)
                 rp[i]=((t>>1)&BN_MASK2)|c;
                 c=(t&1)?BN_TBIT:0;
                 }
-        bn_fix_top(r);
+        bn_correct_top(r);
+        bn_check_top(r);
         return(1);
         }
 
@@ -127,6 +135,9 @@ int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
         BN_ULONG *t,*f;
         BN_ULONG l;
 
+        bn_check_top(r);
+        bn_check_top(a);
+
         r->neg=a->neg;
         nw=n/BN_BITS2;
         if (bn_wexpand(r,a->top+nw+1) == NULL) return(0);
@@ -149,7 +160,8 @@ int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
 /*      for (i=0; i<nw; i++)
                 t[i]=0;*/
         r->top=a->top+nw+1;
-        bn_fix_top(r);
+        bn_correct_top(r);
+        bn_check_top(r);
         return(1);
         }
 
@@ -159,6 +171,9 @@ int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
         BN_ULONG *t,*f;
         BN_ULONG l,tmp;
 
+        bn_check_top(r);
+        bn_check_top(a);
+
         nw=n/BN_BITS2;
         rb=n%BN_BITS2;
         lb=BN_BITS2-rb;
@@ -185,13 +200,13 @@ int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
 
         if (rb == 0)
                 {
-                for (i=j+1; i > 0; i--)
+                for (i=j; i != 0; i--)
                         *(t++)= *(f++);
                 }
         else
                 {
                 l= *(f++);
-                for (i=1; i<j; i++)
+                for (i=j-1; i != 0; i--)
                         {
                         tmp =(l>>rb)&BN_MASK2;
                         l= *(f++);
@@ -199,7 +214,7 @@ int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
                         }
                 *(t++) =(l>>rb)&BN_MASK2;
                 }
-        *t=0;
-        bn_fix_top(r);
+        bn_correct_top(r);
+        bn_check_top(r);
         return(1);
         }
diff --git a/src/lib/libssl/src/crypto/bn/bn_sqr.c b/src/lib/libssl/src/crypto/bn/bn_sqr.c
index c1d0cca438..270d0cd348 100644
--- a/src/lib/libssl/src/crypto/bn/bn_sqr.c
+++ b/src/lib/libssl/src/crypto/bn/bn_sqr.c
@@ -77,16 +77,16 @@ int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
         if (al <= 0)
                 {
                 r->top=0;
-                return(1);
+                return 1;
                 }
 
         BN_CTX_start(ctx);
         rr=(a != r) ? r : BN_CTX_get(ctx);
         tmp=BN_CTX_get(ctx);
-        if (tmp == NULL) goto err;
+        if (!rr || !tmp) goto err;
 
-        max=(al+al);
-        if (bn_wexpand(rr,max+1) == NULL) goto err;
+        max = 2 * al; /* Non-zero (from above) */
+        if (bn_wexpand(rr,max) == NULL) goto err;
 
         if (al == 4)
                 {
@@ -138,12 +138,18 @@ int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
 #endif
                 }
 
-        rr->top=max;
         rr->neg=0;
-        if ((max > 0) && (rr->d[max-1] == 0)) rr->top--;
+        /* If the most-significant half of the top word of 'a' is zero, then
+         * the square of 'a' will max-1 words. */
+        if(a->d[al - 1] == (a->d[al - 1] & BN_MASK2l))
+                rr->top = max - 1;
+        else
+                rr->top = max;
         if (rr != r) BN_copy(r,rr);
         ret = 1;
  err:
+        bn_check_top(rr);
+        bn_check_top(tmp);
         BN_CTX_end(ctx);
         return(ret);
         }
diff --git a/src/lib/libssl/src/crypto/bn/bn_sqrt.c b/src/lib/libssl/src/crypto/bn/bn_sqrt.c
index e2a1105dc8..6beaf9e5e5 100644
--- a/src/lib/libssl/src/crypto/bn/bn_sqrt.c
+++ b/src/lib/libssl/src/crypto/bn/bn_sqrt.c
@@ -1,4 +1,4 @@
-/* crypto/bn/bn_mod.c */
+/* crypto/bn/bn_sqrt.c */
 /* Written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
  * and Bodo Moeller for the OpenSSL project. */
 /* ====================================================================
@@ -65,14 +65,12 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
  * using the Tonelli/Shanks algorithm (cf. Henri Cohen, "A Course
  * in Algebraic Computational Number Theory", algorithm 1.5.1).
  * 'p' must be prime!
- * If 'a' is not a square, this is not necessarily detected by
- * the algorithms; a bogus result must be expected in this case.
  */
         {
         BIGNUM *ret = in;
         int err = 1;
         int r;
-        BIGNUM *b, *q, *t, *x, *y;
+        BIGNUM *A, *b, *q, *t, *x, *y;
         int e, i, j;
         
         if (!BN_is_odd(p) || BN_abs_is_word(p, 1))
@@ -85,9 +83,11 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                                 goto end;
                         if (!BN_set_word(ret, BN_is_bit_set(a, 0)))
                                 {
-                                BN_free(ret);
+                                if (ret != in)
+                                        BN_free(ret);
                                 return NULL;
                                 }
+                        bn_check_top(ret);
                         return ret;
                         }
 
@@ -103,23 +103,16 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                         goto end;
                 if (!BN_set_word(ret, BN_is_one(a)))
                         {
-                        BN_free(ret);
+                        if (ret != in)
+                                BN_free(ret);
                         return NULL;
                         }
+                bn_check_top(ret);
                 return ret;
                 }
 
-#if 0 /* if BN_mod_sqrt is used with correct input, this just wastes time */
-        r = BN_kronecker(a, p, ctx);
-        if (r < -1) return NULL;
-        if (r == -1)
-                {
-                BNerr(BN_F_BN_MOD_SQRT, BN_R_NOT_A_SQUARE);
-                return(NULL);
-                }
-#endif
-
         BN_CTX_start(ctx);
+        A = BN_CTX_get(ctx);
         b = BN_CTX_get(ctx);
         q = BN_CTX_get(ctx);
         t = BN_CTX_get(ctx);
@@ -131,6 +124,9 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                 ret = BN_new();
         if (ret == NULL) goto end;
 
+        /* A = a mod p */
+        if (!BN_nnmod(A, a, p, ctx)) goto end;
+
         /* now write  |p| - 1  as  2^e*q  where  q  is odd */
         e = 1;
         while (!BN_is_bit_set(p, e))
@@ -149,9 +145,9 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                 if (!BN_rshift(q, p, 2)) goto end;
                 q->neg = 0;
                 if (!BN_add_word(q, 1)) goto end;
-                if (!BN_mod_exp(ret, a, q, p, ctx)) goto end;
+                if (!BN_mod_exp(ret, A, q, p, ctx)) goto end;
                 err = 0;
-                goto end;
+                goto vrfy;
                 }
         
         if (e == 2)
@@ -182,15 +178,8 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                  * November 1992.)
                  */
 
-                /* make sure that  a  is reduced modulo p */
-                if (a->neg || BN_ucmp(a, p) >= 0)
-                        {
-                        if (!BN_nnmod(x, a, p, ctx)) goto end;
-                        a = x; /* use x as temporary variable */
-                        }
-
                 /* t := 2*a */
-                if (!BN_mod_lshift1_quick(t, a, p)) goto end;
+                if (!BN_mod_lshift1_quick(t, A, p)) goto end;
 
                 /* b := (2*a)^((|p|-5)/8) */
                 if (!BN_rshift(q, p, 3)) goto end;
@@ -205,12 +194,12 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                 if (!BN_sub_word(t, 1)) goto end;
 
                 /* x = a*b*t */
-                if (!BN_mod_mul(x, a, b, p, ctx)) goto end;
+                if (!BN_mod_mul(x, A, b, p, ctx)) goto end;
                 if (!BN_mod_mul(x, x, t, p, ctx)) goto end;
 
                 if (!BN_copy(ret, x)) goto end;
                 err = 0;
-                goto end;
+                goto vrfy;
                 }
         
         /* e > 2, so we really have to use the Tonelli/Shanks algorithm.
@@ -297,11 +286,11 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
         /* x := a^((q-1)/2) */
         if (BN_is_zero(t)) /* special case: p = 2^e + 1 */
                 {
-                if (!BN_nnmod(t, a, p, ctx)) goto end;
+                if (!BN_nnmod(t, A, p, ctx)) goto end;
                 if (BN_is_zero(t))
                         {
                         /* special case: a == 0  (mod p) */
-                        if (!BN_zero(ret)) goto end;
+                        BN_zero(ret);
                         err = 0;
                         goto end;
                         }
@@ -310,11 +299,11 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                 }
         else
                 {
-                if (!BN_mod_exp(x, a, t, p, ctx)) goto end;
+                if (!BN_mod_exp(x, A, t, p, ctx)) goto end;
                 if (BN_is_zero(x))
                         {
                         /* special case: a == 0  (mod p) */
-                        if (!BN_zero(ret)) goto end;
+                        BN_zero(ret);
                         err = 0;
                         goto end;
                         }
@@ -322,10 +311,10 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
 
         /* b := a*x^2  (= a^q) */
         if (!BN_mod_sqr(b, x, p, ctx)) goto end;
-        if (!BN_mod_mul(b, b, a, p, ctx)) goto end;
+        if (!BN_mod_mul(b, b, A, p, ctx)) goto end;
         
         /* x := a*x    (= a^((q+1)/2)) */
-        if (!BN_mod_mul(x, x, a, p, ctx)) goto end;
+        if (!BN_mod_mul(x, x, A, p, ctx)) goto end;
 
         while (1)
                 {
@@ -342,7 +331,7 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                         {
                         if (!BN_copy(ret, x)) goto end;
                         err = 0;
-                        goto end;
+                        goto vrfy;
                         }
 
 
@@ -373,6 +362,22 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                 e = i;
                 }
 
+ vrfy:
+        if (!err)
+                {
+                /* verify the result -- the input might have been not a square
+                 * (test added in 0.9.8) */
+                
+                if (!BN_mod_sqr(x, ret, p, ctx))
+                        err = 1;
+                
+                if (!err && 0 != BN_cmp(x, A))
+                        {
+                        BNerr(BN_F_BN_MOD_SQRT, BN_R_NOT_A_SQUARE);
+                        err = 1;
+                        }
+                }
+
  end:
         if (err)
                 {
@@ -383,5 +388,6 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                 ret = NULL;
                 }
         BN_CTX_end(ctx);
+        bn_check_top(ret);
         return ret;
         }
diff --git a/src/lib/libssl/src/crypto/bn/bn_word.c b/src/lib/libssl/src/crypto/bn/bn_word.c
index de610ce54c..ee7b87c45c 100644
--- a/src/lib/libssl/src/crypto/bn/bn_word.c
+++ b/src/lib/libssl/src/crypto/bn/bn_word.c
@@ -69,6 +69,10 @@ BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w)
 #endif
         int i;
 
+        if (w == 0)
+                return (BN_ULONG)-1;
+
+        bn_check_top(a);
         w&=BN_MASK2;
         for (i=a->top-1; i>=0; i--)
                 {
@@ -85,12 +89,24 @@ BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w)
 
 BN_ULONG BN_div_word(BIGNUM *a, BN_ULONG w)
         {
-        BN_ULONG ret;
-        int i;
+        BN_ULONG ret = 0;
+        int i, j;
+
+        bn_check_top(a);
+        w &= BN_MASK2;
+
+        if (!w)
+                /* actually this an error (division by zero) */
+                return (BN_ULONG)-1;
+        if (a->top == 0)
+                return 0;
+
+        /* normalize input (so bn_div_words doesn't complain) */
+        j = BN_BITS2 - BN_num_bits_word(w);
+        w <<= j;
+        if (!BN_lshift(a, a, j))
+                return (BN_ULONG)-1;
 
-        if (a->top == 0) return(0);
-        ret=0;
-        w&=BN_MASK2;
         for (i=a->top-1; i>=0; i--)
                 {
                 BN_ULONG l,d;
@@ -102,6 +118,8 @@ BN_ULONG BN_div_word(BIGNUM *a, BN_ULONG w)
                 }
         if ((a->top > 0) && (a->d[a->top-1] == 0))
                 a->top--;
+        ret >>= j;
+        bn_check_top(a);
         return(ret);
         }
 
@@ -110,9 +128,14 @@ int BN_add_word(BIGNUM *a, BN_ULONG w)
         BN_ULONG l;
         int i;
 
-        if ((w & BN_MASK2) == 0)
-                return(1);
+        bn_check_top(a);
+        w &= BN_MASK2;
 
+        /* degenerate case: w is zero */
+        if (!w) return 1;
+        /* degenerate case: a is zero */
+        if(BN_is_zero(a)) return BN_set_word(a, w);
+        /* handle 'a' when negative */
         if (a->neg)
                 {
                 a->neg=0;
@@ -121,15 +144,17 @@ int BN_add_word(BIGNUM *a, BN_ULONG w)
                         a->neg=!(a->neg);
                 return(i);
                 }
-        w&=BN_MASK2;
-        if (bn_wexpand(a,a->top+1) == NULL) return(0);
+        /* Only expand (and risk failing) if it's possibly necessary */
+        if (((BN_ULONG)(a->d[a->top - 1] + 1) == 0) &&
+                        (bn_wexpand(a,a->top+1) == NULL))
+                return(0);
         i=0;
         for (;;)
                 {
                 if (i >= a->top)
                         l=w;
                 else
-                        l=(a->d[i]+(BN_ULONG)w)&BN_MASK2;
+                        l=(a->d[i]+w)&BN_MASK2;
                 a->d[i]=l;
                 if (w > l)
                         w=1;
@@ -139,6 +164,7 @@ int BN_add_word(BIGNUM *a, BN_ULONG w)
                 }
         if (i >= a->top)
                 a->top++;
+        bn_check_top(a);
         return(1);
         }
 
@@ -146,10 +172,21 @@ int BN_sub_word(BIGNUM *a, BN_ULONG w)
         {
         int i;
 
-        if ((w & BN_MASK2) == 0)
-                return(1);
+        bn_check_top(a);
+        w &= BN_MASK2;
 
-        if (BN_is_zero(a) || a->neg)
+        /* degenerate case: w is zero */
+        if (!w) return 1;
+        /* degenerate case: a is zero */
+        if(BN_is_zero(a))
+                {
+                i = BN_set_word(a,w);
+                if (i != 0)
+                        BN_set_negative(a, 1);
+                return i;
+                }
+        /* handle 'a' when negative */
+        if (a->neg)
                 {
                 a->neg=0;
                 i=BN_add_word(a,w);
@@ -157,7 +194,6 @@ int BN_sub_word(BIGNUM *a, BN_ULONG w)
                 return(i);
                 }
 
-        w&=BN_MASK2;
         if ((a->top == 1) && (a->d[0] < w))
                 {
                 a->d[0]=w-a->d[0];
@@ -181,6 +217,7 @@ int BN_sub_word(BIGNUM *a, BN_ULONG w)
                 }
         if ((a->d[i] == 0) && (i == (a->top-1)))
                 a->top--;
+        bn_check_top(a);
         return(1);
         }
 
@@ -188,6 +225,7 @@ int BN_mul_word(BIGNUM *a, BN_ULONG w)
         {
         BN_ULONG ll;
 
+        bn_check_top(a);
         w&=BN_MASK2;
         if (a->top)
                 {
@@ -203,6 +241,7 @@ int BN_mul_word(BIGNUM *a, BN_ULONG w)
                                 }
                         }
                 }
+        bn_check_top(a);
         return(1);
         }
 
diff --git a/src/lib/libssl/src/crypto/bn/bntest.c b/src/lib/libssl/src/crypto/bn/bntest.c
index 792a75ff4f..cf190380f5 100644
--- a/src/lib/libssl/src/crypto/bn/bntest.c
+++ b/src/lib/libssl/src/crypto/bn/bntest.c
@@ -55,6 +55,25 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the Eric Young open source
+ * license provided above.
+ *
+ * The binary polynomial arithmetic software is originally written by 
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
+
+/* Until the key-gen callbacks are modified to use newer prototypes, we allow
+ * deprecated functions for openssl-internal code */
+#ifdef OPENSSL_NO_DEPRECATED
+#undef OPENSSL_NO_DEPRECATED
+#endif
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -79,6 +98,7 @@ int test_lshift(BIO *bp,BN_CTX *ctx,BIGNUM *a_);
 int test_rshift1(BIO *bp);
 int test_rshift(BIO *bp,BN_CTX *ctx);
 int test_div(BIO *bp,BN_CTX *ctx);
+int test_div_word(BIO *bp);
 int test_div_recp(BIO *bp,BN_CTX *ctx);
 int test_mul(BIO *bp);
 int test_sqr(BIO *bp,BN_CTX *ctx);
@@ -88,6 +108,15 @@ int test_mod_mul(BIO *bp,BN_CTX *ctx);
 int test_mod_exp(BIO *bp,BN_CTX *ctx);
 int test_mod_exp_mont_consttime(BIO *bp,BN_CTX *ctx);
 int test_exp(BIO *bp,BN_CTX *ctx);
+int test_gf2m_add(BIO *bp);
+int test_gf2m_mod(BIO *bp);
+int test_gf2m_mod_mul(BIO *bp,BN_CTX *ctx);
+int test_gf2m_mod_sqr(BIO *bp,BN_CTX *ctx);
+int test_gf2m_mod_inv(BIO *bp,BN_CTX *ctx);
+int test_gf2m_mod_div(BIO *bp,BN_CTX *ctx);
+int test_gf2m_mod_exp(BIO *bp,BN_CTX *ctx);
+int test_gf2m_mod_sqrt(BIO *bp,BN_CTX *ctx);
+int test_gf2m_mod_solve_quad(BIO *bp,BN_CTX *ctx);
 int test_kron(BIO *bp,BN_CTX *ctx);
 int test_sqrt(BIO *bp,BN_CTX *ctx);
 int rand_neg(void);
@@ -155,80 +184,120 @@ int main(int argc, char *argv[])
 
         message(out,"BN_add");
         if (!test_add(out)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_sub");
         if (!test_sub(out)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_lshift1");
         if (!test_lshift1(out)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_lshift (fixed)");
         if (!test_lshift(out,ctx,BN_bin2bn(lst,sizeof(lst)-1,NULL)))
             goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_lshift");
         if (!test_lshift(out,ctx,NULL)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_rshift1");
         if (!test_rshift1(out)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_rshift");
         if (!test_rshift(out,ctx)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_sqr");
         if (!test_sqr(out,ctx)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_mul");
         if (!test_mul(out)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_div");
         if (!test_div(out,ctx)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
+
+        message(out,"BN_div_word");
+        if (!test_div_word(out)) goto err;
+        (void)BIO_flush(out);
 
         message(out,"BN_div_recp");
         if (!test_div_recp(out,ctx)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_mod");
         if (!test_mod(out,ctx)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_mod_mul");
         if (!test_mod_mul(out,ctx)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_mont");
         if (!test_mont(out,ctx)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_mod_exp");
         if (!test_mod_exp(out,ctx)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_mod_exp_mont_consttime");
         if (!test_mod_exp_mont_consttime(out,ctx)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_exp");
         if (!test_exp(out,ctx)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_kronecker");
         if (!test_kron(out,ctx)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
 
         message(out,"BN_mod_sqrt");
         if (!test_sqrt(out,ctx)) goto err;
-        BIO_flush(out);
+        (void)BIO_flush(out);
+
+        message(out,"BN_GF2m_add");
+        if (!test_gf2m_add(out)) goto err;
+        (void)BIO_flush(out);
+
+        message(out,"BN_GF2m_mod");
+        if (!test_gf2m_mod(out)) goto err;
+        (void)BIO_flush(out);
+
+        message(out,"BN_GF2m_mod_mul");
+        if (!test_gf2m_mod_mul(out,ctx)) goto err;
+        (void)BIO_flush(out);
+
+        message(out,"BN_GF2m_mod_sqr");
+        if (!test_gf2m_mod_sqr(out,ctx)) goto err;
+        (void)BIO_flush(out);
+
+        message(out,"BN_GF2m_mod_inv");
+        if (!test_gf2m_mod_inv(out,ctx)) goto err;
+        (void)BIO_flush(out);
+
+        message(out,"BN_GF2m_mod_div");
+        if (!test_gf2m_mod_div(out,ctx)) goto err;
+        (void)BIO_flush(out);
+
+        message(out,"BN_GF2m_mod_exp");
+        if (!test_gf2m_mod_exp(out,ctx)) goto err;
+        (void)BIO_flush(out);
+
+        message(out,"BN_GF2m_mod_sqrt");
+        if (!test_gf2m_mod_sqrt(out,ctx)) goto err;
+        (void)BIO_flush(out);
+
+        message(out,"BN_GF2m_mod_solve_quad");
+        if (!test_gf2m_mod_solve_quad(out,ctx)) goto err;
+        (void)BIO_flush(out);
 
         BN_CTX_free(ctx);
         BIO_free(out);
@@ -237,8 +306,8 @@ int main(int argc, char *argv[])
         EXIT(0);
 err:
         BIO_puts(out,"1\n"); /* make sure the Perl script fed by bc notices
-                              * the failure, see test_bn in test/Makefile */
-        BIO_flush(out);
+                              * the failure, see test_bn in test/Makefile.ssl*/
+        (void)BIO_flush(out);
         ERR_load_crypto_strings();
         ERR_print_errors_fp(stderr);
         EXIT(1);
@@ -404,6 +473,78 @@ int test_div(BIO *bp, BN_CTX *ctx)
         return(1);
         }
 
+static void print_word(BIO *bp,BN_ULONG w)
+        {
+#ifdef SIXTY_FOUR_BIT
+        if (sizeof(w) > sizeof(unsigned long))
+                {
+                unsigned long   h=(unsigned long)(w>>32),
+                                l=(unsigned long)(w);
+
+                if (h)  BIO_printf(bp,"%lX%08lX",h,l);
+                else    BIO_printf(bp,"%lX",l);
+                return;
+                }
+#endif
+        BIO_printf(bp,"%lX",w);
+        }
+
+int test_div_word(BIO *bp)
+        {
+        BIGNUM   a,b;
+        BN_ULONG r,s;
+        int i;
+
+        BN_init(&a);
+        BN_init(&b);
+
+        for (i=0; i<num0; i++)
+                {
+                do {
+                        BN_bntest_rand(&a,512,-1,0);
+                        BN_bntest_rand(&b,BN_BITS2,-1,0);
+                        s = b.d[0];
+                } while (!s);
+
+                BN_copy(&b, &a);
+                r = BN_div_word(&b, s);
+
+                if (bp != NULL)
+                        {
+                        if (!results)
+                                {
+                                BN_print(bp,&a);
+                                BIO_puts(bp," / ");
+                                print_word(bp,s);
+                                BIO_puts(bp," - ");
+                                }
+                        BN_print(bp,&b);
+                        BIO_puts(bp,"\n");
+
+                        if (!results)
+                                {
+                                BN_print(bp,&a);
+                                BIO_puts(bp," % ");
+                                print_word(bp,s);
+                                BIO_puts(bp," - ");
+                                }
+                        print_word(bp,r);
+                        BIO_puts(bp,"\n");
+                        }
+                BN_mul_word(&b,s);
+                BN_add_word(&b,r);
+                BN_sub(&b,&a,&b);
+                if(!BN_is_zero(&b))
+                    {
+                    fprintf(stderr,"Division (word) test failed!\n");
+                    return 0;
+                    }
+                }
+        BN_free(&a);
+        BN_free(&b);
+        return(1);
+        }
+
 int test_div_recp(BIO *bp, BN_CTX *ctx)
         {
         BIGNUM a,b,c,d,e;
@@ -919,7 +1060,582 @@ int test_exp(BIO *bp, BN_CTX *ctx)
         return(1);
         }
 
-static void genprime_cb(int p, int n, void *arg)
+int test_gf2m_add(BIO *bp)
+        {
+        BIGNUM a,b,c;
+        int i, ret = 0;
+
+        BN_init(&a);
+        BN_init(&b);
+        BN_init(&c);
+
+        for (i=0; i<num0; i++)
+                {
+                BN_rand(&a,512,0,0);
+                BN_copy(&b, BN_value_one());
+                a.neg=rand_neg();
+                b.neg=rand_neg();
+                BN_GF2m_add(&c,&a,&b);
+#if 0 /* make test uses ouput in bc but bc can't handle GF(2^m) arithmetic */
+                if (bp != NULL)
+                        {
+                        if (!results)
+                                {
+                                BN_print(bp,&a);
+                                BIO_puts(bp," ^ ");
+                                BN_print(bp,&b);
+                                BIO_puts(bp," = ");
+                                }
+                        BN_print(bp,&c);
+                        BIO_puts(bp,"\n");
+                        }
+#endif
+                /* Test that two added values have the correct parity. */
+                if((BN_is_odd(&a) && BN_is_odd(&c)) || (!BN_is_odd(&a) && !BN_is_odd(&c)))
+                        {
+                    fprintf(stderr,"GF(2^m) addition test (a) failed!\n");
+                        goto err;
+                        }
+                BN_GF2m_add(&c,&c,&c);
+                /* Test that c + c = 0. */
+                if(!BN_is_zero(&c))
+                    {
+                    fprintf(stderr,"GF(2^m) addition test (b) failed!\n");
+                        goto err;
+                    }
+                }
+        ret = 1;
+  err:
+        BN_free(&a);
+        BN_free(&b);
+        BN_free(&c);
+        return ret;
+        }
+
+int test_gf2m_mod(BIO *bp)
+        {
+        BIGNUM *a,*b[2],*c,*d,*e;
+        int i, j, ret = 0;
+        unsigned int p0[] = {163,7,6,3,0};
+        unsigned int p1[] = {193,15,0};
+
+        a=BN_new();
+        b[0]=BN_new();
+        b[1]=BN_new();
+        c=BN_new();
+        d=BN_new();
+        e=BN_new();
+
+        BN_GF2m_arr2poly(p0, b[0]);
+        BN_GF2m_arr2poly(p1, b[1]);
+
+        for (i=0; i<num0; i++)
+                {
+                BN_bntest_rand(a, 1024, 0, 0);
+                for (j=0; j < 2; j++)
+                        {
+                        BN_GF2m_mod(c, a, b[j]);
+#if 0 /* make test uses ouput in bc but bc can't handle GF(2^m) arithmetic */
+                        if (bp != NULL)
+                                {
+                                if (!results)
+                                        {
+                                        BN_print(bp,a);
+                                        BIO_puts(bp," % ");
+                                        BN_print(bp,b[j]);
+                                        BIO_puts(bp," - ");
+                                        BN_print(bp,c);
+                                        BIO_puts(bp,"\n");
+                                        }
+                                }
+#endif
+                        BN_GF2m_add(d, a, c);
+                        BN_GF2m_mod(e, d, b[j]);
+                        /* Test that a + (a mod p) mod p == 0. */
+                        if(!BN_is_zero(e))
+                                {
+                                fprintf(stderr,"GF(2^m) modulo test failed!\n");
+                                goto err;
+                                }
+                        }
+                }
+        ret = 1;
+  err:
+        BN_free(a);
+        BN_free(b[0]);
+        BN_free(b[1]);
+        BN_free(c);
+        BN_free(d);
+        BN_free(e);
+        return ret;
+        }
+
+int test_gf2m_mod_mul(BIO *bp,BN_CTX *ctx)
+        {
+        BIGNUM *a,*b[2],*c,*d,*e,*f,*g,*h;
+        int i, j, ret = 0;
+        unsigned int p0[] = {163,7,6,3,0};
+        unsigned int p1[] = {193,15,0};
+
+        a=BN_new();
+        b[0]=BN_new();
+        b[1]=BN_new();
+        c=BN_new();
+        d=BN_new();
+        e=BN_new();
+        f=BN_new();
+        g=BN_new();
+        h=BN_new();
+
+        BN_GF2m_arr2poly(p0, b[0]);
+        BN_GF2m_arr2poly(p1, b[1]);
+
+        for (i=0; i<num0; i++)
+                {
+                BN_bntest_rand(a, 1024, 0, 0);
+                BN_bntest_rand(c, 1024, 0, 0);
+                BN_bntest_rand(d, 1024, 0, 0);
+                for (j=0; j < 2; j++)
+                        {
+                        BN_GF2m_mod_mul(e, a, c, b[j], ctx);
+#if 0 /* make test uses ouput in bc but bc can't handle GF(2^m) arithmetic */
+                        if (bp != NULL)
+                                {
+                                if (!results)
+                                        {
+                                        BN_print(bp,a);
+                                        BIO_puts(bp," * ");
+                                        BN_print(bp,c);
+                                        BIO_puts(bp," % ");
+                                        BN_print(bp,b[j]);
+                                        BIO_puts(bp," - ");
+                                        BN_print(bp,e);
+                                        BIO_puts(bp,"\n");
+                                        }
+                                }
+#endif
+                        BN_GF2m_add(f, a, d);
+                        BN_GF2m_mod_mul(g, f, c, b[j], ctx);
+                        BN_GF2m_mod_mul(h, d, c, b[j], ctx);
+                        BN_GF2m_add(f, e, g);
+                        BN_GF2m_add(f, f, h);
+                        /* Test that (a+d)*c = a*c + d*c. */
+                        if(!BN_is_zero(f))
+                                {
+                                fprintf(stderr,"GF(2^m) modular multiplication test failed!\n");
+                                goto err;
+                                }
+                        }
+                }
+        ret = 1;
+  err:
+        BN_free(a);
+        BN_free(b[0]);
+        BN_free(b[1]);
+        BN_free(c);
+        BN_free(d);
+        BN_free(e);
+        BN_free(f);
+        BN_free(g);
+        BN_free(h);
+        return ret;
+        }
+
+int test_gf2m_mod_sqr(BIO *bp,BN_CTX *ctx)
+        {
+        BIGNUM *a,*b[2],*c,*d;
+        int i, j, ret = 0;
+        unsigned int p0[] = {163,7,6,3,0};
+        unsigned int p1[] = {193,15,0};
+
+        a=BN_new();
+        b[0]=BN_new();
+        b[1]=BN_new();
+        c=BN_new();
+        d=BN_new();
+
+        BN_GF2m_arr2poly(p0, b[0]);
+        BN_GF2m_arr2poly(p1, b[1]);
+
+        for (i=0; i<num0; i++)
+                {
+                BN_bntest_rand(a, 1024, 0, 0);
+                for (j=0; j < 2; j++)
+                        {
+                        BN_GF2m_mod_sqr(c, a, b[j], ctx);
+                        BN_copy(d, a);
+                        BN_GF2m_mod_mul(d, a, d, b[j], ctx);
+#if 0 /* make test uses ouput in bc but bc can't handle GF(2^m) arithmetic */
+                        if (bp != NULL)
+                                {
+                                if (!results)
+                                        {
+                                        BN_print(bp,a);
+                                        BIO_puts(bp," ^ 2 % ");
+                                        BN_print(bp,b[j]);
+                                        BIO_puts(bp, " = ");
+                                        BN_print(bp,c);
+                                        BIO_puts(bp,"; a * a = ");
+                                        BN_print(bp,d);
+                                        BIO_puts(bp,"\n");
+                                        }
+                                }
+#endif
+                        BN_GF2m_add(d, c, d);
+                        /* Test that a*a = a^2. */
+                        if(!BN_is_zero(d))
+                                {
+                                fprintf(stderr,"GF(2^m) modular squaring test failed!\n");
+                                goto err;
+                                }
+                        }
+                }
+        ret = 1;
+  err:
+        BN_free(a);
+        BN_free(b[0]);
+        BN_free(b[1]);
+        BN_free(c);
+        BN_free(d);
+        return ret;
+        }
+
+int test_gf2m_mod_inv(BIO *bp,BN_CTX *ctx)
+        {
+        BIGNUM *a,*b[2],*c,*d;
+        int i, j, ret = 0;
+        unsigned int p0[] = {163,7,6,3,0};
+        unsigned int p1[] = {193,15,0};
+
+        a=BN_new();
+        b[0]=BN_new();
+        b[1]=BN_new();
+        c=BN_new();
+        d=BN_new();
+
+        BN_GF2m_arr2poly(p0, b[0]);
+        BN_GF2m_arr2poly(p1, b[1]);
+
+        for (i=0; i<num0; i++)
+                {
+                BN_bntest_rand(a, 512, 0, 0); 
+                for (j=0; j < 2; j++)
+                        {
+                        BN_GF2m_mod_inv(c, a, b[j], ctx);
+                        BN_GF2m_mod_mul(d, a, c, b[j], ctx);
+#if 0 /* make test uses ouput in bc but bc can't handle GF(2^m) arithmetic */
+                        if (bp != NULL)
+                                {
+                                if (!results)
+                                        {
+                                        BN_print(bp,a);
+                                        BIO_puts(bp, " * ");
+                                        BN_print(bp,c);
+                                        BIO_puts(bp," - 1 % ");
+                                        BN_print(bp,b[j]);
+                                        BIO_puts(bp,"\n");
+                                        }
+                                }
+#endif
+                        /* Test that ((1/a)*a) = 1. */
+                        if(!BN_is_one(d))
+                                {
+                                fprintf(stderr,"GF(2^m) modular inversion test failed!\n");
+                                goto err;
+                                }
+                        }
+                }
+        ret = 1;
+  err:
+        BN_free(a);
+        BN_free(b[0]);
+        BN_free(b[1]);
+        BN_free(c);
+        BN_free(d);
+        return ret;
+        }
+
+int test_gf2m_mod_div(BIO *bp,BN_CTX *ctx)
+        {
+        BIGNUM *a,*b[2],*c,*d,*e,*f;
+        int i, j, ret = 0;
+        unsigned int p0[] = {163,7,6,3,0};
+        unsigned int p1[] = {193,15,0};
+
+        a=BN_new();
+        b[0]=BN_new();
+        b[1]=BN_new();
+        c=BN_new();
+        d=BN_new();
+        e=BN_new();
+        f=BN_new();
+
+        BN_GF2m_arr2poly(p0, b[0]);
+        BN_GF2m_arr2poly(p1, b[1]);
+
+        for (i=0; i<num0; i++)
+                {
+                BN_bntest_rand(a, 512, 0, 0); 
+                BN_bntest_rand(c, 512, 0, 0);
+                for (j=0; j < 2; j++)
+                        {
+                        BN_GF2m_mod_div(d, a, c, b[j], ctx);
+                        BN_GF2m_mod_mul(e, d, c, b[j], ctx);
+                        BN_GF2m_mod_div(f, a, e, b[j], ctx);
+#if 0 /* make test uses ouput in bc but bc can't handle GF(2^m) arithmetic */
+                        if (bp != NULL)
+                                {
+                                if (!results)
+                                        {
+                                        BN_print(bp,a);
+                                        BIO_puts(bp, " = ");
+                                        BN_print(bp,c);
+                                        BIO_puts(bp," * ");
+                                        BN_print(bp,d);
+                                        BIO_puts(bp, " % ");
+                                        BN_print(bp,b[j]);
+                                        BIO_puts(bp,"\n");
+                                        }
+                                }
+#endif
+                        /* Test that ((a/c)*c)/a = 1. */
+                        if(!BN_is_one(f))
+                                {
+                                fprintf(stderr,"GF(2^m) modular division test failed!\n");
+                                goto err;
+                                }
+                        }
+                }
+        ret = 1;
+  err:
+        BN_free(a);
+        BN_free(b[0]);
+        BN_free(b[1]);
+        BN_free(c);
+        BN_free(d);
+        BN_free(e);
+        BN_free(f);
+        return ret;
+        }
+
+int test_gf2m_mod_exp(BIO *bp,BN_CTX *ctx)
+        {
+        BIGNUM *a,*b[2],*c,*d,*e,*f;
+        int i, j, ret = 0;
+        unsigned int p0[] = {163,7,6,3,0};
+        unsigned int p1[] = {193,15,0};
+
+        a=BN_new();
+        b[0]=BN_new();
+        b[1]=BN_new();
+        c=BN_new();
+        d=BN_new();
+        e=BN_new();
+        f=BN_new();
+
+        BN_GF2m_arr2poly(p0, b[0]);
+        BN_GF2m_arr2poly(p1, b[1]);
+
+        for (i=0; i<num0; i++)
+                {
+                BN_bntest_rand(a, 512, 0, 0);
+                BN_bntest_rand(c, 512, 0, 0);
+                BN_bntest_rand(d, 512, 0, 0);
+                for (j=0; j < 2; j++)
+                        {
+                        BN_GF2m_mod_exp(e, a, c, b[j], ctx);
+                        BN_GF2m_mod_exp(f, a, d, b[j], ctx);
+                        BN_GF2m_mod_mul(e, e, f, b[j], ctx);
+                        BN_add(f, c, d);
+                        BN_GF2m_mod_exp(f, a, f, b[j], ctx);
+#if 0 /* make test uses ouput in bc but bc can't handle GF(2^m) arithmetic */
+                        if (bp != NULL)
+                                {
+                                if (!results)
+                                        {
+                                        BN_print(bp,a);
+                                        BIO_puts(bp, " ^ (");
+                                        BN_print(bp,c);
+                                        BIO_puts(bp," + ");
+                                        BN_print(bp,d);
+                                        BIO_puts(bp, ") = ");
+                                        BN_print(bp,e);
+                                        BIO_puts(bp, "; - ");
+                                        BN_print(bp,f);
+                                        BIO_puts(bp, " % ");
+                                        BN_print(bp,b[j]);
+                                        BIO_puts(bp,"\n");
+                                        }
+                                }
+#endif
+                        BN_GF2m_add(f, e, f);
+                        /* Test that a^(c+d)=a^c*a^d. */
+                        if(!BN_is_zero(f))
+                                {
+                                fprintf(stderr,"GF(2^m) modular exponentiation test failed!\n");
+                                goto err;
+                                }
+                        }
+                }
+        ret = 1;
+  err:
+        BN_free(a);
+        BN_free(b[0]);
+        BN_free(b[1]);
+        BN_free(c);
+        BN_free(d);
+        BN_free(e);
+        BN_free(f);
+        return ret;
+        }
+
+int test_gf2m_mod_sqrt(BIO *bp,BN_CTX *ctx)
+        {
+        BIGNUM *a,*b[2],*c,*d,*e,*f;
+        int i, j, ret = 0;
+        unsigned int p0[] = {163,7,6,3,0};
+        unsigned int p1[] = {193,15,0};
+
+        a=BN_new();
+        b[0]=BN_new();
+        b[1]=BN_new();
+        c=BN_new();
+        d=BN_new();
+        e=BN_new();
+        f=BN_new();
+
+        BN_GF2m_arr2poly(p0, b[0]);
+        BN_GF2m_arr2poly(p1, b[1]);
+
+        for (i=0; i<num0; i++)
+                {
+                BN_bntest_rand(a, 512, 0, 0);
+                for (j=0; j < 2; j++)
+                        {
+                        BN_GF2m_mod(c, a, b[j]);
+                        BN_GF2m_mod_sqrt(d, a, b[j], ctx);
+                        BN_GF2m_mod_sqr(e, d, b[j], ctx);
+#if 0 /* make test uses ouput in bc but bc can't handle GF(2^m) arithmetic */
+                        if (bp != NULL)
+                                {
+                                if (!results)
+                                        {
+                                        BN_print(bp,d);
+                                        BIO_puts(bp, " ^ 2 - ");
+                                        BN_print(bp,a);
+                                        BIO_puts(bp,"\n");
+                                        }
+                                }
+#endif
+                        BN_GF2m_add(f, c, e);
+                        /* Test that d^2 = a, where d = sqrt(a). */
+                        if(!BN_is_zero(f))
+                                {
+                                fprintf(stderr,"GF(2^m) modular square root test failed!\n");
+                                goto err;
+                                }
+                        }
+                }
+        ret = 1;
+  err:
+        BN_free(a);
+        BN_free(b[0]);
+        BN_free(b[1]);
+        BN_free(c);
+        BN_free(d);
+        BN_free(e);
+        BN_free(f);
+        return ret;
+        }
+
+int test_gf2m_mod_solve_quad(BIO *bp,BN_CTX *ctx)
+        {
+        BIGNUM *a,*b[2],*c,*d,*e;
+        int i, j, s = 0, t, ret = 0;
+        unsigned int p0[] = {163,7,6,3,0};
+        unsigned int p1[] = {193,15,0};
+
+        a=BN_new();
+        b[0]=BN_new();
+        b[1]=BN_new();
+        c=BN_new();
+        d=BN_new();
+        e=BN_new();
+
+        BN_GF2m_arr2poly(p0, b[0]);
+        BN_GF2m_arr2poly(p1, b[1]);
+
+        for (i=0; i<num0; i++)
+                {
+                BN_bntest_rand(a, 512, 0, 0);
+                for (j=0; j < 2; j++)
+                        {
+                        t = BN_GF2m_mod_solve_quad(c, a, b[j], ctx);
+                        if (t)
+                                {
+                                s++;
+                                BN_GF2m_mod_sqr(d, c, b[j], ctx);
+                                BN_GF2m_add(d, c, d);
+                                BN_GF2m_mod(e, a, b[j]);
+#if 0 /* make test uses ouput in bc but bc can't handle GF(2^m) arithmetic */
+                                if (bp != NULL)
+                                        {
+                                        if (!results)
+                                                {
+                                                BN_print(bp,c);
+                                                BIO_puts(bp, " is root of z^2 + z = ");
+                                                BN_print(bp,a);
+                                                BIO_puts(bp, " % ");
+                                                BN_print(bp,b[j]);
+                                                BIO_puts(bp, "\n");
+                                                }
+                                        }
+#endif
+                                BN_GF2m_add(e, e, d);
+                                /* Test that solution of quadratic c satisfies c^2 + c = a. */
+                                if(!BN_is_zero(e))
+                                        {
+                                        fprintf(stderr,"GF(2^m) modular solve quadratic test failed!\n");
+                                        goto err;
+                                        }
+
+                                }
+                        else 
+                                {
+#if 0 /* make test uses ouput in bc but bc can't handle GF(2^m) arithmetic */
+                                if (bp != NULL)
+                                        {
+                                        if (!results)
+                                                {
+                                                BIO_puts(bp, "There are no roots of z^2 + z = ");
+                                                BN_print(bp,a);
+                                                BIO_puts(bp, " % ");
+                                                BN_print(bp,b[j]);
+                                                BIO_puts(bp, "\n");
+                                                }
+                                        }
+#endif
+                                }
+                        }
+                }
+        if (s == 0)
+                {       
+                fprintf(stderr,"All %i tests of GF(2^m) modular solve quadratic resulted in no roots;\n", num0);
+                fprintf(stderr,"this is very unlikely and probably indicates an error.\n");
+                goto err;
+                }
+        ret = 1;
+  err:
+        BN_free(a);
+        BN_free(b[0]);
+        BN_free(b[1]);
+        BN_free(c);
+        BN_free(d);
+        BN_free(e);
+        return ret;
+        }
+
+static int genprime_cb(int p, int n, BN_GENCB *arg)
         {
         char c='*';
 
@@ -929,12 +1645,12 @@ static void genprime_cb(int p, int n, void *arg)
         if (p == 3) c='\n';
         putc(c, stderr);
         fflush(stderr);
-        (void)n;
-        (void)arg;
+        return 1;
         }
 
 int test_kron(BIO *bp, BN_CTX *ctx)
         {
+        BN_GENCB cb;
         BIGNUM *a,*b,*r,*t;
         int i;
         int legendre, kronecker;
@@ -945,6 +1661,8 @@ int test_kron(BIO *bp, BN_CTX *ctx)
         r = BN_new();
         t = BN_new();
         if (a == NULL || b == NULL || r == NULL || t == NULL) goto err;
+
+        BN_GENCB_set(&cb, genprime_cb, NULL);
         
         /* We test BN_kronecker(a, b, ctx) just for  b  odd (Jacobi symbol).
          * In this case we know that if  b  is prime, then BN_kronecker(a, b, ctx)
@@ -955,7 +1673,7 @@ int test_kron(BIO *bp, BN_CTX *ctx)
          * don't want to test whether  b  is prime but whether BN_kronecker
          * works.) */
 
-        if (!BN_generate_prime(b, 512, 0, NULL, NULL, genprime_cb, NULL)) goto err;
+        if (!BN_generate_prime_ex(b, 512, 0, NULL, NULL, &cb)) goto err;
         b->neg = rand_neg();
         putc('\n', stderr);
 
@@ -1023,6 +1741,7 @@ int test_kron(BIO *bp, BN_CTX *ctx)
 
 int test_sqrt(BIO *bp, BN_CTX *ctx)
         {
+        BN_GENCB cb;
         BIGNUM *a,*p,*r;
         int i, j;
         int ret = 0;
@@ -1031,7 +1750,9 @@ int test_sqrt(BIO *bp, BN_CTX *ctx)
         p = BN_new();
         r = BN_new();
         if (a == NULL || p == NULL || r == NULL) goto err;
-        
+
+        BN_GENCB_set(&cb, genprime_cb, NULL);
+
         for (i = 0; i < 16; i++)
                 {
                 if (i < 8)
@@ -1045,7 +1766,7 @@ int test_sqrt(BIO *bp, BN_CTX *ctx)
                         if (!BN_set_word(a, 32)) goto err;
                         if (!BN_set_word(r, 2*i + 1)) goto err;
                 
-                        if (!BN_generate_prime(p, 256, 0, a, r, genprime_cb, NULL)) goto err;
+                        if (!BN_generate_prime_ex(p, 256, 0, a, r, &cb)) goto err;
                         putc('\n', stderr);
                         }
                 p->neg = rand_neg();
diff --git a/src/lib/libssl/src/crypto/bn/exptest.c b/src/lib/libssl/src/crypto/bn/exptest.c
index 28aaac2ac1..f598a07cf5 100644
--- a/src/lib/libssl/src/crypto/bn/exptest.c
+++ b/src/lib/libssl/src/crypto/bn/exptest.c
@@ -195,6 +195,9 @@ int main(int argc, char *argv[])
 err:
         ERR_load_crypto_strings();
         ERR_print_errors(out);
+#ifdef OPENSSL_SYS_NETWARE
+    printf("ERROR\n");
+#endif
         EXIT(1);
         return(1);
         }
diff --git a/src/lib/libssl/src/crypto/buffer/buf_err.c b/src/lib/libssl/src/crypto/buffer/buf_err.c
index 1fc32a6861..3e25bbe879 100644
--- a/src/lib/libssl/src/crypto/buffer/buf_err.c
+++ b/src/lib/libssl/src/crypto/buffer/buf_err.c
@@ -70,9 +70,12 @@
 
 static ERR_STRING_DATA BUF_str_functs[]=
         {
+{ERR_FUNC(BUF_F_BUF_MEMDUP),    "BUF_memdup"},
 {ERR_FUNC(BUF_F_BUF_MEM_GROW),  "BUF_MEM_grow"},
+{ERR_FUNC(BUF_F_BUF_MEM_GROW_CLEAN),    "BUF_MEM_grow_clean"},
 {ERR_FUNC(BUF_F_BUF_MEM_NEW),   "BUF_MEM_new"},
 {ERR_FUNC(BUF_F_BUF_STRDUP),    "BUF_strdup"},
+{ERR_FUNC(BUF_F_BUF_STRNDUP),   "BUF_strndup"},
 {0,NULL}
         };
 
@@ -85,15 +88,12 @@ static ERR_STRING_DATA BUF_str_reasons[]=
 
 void ERR_load_BUF_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(BUF_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,BUF_str_functs);
                 ERR_load_strings(0,BUF_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/buffer/buffer.c b/src/lib/libssl/src/crypto/buffer/buffer.c
index d96487e7db..3bf03c7eff 100644
--- a/src/lib/libssl/src/crypto/buffer/buffer.c
+++ b/src/lib/libssl/src/crypto/buffer/buffer.c
@@ -149,7 +149,7 @@ int BUF_MEM_grow_clean(BUF_MEM *str, int len)
                 ret=OPENSSL_realloc_clean(str->data,str->max,n);
         if (ret == NULL)
                 {
-                BUFerr(BUF_F_BUF_MEM_GROW,ERR_R_MALLOC_FAILURE);
+                BUFerr(BUF_F_BUF_MEM_GROW_CLEAN,ERR_R_MALLOC_FAILURE);
                 len=0;
                 }
         else
@@ -164,22 +164,41 @@ int BUF_MEM_grow_clean(BUF_MEM *str, int len)
 
 char *BUF_strdup(const char *str)
         {
+        if (str == NULL) return(NULL);
+        return BUF_strndup(str, strlen(str));
+        }
+
+char *BUF_strndup(const char *str, size_t siz)
+        {
         char *ret;
-        int n;
 
         if (str == NULL) return(NULL);
 
-        n=strlen(str);
-        ret=OPENSSL_malloc(n+1);
+        ret=OPENSSL_malloc(siz+1);
         if (ret == NULL) 
                 {
-                BUFerr(BUF_F_BUF_STRDUP,ERR_R_MALLOC_FAILURE);
+                BUFerr(BUF_F_BUF_STRNDUP,ERR_R_MALLOC_FAILURE);
                 return(NULL);
                 }
-        memcpy(ret,str,n+1);
+        BUF_strlcpy(ret,str,siz+1);
         return(ret);
         }
 
+void *BUF_memdup(const void *data, size_t siz)
+        {
+        void *ret;
+
+        if (data == NULL) return(NULL);
+
+        ret=OPENSSL_malloc(siz);
+        if (ret == NULL) 
+                {
+                BUFerr(BUF_F_BUF_MEMDUP,ERR_R_MALLOC_FAILURE);
+                return(NULL);
+                }
+        return memcpy(ret, data, siz);
+        }       
+
 size_t BUF_strlcpy(char *dst, const char *src, size_t size)
         {
         size_t l = 0;
diff --git a/src/lib/libssl/src/crypto/buffer/buffer.h b/src/lib/libssl/src/crypto/buffer/buffer.h
index 465dc34f3f..1db9607450 100644
--- a/src/lib/libssl/src/crypto/buffer/buffer.h
+++ b/src/lib/libssl/src/crypto/buffer/buffer.h
@@ -59,25 +59,35 @@
 #ifndef HEADER_BUFFER_H
 #define HEADER_BUFFER_H
 
+#include <openssl/ossl_typ.h>
+
 #ifdef  __cplusplus
 extern "C" {
 #endif
 
 #include <stddef.h>
+
+#if !defined(NO_SYS_TYPES_H)
 #include <sys/types.h>
+#endif
+
+/* Already declared in ossl_typ.h */
+/* typedef struct buf_mem_st BUF_MEM; */
 
-typedef struct buf_mem_st
+struct buf_mem_st
         {
         int length;     /* current number of bytes */
         char *data;
         int max;        /* size of buffer */
-        } BUF_MEM;
+        };
 
 BUF_MEM *BUF_MEM_new(void);
 void    BUF_MEM_free(BUF_MEM *a);
 int     BUF_MEM_grow(BUF_MEM *str, int len);
 int     BUF_MEM_grow_clean(BUF_MEM *str, int len);
 char *  BUF_strdup(const char *str);
+char *  BUF_strndup(const char *str, size_t siz);
+void *  BUF_memdup(const void *data, size_t siz);
 
 /* safe string functions */
 size_t BUF_strlcpy(char *dst,const char *src,size_t siz);
@@ -93,9 +103,12 @@ void ERR_load_BUF_strings(void);
 /* Error codes for the BUF functions. */
 
 /* Function codes. */
+#define BUF_F_BUF_MEMDUP                                 103
 #define BUF_F_BUF_MEM_GROW                               100
+#define BUF_F_BUF_MEM_GROW_CLEAN                         105
 #define BUF_F_BUF_MEM_NEW                                101
 #define BUF_F_BUF_STRDUP                                 102
+#define BUF_F_BUF_STRNDUP                                104
 
 /* Reason codes. */
 
diff --git a/src/lib/libssl/src/crypto/cast/c_ecb.c b/src/lib/libssl/src/crypto/cast/c_ecb.c
index 0b3da9ad87..f2dc606226 100644
--- a/src/lib/libssl/src/crypto/cast/c_ecb.c
+++ b/src/lib/libssl/src/crypto/cast/c_ecb.c
@@ -60,7 +60,7 @@
 #include "cast_lcl.h"
 #include <openssl/opensslv.h>
 
-const char *CAST_version="CAST" OPENSSL_VERSION_PTEXT;
+const char CAST_version[]="CAST" OPENSSL_VERSION_PTEXT;
 
 void CAST_ecb_encrypt(const unsigned char *in, unsigned char *out,
                       CAST_KEY *ks, int enc)
diff --git a/src/lib/libssl/src/crypto/cast/c_skey.c b/src/lib/libssl/src/crypto/cast/c_skey.c
index db9b7573e0..76e40005c9 100644
--- a/src/lib/libssl/src/crypto/cast/c_skey.c
+++ b/src/lib/libssl/src/crypto/cast/c_skey.c
@@ -56,10 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
-#include <openssl/crypto.h>
-#include <openssl/fips.h>
 #include <openssl/cast.h>
-
 #include "cast_lcl.h"
 #include "cast_s.h"
 
@@ -75,7 +72,7 @@
 #define S6 CAST_S_table6
 #define S7 CAST_S_table7
 
-FIPS_NON_FIPS_VCIPHER_Init(CAST)
+void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data)
         {
         CAST_LONG x[16];
         CAST_LONG z[16];
diff --git a/src/lib/libssl/src/crypto/cast/cast.h b/src/lib/libssl/src/crypto/cast/cast.h
index 9e300178d9..90b45b950a 100644
--- a/src/lib/libssl/src/crypto/cast/cast.h
+++ b/src/lib/libssl/src/crypto/cast/cast.h
@@ -63,6 +63,8 @@
 extern "C" {
 #endif
 
+#include <openssl/opensslconf.h>
+
 #ifdef OPENSSL_NO_CAST
 #error CAST is disabled.
 #endif
@@ -81,10 +83,7 @@ typedef struct cast_key_st
         int short_key;  /* Use reduced rounds for short key */
         } CAST_KEY;
 
-
-#ifdef OPENSSL_FIPS 
-void private_CAST_set_key(CAST_KEY *key, int len, const unsigned char *data);
-#endif
+ 
 void CAST_set_key(CAST_KEY *key, int len, const unsigned char *data);
 void CAST_ecb_encrypt(const unsigned char *in,unsigned char *out,CAST_KEY *key,
                       int enc);
diff --git a/src/lib/libssl/src/crypto/cast/cast_spd.c b/src/lib/libssl/src/crypto/cast/cast_spd.c
index 76abf50d98..d650af475c 100644
--- a/src/lib/libssl/src/crypto/cast/cast_spd.c
+++ b/src/lib/libssl/src/crypto/cast/cast_spd.c
@@ -69,7 +69,10 @@
 #include OPENSSL_UNISTD_IO
 OPENSSL_DECLARE_EXIT
 
+#ifndef OPENSSL_SYS_NETWARE
 #include <signal.h>
+#endif
+
 #ifndef _IRIX
 #include <time.h>
 #endif
diff --git a/src/lib/libssl/src/crypto/cast/castopts.c b/src/lib/libssl/src/crypto/cast/castopts.c
index 1b858d153b..33b2c7b06f 100644
--- a/src/lib/libssl/src/crypto/cast/castopts.c
+++ b/src/lib/libssl/src/crypto/cast/castopts.c
@@ -69,7 +69,10 @@
 #include OPENSSL_UNISTD_IO
 OPENSSL_DECLARE_EXIT
 
+#ifndef OPENSSL_SYS_NETWARE
 #include <signal.h>
+#endif
+
 #ifndef _IRIX
 #include <time.h>
 #endif
diff --git a/src/lib/libssl/src/crypto/cast/casttest.c b/src/lib/libssl/src/crypto/cast/casttest.c
index 83e5a16c73..0d020d6975 100644
--- a/src/lib/libssl/src/crypto/cast/casttest.c
+++ b/src/lib/libssl/src/crypto/cast/casttest.c
@@ -59,6 +59,7 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
+#include <openssl/opensslconf.h> /* To see if OPENSSL_NO_CAST is defined */
 
 #include "../e_os.h"
 
diff --git a/src/lib/libssl/src/crypto/comp/c_zlib.c b/src/lib/libssl/src/crypto/comp/c_zlib.c
index 5fcb521ffb..0f34597e70 100644
--- a/src/lib/libssl/src/crypto/comp/c_zlib.c
+++ b/src/lib/libssl/src/crypto/comp/c_zlib.c
@@ -24,6 +24,32 @@ static COMP_METHOD zlib_method_nozlib={
 
 #include <zlib.h>
 
+static int zlib_stateful_init(COMP_CTX *ctx);
+static void zlib_stateful_finish(COMP_CTX *ctx);
+static int zlib_stateful_compress_block(COMP_CTX *ctx, unsigned char *out,
+        unsigned int olen, unsigned char *in, unsigned int ilen);
+static int zlib_stateful_expand_block(COMP_CTX *ctx, unsigned char *out,
+        unsigned int olen, unsigned char *in, unsigned int ilen);
+
+
+/* memory allocations functions for zlib intialization */
+static void* zlib_zalloc(void* opaque, unsigned int no, unsigned int size)
+{
+        void *p;
+        
+        p=OPENSSL_malloc(no*size);
+        if (p)
+                memset(p, 0, no*size);
+        return p;
+}
+
+
+static void zlib_zfree(void* opaque, void* address)
+{
+        OPENSSL_free(address);
+}
+
+#if 0
 static int zlib_compress_block(COMP_CTX *ctx, unsigned char *out,
         unsigned int olen, unsigned char *in, unsigned int ilen);
 static int zlib_expand_block(COMP_CTX *ctx, unsigned char *out,
@@ -32,7 +58,7 @@ static int zlib_expand_block(COMP_CTX *ctx, unsigned char *out,
 static int zz_uncompress(Bytef *dest, uLongf *destLen, const Bytef *source,
         uLong sourceLen);
 
-static COMP_METHOD zlib_method={
+static COMP_METHOD zlib_stateless_method={
         NID_zlib_compression,
         LN_zlib_compression,
         NULL,
@@ -42,12 +68,24 @@ static COMP_METHOD zlib_method={
         NULL,
         NULL,
         };
+#endif
+
+static COMP_METHOD zlib_stateful_method={
+        NID_zlib_compression,
+        LN_zlib_compression,
+        zlib_stateful_init,
+        zlib_stateful_finish,
+        zlib_stateful_compress_block,
+        zlib_stateful_expand_block,
+        NULL,
+        NULL,
+        };
 
 /* 
  * When OpenSSL is built on Windows, we do not want to require that
  * the ZLIB.DLL be available in order for the OpenSSL DLLs to
  * work.  Therefore, all ZLIB routines are loaded at run time
- * and we do not link to a .LIB file.
+ * and we do not link to a .LIB file when ZLIB_SHARED is set.
  */
 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32)
 # include <windows.h>
@@ -63,10 +101,19 @@ typedef int (*inflateEnd_ft)(z_streamp strm);
 typedef int (*inflate_ft)(z_streamp strm, int flush);
 typedef int (*inflateInit__ft)(z_streamp strm,
         const char * version, int stream_size);
+typedef int (*deflateEnd_ft)(z_streamp strm);
+typedef int (*deflate_ft)(z_streamp strm, int flush);
+typedef int (*deflateInit__ft)(z_streamp strm, int level,
+        const char * version, int stream_size);
+typedef const char * (*zError__ft)(int err);
 static compress_ft      p_compress=NULL;
 static inflateEnd_ft    p_inflateEnd=NULL;
 static inflate_ft       p_inflate=NULL;
 static inflateInit__ft  p_inflateInit_=NULL;
+static deflateEnd_ft    p_deflateEnd=NULL;
+static deflate_ft       p_deflate=NULL;
+static deflateInit__ft  p_deflateInit_=NULL;
+static zError__ft       p_zError=NULL;
 
 static int zlib_loaded = 0;     /* only attempt to init func pts once */
 static DSO *zlib_dso = NULL;
@@ -75,10 +122,133 @@ static DSO *zlib_dso = NULL;
 #define inflateEnd              p_inflateEnd
 #define inflate                 p_inflate
 #define inflateInit_            p_inflateInit_
+#define deflateEnd              p_deflateEnd
+#define deflate                 p_deflate
+#define deflateInit_            p_deflateInit_
+#define zError                  p_zError
 #endif /* ZLIB_SHARED */
 
+struct zlib_state
+        {
+        z_stream istream;
+        z_stream ostream;
+        };
+
+static int zlib_stateful_ex_idx = -1;
+
+static void zlib_stateful_free_ex_data(void *obj, void *item,
+        CRYPTO_EX_DATA *ad, int ind,long argl, void *argp)
+        {
+        struct zlib_state *state = (struct zlib_state *)item;
+        inflateEnd(&state->istream);
+        deflateEnd(&state->ostream);
+        OPENSSL_free(state);
+        }
+
+static int zlib_stateful_init(COMP_CTX *ctx)
+        {
+        int err;
+        struct zlib_state *state =
+                (struct zlib_state *)OPENSSL_malloc(sizeof(struct zlib_state));
+
+        if (state == NULL)
+                goto err;
+
+        state->istream.zalloc = zlib_zalloc;
+        state->istream.zfree = zlib_zfree;
+        state->istream.opaque = Z_NULL;
+        state->istream.next_in = Z_NULL;
+        state->istream.next_out = Z_NULL;
+        state->istream.avail_in = 0;
+        state->istream.avail_out = 0;
+        err = inflateInit_(&state->istream,
+                ZLIB_VERSION, sizeof(z_stream));
+        if (err != Z_OK)
+                goto err;
+
+        state->ostream.zalloc = zlib_zalloc;
+        state->ostream.zfree = zlib_zfree;
+        state->ostream.opaque = Z_NULL;
+        state->ostream.next_in = Z_NULL;
+        state->ostream.next_out = Z_NULL;
+        state->ostream.avail_in = 0;
+        state->ostream.avail_out = 0;
+        err = deflateInit_(&state->ostream,Z_DEFAULT_COMPRESSION,
+                ZLIB_VERSION, sizeof(z_stream));
+        if (err != Z_OK)
+                goto err;
+
+        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_COMP,ctx,&ctx->ex_data);
+        CRYPTO_set_ex_data(&ctx->ex_data,zlib_stateful_ex_idx,state);
+        return 1;
+ err:
+        if (state) OPENSSL_free(state);
+        return 0;
+        }
+
+static void zlib_stateful_finish(COMP_CTX *ctx)
+        {
+        CRYPTO_free_ex_data(CRYPTO_EX_INDEX_COMP,ctx,&ctx->ex_data);
+        }
+
+static int zlib_stateful_compress_block(COMP_CTX *ctx, unsigned char *out,
+        unsigned int olen, unsigned char *in, unsigned int ilen)
+        {
+        int err = Z_OK;
+        struct zlib_state *state =
+                (struct zlib_state *)CRYPTO_get_ex_data(&ctx->ex_data,
+                        zlib_stateful_ex_idx);
+
+        if (state == NULL)
+                return -1;
+
+        state->ostream.next_in = in;
+        state->ostream.avail_in = ilen;
+        state->ostream.next_out = out;
+        state->ostream.avail_out = olen;
+        if (ilen > 0)
+                err = deflate(&state->ostream, Z_SYNC_FLUSH);
+        if (err != Z_OK)
+                return -1;
+#ifdef DEBUG_ZLIB
+        fprintf(stderr,"compress(%4d)->%4d %s\n",
+                ilen,olen - state->ostream.avail_out,
+                (ilen != olen - state->ostream.avail_out)?"zlib":"clear");
+#endif
+        return olen - state->ostream.avail_out;
+        }
+
+static int zlib_stateful_expand_block(COMP_CTX *ctx, unsigned char *out,
+        unsigned int olen, unsigned char *in, unsigned int ilen)
+        {
+        int err = Z_OK;
+
+        struct zlib_state *state =
+                (struct zlib_state *)CRYPTO_get_ex_data(&ctx->ex_data,
+                        zlib_stateful_ex_idx);
+
+        if (state == NULL)
+                return 0;
+
+        state->istream.next_in = in;
+        state->istream.avail_in = ilen;
+        state->istream.next_out = out;
+        state->istream.avail_out = olen;
+        if (ilen > 0)
+                err = inflate(&state->istream, Z_SYNC_FLUSH);
+        if (err != Z_OK)
+                return -1;
+#ifdef DEBUG_ZLIB
+        fprintf(stderr,"expand(%4d)->%4d %s\n",
+                ilen,olen - state->istream.avail_out,
+                (ilen != olen - state->istream.avail_out)?"zlib":"clear");
+#endif
+        return olen - state->istream.avail_out;
+        }
+
+#if 0
 static int zlib_compress_block(COMP_CTX *ctx, unsigned char *out,
-             unsigned int olen, unsigned char *in, unsigned int ilen)
+        unsigned int olen, unsigned char *in, unsigned int ilen)
         {
         unsigned long l;
         int i;
@@ -111,7 +281,7 @@ static int zlib_compress_block(COMP_CTX *ctx, unsigned char *out,
         }
 
 static int zlib_expand_block(COMP_CTX *ctx, unsigned char *out,
-             unsigned int olen, unsigned char *in, unsigned int ilen)
+        unsigned int olen, unsigned char *in, unsigned int ilen)
         {
         unsigned long l;
         int i;
@@ -153,7 +323,8 @@ static int zz_uncompress (Bytef *dest, uLongf *destLen, const Bytef *source,
     stream.zalloc = (alloc_func)0;
     stream.zfree = (free_func)0;
 
-    err = inflateInit(&stream);
+    err = inflateInit_(&stream,
+            ZLIB_VERSION, sizeof(z_stream));
     if (err != Z_OK) return err;
 
     err = inflate(&stream, Z_FINISH);
@@ -166,6 +337,7 @@ static int zz_uncompress (Bytef *dest, uLongf *destLen, const Bytef *source,
     err = inflateEnd(&stream);
     return err;
 }
+#endif
 
 #endif
 
@@ -195,9 +367,22 @@ COMP_METHOD *COMP_zlib(void)
                         p_inflateInit_
                                 = (inflateInit__ft) DSO_bind_func(zlib_dso,
                                         "inflateInit_");
+                        p_deflateEnd
+                                = (deflateEnd_ft) DSO_bind_func(zlib_dso,
+                                        "deflateEnd");
+                        p_deflate
+                                = (deflate_ft) DSO_bind_func(zlib_dso,
+                                        "deflate");
+                        p_deflateInit_
+                                = (deflateInit__ft) DSO_bind_func(zlib_dso,
+                                        "deflateInit_");
+                        p_zError
+                                = (zError__ft) DSO_bind_func(zlib_dso,
+                                        "zError");
 
                         if (p_compress && p_inflateEnd && p_inflate
-                                && p_inflateInit_)
+                                && p_inflateInit_ && p_deflateEnd
+                                && p_deflate && p_deflateInit_ && p_zError)
                                 zlib_loaded++;
                         }
                 }
@@ -207,9 +392,410 @@ COMP_METHOD *COMP_zlib(void)
         if (zlib_loaded)
 #endif
 #if defined(ZLIB) || defined(ZLIB_SHARED)
-                meth = &zlib_method;
+                {
+                /* init zlib_stateful_ex_idx here so that in a multi-process
+                 * application it's enough to intialize openssl before forking
+                 * (idx will be inherited in all the children) */
+                if (zlib_stateful_ex_idx == -1)
+                        {
+                        CRYPTO_w_lock(CRYPTO_LOCK_COMP);
+                        if (zlib_stateful_ex_idx == -1)
+                                zlib_stateful_ex_idx =
+                                        CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_COMP,
+                                                0,NULL,NULL,NULL,zlib_stateful_free_ex_data);
+                        CRYPTO_w_unlock(CRYPTO_LOCK_COMP);
+                        if (zlib_stateful_ex_idx == -1)
+                                goto err;
+                        }
+                
+                meth = &zlib_stateful_method;
+                }
+err:    
 #endif
 
         return(meth);
         }
 
+void COMP_zlib_cleanup(void)
+        {
+#ifdef ZLIB_SHARED
+        if (zlib_dso)
+                DSO_free(zlib_dso);
+#endif
+        }
+
+#ifdef ZLIB
+
+/* Zlib based compression/decompression filter BIO */
+
+typedef struct
+        {
+        unsigned char *ibuf;    /* Input buffer */
+        int ibufsize;           /* Buffer size */
+        z_stream zin;           /* Input decompress context */
+        unsigned char *obuf;    /* Output buffer */
+        int obufsize;           /* Output buffer size */
+        unsigned char *optr;    /* Position in output buffer */
+        int ocount;             /* Amount of data in output buffer */
+        int odone;              /* deflate EOF */
+        int comp_level;         /* Compression level to use */
+        z_stream zout;          /* Output compression context */
+        } BIO_ZLIB_CTX;
+
+#define ZLIB_DEFAULT_BUFSIZE 1024
+
+static int bio_zlib_new(BIO *bi);
+static int bio_zlib_free(BIO *bi);
+static int bio_zlib_read(BIO *b, char *out, int outl);
+static int bio_zlib_write(BIO *b, const char *in, int inl);
+static long bio_zlib_ctrl(BIO *b, int cmd, long num, void *ptr);
+static long bio_zlib_callback_ctrl(BIO *b, int cmd, bio_info_cb *fp);
+
+static BIO_METHOD bio_meth_zlib = 
+        {
+        BIO_TYPE_COMP,
+        "zlib",
+        bio_zlib_write,
+        bio_zlib_read,
+        NULL,
+        NULL,
+        bio_zlib_ctrl,
+        bio_zlib_new,
+        bio_zlib_free,
+        bio_zlib_callback_ctrl
+        };
+
+BIO_METHOD *BIO_f_zlib(void)
+        {
+        return &bio_meth_zlib;
+        }
+
+
+static int bio_zlib_new(BIO *bi)
+        {
+        BIO_ZLIB_CTX *ctx;
+#ifdef ZLIB_SHARED
+        (void)COMP_zlib();
+        if (!zlib_loaded)
+                {
+                COMPerr(COMP_F_BIO_ZLIB_NEW, COMP_R_ZLIB_NOT_SUPPORTED);
+                return 0;
+                }
+#endif
+        ctx = OPENSSL_malloc(sizeof(BIO_ZLIB_CTX));
+        if(!ctx)
+                {
+                COMPerr(COMP_F_BIO_ZLIB_NEW, ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        ctx->ibuf = NULL;
+        ctx->obuf = NULL;
+        ctx->ibufsize = ZLIB_DEFAULT_BUFSIZE;
+        ctx->obufsize = ZLIB_DEFAULT_BUFSIZE;
+        ctx->zin.zalloc = Z_NULL;
+        ctx->zin.zfree = Z_NULL;
+        ctx->zin.next_in = NULL;
+        ctx->zin.avail_in = 0;
+        ctx->zin.next_out = NULL;
+        ctx->zin.avail_out = 0;
+        ctx->zout.zalloc = Z_NULL;
+        ctx->zout.zfree = Z_NULL;
+        ctx->zout.next_in = NULL;
+        ctx->zout.avail_in = 0;
+        ctx->zout.next_out = NULL;
+        ctx->zout.avail_out = 0;
+        ctx->odone = 0;
+        ctx->comp_level = Z_DEFAULT_COMPRESSION;
+        bi->init = 1;
+        bi->ptr = (char *)ctx;
+        bi->flags = 0;
+        return 1;
+        }
+
+static int bio_zlib_free(BIO *bi)
+        {
+        BIO_ZLIB_CTX *ctx;
+        if(!bi) return 0;
+        ctx = (BIO_ZLIB_CTX *)bi->ptr;
+        if(ctx->ibuf)
+                {
+                /* Destroy decompress context */
+                inflateEnd(&ctx->zin);
+                OPENSSL_free(ctx->ibuf);
+                }
+        if(ctx->obuf)
+                {
+                /* Destroy compress context */
+                deflateEnd(&ctx->zout);
+                OPENSSL_free(ctx->obuf);
+                }
+        OPENSSL_free(ctx);
+        bi->ptr = NULL;
+        bi->init = 0;
+        bi->flags = 0;
+        return 1;
+        }
+
+static int bio_zlib_read(BIO *b, char *out, int outl)
+        {
+        BIO_ZLIB_CTX *ctx;
+        int ret;
+        z_stream *zin;
+        if(!out || !outl) return 0;
+        ctx = (BIO_ZLIB_CTX *)b->ptr;
+        zin = &ctx->zin;
+        BIO_clear_retry_flags(b);
+        if(!ctx->ibuf)
+                {
+                ctx->ibuf = OPENSSL_malloc(ctx->ibufsize);
+                if(!ctx->ibuf)
+                        {
+                        COMPerr(COMP_F_BIO_ZLIB_READ, ERR_R_MALLOC_FAILURE);
+                        return 0;
+                        }
+                inflateInit(zin);
+                zin->next_in = ctx->ibuf;
+                zin->avail_in = 0;
+                }
+
+        /* Copy output data directly to supplied buffer */
+        zin->next_out = (unsigned char *)out;
+        zin->avail_out = (unsigned int)outl;
+        for(;;)
+                {
+                /* Decompress while data available */
+                while(zin->avail_in)
+                        {
+                        ret = inflate(zin, 0);
+                        if((ret != Z_OK) && (ret != Z_STREAM_END))
+                                {
+                                COMPerr(COMP_F_BIO_ZLIB_READ,
+                                                COMP_R_ZLIB_INFLATE_ERROR);
+                                ERR_add_error_data(2, "zlib error:",
+                                                        zError(ret));
+                                return 0;
+                                }
+                        /* If EOF or we've read everything then return */
+                        if((ret == Z_STREAM_END) || !zin->avail_out)
+                                return outl - zin->avail_out;
+                        }
+
+                /* No data in input buffer try to read some in,
+                 * if an error then return the total data read.
+                 */
+                ret = BIO_read(b->next_bio, ctx->ibuf, ctx->ibufsize);
+                if(ret <= 0)
+                        {
+                        /* Total data read */
+                        int tot = outl - zin->avail_out;
+                        BIO_copy_next_retry(b);
+                        if(ret < 0) return (tot > 0) ? tot : ret;
+                        return tot;
+                        }
+                zin->avail_in = ret;
+                zin->next_in = ctx->ibuf;
+                }
+        }
+
+static int bio_zlib_write(BIO *b, const char *in, int inl)
+        {
+        BIO_ZLIB_CTX *ctx;
+        int ret;
+        z_stream *zout;
+        if(!in || !inl) return 0;
+        ctx = (BIO_ZLIB_CTX *)b->ptr;
+        if(ctx->odone) return 0;
+        zout = &ctx->zout;
+        BIO_clear_retry_flags(b);
+        if(!ctx->obuf)
+                {
+                ctx->obuf = OPENSSL_malloc(ctx->obufsize);
+                /* Need error here */
+                if(!ctx->obuf)
+                        {
+                        COMPerr(COMP_F_BIO_ZLIB_WRITE, ERR_R_MALLOC_FAILURE);
+                        return 0;
+                        }
+                ctx->optr = ctx->obuf;
+                ctx->ocount = 0;
+                deflateInit(zout, ctx->comp_level);
+                zout->next_out = ctx->obuf;
+                zout->avail_out = ctx->obufsize;
+                }
+        /* Obtain input data directly from supplied buffer */
+        zout->next_in = (void *)in;
+        zout->avail_in = inl;
+        for(;;)
+                {
+                /* If data in output buffer write it first */
+                while(ctx->ocount) {
+                        ret = BIO_write(b->next_bio, ctx->optr, ctx->ocount);
+                        if(ret <= 0)
+                                {
+                                /* Total data written */
+                                int tot = inl - zout->avail_in;
+                                BIO_copy_next_retry(b);
+                                if(ret < 0) return (tot > 0) ? tot : ret;
+                                return tot;
+                                }
+                        ctx->optr += ret;
+                        ctx->ocount -= ret;
+                }
+
+                /* Have we consumed all supplied data? */
+                if(!zout->avail_in)
+                        return inl;
+
+                /* Compress some more */
+
+                /* Reset buffer */
+                ctx->optr = ctx->obuf;
+                zout->next_out = ctx->obuf;
+                zout->avail_out = ctx->obufsize;
+                /* Compress some more */
+                ret = deflate(zout, 0);
+                if(ret != Z_OK)
+                        {
+                        COMPerr(COMP_F_BIO_ZLIB_WRITE,
+                                                COMP_R_ZLIB_DEFLATE_ERROR);
+                        ERR_add_error_data(2, "zlib error:", zError(ret));
+                        return 0;
+                        }
+                ctx->ocount = ctx->obufsize - zout->avail_out;
+                }
+        }
+
+static int bio_zlib_flush(BIO *b)
+        {
+        BIO_ZLIB_CTX *ctx;
+        int ret;
+        z_stream *zout;
+        ctx = (BIO_ZLIB_CTX *)b->ptr;
+        /* If no data written or already flush show success */
+        if(!ctx->obuf || (ctx->odone && !ctx->ocount)) return 1;
+        zout = &ctx->zout;
+        BIO_clear_retry_flags(b);
+        /* No more input data */
+        zout->next_in = NULL;
+        zout->avail_in = 0;
+        for(;;)
+                {
+                /* If data in output buffer write it first */
+                while(ctx->ocount)
+                        {
+                        ret = BIO_write(b->next_bio, ctx->optr, ctx->ocount);
+                        if(ret <= 0)
+                                {
+                                BIO_copy_next_retry(b);
+                                return ret;
+                                }
+                        ctx->optr += ret;
+                        ctx->ocount -= ret;
+                        }
+                if(ctx->odone) return 1;
+
+                /* Compress some more */
+
+                /* Reset buffer */
+                ctx->optr = ctx->obuf;
+                zout->next_out = ctx->obuf;
+                zout->avail_out = ctx->obufsize;
+                /* Compress some more */
+                ret = deflate(zout, Z_FINISH);
+                if(ret == Z_STREAM_END) ctx->odone = 1;
+                else if(ret != Z_OK)
+                        {
+                        COMPerr(COMP_F_BIO_ZLIB_FLUSH,
+                                                COMP_R_ZLIB_DEFLATE_ERROR);
+                        ERR_add_error_data(2, "zlib error:", zError(ret));
+                        return 0;
+                        }
+                ctx->ocount = ctx->obufsize - zout->avail_out;
+                }
+        }
+
+static long bio_zlib_ctrl(BIO *b, int cmd, long num, void *ptr)
+        {
+        BIO_ZLIB_CTX *ctx;
+        int ret, *ip;
+        int ibs, obs;
+        if(!b->next_bio) return 0;
+        ctx = (BIO_ZLIB_CTX *)b->ptr;
+        switch (cmd)
+                {
+
+        case BIO_CTRL_RESET:
+                ctx->ocount = 0;
+                ctx->odone = 0;
+                break;
+
+        case BIO_CTRL_FLUSH:
+                ret = bio_zlib_flush(b);
+                if (ret > 0)
+                        ret = BIO_flush(b->next_bio);
+                break;
+
+        case BIO_C_SET_BUFF_SIZE:
+                ibs = -1;
+                obs = -1;
+                if (ptr != NULL)
+                        {
+                        ip = ptr;
+                        if (*ip == 0)
+                                ibs = (int) num;
+                        else 
+                                obs = (int) num;
+                        }
+                else
+                        {
+                        ibs = (int)num;
+                        obs = ibs;
+                        }
+
+                if (ibs != -1)
+                        {
+                        if (ctx->ibuf)
+                                {
+                                OPENSSL_free(ctx->ibuf);
+                                ctx->ibuf = NULL;
+                                }
+                        ctx->ibufsize = ibs;
+                        }
+
+                if (obs != -1)
+                        {
+                        if (ctx->obuf)
+                                {
+                                OPENSSL_free(ctx->obuf);
+                                ctx->obuf = NULL;
+                                }
+                        ctx->obufsize = obs;
+                        }
+
+                break;
+
+        case BIO_C_DO_STATE_MACHINE:
+                BIO_clear_retry_flags(b);
+                ret = BIO_ctrl(b->next_bio, cmd, num, ptr);
+                BIO_copy_next_retry(b);
+                break;
+
+        default:
+                ret = BIO_ctrl(b->next_bio, cmd, num, ptr);
+                break;
+
+                }
+
+        return ret;
+        }
+
+
+static long bio_zlib_callback_ctrl(BIO *b, int cmd, bio_info_cb *fp)
+        {
+        if(!b->next_bio)
+                return 0;
+        return
+                BIO_callback_ctrl(b->next_bio, cmd, fp);
+        }
+
+#endif
diff --git a/src/lib/libssl/src/crypto/comp/comp.h b/src/lib/libssl/src/crypto/comp/comp.h
index ab48b78ae9..4b405c7d49 100644
--- a/src/lib/libssl/src/crypto/comp/comp.h
+++ b/src/lib/libssl/src/crypto/comp/comp.h
@@ -8,19 +8,26 @@
 extern "C" {
 #endif
 
+typedef struct comp_ctx_st COMP_CTX;
+
 typedef struct comp_method_st
         {
         int type;               /* NID for compression library */
         const char *name;       /* A text string to identify the library */
-        int (*init)();
-        void (*finish)();
-        int (*compress)();
-        int (*expand)();
-        long (*ctrl)();
-        long (*callback_ctrl)();
+        int (*init)(COMP_CTX *ctx);
+        void (*finish)(COMP_CTX *ctx);
+        int (*compress)(COMP_CTX *ctx,
+                        unsigned char *out, unsigned int olen,
+                        unsigned char *in, unsigned int ilen);
+        int (*expand)(COMP_CTX *ctx,
+                      unsigned char *out, unsigned int olen,
+                      unsigned char *in, unsigned int ilen);
+        /* The following two do NOTHING, but are kept for backward compatibility */
+        long (*ctrl)(void);
+        long (*callback_ctrl)(void);
         } COMP_METHOD;
 
-typedef struct comp_ctx_st
+struct comp_ctx_st
         {
         COMP_METHOD *meth;
         unsigned long compress_in;
@@ -29,7 +36,7 @@ typedef struct comp_ctx_st
         unsigned long expand_out;
 
         CRYPTO_EX_DATA  ex_data;
-        } COMP_CTX;
+        };
 
 
 COMP_CTX *COMP_CTX_new(COMP_METHOD *meth);
@@ -40,6 +47,13 @@ int COMP_expand_block(COMP_CTX *ctx, unsigned char *out, int olen,
         unsigned char *in, int ilen);
 COMP_METHOD *COMP_rle(void );
 COMP_METHOD *COMP_zlib(void );
+void COMP_zlib_cleanup(void);
+
+#ifdef HEADER_BIO_H
+#ifdef ZLIB
+BIO_METHOD *BIO_f_zlib(void);
+#endif
+#endif
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -50,8 +64,15 @@ void ERR_load_COMP_strings(void);
 /* Error codes for the COMP functions. */
 
 /* Function codes. */
+#define COMP_F_BIO_ZLIB_FLUSH                            99
+#define COMP_F_BIO_ZLIB_NEW                              100
+#define COMP_F_BIO_ZLIB_READ                             101
+#define COMP_F_BIO_ZLIB_WRITE                            102
 
 /* Reason codes. */
+#define COMP_R_ZLIB_DEFLATE_ERROR                        99
+#define COMP_R_ZLIB_INFLATE_ERROR                        100
+#define COMP_R_ZLIB_NOT_SUPPORTED                        101
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/comp/comp_err.c b/src/lib/libssl/src/crypto/comp/comp_err.c
index 1652b8c2c4..187d68b725 100644
--- a/src/lib/libssl/src/crypto/comp/comp_err.c
+++ b/src/lib/libssl/src/crypto/comp/comp_err.c
@@ -1,6 +1,6 @@
 /* crypto/comp/comp_err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2008 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -64,13 +64,24 @@
 
 /* BEGIN ERROR CODES */
 #ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(ERR_LIB_COMP,func,0)
+#define ERR_REASON(reason) ERR_PACK(ERR_LIB_COMP,0,reason)
+
 static ERR_STRING_DATA COMP_str_functs[]=
         {
+{ERR_FUNC(COMP_F_BIO_ZLIB_FLUSH),       "BIO_ZLIB_FLUSH"},
+{ERR_FUNC(COMP_F_BIO_ZLIB_NEW), "BIO_ZLIB_NEW"},
+{ERR_FUNC(COMP_F_BIO_ZLIB_READ),        "BIO_ZLIB_READ"},
+{ERR_FUNC(COMP_F_BIO_ZLIB_WRITE),       "BIO_ZLIB_WRITE"},
 {0,NULL}
         };
 
 static ERR_STRING_DATA COMP_str_reasons[]=
         {
+{ERR_REASON(COMP_R_ZLIB_DEFLATE_ERROR)   ,"zlib deflate error"},
+{ERR_REASON(COMP_R_ZLIB_INFLATE_ERROR)   ,"zlib inflate error"},
+{ERR_REASON(COMP_R_ZLIB_NOT_SUPPORTED)   ,"zlib not supported"},
 {0,NULL}
         };
 
@@ -78,15 +89,12 @@ static ERR_STRING_DATA COMP_str_reasons[]=
 
 void ERR_load_COMP_strings(void)
         {
-        static int init=1;
-
-        if (init)
-                {
-                init=0;
 #ifndef OPENSSL_NO_ERR
-                ERR_load_strings(ERR_LIB_COMP,COMP_str_functs);
-                ERR_load_strings(ERR_LIB_COMP,COMP_str_reasons);
-#endif
 
+        if (ERR_func_error_string(COMP_str_functs[0].error) == NULL)
+                {
+                ERR_load_strings(0,COMP_str_functs);
+                ERR_load_strings(0,COMP_str_reasons);
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/comp/comp_lib.c b/src/lib/libssl/src/crypto/comp/comp_lib.c
index beb98ce8cc..b60ae371e8 100644
--- a/src/lib/libssl/src/crypto/comp/comp_lib.c
+++ b/src/lib/libssl/src/crypto/comp/comp_lib.c
@@ -20,17 +20,11 @@ COMP_CTX *COMP_CTX_new(COMP_METHOD *meth)
                 OPENSSL_free(ret);
                 ret=NULL;
                 }
-#if 0
-        else
-                CRYPTO_new_ex_data(rsa_meth,(char *)ret,&ret->ex_data);
-#endif
         return(ret);
         }
 
 void COMP_CTX_free(COMP_CTX *ctx)
         {
-        /* CRYPTO_free_ex_data(rsa_meth,(char *)ctx,&ctx->ex_data); */
-
         if(ctx == NULL)
             return;
 
diff --git a/src/lib/libssl/src/crypto/conf/conf.h b/src/lib/libssl/src/crypto/conf/conf.h
index f4671442ab..8aa06bc5ec 100644
--- a/src/lib/libssl/src/crypto/conf/conf.h
+++ b/src/lib/libssl/src/crypto/conf/conf.h
@@ -65,6 +65,8 @@
 #include <openssl/safestack.h>
 #include <openssl/e_os2.h>
 
+#include <openssl/ossl_typ.h>
+
 #ifdef  __cplusplus
 extern "C" {
 #endif
@@ -81,7 +83,6 @@ DECLARE_STACK_OF(CONF_MODULE)
 DECLARE_STACK_OF(CONF_IMODULE)
 
 struct conf_st;
-typedef struct conf_st CONF;
 struct conf_method_st;
 typedef struct conf_method_st CONF_METHOD;
 
@@ -113,6 +114,7 @@ typedef void conf_finish_func(CONF_IMODULE *md);
 #define CONF_MFLAGS_SILENT              0x4
 #define CONF_MFLAGS_NO_DSO              0x8
 #define CONF_MFLAGS_IGNORE_MISSING_FILE 0x10
+#define CONF_MFLAGS_DEFAULT_SECTION     0x20
 
 int CONF_set_default_method(CONF_METHOD *meth);
 void CONF_set_nconf(CONF *conf,LHASH *hash);
@@ -212,6 +214,8 @@ void ERR_load_CONF_strings(void);
 #define CONF_F_CONF_LOAD_BIO                             102
 #define CONF_F_CONF_LOAD_FP                              103
 #define CONF_F_CONF_MODULES_LOAD                         116
+#define CONF_F_DEF_LOAD                                  120
+#define CONF_F_DEF_LOAD_BIO                              121
 #define CONF_F_MODULE_INIT                               115
 #define CONF_F_MODULE_LOAD_DSO                           117
 #define CONF_F_MODULE_RUN                                118
diff --git a/src/lib/libssl/src/crypto/conf/conf_api.c b/src/lib/libssl/src/crypto/conf/conf_api.c
index 0032baa711..909d72b4b8 100644
--- a/src/lib/libssl/src/crypto/conf/conf_api.c
+++ b/src/lib/libssl/src/crypto/conf/conf_api.c
@@ -121,7 +121,7 @@ int _CONF_add_string(CONF *conf, CONF_VALUE *section, CONF_VALUE *value)
         v = (CONF_VALUE *)lh_insert(conf->data, value);
         if (v != NULL)
                 {
-                sk_CONF_VALUE_delete_ptr(ts,v);
+                (void)sk_CONF_VALUE_delete_ptr(ts,v);
                 OPENSSL_free(v->name);
                 OPENSSL_free(v->value);
                 OPENSSL_free(v);
diff --git a/src/lib/libssl/src/crypto/conf/conf_def.c b/src/lib/libssl/src/crypto/conf/conf_def.c
index 2464f8ed90..d8bce8732a 100644
--- a/src/lib/libssl/src/crypto/conf/conf_def.c
+++ b/src/lib/libssl/src/crypto/conf/conf_def.c
@@ -60,6 +60,7 @@
 
 #include <stdio.h>
 #include <string.h>
+#include "cryptlib.h"
 #include <openssl/stack.h>
 #include <openssl/lhash.h>
 #include <openssl/conf.h>
@@ -67,7 +68,6 @@
 #include "conf_def.h"
 #include <openssl/buffer.h>
 #include <openssl/err.h>
-#include "cryptlib.h"
 
 static char *eat_ws(CONF *conf, char *p);
 static char *eat_alpha_numeric(CONF *conf, char *p);
@@ -88,7 +88,7 @@ static int def_dump(const CONF *conf, BIO *bp);
 static int def_is_number(const CONF *conf, char c);
 static int def_to_int(const CONF *conf, char c);
 
-const char *CONF_def_version="CONF_def" OPENSSL_VERSION_PTEXT;
+const char CONF_def_version[]="CONF_def" OPENSSL_VERSION_PTEXT;
 
 static CONF_METHOD default_method = {
         "OpenSSL default",
@@ -194,9 +194,9 @@ static int def_load(CONF *conf, const char *name, long *line)
         if (in == NULL)
                 {
                 if (ERR_GET_REASON(ERR_peek_last_error()) == BIO_R_NO_SUCH_FILE)
-                        CONFerr(CONF_F_CONF_LOAD,CONF_R_NO_SUCH_FILE);
+                        CONFerr(CONF_F_DEF_LOAD,CONF_R_NO_SUCH_FILE);
                 else
-                        CONFerr(CONF_F_CONF_LOAD,ERR_R_SYS_LIB);
+                        CONFerr(CONF_F_DEF_LOAD,ERR_R_SYS_LIB);
                 return 0;
                 }
 
@@ -225,28 +225,28 @@ static int def_load_bio(CONF *conf, BIO *in, long *line)
 
         if ((buff=BUF_MEM_new()) == NULL)
                 {
-                CONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_BUF_LIB);
+                CONFerr(CONF_F_DEF_LOAD_BIO,ERR_R_BUF_LIB);
                 goto err;
                 }
 
         section=(char *)OPENSSL_malloc(10);
         if (section == NULL)
                 {
-                CONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_MALLOC_FAILURE);
+                CONFerr(CONF_F_DEF_LOAD_BIO,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
         BUF_strlcpy(section,"default",10);
 
         if (_CONF_new_data(conf) == 0)
                 {
-                CONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_MALLOC_FAILURE);
+                CONFerr(CONF_F_DEF_LOAD_BIO,ERR_R_MALLOC_FAILURE);
                 goto err;
                 }
 
         sv=_CONF_new_section(conf,section);
         if (sv == NULL)
                 {
-                CONFerr(CONF_F_CONF_LOAD_BIO,
+                CONFerr(CONF_F_DEF_LOAD_BIO,
                                         CONF_R_UNABLE_TO_CREATE_NEW_SECTION);
                 goto err;
                 }
@@ -258,7 +258,7 @@ static int def_load_bio(CONF *conf, BIO *in, long *line)
                 {
                 if (!BUF_MEM_grow(buff,bufnum+CONFBUFSIZE))
                         {
-                        CONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_BUF_LIB);
+                        CONFerr(CONF_F_DEF_LOAD_BIO,ERR_R_BUF_LIB);
                         goto err;
                         }
                 p= &(buff->data[bufnum]);
@@ -329,7 +329,7 @@ again:
                                         ss=p;
                                         goto again;
                                         }
-                                CONFerr(CONF_F_CONF_LOAD_BIO,
+                                CONFerr(CONF_F_DEF_LOAD_BIO,
                                         CONF_R_MISSING_CLOSE_SQUARE_BRACKET);
                                 goto err;
                                 }
@@ -339,7 +339,7 @@ again:
                                 sv=_CONF_new_section(conf,section);
                         if (sv == NULL)
                                 {
-                                CONFerr(CONF_F_CONF_LOAD_BIO,
+                                CONFerr(CONF_F_DEF_LOAD_BIO,
                                         CONF_R_UNABLE_TO_CREATE_NEW_SECTION);
                                 goto err;
                                 }
@@ -362,7 +362,7 @@ again:
                         p=eat_ws(conf, end);
                         if (*p != '=')
                                 {
-                                CONFerr(CONF_F_CONF_LOAD_BIO,
+                                CONFerr(CONF_F_DEF_LOAD_BIO,
                                                 CONF_R_MISSING_EQUAL_SIGN);
                                 goto err;
                                 }
@@ -379,7 +379,7 @@ again:
 
                         if (!(v=(CONF_VALUE *)OPENSSL_malloc(sizeof(CONF_VALUE))))
                                 {
-                                CONFerr(CONF_F_CONF_LOAD_BIO,
+                                CONFerr(CONF_F_DEF_LOAD_BIO,
                                                         ERR_R_MALLOC_FAILURE);
                                 goto err;
                                 }
@@ -388,7 +388,7 @@ again:
                         v->value=NULL;
                         if (v->name == NULL)
                                 {
-                                CONFerr(CONF_F_CONF_LOAD_BIO,
+                                CONFerr(CONF_F_DEF_LOAD_BIO,
                                                         ERR_R_MALLOC_FAILURE);
                                 goto err;
                                 }
@@ -402,7 +402,7 @@ again:
                                         tv=_CONF_new_section(conf,psection);
                                 if (tv == NULL)
                                         {
-                                        CONFerr(CONF_F_CONF_LOAD_BIO,
+                                        CONFerr(CONF_F_DEF_LOAD_BIO,
                                            CONF_R_UNABLE_TO_CREATE_NEW_SECTION);
                                         goto err;
                                         }
@@ -416,7 +416,7 @@ again:
 #if 1
                         if (_CONF_add_string(conf, tv, v) == 0)
                                 {
-                                CONFerr(CONF_F_CONF_LOAD_BIO,
+                                CONFerr(CONF_F_DEF_LOAD_BIO,
                                                         ERR_R_MALLOC_FAILURE);
                                 goto err;
                                 }
@@ -424,7 +424,7 @@ again:
                         v->section=tv->section; 
                         if (!sk_CONF_VALUE_push(ts,v))
                                 {
-                                CONFerr(CONF_F_CONF_LOAD_BIO,
+                                CONFerr(CONF_F_DEF_LOAD_BIO,
                                                         ERR_R_MALLOC_FAILURE);
                                 goto err;
                                 }
@@ -629,7 +629,7 @@ static int str_copy(CONF *conf, char *section, char **pto, char *from)
                                 CONFerr(CONF_F_STR_COPY,CONF_R_VARIABLE_HAS_NO_VALUE);
                                 goto err;
                                 }
-                        BUF_MEM_grow_clean(buf,(strlen(p)+len-(e-from)));
+                        BUF_MEM_grow_clean(buf,(strlen(p)+buf->length-(e-from)));
                         while (*p)
                                 buf->data[to++]= *(p++);
 
diff --git a/src/lib/libssl/src/crypto/conf/conf_err.c b/src/lib/libssl/src/crypto/conf/conf_err.c
index f5e2ca4bf0..a16a5e0bd4 100644
--- a/src/lib/libssl/src/crypto/conf/conf_err.c
+++ b/src/lib/libssl/src/crypto/conf/conf_err.c
@@ -75,6 +75,8 @@ static ERR_STRING_DATA CONF_str_functs[]=
 {ERR_FUNC(CONF_F_CONF_LOAD_BIO),        "CONF_load_bio"},
 {ERR_FUNC(CONF_F_CONF_LOAD_FP), "CONF_load_fp"},
 {ERR_FUNC(CONF_F_CONF_MODULES_LOAD),    "CONF_modules_load"},
+{ERR_FUNC(CONF_F_DEF_LOAD),     "DEF_LOAD"},
+{ERR_FUNC(CONF_F_DEF_LOAD_BIO), "DEF_LOAD_BIO"},
 {ERR_FUNC(CONF_F_MODULE_INIT),  "MODULE_INIT"},
 {ERR_FUNC(CONF_F_MODULE_LOAD_DSO),      "MODULE_LOAD_DSO"},
 {ERR_FUNC(CONF_F_MODULE_RUN),   "MODULE_RUN"},
@@ -116,15 +118,12 @@ static ERR_STRING_DATA CONF_str_reasons[]=
 
 void ERR_load_CONF_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(CONF_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,CONF_str_functs);
                 ERR_load_strings(0,CONF_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/conf/conf_lib.c b/src/lib/libssl/src/crypto/conf/conf_lib.c
index 6a3cf109dd..2a3399d269 100644
--- a/src/lib/libssl/src/crypto/conf/conf_lib.c
+++ b/src/lib/libssl/src/crypto/conf/conf_lib.c
@@ -63,7 +63,7 @@
 #include <openssl/conf_api.h>
 #include <openssl/lhash.h>
 
-const char *CONF_version="CONF" OPENSSL_VERSION_PTEXT;
+const char CONF_version[]="CONF" OPENSSL_VERSION_PTEXT;
 
 static CONF_METHOD *default_CONF_method=NULL;
 
@@ -184,7 +184,7 @@ long CONF_get_number(LHASH *conf,const char *group,const char *name)
         if (status == 0)
                 {
                 /* This function does not believe in errors... */
-                ERR_get_error();
+                ERR_clear_error();
                 }
         return result;
         }
diff --git a/src/lib/libssl/src/crypto/conf/conf_mod.c b/src/lib/libssl/src/crypto/conf/conf_mod.c
index 812e60dc70..58b23ba992 100644
--- a/src/lib/libssl/src/crypto/conf/conf_mod.c
+++ b/src/lib/libssl/src/crypto/conf/conf_mod.c
@@ -126,17 +126,18 @@ int CONF_modules_load(const CONF *cnf, const char *appname,
         {
         STACK_OF(CONF_VALUE) *values;
         CONF_VALUE *vl;
-        char *vsection;
+        char *vsection = NULL;
 
         int ret, i;
 
         if (!cnf)
                 return 1;
 
-        if (appname == NULL)
-                appname = "openssl_conf";
+        if (appname)
+                vsection = NCONF_get_string(cnf, NULL, appname);
 
-        vsection = NCONF_get_string(cnf, NULL, appname); 
+        if (!appname || (!vsection && (flags & CONF_MFLAGS_DEFAULT_SECTION)))
+                vsection = NCONF_get_string(cnf, NULL, "openssl_conf");
 
         if (!vsection)
                 {
@@ -231,7 +232,7 @@ static int module_run(const CONF *cnf, char *name, char *value,
                 if (!(flags & CONF_MFLAGS_SILENT))
                         {
                         char rcode[DECIMAL_SIZE(ret)+1];
-                        CONFerr(CONF_F_CONF_MODULES_LOAD, CONF_R_MODULE_INITIALIZATION_ERROR);
+                        CONFerr(CONF_F_MODULE_RUN, CONF_R_MODULE_INITIALIZATION_ERROR);
                         BIO_snprintf(rcode, sizeof rcode, "%-8d", ret);
                         ERR_add_error_data(6, "module=", name, ", value=", value, ", retcode=", rcode);
                         }
@@ -254,7 +255,7 @@ static CONF_MODULE *module_load_dso(const CONF *cnf, char *name, char *value,
         path = NCONF_get_string(cnf, value, "path");
         if (!path)
                 {
-                ERR_get_error();
+                ERR_clear_error();
                 path = name;
                 }
         dso = DSO_load(NULL, path, NULL, 0);
@@ -431,7 +432,7 @@ void CONF_modules_unload(int all)
                 if (((md->links > 0) || !md->dso) && !all)
                         continue;
                 /* Since we're working in reverse this is OK */
-                sk_CONF_MODULE_delete(supported_modules, i);
+                (void)sk_CONF_MODULE_delete(supported_modules, i);
                 module_free(md);
                 }
         if (sk_CONF_MODULE_num(supported_modules) == 0)
diff --git a/src/lib/libssl/src/crypto/conf/conf_sap.c b/src/lib/libssl/src/crypto/conf/conf_sap.c
index e15c2e5546..9c53bac1a8 100644
--- a/src/lib/libssl/src/crypto/conf/conf_sap.c
+++ b/src/lib/libssl/src/crypto/conf/conf_sap.c
@@ -88,8 +88,8 @@ void OPENSSL_config(const char *config_name)
 
 
         ERR_clear_error();
-        if (CONF_modules_load_file(NULL, NULL,
-                                        CONF_MFLAGS_IGNORE_MISSING_FILE) <= 0)
+        if (CONF_modules_load_file(NULL, config_name,
+        CONF_MFLAGS_DEFAULT_SECTION|CONF_MFLAGS_IGNORE_MISSING_FILE) <= 0)
                 {
                 BIO *bio_err;
                 ERR_load_crypto_strings();
diff --git a/src/lib/libssl/src/crypto/cpt_err.c b/src/lib/libssl/src/crypto/cpt_err.c
index 06a6109cce..9fd41fff8c 100644
--- a/src/lib/libssl/src/crypto/cpt_err.c
+++ b/src/lib/libssl/src/crypto/cpt_err.c
@@ -92,15 +92,12 @@ static ERR_STRING_DATA CRYPTO_str_reasons[]=
 
 void ERR_load_CRYPTO_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(CRYPTO_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,CRYPTO_str_functs);
                 ERR_load_strings(0,CRYPTO_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/cryptlib.c b/src/lib/libssl/src/crypto/cryptlib.c
index e63bbe8dba..8c68623828 100644
--- a/src/lib/libssl/src/crypto/cryptlib.c
+++ b/src/lib/libssl/src/crypto/cryptlib.c
@@ -1,4 +1,57 @@
 /* crypto/cryptlib.c */
+/* ====================================================================
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -55,11 +108,13 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
-#include <stdio.h>
-#include <string.h>
 #include "cryptlib.h"
-#include <openssl/crypto.h>
 #include <openssl/safestack.h>
 
 #if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WIN16)
@@ -70,7 +125,7 @@ DECLARE_STACK_OF(CRYPTO_dynlock)
 IMPLEMENT_STACK_OF(CRYPTO_dynlock)
 
 /* real #defines in crypto.h, keep these upto date */
-static const char* lock_names[CRYPTO_NUM_LOCKS] =
+static const char* const lock_names[CRYPTO_NUM_LOCKS] =
         {
         "<<ERROR>>",
         "err",
@@ -104,10 +159,14 @@ static const char* lock_names[CRYPTO_NUM_LOCKS] =
         "dynlock",
         "engine",
         "ui",
-        "hwcrhk",               /* This is a HACK which will disappear in 0.9.8 */
-        "fips",
-        "fips2",
-#if CRYPTO_NUM_LOCKS != 35
+        "ecdsa",
+        "ec",
+        "ecdh",
+        "bn",
+        "ec_pre_comp",
+        "store",
+        "comp",
+#if CRYPTO_NUM_LOCKS != 39
 # error "Inconsistency between crypto.h and cryptlib.c"
 #endif
         };
@@ -218,7 +277,7 @@ int CRYPTO_get_new_dynlockid(void)
         else
                 /* If we found a place with a NULL pointer, put our pointer
                    in it.  */
-                sk_CRYPTO_dynlock_set(dyn_locks,i,pointer);
+                (void)sk_CRYPTO_dynlock_set(dyn_locks,i,pointer);
         CRYPTO_w_unlock(CRYPTO_LOCK_DYNLOCK);
 
         if (i == -1)
@@ -260,7 +319,7 @@ void CRYPTO_destroy_dynlockid(int i)
 #endif
                         if (pointer->references <= 0)
                                 {
-                                sk_CRYPTO_dynlock_set(dyn_locks, i, NULL);
+                                (void)sk_CRYPTO_dynlock_set(dyn_locks, i, NULL);
                                 }
                         else
                                 pointer = NULL;
@@ -480,9 +539,48 @@ const char *CRYPTO_get_lock_name(int type)
                 return(sk_value(app_locks,type-CRYPTO_NUM_LOCKS));
         }
 
-int OPENSSL_NONPIC_relocated=0;
+#if     defined(__i386)   || defined(__i386__)   || defined(_M_IX86) || \
+        defined(__INTEL__) || \
+        defined(__x86_64) || defined(__x86_64__) || defined(_M_AMD64)
+
+unsigned long  OPENSSL_ia32cap_P=0;
+unsigned long *OPENSSL_ia32cap_loc(void) { return &OPENSSL_ia32cap_P; }
+
+#if defined(OPENSSL_CPUID_OBJ) && !defined(OPENSSL_NO_ASM) && !defined(I386_ONLY)
+#define OPENSSL_CPUID_SETUP
+void OPENSSL_cpuid_setup(void)
+{ static int trigger=0;
+  unsigned long OPENSSL_ia32_cpuid(void);
+  char *env;
 
-#if defined(_WIN32) && defined(_WINDLL)
+    if (trigger)        return;
+
+    trigger=1;
+    if ((env=getenv("OPENSSL_ia32cap")))
+        OPENSSL_ia32cap_P = strtoul(env,NULL,0)|(1<<10);
+    else
+        OPENSSL_ia32cap_P = OPENSSL_ia32_cpuid()|(1<<10);
+    /*
+     * |(1<<10) sets a reserved bit to signal that variable
+     * was initialized already... This is to avoid interference
+     * with cpuid snippets in ELF .init segment.
+     */
+}
+#endif
+
+#else
+unsigned long *OPENSSL_ia32cap_loc(void) { return NULL; }
+#endif
+int OPENSSL_NONPIC_relocated = 0;
+#if !defined(OPENSSL_CPUID_SETUP)
+void OPENSSL_cpuid_setup(void) {}
+#endif
+
+#if (defined(_WIN32) || defined(__CYGWIN__)) && defined(_WINDLL)
+#ifdef __CYGWIN__
+/* pick DLL_[PROCESS|THREAD]_[ATTACH|DETACH] definitions */
+#include <windows.h>
+#endif
 
 /* All we really need to do is remove the 'error' state when a thread
  * detaches */
@@ -493,6 +591,7 @@ BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason,
         switch(fdwReason)
                 {
         case DLL_PROCESS_ATTACH:
+                OPENSSL_cpuid_setup();
 #if defined(_WIN32_WINNT)
                 {
                 IMAGE_DOS_HEADER *dos_header = (IMAGE_DOS_HEADER *)hinstDLL;
@@ -521,11 +620,11 @@ BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason,
         }
 #endif
 
-#if defined(_WIN32)
+#if defined(_WIN32) && !defined(__CYGWIN__)
 #include <tchar.h>
 
 #if defined(_WIN32_WINNT) && _WIN32_WINNT>=0x0333
-static int IsService(void)
+int OPENSSL_isservice(void)
 { HWINSTA h;
   DWORD len;
   WCHAR *name;
@@ -562,12 +661,15 @@ static int IsService(void)
 #endif
     else                                return 0;
 }
+#else
+int OPENSSL_isservice(void) { return 0; }
 #endif
 
 void OPENSSL_showfatal (const char *fmta,...)
 { va_list ap;
   TCHAR buf[256];
   const TCHAR *fmt;
+#ifdef STD_ERROR_HANDLE /* what a dirty trick! */
   HANDLE h;
 
     if ((h=GetStdHandle(STD_ERROR_HANDLE)) != NULL &&
@@ -578,6 +680,7 @@ void OPENSSL_showfatal (const char *fmta,...)
         va_end (ap);
         return;
     }
+#endif
 
     if (sizeof(TCHAR)==sizeof(char))
         fmt=(const TCHAR *)fmta;
@@ -623,7 +726,7 @@ void OPENSSL_showfatal (const char *fmta,...)
 
 #if defined(_WIN32_WINNT) && _WIN32_WINNT>=0x0333
     /* this -------------v--- guards NT-specific calls */
-    if (GetVersion() < 0x80000000 && IsService())
+    if (GetVersion() < 0x80000000 && OPENSSL_isservice())
     {   HANDLE h = RegisterEventSource(0,_T("OPENSSL"));
         const TCHAR *pmsg=buf;
         ReportEvent(h,EVENTLOG_ERROR_TYPE,0,0,0,1,0,&pmsg,0);
@@ -631,21 +734,7 @@ void OPENSSL_showfatal (const char *fmta,...)
     }
     else
 #endif
-    {   MSGBOXPARAMS         m;
-
-        m.cbSize             = sizeof(m);
-        m.hwndOwner          = NULL;
-        m.lpszCaption        = _T("OpenSSL: FATAL");
-        m.dwStyle            = MB_OK;
-        m.hInstance          = NULL;
-        m.lpszIcon           = IDI_ERROR;
-        m.dwContextHelpId    = 0;
-        m.lpfnMsgBoxCallback = NULL;
-        m.dwLanguageId       = MAKELANGID(LANG_ENGLISH,SUBLANG_ENGLISH_US);
-        m.lpszText           = buf;
-
-        MessageBoxIndirect (&m);
-    }
+        MessageBox (NULL,buf,_T("OpenSSL: FATAL"),MB_OK|MB_ICONSTOP);
 }
 #else
 void OPENSSL_showfatal (const char *fmta,...)
@@ -655,6 +744,7 @@ void OPENSSL_showfatal (const char *fmta,...)
     vfprintf (stderr,fmta,ap);
     va_end (ap);
 }
+int OPENSSL_isservice (void) { return 0; }
 #endif
 
 void OpenSSLDie(const char *file,int line,const char *assertion)
@@ -666,79 +756,3 @@ void OpenSSLDie(const char *file,int line,const char *assertion)
         }
 
 void *OPENSSL_stderr(void)      { return stderr; }
-
-#ifdef OPENSSL_FIPS
-
-void fips_w_lock(void)          { CRYPTO_w_lock(CRYPTO_LOCK_FIPS); }
-void fips_w_unlock(void)        { CRYPTO_w_unlock(CRYPTO_LOCK_FIPS); }
-void fips_r_lock(void)          { CRYPTO_r_lock(CRYPTO_LOCK_FIPS); }
-void fips_r_unlock(void)        { CRYPTO_r_unlock(CRYPTO_LOCK_FIPS); }
-
-static int fips_started = 0;
-static unsigned long fips_thread = 0;
-
-void fips_set_started(void)
-        {
-        fips_started = 1;
-        }
-
-int fips_is_started(void)
-        {
-        return fips_started;
-        }
-
-int fips_is_owning_thread(void)
-        {
-        int ret = 0;
-
-        if (fips_is_started())
-                {
-                CRYPTO_r_lock(CRYPTO_LOCK_FIPS2);
-                if (fips_thread != 0 && fips_thread == CRYPTO_thread_id())
-                        ret = 1;
-                CRYPTO_r_unlock(CRYPTO_LOCK_FIPS2);
-                }
-        return ret;
-        }
-
-int fips_set_owning_thread(void)
-        {
-        int ret = 0;
-
-        if (fips_is_started())
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_FIPS2);
-                if (fips_thread == 0)
-                        {
-                        fips_thread = CRYPTO_thread_id();
-                        ret = 1;
-                        }
-                CRYPTO_w_unlock(CRYPTO_LOCK_FIPS2);
-                }
-        return ret;
-        }
-
-int fips_clear_owning_thread(void)
-        {
-        int ret = 0;
-
-        if (fips_is_started())
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_FIPS2);
-                if (fips_thread == CRYPTO_thread_id())
-                        {
-                        fips_thread = 0;
-                        ret = 1;
-                        }
-                CRYPTO_w_unlock(CRYPTO_LOCK_FIPS2);
-                }
-        return ret;
-        }
-
-unsigned char *fips_signature_witness(void)
-        {
-        extern unsigned char FIPS_signature[];
-        return FIPS_signature;
-        }
-#endif /* OPENSSL_FIPS */
-
diff --git a/src/lib/libssl/src/crypto/cryptlib.h b/src/lib/libssl/src/crypto/cryptlib.h
index 6f59e08ca6..5ceaa964b5 100644
--- a/src/lib/libssl/src/crypto/cryptlib.h
+++ b/src/lib/libssl/src/crypto/cryptlib.h
@@ -64,6 +64,11 @@
 
 #include "e_os.h"
 
+#ifdef OPENSSL_USE_APPLINK
+#define BIO_FLAGS_UPLINK 0x8000
+#include "ms/uplink.h"
+#endif
+
 #include <openssl/crypto.h>
 #include <openssl/buffer.h> 
 #include <openssl/bio.h> 
@@ -93,9 +98,12 @@ extern "C" {
 #define DECIMAL_SIZE(type)      ((sizeof(type)*8+2)/3+1)
 #define HEX_SIZE(type)          (sizeof(type)*2)
 
+void OPENSSL_cpuid_setup(void);
+extern unsigned long OPENSSL_ia32cap_P;
 void OPENSSL_showfatal(const char *,...);
 void *OPENSSL_stderr(void);
 extern int OPENSSL_NONPIC_relocated;
+int OPENSSL_isservice(void);
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/crypto-lib.com b/src/lib/libssl/src/crypto/crypto-lib.com
index 427c321f25..8898f30c1f 100644
--- a/src/lib/libssl/src/crypto/crypto-lib.com
+++ b/src/lib/libssl/src/crypto/crypto-lib.com
@@ -75,12 +75,15 @@ $ ENDIF
 $!
 $! Define The Different Encryption Types.
 $!
-$ ENCRYPT_TYPES = "Basic,MD2,MD4,MD5,SHA,MDC2,HMAC,RIPEMD,"+ -
-                  "DES,RC2,RC4,RC5,IDEA,BF,CAST,"+ -
-                  "BN,EC,RSA,DSA,DH,DSO,ENGINE,AES,"+ -
-                  "BUFFER,BIO,STACK,LHASH,RAND,ERR,OBJECTS,"+ -
+$ ENCRYPT_TYPES = "Basic,"+ -
+                  "OBJECTS,"+ -
+                  "MD2,MD4,MD5,SHA,MDC2,HMAC,RIPEMD,"+ -
+                  "DES,RC2,RC4,RC5,IDEA,BF,CAST,CAMELLIA,SEED,"+ -
+                  "BN,EC,RSA,DSA,ECDSA,DH,ECDH,DSO,ENGINE,AES,"+ -
+                  "BUFFER,BIO,STACK,LHASH,RAND,ERR,"+ -
                   "EVP,EVP_2,ASN1,ASN1_2,PEM,X509,X509V3,"+ -
-                  "CONF,TXT_DB,PKCS7,PKCS12,COMP,OCSP,UI,KRB5"
+                  "CONF,TXT_DB,PKCS7,PKCS12,COMP,OCSP,UI,KRB5,"+ -
+                  "STORE,CMS,PQUEUE"
 $!
 $! Check To Make Sure We Have Valid Command Line Parameters.
 $!
@@ -158,11 +161,11 @@ $!
 $ APPS_DES = "DES/DES,CBC3_ENC"
 $ APPS_PKCS7 = "ENC/ENC;DEC/DEC;SIGN/SIGN;VERIFY/VERIFY,EXAMPLE"
 $
-$ LIB_ = "cryptlib,mem,mem_clr,mem_dbg,cversion,ex_data,tmdiff,cpt_err,ebcdic,uid,o_time,o_str"
+$ LIB_ = "cryptlib,mem,mem_clr,mem_dbg,cversion,ex_data,tmdiff,cpt_err,ebcdic,uid,o_time,o_str,o_dir"
 $ LIB_MD2 = "md2_dgst,md2_one"
 $ LIB_MD4 = "md4_dgst,md4_one"
 $ LIB_MD5 = "md5_dgst,md5_one"
-$ LIB_SHA = "sha_dgst,sha1dgst,sha_one,sha1_one"
+$ LIB_SHA = "sha_dgst,sha1dgst,sha_one,sha1_one,sha256,sha512"
 $ LIB_MDC2 = "mdc2dgst,mdc2_one"
 $ LIB_HMAC = "hmac"
 $ LIB_RIPEMD = "rmd_dgst,rmd_one"
@@ -179,34 +182,43 @@ $ LIB_RC5 = "rc5_skey,rc5_ecb,rc5_enc,rc5cfb64,rc5ofb64"
 $ LIB_IDEA = "i_cbc,i_cfb64,i_ofb64,i_ecb,i_skey"
 $ LIB_BF = "bf_skey,bf_ecb,bf_enc,bf_cfb64,bf_ofb64"
 $ LIB_CAST = "c_skey,c_ecb,c_enc,c_cfb64,c_ofb64"
+$ LIB_CAMELLIA = "camellia,cmll_misc,cmll_ecb,cmll_cbc,cmll_ofb,"+ -
+        "cmll_cfb,cmll_ctr"
+$ LIB_SEED = "seed,seed_cbc,seed_ecb,seed_cfb,seed_ofb"
 $ LIB_BN_ASM = "[.asm]vms.mar,vms-helper"
 $ IF F$TRNLNM("OPENSSL_NO_ASM").OR.ARCH.EQS."AXP" THEN LIB_BN_ASM = "bn_asm"
 $ LIB_BN = "bn_add,bn_div,bn_exp,bn_lib,bn_ctx,bn_mul,bn_mod,"+ -
         "bn_print,bn_rand,bn_shift,bn_word,bn_blind,"+ -
         "bn_kron,bn_sqrt,bn_gcd,bn_prime,bn_err,bn_sqr,"+LIB_BN_ASM+","+ -
-        "bn_recp,bn_mont,bn_mpi,bn_exp2,bn_x931p"
+        "bn_recp,bn_mont,bn_mpi,bn_exp2,bn_gf2m,bn_nist,"+ -
+        "bn_depr,bn_const"
+$ LIB_EC = "ec_lib,ecp_smpl,ecp_mont,ecp_nist,ec_cvt,ec_mult,"+ -
+        "ec_err,ec_curve,ec_check,ec_print,ec_asn1,ec_key,"+ -
+        "ec2_smpl,ec2_mult"
 $ LIB_RSA = "rsa_eay,rsa_gen,rsa_lib,rsa_sign,rsa_saos,rsa_err,"+ -
         "rsa_pk1,rsa_ssl,rsa_none,rsa_oaep,rsa_chk,rsa_null,"+ -
-        "rsa_pss,rsa_x931,rsa_asn1"
-$ LIB_EC = "ec_lib,ecp_smpl,ecp_mont,ecp_recp,ecp_nist,ec_cvt,ec_mult,"+ -
-        "ec_err"
-$ LIB_DSA = "dsa_gen,dsa_key,dsa_lib,dsa_asn1,dsa_vrf,dsa_sign,dsa_err,dsa_ossl"
-$ LIB_DH = "dh_asn1,dh_gen,dh_key,dh_lib,dh_check,dh_err"
+        "rsa_pss,rsa_x931,rsa_asn1,rsa_depr"
+$ LIB_DSA = "dsa_gen,dsa_key,dsa_lib,dsa_asn1,dsa_vrf,dsa_sign,"+ -
+        "dsa_err,dsa_ossl,dsa_depr"
+$ LIB_ECDSA = "ecs_lib,ecs_asn1,ecs_ossl,ecs_sign,ecs_vrf,ecs_err"
+$ LIB_DH = "dh_asn1,dh_gen,dh_key,dh_lib,dh_check,dh_err,dh_depr"
+$ LIB_ECDH = "ech_lib,ech_ossl,ech_key,ech_err"
 $ LIB_DSO = "dso_dl,dso_dlfcn,dso_err,dso_lib,dso_null,"+ -
         "dso_openssl,dso_win32,dso_vms"
 $ LIB_ENGINE = "eng_err,eng_lib,eng_list,eng_init,eng_ctrl,"+ -
         "eng_table,eng_pkey,eng_fat,eng_all,"+ -
-        "tb_rsa,tb_dsa,tb_dh,tb_rand,tb_cipher,tb_digest,"+ -
-        "eng_openssl,eng_dyn,eng_cnf,"+ -
-        "hw_atalla,hw_cswift,hw_ncipher,hw_nuron,hw_ubsec,"+ -
-        "hw_cryptodev,hw_aep,hw_sureware,hw_4758_cca"
-$ LIB_AES = "aes_core,aes_misc,aes_ecb,aes_cbc,aes_cfb,aes_ofb,aes_ctr"
+        "tb_rsa,tb_dsa,tb_ecdsa,tb_dh,tb_ecdh,tb_rand,tb_store,"+ -
+        "tb_cipher,tb_digest,"+ -
+        "eng_openssl,eng_dyn,eng_cnf,eng_cryptodev,eng_padlock"
+$ LIB_AES = "aes_core,aes_misc,aes_ecb,aes_cbc,aes_cfb,aes_ofb,"+ -
+        "aes_ctr,aes_ige,aes_wrap"
 $ LIB_BUFFER = "buffer,buf_err"
 $ LIB_BIO = "bio_lib,bio_cb,bio_err,"+ -
         "bss_mem,bss_null,bss_fd,"+ -
         "bss_file,bss_sock,bss_conn,"+ -
         "bf_null,bf_buff,b_print,b_dump,"+ -
         "b_sock,bss_acpt,bf_nbio,bss_rtcp,bss_bio,bss_log,"+ -
+        "bss_dgram,"+ -
         "bf_lbuf"
 $ LIB_STACK = "stack"
 $ LIB_LHASH = "lhash,lh_stats"
@@ -215,11 +227,11 @@ $ LIB_RAND = "md_rand,randfile,rand_lib,rand_err,rand_egd,"+ -
 $ LIB_ERR = "err,err_all,err_prn"
 $ LIB_OBJECTS = "o_names,obj_dat,obj_lib,obj_err"
 $ LIB_EVP = "encode,digest,evp_enc,evp_key,evp_acnf,"+ -
-        "e_des,e_bf,e_idea,e_des3,"+ -
+        "e_des,e_bf,e_idea,e_des3,e_camellia,e_seed,"+ -
         "e_rc4,e_aes,names,"+ -
         "e_xcbc_d,e_rc2,e_cast,e_rc5"
 $ LIB_EVP_2 = "m_null,m_md2,m_md4,m_md5,m_sha,m_sha1," + -
-        "m_dss,m_dss1,m_mdc2,m_ripemd,"+ -
+        "m_dss,m_dss1,m_mdc2,m_ripemd,m_ecdsa,"+ -
         "p_open,p_seal,p_sign,p_verify,p_lib,p_enc,p_dec,"+ -
         "bio_md,bio_b64,bio_enc,evp_err,e_null,"+ -
         "c_all,c_allc,c_alld,evp_lib,bio_ok,"+-
@@ -233,8 +245,8 @@ $ LIB_ASN1 = "a_object,a_bitstr,a_utctm,a_gentm,a_time,a_int,a_octet,"+ -
 $ LIB_ASN1_2 = "t_req,t_x509,t_x509a,t_crl,t_pkey,t_spki,t_bitst,"+ -
         "tasn_new,tasn_fre,tasn_enc,tasn_dec,tasn_utl,tasn_typ,"+ -
         "f_int,f_string,n_pkey,"+ -
-        "f_enum,a_hdr,x_pkey,a_bool,x_exten,"+ -
-        "asn1_par,asn1_lib,asn1_err,a_meth,a_bytes,a_strnid,"+ -
+        "f_enum,a_hdr,x_pkey,a_bool,x_exten,asn_mime,"+ -
+        "asn1_gen,asn1_par,asn1_lib,asn1_err,a_meth,a_bytes,a_strnid,"+ -
         "evp_asn1,asn_pack,p5_pbe,p5_pbev2,p8_pkey,asn_moid"
 $ LIB_PEM = "pem_sign,pem_seal,pem_info,pem_lib,pem_all,pem_err,"+ -
         "pem_x509,pem_xaux,pem_oth,pem_pk8,pem_pkey"
@@ -243,11 +255,13 @@ $ LIB_X509 = "x509_def,x509_d2,x509_r2x,x509_cmp,"+ -
         "x509_set,x509cset,x509rset,x509_err,"+ -
         "x509name,x509_v3,x509_ext,x509_att,"+ -
         "x509type,x509_lu,x_all,x509_txt,"+ -
-        "x509_trs,by_file,by_dir"
+        "x509_trs,by_file,by_dir,x509_vpm"
 $ LIB_X509V3 = "v3_bcons,v3_bitst,v3_conf,v3_extku,v3_ia5,v3_lib,"+ -
         "v3_prn,v3_utl,v3err,v3_genn,v3_alt,v3_skey,v3_akey,v3_pku,"+ -
         "v3_int,v3_enum,v3_sxnet,v3_cpols,v3_crld,v3_purp,v3_info,"+ -
-        "v3_ocsp,v3_akeya,v3_pcia,v3_pci"
+        "v3_ocsp,v3_akeya,v3_pmaps,v3_pcons,v3_ncons,v3_pcia,v3_pci,"+ -
+        "pcy_cache,pcy_node,pcy_data,pcy_map,pcy_tree,pcy_lib,"+ -
+        "v3_asid,v3_addr"
 $ LIB_CONF = "conf_err,conf_lib,conf_api,conf_def,conf_mod,conf_mall,conf_sap"
 $ LIB_TXT_DB = "txt_db"
 $ LIB_PKCS7 = "pk7_asn1,pk7_lib,pkcs7err,pk7_doit,pk7_smime,pk7_attr,"+ -
@@ -262,13 +276,17 @@ $ LIB_OCSP = "ocsp_asn,ocsp_ext,ocsp_ht,ocsp_lib,ocsp_cl,"+ -
 $ LIB_UI_COMPAT = ",ui_compat"
 $ LIB_UI = "ui_err,ui_lib,ui_openssl,ui_util"+LIB_UI_COMPAT
 $ LIB_KRB5 = "krb5_asn"
+$ LIB_STORE = "str_err,str_lib,str_meth,str_mem"
+$ LIB_CMS = "cms_lib,cms_asn1,cms_att,cms_io,cms_smime,cms_err,"+ -
+        "cms_sd,cms_dd,cms_cd,cms_env,cms_enc,cms_ess"
+$ LIB_PQUEUE = "pqueue"
 $!
 $! Setup exceptional compilations
 $!
 $ ! Add definitions for no threads on OpenVMS 7.1 and higher
 $ COMPILEWITH_CC3 = ",bss_rtcp,"
 $ ! Disable the DOLLARID warning
-$ COMPILEWITH_CC4 = ",a_utctm,bss_log,o_time,"
+$ COMPILEWITH_CC4 = ",a_utctm,bss_log,o_time,o_dir"
 $ ! Disable disjoint optimization
 $ COMPILEWITH_CC5 = ",md2_dgst,md4_dgst,md5_dgst,mdc2dgst," + -
                     "sha_dgst,sha1dgst,rmd_dgst,bf_enc,"
diff --git a/src/lib/libssl/src/crypto/crypto.h b/src/lib/libssl/src/crypto/crypto.h
index 22fd939e65..d2b5ffe332 100644
--- a/src/lib/libssl/src/crypto/crypto.h
+++ b/src/lib/libssl/src/crypto/crypto.h
@@ -1,4 +1,57 @@
 /* crypto/crypto.h */
+/* ====================================================================
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -55,12 +108,19 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #ifndef HEADER_CRYPTO_H
 #define HEADER_CRYPTO_H
 
 #include <stdlib.h>
 
+#include <openssl/e_os2.h>
+
 #ifndef OPENSSL_NO_FP_API
 #include <stdio.h>
 #endif
@@ -68,6 +128,7 @@
 #include <openssl/stack.h>
 #include <openssl/safestack.h>
 #include <openssl/opensslv.h>
+#include <openssl/ossl_typ.h>
 
 #ifdef CHARSET_EBCDIC
 #include <openssl/ebcdic.h>
@@ -92,15 +153,39 @@ extern "C" {
 #define SSLEAY_PLATFORM         4
 #define SSLEAY_DIR              5
 
+/* Already declared in ossl_typ.h */
+#if 0
+typedef struct crypto_ex_data_st CRYPTO_EX_DATA;
+/* Called when a new object is created */
+typedef int CRYPTO_EX_new(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                                        int idx, long argl, void *argp);
+/* Called when an object is free()ed */
+typedef void CRYPTO_EX_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                                        int idx, long argl, void *argp);
+/* Called when we need to dup an object */
+typedef int CRYPTO_EX_dup(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from, void *from_d, 
+                                        int idx, long argl, void *argp);
+#endif
+
+/* A generic structure to pass assorted data in a expandable way */
+typedef struct openssl_item_st
+        {
+        int code;
+        void *value;            /* Not used for flag attributes */
+        size_t value_size;      /* Max size of value for output, length for input */
+        size_t *value_length;   /* Returned length of value for output */
+        } OPENSSL_ITEM;
+
+
 /* When changing the CRYPTO_LOCK_* list, be sure to maintin the text lock
  * names in cryptlib.c
  */
 
-#define CRYPTO_LOCK_ERR                 1
-#define CRYPTO_LOCK_EX_DATA             2
-#define CRYPTO_LOCK_X509                3
-#define CRYPTO_LOCK_X509_INFO           4
-#define CRYPTO_LOCK_X509_PKEY           5
+#define CRYPTO_LOCK_ERR                 1
+#define CRYPTO_LOCK_EX_DATA             2
+#define CRYPTO_LOCK_X509                3
+#define CRYPTO_LOCK_X509_INFO           4
+#define CRYPTO_LOCK_X509_PKEY           5
 #define CRYPTO_LOCK_X509_CRL            6
 #define CRYPTO_LOCK_X509_REQ            7
 #define CRYPTO_LOCK_DSA                 8
@@ -127,10 +212,14 @@ extern "C" {
 #define CRYPTO_LOCK_DYNLOCK             29
 #define CRYPTO_LOCK_ENGINE              30
 #define CRYPTO_LOCK_UI                  31
-#define CRYPTO_LOCK_HWCRHK              32 /* This is a HACK which will disappear in 0.9.8 */
-#define CRYPTO_LOCK_FIPS                33
-#define CRYPTO_LOCK_FIPS2               34
-#define CRYPTO_NUM_LOCKS                35
+#define CRYPTO_LOCK_ECDSA               32
+#define CRYPTO_LOCK_EC                  33
+#define CRYPTO_LOCK_ECDH                34
+#define CRYPTO_LOCK_BN                  35
+#define CRYPTO_LOCK_EC_PRE_COMP         36
+#define CRYPTO_LOCK_STORE               37
+#define CRYPTO_LOCK_COMP                38
+#define CRYPTO_NUM_LOCKS                39
 
 #define CRYPTO_LOCK             1
 #define CRYPTO_UNLOCK           2
@@ -191,21 +280,11 @@ typedef struct
 /* predec of the BIO type */
 typedef struct bio_st BIO_dummy;
 
-typedef struct crypto_ex_data_st
+struct crypto_ex_data_st
         {
         STACK *sk;
         int dummy; /* gcc is screwing up this data structure :-( */
-        } CRYPTO_EX_DATA;
-
-/* Called when a new object is created */
-typedef int CRYPTO_EX_new(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
-                                        int idx, long argl, void *argp);
-/* Called when an object is free()ed */
-typedef void CRYPTO_EX_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
-                                        int idx, long argl, void *argp);
-/* Called when we need to dup an object */
-typedef int CRYPTO_EX_dup(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from, void *from_d, 
-                                        int idx, long argl, void *argp);
+        };
 
 /* This stuff is basically class callback functions
  * The current classes are SSL_CTX, SSL, SSL_SESSION, and a few more */
@@ -237,6 +316,10 @@ DECLARE_STACK_OF(CRYPTO_EX_DATA_FUNCS)
 #define CRYPTO_EX_INDEX_ENGINE          9
 #define CRYPTO_EX_INDEX_X509            10
 #define CRYPTO_EX_INDEX_UI              11
+#define CRYPTO_EX_INDEX_ECDSA           12
+#define CRYPTO_EX_INDEX_ECDH            13
+#define CRYPTO_EX_INDEX_COMP            14
+#define CRYPTO_EX_INDEX_STORE           15
 
 /* Dynamically assigned indexes start from this value (don't use directly, use
  * via CRYPTO_ex_data_new_class). */
@@ -434,61 +517,10 @@ void CRYPTO_mem_leaks_cb(CRYPTO_MEM_LEAK_CB *cb);
 
 /* die if we have to */
 void OpenSSLDie(const char *file,int line,const char *assertion);
-#define OPENSSL_assert(e)       (void)((e) ? 0 : (OpenSSLDie(__FILE__, __LINE__, #e),1))
-
-#ifdef OPENSSL_FIPS
-#define FIPS_ERROR_IGNORED(alg) OpenSSLDie(__FILE__, __LINE__, \
-                alg " previous FIPS forbidden algorithm error ignored");
-
-#define FIPS_BAD_ABORT(alg) OpenSSLDie(__FILE__, __LINE__, \
-                #alg " Algorithm forbidden in FIPS mode");
-
-#ifdef OPENSSL_FIPS_STRICT
-#define FIPS_BAD_ALGORITHM(alg) FIPS_BAD_ABORT(alg)
-#else
-#define FIPS_BAD_ALGORITHM(alg) \
-        { \
-        FIPSerr(FIPS_F_HASH_FINAL,FIPS_R_NON_FIPS_METHOD); \
-        ERR_add_error_data(2, "Algorithm=", #alg); \
-        return 0; \
-        }
-#endif
-
-/* Low level digest API blocking macro */
-
-#define FIPS_NON_FIPS_MD_Init(alg) \
-        int alg##_Init(alg##_CTX *c) \
-                { \
-                if (FIPS_mode()) \
-                        FIPS_BAD_ALGORITHM(alg) \
-                return private_##alg##_Init(c); \
-                } \
-        int private_##alg##_Init(alg##_CTX *c)
-
-/* For ciphers the API often varies from cipher to cipher and each needs to
- * be treated as a special case. Variable key length ciphers (Blowfish, RC4,
- * CAST) however are very similar and can use a blocking macro.
- */
-
-#define FIPS_NON_FIPS_VCIPHER_Init(alg) \
-        void alg##_set_key(alg##_KEY *key, int len, const unsigned char *data) \
-                { \
-                if (FIPS_mode()) \
-                        FIPS_BAD_ABORT(alg) \
-                private_##alg##_set_key(key, len, data); \
-                } \
-        void private_##alg##_set_key(alg##_KEY *key, int len, \
-                                        const unsigned char *data)
-
-#else
-
-#define FIPS_NON_FIPS_VCIPHER_Init(alg) \
-        void alg##_set_key(alg##_KEY *key, int len, const unsigned char *data)
-
-#define FIPS_NON_FIPS_MD_Init(alg) \
-        int alg##_Init(alg##_CTX *c) 
+#define OPENSSL_assert(e)       (void)((e) ? 0 : (OpenSSLDie(__FILE__, __LINE__, #e),1))
 
-#endif /* def OPENSSL_FIPS */
+unsigned long *OPENSSL_ia32cap_loc(void);
+#define OPENSSL_ia32cap (*(OPENSSL_ia32cap_loc()))
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
diff --git a/src/lib/libssl/src/crypto/cversion.c b/src/lib/libssl/src/crypto/cversion.c
index beeeb14013..ea9f25fd16 100644
--- a/src/lib/libssl/src/crypto/cversion.c
+++ b/src/lib/libssl/src/crypto/cversion.c
@@ -56,10 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
-#include <stdio.h>
-#include <string.h>
 #include "cryptlib.h"
-#include <openssl/crypto.h>
 
 #ifndef NO_WINDOWS_BRAINDEATH
 #include "buildinf.h"
diff --git a/src/lib/libssl/src/crypto/des/cfb64ede.c b/src/lib/libssl/src/crypto/des/cfb64ede.c
index f3c6018528..de34ecceb9 100644
--- a/src/lib/libssl/src/crypto/des/cfb64ede.c
+++ b/src/lib/libssl/src/crypto/des/cfb64ede.c
@@ -152,8 +152,8 @@ void DES_ede3_cfb_encrypt(const unsigned char *in,unsigned char *out,
                           DES_cblock *ivec,int enc)
         {
         register DES_LONG d0,d1,v0,v1;
-        register long l=length;
-        register int num=numbits,n=(numbits+7)/8,i;
+        register unsigned long l=length,n=((unsigned int)numbits+7)/8;
+        register int num=numbits,i;
         DES_LONG ti[2];
         unsigned char *iv;
         unsigned char ovec[16];
diff --git a/src/lib/libssl/src/crypto/des/cfb_enc.c b/src/lib/libssl/src/crypto/des/cfb_enc.c
index 03cabb223c..720f29a28e 100644
--- a/src/lib/libssl/src/crypto/des/cfb_enc.c
+++ b/src/lib/libssl/src/crypto/des/cfb_enc.c
@@ -58,6 +58,7 @@
 
 #include "e_os.h"
 #include "des_locl.h"
+#include <assert.h>
 
 /* The input and output are loaded in multiples of 8 bits.
  * What this means is that if you hame numbits=12 and length=2
@@ -72,19 +73,29 @@ void DES_cfb_encrypt(const unsigned char *in, unsigned char *out, int numbits,
                      int enc)
         {
         register DES_LONG d0,d1,v0,v1;
-        register unsigned long l=length,n=(numbits+7)/8;
-        register int num=numbits,i;
+        register unsigned long l=length;
+        register int num=numbits/8,n=(numbits+7)/8,i,rem=numbits%8;
         DES_LONG ti[2];
         unsigned char *iv;
+#ifndef L_ENDIAN
         unsigned char ovec[16];
+#else
+        unsigned int  sh[4];
+        unsigned char *ovec=(unsigned char *)sh;
 
-        if (num > 64) return;
+        /* I kind of count that compiler optimizes away this assertioni,*/
+        assert (sizeof(sh[0])==4);      /* as this holds true for all,  */
+                                        /* but 16-bit platforms...      */
+                                        
+#endif
+
+        if (numbits<=0 || numbits > 64) return;
         iv = &(*ivec)[0];
         c2l(iv,v0);
         c2l(iv,v1);
         if (enc)
                 {
-                while (l >= n)
+                while (l >= (unsigned long)n)
                         {
                         l-=n;
                         ti[0]=v0;
@@ -98,35 +109,40 @@ void DES_cfb_encrypt(const unsigned char *in, unsigned char *out, int numbits,
                         out+=n;
                         /* 30-08-94 - eay - changed because l>>32 and
                          * l<<32 are bad under gcc :-( */
-                        if (num == 32)
+                        if (numbits == 32)
                                 { v0=v1; v1=d0; }
-                        else if (num == 64)
+                        else if (numbits == 64)
                                 { v0=d0; v1=d1; }
                         else
                                 {
+#ifndef L_ENDIAN
                                 iv=&ovec[0];
                                 l2c(v0,iv);
                                 l2c(v1,iv);
                                 l2c(d0,iv);
                                 l2c(d1,iv);
-                                /* shift ovec left most of the bits... */
-                                memmove(ovec,ovec+num/8,8+(num%8 ? 1 : 0));
-                                /* now the remaining bits */
-                                if(num%8 != 0)
+#else
+                                sh[0]=v0, sh[1]=v1, sh[2]=d0, sh[3]=d1;
+#endif
+                                if (rem==0)
+                                        memmove(ovec,ovec+num,8);
+                                else
                                         for(i=0 ; i < 8 ; ++i)
-                                                {
-                                                ovec[i]<<=num%8;
-                                                ovec[i]|=ovec[i+1]>>(8-num%8);
-                                                }
+                                                ovec[i]=ovec[i+num]<<rem |
+                                                        ovec[i+num+1]>>(8-rem);
+#ifdef L_ENDIAN
+                                v0=sh[0], v1=sh[1];
+#else
                                 iv=&ovec[0];
                                 c2l(iv,v0);
                                 c2l(iv,v1);
+#endif
                                 }
                         }
                 }
         else
                 {
-                while (l >= n)
+                while (l >= (unsigned long)n)
                         {
                         l-=n;
                         ti[0]=v0;
@@ -136,29 +152,34 @@ void DES_cfb_encrypt(const unsigned char *in, unsigned char *out, int numbits,
                         in+=n;
                         /* 30-08-94 - eay - changed because l>>32 and
                          * l<<32 are bad under gcc :-( */
-                        if (num == 32)
+                        if (numbits == 32)
                                 { v0=v1; v1=d0; }
-                        else if (num == 64)
+                        else if (numbits == 64)
                                 { v0=d0; v1=d1; }
                         else
                                 {
+#ifndef L_ENDIAN
                                 iv=&ovec[0];
                                 l2c(v0,iv);
                                 l2c(v1,iv);
                                 l2c(d0,iv);
                                 l2c(d1,iv);
-                                /* shift ovec left most of the bits... */
-                                memmove(ovec,ovec+num/8,8+(num%8 ? 1 : 0));
-                                /* now the remaining bits */
-                                if(num%8 != 0)
+#else
+                                sh[0]=v0, sh[1]=v1, sh[2]=d0, sh[3]=d1;
+#endif
+                                if (rem==0)
+                                        memmove(ovec,ovec+num,8);
+                                else
                                         for(i=0 ; i < 8 ; ++i)
-                                                {
-                                                ovec[i]<<=num%8;
-                                                ovec[i]|=ovec[i+1]>>(8-num%8);
-                                                }
+                                                ovec[i]=ovec[i+num]<<rem |
+                                                        ovec[i+num+1]>>(8-rem);
+#ifdef L_ENDIAN
+                                v0=sh[0], v1=sh[1];
+#else
                                 iv=&ovec[0];
                                 c2l(iv,v0);
                                 c2l(iv,v1);
+#endif
                                 }
                         d0^=ti[0];
                         d1^=ti[1];
diff --git a/src/lib/libssl/src/crypto/des/des.h b/src/lib/libssl/src/crypto/des/des.h
index 81bd874edd..7318593699 100644
--- a/src/lib/libssl/src/crypto/des/des.h
+++ b/src/lib/libssl/src/crypto/des/des.h
@@ -59,13 +59,13 @@
 #ifndef HEADER_DES_H
 #define HEADER_DES_H
 
+#include <openssl/e_os2.h>      /* OPENSSL_EXTERN, OPENSSL_NO_DES,
+                                   DES_LONG (via openssl/opensslconf.h */
+
 #ifdef OPENSSL_NO_DES
 #error DES is disabled.
 #endif
 
-#include <openssl/opensslconf.h> /* DES_LONG */
-#include <openssl/e_os2.h>      /* OPENSSL_EXTERN */
-
 #ifdef OPENSSL_BUILD_SHLIBCRYPTO
 # undef OPENSSL_EXTERN
 # define OPENSSL_EXTERN OPENSSL_EXPORT
@@ -130,7 +130,7 @@ OPENSSL_DECLARE_GLOBAL(int,DES_rw_mode);	/* defaults to DES_PCBC_MODE */
 #define DES_rw_mode OPENSSL_GLOBAL_REF(DES_rw_mode)
 
 const char *DES_options(void);
-void DES_ecb3_encrypt(const unsigned char *input, unsigned char *output,
+void DES_ecb3_encrypt(const_DES_cblock *input, DES_cblock *output,
                       DES_key_schedule *ks1,DES_key_schedule *ks2,
                       DES_key_schedule *ks3, int enc);
 DES_LONG DES_cbc_cksum(const unsigned char *input,DES_cblock *output,
@@ -197,9 +197,10 @@ void DES_ede3_ofb64_encrypt(const unsigned char *in,unsigned char *out,
                             long length,DES_key_schedule *ks1,
                             DES_key_schedule *ks2,DES_key_schedule *ks3,
                             DES_cblock *ivec,int *num);
-
+#if 0
 void DES_xwhite_in2out(const_DES_cblock *DES_key,const_DES_cblock *in_white,
                        DES_cblock *out_white);
+#endif
 
 int DES_enc_read(int fd,void *buf,int len,DES_key_schedule *sched,
                  DES_cblock *iv);
diff --git a/src/lib/libssl/src/crypto/des/des_enc.c b/src/lib/libssl/src/crypto/des/des_enc.c
index 6a49ec4a55..53705b9f5b 100644
--- a/src/lib/libssl/src/crypto/des/des_enc.c
+++ b/src/lib/libssl/src/crypto/des/des_enc.c
@@ -58,9 +58,6 @@
 
 #include "des_locl.h"
 
-#ifndef OPENSSL_FIPS
-#ifndef OPENBSD_DES_ASM
-
 void DES_encrypt1(DES_LONG *data, DES_key_schedule *ks, int enc)
         {
         register DES_LONG l,r,t,u;
@@ -291,12 +288,8 @@ void DES_decrypt3(DES_LONG *data, DES_key_schedule *ks1,
         data[1]=r;
         }
 
-#endif /* ndef OPENSSL_FIPS */
-
 #ifndef DES_DEFAULT_OPTIONS
 
-#if !defined(OPENSSL_FIPS_DES_ASM)
-
 #undef CBC_ENC_C__DONT_UPDATE_IV
 #include "ncbc_enc.c" /* DES_ncbc_encrypt */
 
@@ -412,6 +405,4 @@ void DES_ede3_cbc_encrypt(const unsigned char *input, unsigned char *output,
         tin[0]=tin[1]=0;
         }
 
-#endif /* !defined(OPENSSL_FIPS_DES_ASM) */
-
 #endif /* DES_DEFAULT_OPTIONS */
diff --git a/src/lib/libssl/src/crypto/des/des_locl.h b/src/lib/libssl/src/crypto/des/des_locl.h
index 8f04b18c50..4b9ecff233 100644
--- a/src/lib/libssl/src/crypto/des/des_locl.h
+++ b/src/lib/libssl/src/crypto/des/des_locl.h
@@ -160,7 +160,7 @@
                                 } \
                         }
 
-#if defined(OPENSSL_SYS_WIN32) && defined(_MSC_VER)
+#if (defined(OPENSSL_SYS_WIN32) && defined(_MSC_VER)) || defined(__ICC)
 #define ROTATE(a,n)     (_lrotr(a,n))
 #elif defined(__GNUC__) && __GNUC__>=2 && !defined(__STRICT_ANSI__) && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM) && !defined(PEDANTIC)
 # if defined(__i386) || defined(__i386__) || defined(__x86_64) || defined(__x86_64__)
diff --git a/src/lib/libssl/src/crypto/des/des_old.c b/src/lib/libssl/src/crypto/des/des_old.c
index 88e9802aad..7c33ed7a93 100644
--- a/src/lib/libssl/src/crypto/des/des_old.c
+++ b/src/lib/libssl/src/crypto/des/des_old.c
@@ -84,7 +84,7 @@ void _ossl_old_des_ecb3_encrypt(_ossl_old_des_cblock *input,_ossl_old_des_cblock
         des_key_schedule ks1,des_key_schedule ks2,
         des_key_schedule ks3, int enc)
         {
-        DES_ecb3_encrypt((const unsigned char *)input, (unsigned char *)output,
+        DES_ecb3_encrypt((const_DES_cblock *)input, output,
                 (DES_key_schedule *)ks1, (DES_key_schedule *)ks2,
                 (DES_key_schedule *)ks3, enc);
         }
@@ -169,11 +169,13 @@ void _ossl_old_des_ede3_ofb64_encrypt(unsigned char *in, unsigned char *out,
                 (DES_key_schedule *)ks3, ivec, num);
         }
 
+#if 0 /* broken code, preserved just in case anyone specifically looks for this */
 void _ossl_old_des_xwhite_in2out(_ossl_old_des_cblock (*des_key), _ossl_old_des_cblock (*in_white),
         _ossl_old_des_cblock (*out_white))
         {
         DES_xwhite_in2out(des_key, in_white, out_white);
         }
+#endif
 
 int _ossl_old_des_enc_read(int fd,char *buf,int len,des_key_schedule sched,
         _ossl_old_des_cblock *iv)
diff --git a/src/lib/libssl/src/crypto/des/des_old.h b/src/lib/libssl/src/crypto/des/des_old.h
index 1d8bf65101..8665ba4e7e 100644
--- a/src/lib/libssl/src/crypto/des/des_old.h
+++ b/src/lib/libssl/src/crypto/des/des_old.h
@@ -91,6 +91,8 @@
 #ifndef HEADER_DES_OLD_H
 #define HEADER_DES_OLD_H
 
+#include <openssl/e_os2.h>      /* OPENSSL_EXTERN, OPENSSL_NO_DES, DES_LONG */
+
 #ifdef OPENSSL_NO_DES
 #error DES is disabled.
 #endif
@@ -103,8 +105,6 @@
 #error <openssl/des_old.h> replaces <kerberos/des.h>.
 #endif
 
-#include <openssl/opensslconf.h> /* DES_LONG */
-#include <openssl/e_os2.h>      /* OPENSSL_EXTERN */
 #include <openssl/symhacks.h>
 
 #ifdef OPENSSL_BUILD_SHLIBCRYPTO
@@ -116,6 +116,10 @@
 extern "C" {
 #endif
 
+#ifdef _
+#undef _
+#endif
+
 typedef unsigned char _ossl_old_des_cblock[8];
 typedef struct _ossl_old_des_ks_struct
         {
@@ -171,9 +175,9 @@ typedef struct _ossl_old_des_ks_struct
         DES_enc_write((f),(b),(l),&(k),(iv))
 #define des_fcrypt(b,s,r)\
         DES_fcrypt((b),(s),(r))
+#if 0
 #define des_crypt(b,s)\
         DES_crypt((b),(s))
-#if 0
 #if !defined(PERL5) && !defined(__FreeBSD__) && !defined(NeXT) && !defined(__OpenBSD__)
 #define crypt(b,s)\
         DES_crypt((b),(s))
@@ -360,9 +364,10 @@ void _ossl_old_des_ede3_cfb64_encrypt(unsigned char *in, unsigned char *out,
 void _ossl_old_des_ede3_ofb64_encrypt(unsigned char *in, unsigned char *out,
         long length, _ossl_old_des_key_schedule ks1, _ossl_old_des_key_schedule ks2,
         _ossl_old_des_key_schedule ks3, _ossl_old_des_cblock *ivec, int *num);
-
+#if 0
 void _ossl_old_des_xwhite_in2out(_ossl_old_des_cblock (*des_key), _ossl_old_des_cblock (*in_white),
         _ossl_old_des_cblock (*out_white));
+#endif
 
 int _ossl_old_des_enc_read(int fd,char *buf,int len,_ossl_old_des_key_schedule sched,
         _ossl_old_des_cblock *iv);
diff --git a/src/lib/libssl/src/crypto/des/des_opts.c b/src/lib/libssl/src/crypto/des/des_opts.c
index 79278b920e..2df82962c5 100644
--- a/src/lib/libssl/src/crypto/des/des_opts.c
+++ b/src/lib/libssl/src/crypto/des/des_opts.c
@@ -71,7 +71,11 @@
 #include <io.h>
 extern void exit();
 #endif
+
+#ifndef OPENSSL_SYS_NETWARE
 #include <signal.h>
+#endif
+
 #ifndef _IRIX
 #include <time.h>
 #endif
diff --git a/src/lib/libssl/src/crypto/des/des_ver.h b/src/lib/libssl/src/crypto/des/des_ver.h
index 379bbadda2..d1ada258a6 100644
--- a/src/lib/libssl/src/crypto/des/des_ver.h
+++ b/src/lib/libssl/src/crypto/des/des_ver.h
@@ -67,5 +67,5 @@
 #define DES_version OSSL_DES_version
 #define libdes_version OSSL_libdes_version
 
-OPENSSL_EXTERN const char *OSSL_DES_version;    /* SSLeay version string */
-OPENSSL_EXTERN const char *OSSL_libdes_version; /* old libdes version string */
+OPENSSL_EXTERN const char OSSL_DES_version[];   /* SSLeay version string */
+OPENSSL_EXTERN const char OSSL_libdes_version[];        /* old libdes version string */
diff --git a/src/lib/libssl/src/crypto/des/destest.c b/src/lib/libssl/src/crypto/des/destest.c
index e3e9d77f14..64b92a34fe 100644
--- a/src/lib/libssl/src/crypto/des/destest.c
+++ b/src/lib/libssl/src/crypto/des/destest.c
@@ -84,7 +84,7 @@ int main(int argc, char *argv[])
 #else
 #include <openssl/des.h>
 
-#define crypt(c,s) (des_crypt((c),(s)))
+#define crypt(c,s) (DES_crypt((c),(s)))
 
 /* tisk tisk - the test keys don't all have odd parity :-( */
 /* test data */
@@ -333,7 +333,8 @@ static int cfb64_test(unsigned char *cfb_cipher);
 static int ede_cfb64_test(unsigned char *cfb_cipher);
 int main(int argc, char *argv[])
         {
-        int i,j,err=0;
+        int j,err=0;
+        unsigned int i;
         des_cblock in,out,outin,iv3,iv2;
         des_key_schedule ks,ks2,ks3;
         unsigned char cbc_in[40];
@@ -391,7 +392,7 @@ int main(int argc, char *argv[])
         DES_ede3_cbcm_encrypt(cbc_out,cbc_in,i,&ks,&ks2,&ks3,&iv3,&iv2,DES_DECRYPT);
         if (memcmp(cbc_in,cbc_data,strlen((char *)cbc_data)+1) != 0)
                 {
-                int n;
+                unsigned int n;
 
                 printf("des_ede3_cbcm_encrypt decrypt error\n");
                 for(n=0 ; n < i ; ++n)
@@ -439,8 +440,8 @@ int main(int argc, char *argv[])
                 memcpy(in,plain_data[i],8);
                 memset(out,0,8);
                 memset(outin,0,8);
-                des_ecb2_encrypt(in,out,ks,ks2,DES_ENCRYPT);
-                des_ecb2_encrypt(out,outin,ks,ks2,DES_DECRYPT);
+                des_ecb2_encrypt(&in,&out,ks,ks2,DES_ENCRYPT);
+                des_ecb2_encrypt(&out,&outin,ks,ks2,DES_DECRYPT);
 
                 if (memcmp(out,cipher_ecb2[i],8) != 0)
                         {
@@ -540,7 +541,7 @@ int main(int argc, char *argv[])
         if (memcmp(cbc_out,cbc3_ok,
                 (unsigned int)(strlen((char *)cbc_data)+1+7)/8*8) != 0)
                 {
-                int n;
+                unsigned int n;
 
                 printf("des_ede3_cbc_encrypt encrypt error\n");
                 for(n=0 ; n < i ; ++n)
@@ -556,7 +557,7 @@ int main(int argc, char *argv[])
         des_ede3_cbc_encrypt(cbc_out,cbc_in,i,ks,ks2,ks3,&iv3,DES_DECRYPT);
         if (memcmp(cbc_in,cbc_data,strlen((char *)cbc_data)+1) != 0)
                 {
-                int n;
+                unsigned int n;
 
                 printf("des_ede3_cbc_encrypt decrypt error\n");
                 for(n=0 ; n < i ; ++n)
@@ -820,6 +821,9 @@ plain[8+4], plain[8+5], plain[8+6], plain[8+7]);
                 printf("fast crypt error, %s should be yA1Rp/1hZXIJk\n",str);
                 err=1;
                 }
+#ifdef OPENSSL_SYS_NETWARE
+    if (err) printf("ERROR: %d\n", err);
+#endif
         printf("\n");
         return(err);
         }
diff --git a/src/lib/libssl/src/crypto/des/ecb3_enc.c b/src/lib/libssl/src/crypto/des/ecb3_enc.c
index fa0c9c4d4f..c3437bc606 100644
--- a/src/lib/libssl/src/crypto/des/ecb3_enc.c
+++ b/src/lib/libssl/src/crypto/des/ecb3_enc.c
@@ -58,13 +58,15 @@
 
 #include "des_locl.h"
 
-void DES_ecb3_encrypt(const unsigned char *in, unsigned char *out,
+void DES_ecb3_encrypt(const_DES_cblock *input, DES_cblock *output,
                       DES_key_schedule *ks1, DES_key_schedule *ks2,
                       DES_key_schedule *ks3,
              int enc)
         {
         register DES_LONG l0,l1;
         DES_LONG ll[2];
+        const unsigned char *in = &(*input)[0];
+        unsigned char *out = &(*output)[0];
 
         c2l(in,l0);
         c2l(in,l1);
diff --git a/src/lib/libssl/src/crypto/des/ecb_enc.c b/src/lib/libssl/src/crypto/des/ecb_enc.c
index 784aa5ba23..00d5b91e8c 100644
--- a/src/lib/libssl/src/crypto/des/ecb_enc.c
+++ b/src/lib/libssl/src/crypto/des/ecb_enc.c
@@ -62,8 +62,8 @@
 #include <openssl/opensslv.h>
 #include <openssl/bio.h>
 
-OPENSSL_GLOBAL const char *libdes_version="libdes" OPENSSL_VERSION_PTEXT;
-OPENSSL_GLOBAL const char *DES_version="DES" OPENSSL_VERSION_PTEXT;
+OPENSSL_GLOBAL const char libdes_version[]="libdes" OPENSSL_VERSION_PTEXT;
+OPENSSL_GLOBAL const char DES_version[]="DES" OPENSSL_VERSION_PTEXT;
 
 const char *DES_options(void)
         {
diff --git a/src/lib/libssl/src/crypto/des/ede_cbcm_enc.c b/src/lib/libssl/src/crypto/des/ede_cbcm_enc.c
index fa45aa272b..adfcb75cf3 100644
--- a/src/lib/libssl/src/crypto/des/ede_cbcm_enc.c
+++ b/src/lib/libssl/src/crypto/des/ede_cbcm_enc.c
@@ -68,6 +68,8 @@ http://www.cs.technion.ac.il/users/wwwb/cgi-bin/tr-get.cgi/1998/CS/CS0928.ps.gz
 
 */
 
+#include <openssl/opensslconf.h> /* To see if OPENSSL_NO_DESCBCM is defined */
+
 #ifndef OPENSSL_NO_DESCBCM
 #include "des_locl.h"
 
diff --git a/src/lib/libssl/src/crypto/des/fcrypt.c b/src/lib/libssl/src/crypto/des/fcrypt.c
index 2758c32656..ccbdff250f 100644
--- a/src/lib/libssl/src/crypto/des/fcrypt.c
+++ b/src/lib/libssl/src/crypto/des/fcrypt.c
@@ -58,9 +58,6 @@ static unsigned const char cov_2char[64]={
 0x73,0x74,0x75,0x76,0x77,0x78,0x79,0x7A
 };
 
-void fcrypt_body(DES_LONG *out,DES_key_schedule *ks,
-                 DES_LONG Eswap0, DES_LONG Eswap1);
-
 char *DES_crypt(const char *buf, const char *salt)
         {
         static char buff[14];
diff --git a/src/lib/libssl/src/crypto/des/read2pwd.c b/src/lib/libssl/src/crypto/des/read2pwd.c
index 3a63c4016c..ee6969f76e 100644
--- a/src/lib/libssl/src/crypto/des/read2pwd.c
+++ b/src/lib/libssl/src/crypto/des/read2pwd.c
@@ -112,6 +112,7 @@
 #include <string.h>
 #include <openssl/des.h>
 #include <openssl/ui.h>
+#include <openssl/crypto.h>
 
 int DES_read_password(DES_cblock *key, const char *prompt, int verify)
         {
diff --git a/src/lib/libssl/src/crypto/des/set_key.c b/src/lib/libssl/src/crypto/des/set_key.c
index 8881d46a7a..a43ef3c881 100644
--- a/src/lib/libssl/src/crypto/des/set_key.c
+++ b/src/lib/libssl/src/crypto/des/set_key.c
@@ -65,8 +65,6 @@
  */
 #include "des_locl.h"
 
-#ifndef OPENSSL_FIPS
-
 OPENSSL_IMPLEMENT_GLOBAL(int,DES_check_key);    /* defaults to false */
 
 static const unsigned char odd_parity[256]={
@@ -89,7 +87,7 @@ static const unsigned char odd_parity[256]={
 
 void DES_set_odd_parity(DES_cblock *key)
         {
-        int i;
+        unsigned int i;
 
         for (i=0; i<DES_KEY_SZ; i++)
                 (*key)[i]=odd_parity[(*key)[i]];
@@ -97,7 +95,7 @@ void DES_set_odd_parity(DES_cblock *key)
 
 int DES_check_key_parity(const_DES_cblock *key)
         {
-        int i;
+        unsigned int i;
 
         for (i=0; i<DES_KEY_SZ; i++)
                 {
@@ -117,7 +115,7 @@ int DES_check_key_parity(const_DES_cblock *key)
  * (and actual cblock values).
  */
 #define NUM_WEAK_KEY    16
-static DES_cblock weak_keys[NUM_WEAK_KEY]={
+static const DES_cblock weak_keys[NUM_WEAK_KEY]={
         /* weak keys */
         {0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01},
         {0xFE,0xFE,0xFE,0xFE,0xFE,0xFE,0xFE,0xFE},
@@ -407,5 +405,3 @@ void des_fixup_key_parity(des_cblock *key)
         des_set_odd_parity(key);
         }
 */
-
-#endif /* ndef OPENSSL_FIPS */
diff --git a/src/lib/libssl/src/crypto/des/speed.c b/src/lib/libssl/src/crypto/des/speed.c
index 48fc1d49fc..1616f4b7c9 100644
--- a/src/lib/libssl/src/crypto/des/speed.c
+++ b/src/lib/libssl/src/crypto/des/speed.c
@@ -69,7 +69,11 @@
 #include OPENSSL_UNISTD_IO
 OPENSSL_DECLARE_EXIT
 
+#ifndef OPENSSL_SYS_NETWARE
 #include <signal.h>
+#define crypt(c,s) (des_crypt((c),(s)))
+#endif
+
 #ifndef _IRIX
 #include <time.h>
 #endif
diff --git a/src/lib/libssl/src/crypto/des/str2key.c b/src/lib/libssl/src/crypto/des/str2key.c
index 0373db469c..9c2054bda6 100644
--- a/src/lib/libssl/src/crypto/des/str2key.c
+++ b/src/lib/libssl/src/crypto/des/str2key.c
@@ -57,6 +57,7 @@
  */
 
 #include "des_locl.h"
+#include <openssl/crypto.h>
 
 void DES_string_to_key(const char *str, DES_cblock *key)
         {
diff --git a/src/lib/libssl/src/crypto/des/xcbc_enc.c b/src/lib/libssl/src/crypto/des/xcbc_enc.c
index 47246eb466..dc0c761b71 100644
--- a/src/lib/libssl/src/crypto/des/xcbc_enc.c
+++ b/src/lib/libssl/src/crypto/des/xcbc_enc.c
@@ -60,6 +60,7 @@
 
 /* RSA's DESX */
 
+#if 0 /* broken code, preserved just in case anyone specifically looks for this */
 static unsigned char desx_white_in2out[256]={
 0xBD,0x56,0xEA,0xF2,0xA2,0xF1,0xAC,0x2A,0xB0,0x93,0xD1,0x9C,0x1B,0x33,0xFD,0xD0,
 0x30,0x04,0xB6,0xDC,0x7D,0xDF,0x32,0x4B,0xF7,0xCB,0x45,0x9B,0x31,0xBB,0x21,0x5A,
@@ -98,7 +99,7 @@ void DES_xwhite_in2out(const_DES_cblock *des_key, const_DES_cblock *in_white,
                 }
 
         out0=out[0];
-        out1=out[i];
+        out1=out[i]; /* BUG: out-of-bounds read */
         for (i=0; i<8; i++)
                 {
                 out[i]=in[i]^desx_white_in2out[out0^out1];
@@ -106,6 +107,7 @@ void DES_xwhite_in2out(const_DES_cblock *des_key, const_DES_cblock *in_white,
                 out1=(int)out[i&0x07];
                 }
         }
+#endif
 
 void DES_xcbc_encrypt(const unsigned char *in, unsigned char *out,
                       long length, DES_key_schedule *schedule,
diff --git a/src/lib/libssl/src/crypto/dh/dh.h b/src/lib/libssl/src/crypto/dh/dh.h
index 582b34329f..0afabc7dd3 100644
--- a/src/lib/libssl/src/crypto/dh/dh.h
+++ b/src/lib/libssl/src/crypto/dh/dh.h
@@ -59,6 +59,8 @@
 #ifndef HEADER_DH_H
 #define HEADER_DH_H
 
+#include <openssl/e_os2.h>
+
 #ifdef OPENSSL_NO_DH
 #error DH is disabled.
 #endif
@@ -66,11 +68,14 @@
 #ifndef OPENSSL_NO_BIO
 #include <openssl/bio.h>
 #endif
-#include <openssl/bn.h>
-#include <openssl/crypto.h>
 #include <openssl/ossl_typ.h>
+#ifndef OPENSSL_NO_DEPRECATED
+#include <openssl/bn.h>
+#endif
         
-#define OPENSSL_DH_MAX_MODULUS_BITS     10000
+#ifndef OPENSSL_DH_MAX_MODULUS_BITS
+# define OPENSSL_DH_MAX_MODULUS_BITS    10000
+#endif
 
 #define DH_FLAG_CACHE_MONT_P     0x01
 #define DH_FLAG_NO_EXP_CONSTTIME 0x02 /* new with 0.9.7h; the built-in DH
@@ -85,9 +90,12 @@
 extern "C" {
 #endif
 
-typedef struct dh_st DH;
+/* Already defined in ossl_typ.h */
+/* typedef struct dh_st DH; */
+/* typedef struct dh_method DH_METHOD; */
 
-typedef struct dh_method {
+struct dh_method
+        {
         const char *name;
         /* Methods here */
         int (*generate_key)(DH *dh);
@@ -100,7 +108,9 @@ typedef struct dh_method {
         int (*finish)(DH *dh);
         int flags;
         char *app_data;
-} DH_METHOD;
+        /* If this is non-NULL, it will be used to generate parameters */
+        int (*generate_params)(DH *dh, int prime_len, int generator, BN_GENCB *cb);
+        };
 
 struct dh_st
         {
@@ -115,7 +125,7 @@ struct dh_st
         BIGNUM *priv_key;       /* x */
 
         int flags;
-        char *method_mont_p;
+        BN_MONT_CTX *method_mont_p;
         /* Place holders if we want to do X9.42 DH */
         BIGNUM *q;
         BIGNUM *j;
@@ -147,21 +157,13 @@ struct dh_st
    this for backward compatibility: */
 #define DH_CHECK_P_NOT_STRONG_PRIME     DH_CHECK_P_NOT_SAFE_PRIME
 
-#define DHparams_dup(x) (DH *)ASN1_dup((int (*)())i2d_DHparams, \
-                (char *(*)())d2i_DHparams,(char *)(x))
+#define DHparams_dup(x) ASN1_dup_of_const(DH,i2d_DHparams,d2i_DHparams,x)
 #define d2i_DHparams_fp(fp,x) (DH *)ASN1_d2i_fp((char *(*)())DH_new, \
                 (char *(*)())d2i_DHparams,(fp),(unsigned char **)(x))
 #define i2d_DHparams_fp(fp,x) ASN1_i2d_fp(i2d_DHparams,(fp), \
                 (unsigned char *)(x))
-#define d2i_DHparams_bio(bp,x) (DH *)ASN1_d2i_bio((char *(*)())DH_new, \
-                (char *(*)())d2i_DHparams,(bp),(unsigned char **)(x))
-#ifdef  __cplusplus
-#define i2d_DHparams_bio(bp,x) ASN1_i2d_bio((int (*)())i2d_DHparams,(bp), \
-                (unsigned char *)(x))
-#else
-#define i2d_DHparams_bio(bp,x) ASN1_i2d_bio(i2d_DHparams,(bp), \
-                (unsigned char *)(x))
-#endif
+#define d2i_DHparams_bio(bp,x) ASN1_d2i_bio_of(DH,DH_new,d2i_DHparams,bp,x)
+#define i2d_DHparams_bio(bp,x) ASN1_i2d_bio_of_const(DH,i2d_DHparams,bp,x)
 
 const DH_METHOD *DH_OpenSSL(void);
 
@@ -178,8 +180,16 @@ int DH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
              CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 int DH_set_ex_data(DH *d, int idx, void *arg);
 void *DH_get_ex_data(DH *d, int idx);
+
+/* Deprecated version */
+#ifndef OPENSSL_NO_DEPRECATED
 DH *    DH_generate_parameters(int prime_len,int generator,
                 void (*callback)(int,int,void *),void *cb_arg);
+#endif /* !defined(OPENSSL_NO_DEPRECATED) */
+
+/* New version */
+int     DH_generate_parameters_ex(DH *dh, int prime_len,int generator, BN_GENCB *cb);
+
 int     DH_check(const DH *dh,int *codes);
 int     DH_check_pub_key(const DH *dh,const BIGNUM *pub_key, int *codes);
 int     DH_generate_key(DH *dh);
@@ -204,15 +214,18 @@ void ERR_load_DH_strings(void);
 /* Error codes for the DH functions. */
 
 /* Function codes. */
+#define DH_F_COMPUTE_KEY                                 102
 #define DH_F_DHPARAMS_PRINT                              100
 #define DH_F_DHPARAMS_PRINT_FP                           101
-#define DH_F_DH_COMPUTE_KEY                              102
-#define DH_F_DH_GENERATE_KEY                             103
-#define DH_F_DH_GENERATE_PARAMETERS                      104
+#define DH_F_DH_BUILTIN_GENPARAMS                        106
 #define DH_F_DH_NEW_METHOD                               105
+#define DH_F_GENERATE_KEY                                103
+#define DH_F_GENERATE_PARAMETERS                         104
 
 /* Reason codes. */
 #define DH_R_BAD_GENERATOR                               101
+#define DH_R_INVALID_PUBKEY                              102
+#define DH_R_MODULUS_TOO_LARGE                           103
 #define DH_R_NO_PRIVATE_VALUE                            100
 #define DH_R_INVALID_PUBKEY                              102
 #define DH_R_MODULUS_TOO_LARGE                           103
diff --git a/src/lib/libssl/src/crypto/dh/dh_check.c b/src/lib/libssl/src/crypto/dh/dh_check.c
index 17debff62d..b846913004 100644
--- a/src/lib/libssl/src/crypto/dh/dh_check.c
+++ b/src/lib/libssl/src/crypto/dh/dh_check.c
@@ -62,7 +62,7 @@
 #include <openssl/dh.h>
 
 /* Check that p is a safe prime and
- * if g is 2, 3 or 5, check that is is a suitable generator
+ * if g is 2, 3 or 5, check that it is a suitable generator
  * where
  * for 2, p mod 24 == 11
  * for 3, p mod 12 == 5
@@ -70,8 +70,6 @@
  * should hold.
  */
 
-#ifndef OPENSSL_FIPS
-
 int DH_check(const DH *dh, int *ret)
         {
         int ok=0;
@@ -106,12 +104,12 @@ int DH_check(const DH *dh, int *ret)
         else
                 *ret|=DH_UNABLE_TO_CHECK_GENERATOR;
 
-        if (!BN_is_prime(dh->p,BN_prime_checks,NULL,ctx,NULL))
+        if (!BN_is_prime_ex(dh->p,BN_prime_checks,ctx,NULL))
                 *ret|=DH_CHECK_P_NOT_PRIME;
         else
                 {
                 if (!BN_rshift1(q,dh->p)) goto err;
-                if (!BN_is_prime(q,BN_prime_checks,NULL,ctx,NULL))
+                if (!BN_is_prime_ex(q,BN_prime_checks,ctx,NULL))
                         *ret|=DH_CHECK_P_NOT_SAFE_PRIME;
                 }
         ok=1;
@@ -142,5 +140,3 @@ err:
         if (q != NULL) BN_free(q);
         return(ok);
         }
-
-#endif
diff --git a/src/lib/libssl/src/crypto/dh/dh_err.c b/src/lib/libssl/src/crypto/dh/dh_err.c
index 611067ef4a..b2361c7389 100644
--- a/src/lib/libssl/src/crypto/dh/dh_err.c
+++ b/src/lib/libssl/src/crypto/dh/dh_err.c
@@ -70,18 +70,21 @@
 
 static ERR_STRING_DATA DH_str_functs[]=
         {
+{ERR_FUNC(DH_F_COMPUTE_KEY),    "COMPUTE_KEY"},
 {ERR_FUNC(DH_F_DHPARAMS_PRINT), "DHparams_print"},
 {ERR_FUNC(DH_F_DHPARAMS_PRINT_FP),      "DHparams_print_fp"},
-{ERR_FUNC(DH_F_DH_COMPUTE_KEY), "DH_compute_key"},
-{ERR_FUNC(DH_F_DH_GENERATE_KEY),        "DH_generate_key"},
-{ERR_FUNC(DH_F_DH_GENERATE_PARAMETERS), "DH_generate_parameters"},
+{ERR_FUNC(DH_F_DH_BUILTIN_GENPARAMS),   "DH_BUILTIN_GENPARAMS"},
 {ERR_FUNC(DH_F_DH_NEW_METHOD),  "DH_new_method"},
+{ERR_FUNC(DH_F_GENERATE_KEY),   "GENERATE_KEY"},
+{ERR_FUNC(DH_F_GENERATE_PARAMETERS),    "GENERATE_PARAMETERS"},
 {0,NULL}
         };
 
 static ERR_STRING_DATA DH_str_reasons[]=
         {
 {ERR_REASON(DH_R_BAD_GENERATOR)          ,"bad generator"},
+{ERR_REASON(DH_R_INVALID_PUBKEY)         ,"invalid public key"},
+{ERR_REASON(DH_R_MODULUS_TOO_LARGE)      ,"modulus too large"},
 {ERR_REASON(DH_R_NO_PRIVATE_VALUE)       ,"no private value"},
 {ERR_REASON(DH_R_INVALID_PUBKEY)         ,"invalid public key"},
 {ERR_REASON(DH_R_MODULUS_TOO_LARGE)      ,"modulus too large"},
@@ -92,15 +95,12 @@ static ERR_STRING_DATA DH_str_reasons[]=
 
 void ERR_load_DH_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(DH_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,DH_str_functs);
                 ERR_load_strings(0,DH_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/dh/dh_gen.c b/src/lib/libssl/src/crypto/dh/dh_gen.c
index 23777f5a16..cfd5b11868 100644
--- a/src/lib/libssl/src/crypto/dh/dh_gen.c
+++ b/src/lib/libssl/src/crypto/dh/dh_gen.c
@@ -56,11 +56,25 @@
  * [including the GNU Public Licence.]
  */
 
+/* NB: These functions have been upgraded - the previous prototypes are in
+ * dh_depr.c as wrappers to these ones.
+ *  - Geoff
+ */
+
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 
+static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb);
+
+int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb)
+        {
+        if(ret->meth->generate_params)
+                return ret->meth->generate_params(ret, prime_len, generator, cb);
+        return dh_builtin_genparams(ret, prime_len, generator, cb);
+        }
+
 /* We generate DH parameters as follows
  * find a prime q which is prime_len/2 bits long.
  * p=(2*q)+1 or (p-1)/2 = q
@@ -86,29 +100,26 @@
  * It's just as OK (and in some sense better) to use a generator of the
  * order-q subgroup.
  */
-
-#ifndef OPENSSL_FIPS
-
-DH *DH_generate_parameters(int prime_len, int generator,
-             void (*callback)(int,int,void *), void *cb_arg)
+static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb)
         {
-        BIGNUM *p=NULL,*t1,*t2;
-        DH *ret=NULL;
+        BIGNUM *t1,*t2;
         int g,ok= -1;
         BN_CTX *ctx=NULL;
 
-        ret=DH_new();
-        if (ret == NULL) goto err;
         ctx=BN_CTX_new();
         if (ctx == NULL) goto err;
         BN_CTX_start(ctx);
         t1 = BN_CTX_get(ctx);
         t2 = BN_CTX_get(ctx);
         if (t1 == NULL || t2 == NULL) goto err;
+
+        /* Make sure 'ret' has the necessary elements */
+        if(!ret->p && ((ret->p = BN_new()) == NULL)) goto err;
+        if(!ret->g && ((ret->g = BN_new()) == NULL)) goto err;
         
         if (generator <= 1)
                 {
-                DHerr(DH_F_DH_GENERATE_PARAMETERS, DH_R_BAD_GENERATOR);
+                DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_BAD_GENERATOR);
                 goto err;
                 }
         if (generator == DH_GENERATOR_2)
@@ -144,18 +155,14 @@ DH *DH_generate_parameters(int prime_len, int generator,
                 g=generator;
                 }
         
-        p=BN_generate_prime(NULL,prime_len,1,t1,t2,callback,cb_arg);
-        if (p == NULL) goto err;
-        if (callback != NULL) callback(3,0,cb_arg);
-        ret->p=p;
-        ret->g=BN_new();
-        if (ret->g == NULL) goto err;
+        if(!BN_generate_prime_ex(ret->p,prime_len,1,t1,t2,cb)) goto err;
+        if(!BN_GENCB_call(cb, 3, 0)) goto err;
         if (!BN_set_word(ret->g,g)) goto err;
         ok=1;
 err:
         if (ok == -1)
                 {
-                DHerr(DH_F_DH_GENERATE_PARAMETERS,ERR_R_BN_LIB);
+                DHerr(DH_F_DH_BUILTIN_GENPARAMS,ERR_R_BN_LIB);
                 ok=0;
                 }
 
@@ -164,12 +171,5 @@ err:
                 BN_CTX_end(ctx);
                 BN_CTX_free(ctx);
                 }
-        if (!ok && (ret != NULL))
-                {
-                DH_free(ret);
-                ret=NULL;
-                }
-        return(ret);
+        return ok;
         }
-
-#endif
diff --git a/src/lib/libssl/src/crypto/dh/dh_key.c b/src/lib/libssl/src/crypto/dh/dh_key.c
index 74de589204..e7db440342 100644
--- a/src/lib/libssl/src/crypto/dh/dh_key.c
+++ b/src/lib/libssl/src/crypto/dh/dh_key.c
@@ -62,8 +62,6 @@
 #include <openssl/rand.h>
 #include <openssl/dh.h>
 
-#ifndef OPENSSL_FIPS
-
 static int generate_key(DH *dh);
 static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh);
 static int dh_bn_mod_exp(const DH *dh, BIGNUM *r,
@@ -91,6 +89,7 @@ dh_bn_mod_exp,
 dh_init,
 dh_finish,
 0,
+NULL,
 NULL
 };
 
@@ -131,8 +130,7 @@ static int generate_key(DH *dh)
 
         if (dh->flags & DH_FLAG_CACHE_MONT_P)
                 {
-                mont = BN_MONT_CTX_set_locked(
-                                (BN_MONT_CTX **)&dh->method_mont_p,
+                mont = BN_MONT_CTX_set_locked(&dh->method_mont_p,
                                 CRYPTO_LOCK_DH, dh->p, ctx);
                 if (!mont)
                         goto err;
@@ -152,7 +150,7 @@ static int generate_key(DH *dh)
                         {
                         BN_init(&local_prk);
                         prk = &local_prk;
-                        BN_with_flags(prk, priv_key, BN_FLG_EXP_CONSTTIME);
+                        BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME);
                         }
                 else
                         prk = priv_key;
@@ -165,7 +163,7 @@ static int generate_key(DH *dh)
         ok=1;
 err:
         if (ok != 1)
-                DHerr(DH_F_DH_GENERATE_KEY,ERR_R_BN_LIB);
+                DHerr(DH_F_GENERATE_KEY,ERR_R_BN_LIB);
 
         if ((pub_key != NULL)  && (dh->pub_key == NULL))  BN_free(pub_key);
         if ((priv_key != NULL) && (dh->priv_key == NULL)) BN_free(priv_key);
@@ -175,16 +173,16 @@ err:
 
 static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
         {
-        BN_CTX *ctx;
+        BN_CTX *ctx=NULL;
         BN_MONT_CTX *mont=NULL;
         BIGNUM *tmp;
         int ret= -1;
-        int check_result;
+        int check_result;
 
         if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
                 {
-                DHerr(DH_F_DH_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE);
-                return -1;
+                DHerr(DH_F_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE);
+                goto err;
                 }
 
         ctx = BN_CTX_new();
@@ -194,31 +192,32 @@ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
         
         if (dh->priv_key == NULL)
                 {
-                DHerr(DH_F_DH_COMPUTE_KEY,DH_R_NO_PRIVATE_VALUE);
+                DHerr(DH_F_COMPUTE_KEY,DH_R_NO_PRIVATE_VALUE);
                 goto err;
                 }
 
         if (dh->flags & DH_FLAG_CACHE_MONT_P)
                 {
-                mont = BN_MONT_CTX_set_locked(
-                                (BN_MONT_CTX **)&dh->method_mont_p,
+                mont = BN_MONT_CTX_set_locked(&dh->method_mont_p,
                                 CRYPTO_LOCK_DH, dh->p, ctx);
                 if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0)
                         {
                         /* XXX */
-                        BN_set_flags(dh->priv_key, BN_FLG_EXP_CONSTTIME);
+                        BN_set_flags(dh->priv_key, BN_FLG_CONSTTIME);
                         }
                 if (!mont)
                         goto err;
                 }
-        if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result)
+
+        if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result)
                 {
-                DHerr(DH_F_DH_COMPUTE_KEY,DH_R_INVALID_PUBKEY);
+                DHerr(DH_F_COMPUTE_KEY,DH_R_INVALID_PUBKEY);
                 goto err;
                 }
+
         if (!dh->meth->bn_mod_exp(dh, tmp, pub_key, dh->priv_key,dh->p,ctx,mont))
                 {
-                DHerr(DH_F_DH_COMPUTE_KEY,ERR_R_BN_LIB);
+                DHerr(DH_F_COMPUTE_KEY,ERR_R_BN_LIB);
                 goto err;
                 }
 
@@ -259,8 +258,6 @@ static int dh_init(DH *dh)
 static int dh_finish(DH *dh)
         {
         if(dh->method_mont_p)
-                BN_MONT_CTX_free((BN_MONT_CTX *)dh->method_mont_p);
+                BN_MONT_CTX_free(dh->method_mont_p);
         return(1);
         }
-
-#endif
diff --git a/src/lib/libssl/src/crypto/dh/dh_lib.c b/src/lib/libssl/src/crypto/dh/dh_lib.c
index 09965ee2ea..7aef080e7a 100644
--- a/src/lib/libssl/src/crypto/dh/dh_lib.c
+++ b/src/lib/libssl/src/crypto/dh/dh_lib.c
@@ -64,7 +64,7 @@
 #include <openssl/engine.h>
 #endif
 
-const char *DH_version="Diffie-Hellman" OPENSSL_VERSION_PTEXT;
+const char DH_version[]="Diffie-Hellman" OPENSSL_VERSION_PTEXT;
 
 static const DH_METHOD *default_DH_method = NULL;
 
diff --git a/src/lib/libssl/src/crypto/dh/dhtest.c b/src/lib/libssl/src/crypto/dh/dhtest.c
index b76dede771..882f5c310a 100644
--- a/src/lib/libssl/src/crypto/dh/dhtest.c
+++ b/src/lib/libssl/src/crypto/dh/dhtest.c
@@ -56,6 +56,12 @@
  * [including the GNU Public Licence.]
  */
 
+/* Until the key-gen callbacks are modified to use newer prototypes, we allow
+ * deprecated functions for openssl-internal code */
+#ifdef OPENSSL_NO_DEPRECATED
+#undef OPENSSL_NO_DEPRECATED
+#endif
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -83,12 +89,13 @@ int main(int argc, char *argv[])
 #define MS_CALLBACK
 #endif
 
-static void MS_CALLBACK cb(int p, int n, void *arg);
+static int MS_CALLBACK cb(int p, int n, BN_GENCB *arg);
 
 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 
 int main(int argc, char *argv[])
         {
+        BN_GENCB _cb;
         DH *a;
         DH *b=NULL;
         char buf[12];
@@ -110,8 +117,10 @@ int main(int argc, char *argv[])
         if (out == NULL) EXIT(1);
         BIO_set_fp(out,stdout,BIO_NOCLOSE);
 
-        a=DH_generate_parameters(64,DH_GENERATOR_5,cb,out);
-        if (a == NULL) goto err;
+        BN_GENCB_set(&_cb, &cb, out);
+        if(((a = DH_new()) == NULL) || !DH_generate_parameters_ex(a, 64,
+                                DH_GENERATOR_5, &_cb))
+                goto err;
 
         if (!DH_check(a, &i)) goto err;
         if (i & DH_CHECK_P_NOT_PRIME)
@@ -192,14 +201,14 @@ err:
         if(b != NULL) DH_free(b);
         if(a != NULL) DH_free(a);
         BIO_free(out);
-        CRYPTO_cleanup_all_ex_data();
-        ERR_remove_state(0);
-        CRYPTO_mem_leaks_fp(stderr);
+#ifdef OPENSSL_SYS_NETWARE
+    if (ret) printf("ERROR: %d\n", ret);
+#endif
         EXIT(ret);
         return(ret);
         }
 
-static void MS_CALLBACK cb(int p, int n, void *arg)
+static int MS_CALLBACK cb(int p, int n, BN_GENCB *arg)
         {
         char c='*';
 
@@ -207,10 +216,11 @@ static void MS_CALLBACK cb(int p, int n, void *arg)
         if (p == 1) c='+';
         if (p == 2) c='*';
         if (p == 3) c='\n';
-        BIO_write((BIO *)arg,&c,1);
-        (void)BIO_flush((BIO *)arg);
+        BIO_write(arg->arg,&c,1);
+        (void)BIO_flush(arg->arg);
 #ifdef LINT
         p=n;
 #endif
+        return 1;
         }
 #endif
diff --git a/src/lib/libssl/src/crypto/dsa/dsa.h b/src/lib/libssl/src/crypto/dsa/dsa.h
index aa0669eb7a..c079154625 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa.h
+++ b/src/lib/libssl/src/crypto/dsa/dsa.h
@@ -65,6 +65,8 @@
 #ifndef HEADER_DSA_H
 #define HEADER_DSA_H
 
+#include <openssl/e_os2.h>
+
 #ifdef OPENSSL_NO_DSA
 #error DSA is disabled.
 #endif
@@ -72,12 +74,19 @@
 #ifndef OPENSSL_NO_BIO
 #include <openssl/bio.h>
 #endif
-#include <openssl/bn.h>
 #include <openssl/crypto.h>
 #include <openssl/ossl_typ.h>
+
+#ifndef OPENSSL_NO_DEPRECATED
+#include <openssl/bn.h>
 #ifndef OPENSSL_NO_DH
 # include <openssl/dh.h>
 #endif
+#endif
+
+#ifndef OPENSSL_DSA_MAX_MODULUS_BITS
+# define OPENSSL_DSA_MAX_MODULUS_BITS   10000
+#endif
 
 #define OPENSSL_DSA_MAX_MODULUS_BITS    3072
 
@@ -90,22 +99,13 @@
                                               * be used for all exponents.
                                               */
 
-/* If this flag is set external DSA_METHOD callbacks are allowed in FIPS mode
- * it is then the applications responsibility to ensure the external method
- * is compliant.
- */
-
-#define DSA_FLAG_FIPS_EXTERNAL_METHOD_ALLOW     0x04
-
-#if defined(OPENSSL_FIPS)
-#define FIPS_DSA_SIZE_T int
-#endif
-
 #ifdef  __cplusplus
 extern "C" {
 #endif
 
-typedef struct dsa_st DSA;
+/* Already defined in ossl_typ.h */
+/* typedef struct dsa_st DSA; */
+/* typedef struct dsa_method DSA_METHOD; */
 
 typedef struct DSA_SIG_st
         {
@@ -113,7 +113,8 @@ typedef struct DSA_SIG_st
         BIGNUM *s;
         } DSA_SIG;
 
-typedef struct dsa_method {
+struct dsa_method
+        {
         const char *name;
         DSA_SIG * (*dsa_do_sign)(const unsigned char *dgst, int dlen, DSA *dsa);
         int (*dsa_sign_setup)(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp,
@@ -130,7 +131,14 @@ typedef struct dsa_method {
         int (*finish)(DSA *dsa);
         int flags;
         char *app_data;
-} DSA_METHOD;
+        /* If this is non-NULL, it is used to generate DSA parameters */
+        int (*dsa_paramgen)(DSA *dsa, int bits,
+                        unsigned char *seed, int seed_len,
+                        int *counter_ret, unsigned long *h_ret,
+                        BN_GENCB *cb);
+        /* If this is non-NULL, it is used to generate DSA keys */
+        int (*dsa_keygen)(DSA *dsa);
+        };
 
 struct dsa_st
         {
@@ -151,7 +159,7 @@ struct dsa_st
 
         int flags;
         /* Normally used to cache montgomery values */
-        char *method_mont_p;
+        BN_MONT_CTX *method_mont_p;
         int references;
         CRYPTO_EX_DATA ex_data;
         const DSA_METHOD *meth;
@@ -159,16 +167,13 @@ struct dsa_st
         ENGINE *engine;
         };
 
-#define DSAparams_dup(x) (DSA *)ASN1_dup((int (*)())i2d_DSAparams, \
-                (char *(*)())d2i_DSAparams,(char *)(x))
+#define DSAparams_dup(x) ASN1_dup_of_const(DSA,i2d_DSAparams,d2i_DSAparams,x)
 #define d2i_DSAparams_fp(fp,x) (DSA *)ASN1_d2i_fp((char *(*)())DSA_new, \
                 (char *(*)())d2i_DSAparams,(fp),(unsigned char **)(x))
 #define i2d_DSAparams_fp(fp,x) ASN1_i2d_fp(i2d_DSAparams,(fp), \
                 (unsigned char *)(x))
-#define d2i_DSAparams_bio(bp,x) (DSA *)ASN1_d2i_bio((char *(*)())DSA_new, \
-                (char *(*)())d2i_DSAparams,(bp),(unsigned char **)(x))
-#define i2d_DSAparams_bio(bp,x) ASN1_i2d_bio(i2d_DSAparams,(bp), \
-                (unsigned char *)(x))
+#define d2i_DSAparams_bio(bp,x) ASN1_d2i_bio_of(DSA,DSA_new,d2i_DSAparams,bp,x)
+#define i2d_DSAparams_bio(bp,x) ASN1_i2d_bio_of_const(DSA,i2d_DSAparams,bp,x)
 
 
 DSA_SIG * DSA_SIG_new(void);
@@ -206,10 +211,20 @@ void *DSA_get_ex_data(DSA *d, int idx);
 DSA *   d2i_DSAPublicKey(DSA **a, const unsigned char **pp, long length);
 DSA *   d2i_DSAPrivateKey(DSA **a, const unsigned char **pp, long length);
 DSA *   d2i_DSAparams(DSA **a, const unsigned char **pp, long length);
+
+/* Deprecated version */
+#ifndef OPENSSL_NO_DEPRECATED
 DSA *   DSA_generate_parameters(int bits,
                 unsigned char *seed,int seed_len,
                 int *counter_ret, unsigned long *h_ret,void
                 (*callback)(int, int, void *),void *cb_arg);
+#endif /* !defined(OPENSSL_NO_DEPRECATED) */
+
+/* New version */
+int     DSA_generate_parameters_ex(DSA *dsa, int bits,
+                unsigned char *seed,int seed_len,
+                int *counter_ret, unsigned long *h_ret, BN_GENCB *cb);
+
 int     DSA_generate_key(DSA *a);
 int     i2d_DSAPublicKey(const DSA *a, unsigned char **pp);
 int     i2d_DSAPrivateKey(const DSA *a, unsigned char **pp);
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_err.c b/src/lib/libssl/src/crypto/dsa/dsa_err.c
index d7fac69154..768711994b 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_err.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_err.c
@@ -100,15 +100,12 @@ static ERR_STRING_DATA DSA_str_reasons[]=
 
 void ERR_load_DSA_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(DSA_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,DSA_str_functs);
                 ERR_load_strings(0,DSA_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_gen.c b/src/lib/libssl/src/crypto/dsa/dsa_gen.c
index e40afeea51..ca0b86a6cf 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_gen.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_gen.c
@@ -69,6 +69,8 @@
 #define HASH    EVP_sha1()
 #endif 
 
+#include <openssl/opensslconf.h> /* To see if OPENSSL_NO_SHA is defined */
+
 #ifndef OPENSSL_NO_SHA
 
 #include <stdio.h>
@@ -80,12 +82,24 @@
 #include <openssl/rand.h>
 #include <openssl/sha.h>
 
-#ifndef OPENSSL_FIPS
-DSA *DSA_generate_parameters(int bits,
+static int dsa_builtin_paramgen(DSA *ret, int bits,
+                unsigned char *seed_in, int seed_len,
+                int *counter_ret, unsigned long *h_ret, BN_GENCB *cb);
+
+int DSA_generate_parameters_ex(DSA *ret, int bits,
+                unsigned char *seed_in, int seed_len,
+                int *counter_ret, unsigned long *h_ret, BN_GENCB *cb)
+        {
+        if(ret->meth->dsa_paramgen)
+                return ret->meth->dsa_paramgen(ret, bits, seed_in, seed_len,
+                                counter_ret, h_ret, cb);
+        return dsa_builtin_paramgen(ret, bits, seed_in, seed_len,
+                        counter_ret, h_ret, cb);
+        }
+
+static int dsa_builtin_paramgen(DSA *ret, int bits,
                 unsigned char *seed_in, int seed_len,
-                int *counter_ret, unsigned long *h_ret,
-                void (*callback)(int, int, void *),
-                void *cb_arg)
+                int *counter_ret, unsigned long *h_ret, BN_GENCB *cb)
         {
         int ok=0;
         unsigned char seed[SHA_DIGEST_LENGTH];
@@ -97,40 +111,43 @@ DSA *DSA_generate_parameters(int bits,
         int k,n=0,i,b,m=0;
         int counter=0;
         int r=0;
-        BN_CTX *ctx=NULL,*ctx2=NULL,*ctx3=NULL;
+        BN_CTX *ctx=NULL;
         unsigned int h=2;
-        DSA *ret=NULL;
 
         if (bits < 512) bits=512;
         bits=(bits+63)/64*64;
 
-        if (seed_len < 20)
+        /* NB: seed_len == 0 is special case: copy generated seed to
+         * seed_in if it is not NULL.
+         */
+        if (seed_len && (seed_len < 20))
                 seed_in = NULL; /* seed buffer too small -- ignore */
         if (seed_len > 20) 
                 seed_len = 20; /* App. 2.2 of FIPS PUB 186 allows larger SEED,
                                 * but our internal buffers are restricted to 160 bits*/
         if ((seed_in != NULL) && (seed_len == 20))
+                {
                 memcpy(seed,seed_in,seed_len);
+                /* set seed_in to NULL to avoid it being copied back */
+                seed_in = NULL;
+                }
 
         if ((ctx=BN_CTX_new()) == NULL) goto err;
-        if ((ctx2=BN_CTX_new()) == NULL) goto err;
-        if ((ctx3=BN_CTX_new()) == NULL) goto err;
-        if ((ret=DSA_new()) == NULL) goto err;
 
         if ((mont=BN_MONT_CTX_new()) == NULL) goto err;
 
-        BN_CTX_start(ctx2);
-        r0 = BN_CTX_get(ctx2);
-        g = BN_CTX_get(ctx2);
-        W = BN_CTX_get(ctx2);
-        q = BN_CTX_get(ctx2);
-        X = BN_CTX_get(ctx2);
-        c = BN_CTX_get(ctx2);
-        p = BN_CTX_get(ctx2);
-        test = BN_CTX_get(ctx2);
-        if (test == NULL) goto err;
+        BN_CTX_start(ctx);
+        r0 = BN_CTX_get(ctx);
+        g = BN_CTX_get(ctx);
+        W = BN_CTX_get(ctx);
+        q = BN_CTX_get(ctx);
+        X = BN_CTX_get(ctx);
+        c = BN_CTX_get(ctx);
+        p = BN_CTX_get(ctx);
+        test = BN_CTX_get(ctx);
 
-        if (!BN_lshift(test,BN_value_one(),bits-1)) goto err;
+        if (!BN_lshift(test,BN_value_one(),bits-1))
+                goto err;
 
         for (;;)
                 {
@@ -139,7 +156,8 @@ DSA *DSA_generate_parameters(int bits,
                         int seed_is_random;
 
                         /* step 1 */
-                        if (callback != NULL) callback(0,m++,cb_arg);
+                        if(!BN_GENCB_call(cb, 0, m++))
+                                goto err;
 
                         if (!seed_len)
                                 {
@@ -172,7 +190,8 @@ DSA *DSA_generate_parameters(int bits,
                         if (!BN_bin2bn(md,SHA_DIGEST_LENGTH,q)) goto err;
 
                         /* step 4 */
-                        r = BN_is_prime_fasttest(q, DSS_prime_checks, callback, ctx3, cb_arg, seed_is_random);
+                        r = BN_is_prime_fasttest_ex(q, DSS_prime_checks, ctx,
+                                        seed_is_random, cb);
                         if (r > 0)
                                 break;
                         if (r != 0)
@@ -182,8 +201,8 @@ DSA *DSA_generate_parameters(int bits,
                         /* step 5 */
                         }
 
-                if (callback != NULL) callback(2,0,cb_arg);
-                if (callback != NULL) callback(3,0,cb_arg);
+                if(!BN_GENCB_call(cb, 2, 0)) goto err;
+                if(!BN_GENCB_call(cb, 3, 0)) goto err;
 
                 /* step 6 */
                 counter=0;
@@ -194,11 +213,11 @@ DSA *DSA_generate_parameters(int bits,
 
                 for (;;)
                         {
-                        if (callback != NULL && counter != 0)
-                                callback(0,counter,cb_arg);
+                        if ((counter != 0) && !BN_GENCB_call(cb, 0, counter))
+                                goto err;
 
                         /* step 7 */
-                        if (!BN_zero(W)) goto err;
+                        BN_zero(W);
                         /* now 'buf' contains "SEED + offset - 1" */
                         for (k=0; k<=n; k++)
                                 {
@@ -233,7 +252,8 @@ DSA *DSA_generate_parameters(int bits,
                         if (BN_cmp(p,test) >= 0)
                                 {
                                 /* step 11 */
-                                r = BN_is_prime_fasttest(p, DSS_prime_checks, callback, ctx3, cb_arg, 1);
+                                r = BN_is_prime_fasttest_ex(p, DSS_prime_checks,
+                                                ctx, 1, cb);
                                 if (r > 0)
                                                 goto end; /* found it */
                                 if (r != 0)
@@ -249,7 +269,8 @@ DSA *DSA_generate_parameters(int bits,
                         }
                 }
 end:
-        if (callback != NULL) callback(2,1,cb_arg);
+        if(!BN_GENCB_call(cb, 2, 1))
+                goto err;
 
         /* We now need to generate g */
         /* Set r0=(p-1)/q */
@@ -268,16 +289,16 @@ end:
                 h++;
                 }
 
-        if (callback != NULL) callback(3,1,cb_arg);
+        if(!BN_GENCB_call(cb, 3, 1))
+                goto err;
 
         ok=1;
 err:
-        if (!ok)
-                {
-                if (ret != NULL) DSA_free(ret);
-                }
-        else
+        if (ok)
                 {
+                if(ret->p) BN_free(ret->p);
+                if(ret->q) BN_free(ret->q);
+                if(ret->g) BN_free(ret->g);
                 ret->p=BN_dup(p);
                 ret->q=BN_dup(q);
                 ret->g=BN_dup(g);
@@ -286,20 +307,16 @@ err:
                         ok=0;
                         goto err;
                         }
-                if ((m > 1) && (seed_in != NULL)) memcpy(seed_in,seed,20);
+                if (seed_in != NULL) memcpy(seed_in,seed,20);
                 if (counter_ret != NULL) *counter_ret=counter;
                 if (h_ret != NULL) *h_ret=h;
                 }
-        if (ctx != NULL) BN_CTX_free(ctx);
-        if (ctx2 != NULL)
+        if(ctx)
                 {
-                BN_CTX_end(ctx2);
-                BN_CTX_free(ctx2);
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
                 }
-        if (ctx3 != NULL) BN_CTX_free(ctx3);
         if (mont != NULL) BN_MONT_CTX_free(mont);
-        return(ok?ret:NULL);
+        return ok;
         }
-#endif /* ndef OPENSSL_FIPS */
-#endif /* ndef OPENSSL_NO_SHA */
-
+#endif
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_key.c b/src/lib/libssl/src/crypto/dsa/dsa_key.c
index 980b6dc2d3..c4aa86bc6d 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_key.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_key.c
@@ -56,17 +56,25 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_SHA
 #include <stdio.h>
 #include <time.h>
 #include "cryptlib.h"
+#ifndef OPENSSL_NO_SHA
 #include <openssl/bn.h>
 #include <openssl/dsa.h>
 #include <openssl/rand.h>
 
-#ifndef OPENSSL_FIPS
+static int dsa_builtin_keygen(DSA *dsa);
+
 int DSA_generate_key(DSA *dsa)
         {
+        if(dsa->meth->dsa_keygen)
+                return dsa->meth->dsa_keygen(dsa);
+        return dsa_builtin_keygen(dsa);
+        }
+
+static int dsa_builtin_keygen(DSA *dsa)
+        {
         int ok=0;
         BN_CTX *ctx=NULL;
         BIGNUM *pub_key=NULL,*priv_key=NULL;
@@ -99,7 +107,7 @@ int DSA_generate_key(DSA *dsa)
                         {
                         BN_init(&local_prk);
                         prk = &local_prk;
-                        BN_with_flags(prk, priv_key, BN_FLG_EXP_CONSTTIME);
+                        BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME);
                         }
                 else
                         prk = priv_key;
@@ -118,4 +126,3 @@ err:
         return(ok);
         }
 #endif
-#endif
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_lib.c b/src/lib/libssl/src/crypto/dsa/dsa_lib.c
index 4171af24c6..e9b75902db 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_lib.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_lib.c
@@ -66,8 +66,11 @@
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
 
-const char *DSA_version="DSA" OPENSSL_VERSION_PTEXT;
+const char DSA_version[]="DSA" OPENSSL_VERSION_PTEXT;
 
 static const DSA_METHOD *default_DSA_method = NULL;
 
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_ossl.c b/src/lib/libssl/src/crypto/dsa/dsa_ossl.c
index 5de5fc7e91..75ff7cc4af 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_ossl.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_ossl.c
@@ -65,33 +65,63 @@
 #include <openssl/rand.h>
 #include <openssl/asn1.h>
 
-#ifndef OPENSSL_FIPS
 static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
 static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp);
 static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
                   DSA *dsa);
 static int dsa_init(DSA *dsa);
 static int dsa_finish(DSA *dsa);
-static int dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1,
-                BIGNUM *a2, BIGNUM *p2, BIGNUM *m, BN_CTX *ctx,
-                BN_MONT_CTX *in_mont);
-static int dsa_bn_mod_exp(DSA *dsa, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
-                                const BIGNUM *m, BN_CTX *ctx,
-                                BN_MONT_CTX *m_ctx);
 
 static DSA_METHOD openssl_dsa_meth = {
 "OpenSSL DSA method",
 dsa_do_sign,
 dsa_sign_setup,
 dsa_do_verify,
-dsa_mod_exp,
-dsa_bn_mod_exp,
+NULL, /* dsa_mod_exp, */
+NULL, /* dsa_bn_mod_exp, */
 dsa_init,
 dsa_finish,
 0,
+NULL,
+NULL,
 NULL
 };
 
+/* These macro wrappers replace attempts to use the dsa_mod_exp() and
+ * bn_mod_exp() handlers in the DSA_METHOD structure. We avoid the problem of
+ * having a the macro work as an expression by bundling an "err_instr". So;
+ * 
+ *     if (!dsa->meth->bn_mod_exp(dsa, r,dsa->g,&k,dsa->p,ctx,
+ *                 dsa->method_mont_p)) goto err;
+ *
+ * can be replaced by;
+ *
+ *     DSA_BN_MOD_EXP(goto err, dsa, r, dsa->g, &k, dsa->p, ctx,
+ *                 dsa->method_mont_p);
+ */
+
+#define DSA_MOD_EXP(err_instr,dsa,rr,a1,p1,a2,p2,m,ctx,in_mont) \
+        do { \
+        int _tmp_res53; \
+        if((dsa)->meth->dsa_mod_exp) \
+                _tmp_res53 = (dsa)->meth->dsa_mod_exp((dsa), (rr), (a1), (p1), \
+                                (a2), (p2), (m), (ctx), (in_mont)); \
+        else \
+                _tmp_res53 = BN_mod_exp2_mont((rr), (a1), (p1), (a2), (p2), \
+                                (m), (ctx), (in_mont)); \
+        if(!_tmp_res53) err_instr; \
+        } while(0)
+#define DSA_BN_MOD_EXP(err_instr,dsa,r,a,p,m,ctx,m_ctx) \
+        do { \
+        int _tmp_res53; \
+        if((dsa)->meth->bn_mod_exp) \
+                _tmp_res53 = (dsa)->meth->bn_mod_exp((dsa), (r), (a), (p), \
+                                (m), (ctx), (m_ctx)); \
+        else \
+                _tmp_res53 = BN_mod_exp_mont((r), (a), (p), (m), (ctx), (m_ctx)); \
+        if(!_tmp_res53) err_instr; \
+        } while(0)
+
 const DSA_METHOD *DSA_OpenSSL(void)
 {
         return &openssl_dsa_meth;
@@ -199,12 +229,12 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
         while (BN_is_zero(&k));
         if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0)
                 {
-                BN_set_flags(&k, BN_FLG_EXP_CONSTTIME);
+                BN_set_flags(&k, BN_FLG_CONSTTIME);
                 }
 
         if (dsa->flags & DSA_FLAG_CACHE_MONT_P)
                 {
-                if (!BN_MONT_CTX_set_locked((BN_MONT_CTX **)&dsa->method_mont_p,
+                if (!BN_MONT_CTX_set_locked(&dsa->method_mont_p,
                                                 CRYPTO_LOCK_DSA,
                                                 dsa->p, ctx))
                         goto err;
@@ -234,8 +264,8 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
                 {
                 K = &k;
                 }
-        if (!dsa->meth->bn_mod_exp(dsa, r,dsa->g,K,dsa->p,ctx,
-                (BN_MONT_CTX *)dsa->method_mont_p)) goto err;
+        DSA_BN_MOD_EXP(goto err, dsa, r, dsa->g, K, dsa->p, ctx,
+                        dsa->method_mont_p);
         if (!BN_mod(r,r,dsa->q,ctx)) goto err;
 
         /* Compute  part of 's = inv(k) (m + xr) mod q' */
@@ -292,12 +322,14 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
 
         if ((ctx=BN_CTX_new()) == NULL) goto err;
 
-        if (BN_is_zero(sig->r) || sig->r->neg || BN_ucmp(sig->r, dsa->q) >= 0)
+        if (BN_is_zero(sig->r) || BN_is_negative(sig->r) ||
+            BN_ucmp(sig->r, dsa->q) >= 0)
                 {
                 ret = 0;
                 goto err;
                 }
-        if (BN_is_zero(sig->s) || sig->s->neg || BN_ucmp(sig->s, dsa->q) >= 0)
+        if (BN_is_zero(sig->s) || BN_is_negative(sig->s) ||
+            BN_ucmp(sig->s, dsa->q) >= 0)
                 {
                 ret = 0;
                 goto err;
@@ -319,43 +351,25 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
 
         if (dsa->flags & DSA_FLAG_CACHE_MONT_P)
                 {
-                mont = BN_MONT_CTX_set_locked(
-                                        (BN_MONT_CTX **)&dsa->method_mont_p,
+                mont = BN_MONT_CTX_set_locked(&dsa->method_mont_p,
                                         CRYPTO_LOCK_DSA, dsa->p, ctx);
                 if (!mont)
                         goto err;
                 }
 
-#if 0
-        {
-        BIGNUM t2;
-
-        BN_init(&t2);
-        /* v = ( g^u1 * y^u2 mod p ) mod q */
-        /* let t1 = g ^ u1 mod p */
-        if (!BN_mod_exp_mont(&t1,dsa->g,&u1,dsa->p,ctx,mont)) goto err;
-        /* let t2 = y ^ u2 mod p */
-        if (!BN_mod_exp_mont(&t2,dsa->pub_key,&u2,dsa->p,ctx,mont)) goto err;
-        /* let u1 = t1 * t2 mod p */
-        if (!BN_mod_mul(&u1,&t1,&t2,dsa->p,ctx)) goto err_bn;
-        BN_free(&t2);
-        }
-        /* let u1 = u1 mod q */
-        if (!BN_mod(&u1,&u1,dsa->q,ctx)) goto err;
-#else
-        {
-        if (!dsa->meth->dsa_mod_exp(dsa, &t1,dsa->g,&u1,dsa->pub_key,&u2,
-                                                dsa->p,ctx,mont)) goto err;
+
+        DSA_MOD_EXP(goto err, dsa, &t1, dsa->g, &u1, dsa->pub_key, &u2, dsa->p, ctx, mont);
         /* BN_copy(&u1,&t1); */
         /* let u1 = u1 mod q */
         if (!BN_mod(&u1,&t1,dsa->q,ctx)) goto err;
-        }
-#endif
+
         /* V is now in u1.  If the signature is correct, it will be
          * equal to R. */
         ret=(BN_ucmp(&u1, sig->r) == 0);
 
         err:
+        /* XXX: surely this is wrong - if ret is 0, it just didn't verify;
+           there is no error in BN. Test should be ret == -1 (Ben) */
         if (ret != 1) DSAerr(DSA_F_DSA_DO_VERIFY,ERR_R_BN_LIB);
         if (ctx != NULL) BN_CTX_free(ctx);
         BN_free(&u1);
@@ -373,21 +387,7 @@ static int dsa_init(DSA *dsa)
 static int dsa_finish(DSA *dsa)
 {
         if(dsa->method_mont_p)
-                BN_MONT_CTX_free((BN_MONT_CTX *)dsa->method_mont_p);
+                BN_MONT_CTX_free(dsa->method_mont_p);
         return(1);
 }
 
-static int dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1, BIGNUM *p1,
-                BIGNUM *a2, BIGNUM *p2, BIGNUM *m, BN_CTX *ctx,
-                BN_MONT_CTX *in_mont)
-{
-        return BN_mod_exp2_mont(rr, a1, p1, a2, p2, m, ctx, in_mont);
-}
-        
-static int dsa_bn_mod_exp(DSA *dsa, BIGNUM *r, BIGNUM *a, const BIGNUM *p,
-                                const BIGNUM *m, BN_CTX *ctx,
-                                BN_MONT_CTX *m_ctx)
-{
-        return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx);
-}
-#endif
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_sign.c b/src/lib/libssl/src/crypto/dsa/dsa_sign.c
index 37c65efb20..89205026f0 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_sign.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_sign.c
@@ -64,18 +64,9 @@
 #include <openssl/dsa.h>
 #include <openssl/rand.h>
 #include <openssl/asn1.h>
-#ifndef OPENSSL_NO_ENGINE
-#include <openssl/engine.h>
-#endif
-#include <openssl/fips.h>
 
 DSA_SIG * DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
         {
-#ifdef OPENSSL_FIPS
-        if(FIPS_mode() && !(dsa->flags & DSA_FLAG_FIPS_EXTERNAL_METHOD_ALLOW)
-                && !FIPS_dsa_check(dsa))
-                return NULL;
-#endif
         return dsa->meth->dsa_do_sign(dgst, dlen, dsa);
         }
 
@@ -96,11 +87,6 @@ int DSA_sign(int type, const unsigned char *dgst, int dlen, unsigned char *sig,
 
 int DSA_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
         {
-#ifdef OPENSSL_FIPS
-        if(FIPS_mode() && !(dsa->flags & DSA_FLAG_FIPS_EXTERNAL_METHOD_ALLOW)
-                && !FIPS_dsa_check(dsa))
-                return 0;
-#endif
         return dsa->meth->dsa_sign_setup(dsa, ctx_in, kinvp, rp);
         }
 
diff --git a/src/lib/libssl/src/crypto/dsa/dsa_vrf.c b/src/lib/libssl/src/crypto/dsa/dsa_vrf.c
index c9784bed48..c4aeddd056 100644
--- a/src/lib/libssl/src/crypto/dsa/dsa_vrf.c
+++ b/src/lib/libssl/src/crypto/dsa/dsa_vrf.c
@@ -65,19 +65,10 @@
 #include <openssl/rand.h>
 #include <openssl/asn1.h>
 #include <openssl/asn1_mac.h>
-#ifndef OPENSSL_NO_ENGINE
-#include <openssl/engine.h>
-#endif
-#include <openssl/fips.h>
 
 int DSA_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
                   DSA *dsa)
         {
-#ifdef OPENSSL_FIPS
-        if(FIPS_mode() && !(dsa->flags & DSA_FLAG_FIPS_EXTERNAL_METHOD_ALLOW)
-                && !FIPS_dsa_check(dsa))
-                return -1;
-#endif
         return dsa->meth->dsa_do_verify(dgst, dgst_len, sig, dsa);
         }
 
diff --git a/src/lib/libssl/src/crypto/dsa/dsatest.c b/src/lib/libssl/src/crypto/dsa/dsatest.c
index 55a3756aff..912317bb44 100644
--- a/src/lib/libssl/src/crypto/dsa/dsatest.c
+++ b/src/lib/libssl/src/crypto/dsa/dsatest.c
@@ -56,6 +56,12 @@
  * [including the GNU Public Licence.]
  */
 
+/* Until the key-gen callbacks are modified to use newer prototypes, we allow
+ * deprecated functions for openssl-internal code */
+#ifdef OPENSSL_NO_DEPRECATED
+#undef OPENSSL_NO_DEPRECATED
+#endif
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -68,6 +74,7 @@
 #include <openssl/rand.h>
 #include <openssl/bio.h>
 #include <openssl/err.h>
+#include <openssl/bn.h>
 
 #ifdef OPENSSL_NO_DSA
 int main(int argc, char *argv[])
@@ -84,7 +91,7 @@ int main(int argc, char *argv[])
 #define MS_CALLBACK
 #endif
 
-static void MS_CALLBACK dsa_cb(int p, int n, void *arg);
+static int MS_CALLBACK dsa_cb(int p, int n, BN_GENCB *arg);
 
 /* seed, out_p, out_q, out_g are taken from the updated Appendix 5 to
  * FIPS PUB 186 and also appear in Appendix 5 to FIPS PIB 186-1 */
@@ -129,6 +136,7 @@ static BIO *bio_err=NULL;
 
 int main(int argc, char **argv)
         {
+        BN_GENCB cb;
         DSA *dsa=NULL;
         int counter,ret=0,i,j;
         unsigned char buf[256];
@@ -148,7 +156,10 @@ int main(int argc, char **argv)
 
         BIO_printf(bio_err,"test generation of DSA parameters\n");
 
-        dsa=DSA_generate_parameters(512,seed,20,&counter,&h,dsa_cb,bio_err);
+        BN_GENCB_set(&cb, dsa_cb, bio_err);
+        if(((dsa = DSA_new()) == NULL) || !DSA_generate_parameters_ex(dsa, 512,
+                                seed, 20, &counter, &h, &cb))
+                goto end;
 
         BIO_printf(bio_err,"seed\n");
         for (i=0; i<20; i+=4)
@@ -156,7 +167,7 @@ int main(int argc, char **argv)
                 BIO_printf(bio_err,"%02X%02X%02X%02X ",
                         seed[i],seed[i+1],seed[i+2],seed[i+3]);
                 }
-        BIO_printf(bio_err,"\ncounter=%d h=%d\n",counter,h);
+        BIO_printf(bio_err,"\ncounter=%d h=%ld\n",counter,h);
                 
         if (dsa == NULL) goto end;
         DSA_print(bio_err,dsa,0);
@@ -220,17 +231,14 @@ end:
                 BIO_free(bio_err);
                 bio_err = NULL;
                 }
+#ifdef OPENSSL_SYS_NETWARE
+    if (!ret) printf("ERROR\n");
+#endif
         EXIT(!ret);
         return(0);
         }
 
-static int cb_exit(int ec)
-        {
-        EXIT(ec);
-        return(0);              /* To keep some compilers quiet */
-        }
-
-static void MS_CALLBACK dsa_cb(int p, int n, void *arg)
+static int MS_CALLBACK dsa_cb(int p, int n, BN_GENCB *arg)
         {
         char c='*';
         static int ok=0,num=0;
@@ -239,13 +247,14 @@ static void MS_CALLBACK dsa_cb(int p, int n, void *arg)
         if (p == 1) c='+';
         if (p == 2) { c='*'; ok++; }
         if (p == 3) c='\n';
-        BIO_write(arg,&c,1);
-        (void)BIO_flush(arg);
+        BIO_write(arg->arg,&c,1);
+        (void)BIO_flush(arg->arg);
 
         if (!ok && (p == 0) && (num > 1))
                 {
                 BIO_printf((BIO *)arg,"error in dsatest\n");
-                cb_exit(1);
+                return 0;
                 }
+        return 1;
         }
 #endif
diff --git a/src/lib/libssl/src/crypto/dso/dso.h b/src/lib/libssl/src/crypto/dso/dso.h
index aa721f7feb..3e51913a72 100644
--- a/src/lib/libssl/src/crypto/dso/dso.h
+++ b/src/lib/libssl/src/crypto/dso/dso.h
@@ -1,4 +1,4 @@
-/* dso.h */
+/* dso.h -*- mode:C; c-file-style: "eay" -*- */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -95,6 +95,13 @@ extern "C" {
  */
 #define DSO_FLAG_UPCASE_SYMBOL                  0x10
 
+/* This flag loads the library with public symbols.
+ * Meaning: The exported symbols of this library are public
+ * to all libraries loaded after this library.
+ * At the moment only implemented in unix.
+ */
+#define DSO_FLAG_GLOBAL_SYMBOLS                 0x20
+
 
 typedef void (*DSO_FUNC_TYPE)(void);
 
@@ -107,6 +114,22 @@ typedef struct dso_st DSO;
  * condition) or a newly allocated string containing the transformed form that
  * the caller will need to free with OPENSSL_free() when done. */
 typedef char* (*DSO_NAME_CONVERTER_FUNC)(DSO *, const char *);
+/* The function prototype used for method functions (or caller-provided
+ * callbacks) that merge two file specifications. They are passed a
+ * DSO structure pointer (or NULL if they are to be used independantly of
+ * a DSO object) and two file specifications to merge. They should
+ * either return NULL (if there is an error condition) or a newly allocated
+ * string containing the result of merging that the caller will need
+ * to free with OPENSSL_free() when done.
+ * Here, merging means that bits and pieces are taken from each of the
+ * file specifications and added together in whatever fashion that is
+ * sensible for the DSO method in question.  The only rule that really
+ * applies is that if the two specification contain pieces of the same
+ * type, the copy from the first string takes priority.  One could see
+ * it as the first specification is the one given by the user and the
+ * second being a bunch of defaults to add on if they're missing in the
+ * first. */
+typedef char* (*DSO_MERGER_FUNC)(DSO *, const char *, const char *);
 
 typedef struct dso_meth_st
         {
@@ -140,6 +163,9 @@ typedef struct dso_meth_st
         /* The default DSO_METHOD-specific function for converting filenames to
          * a canonical native form. */
         DSO_NAME_CONVERTER_FUNC dso_name_converter;
+        /* The default DSO_METHOD-specific function for converting filenames to
+         * a canonical native form. */
+        DSO_MERGER_FUNC dso_merger;
 
         /* [De]Initialisation handlers. */
         int (*init)(DSO *dso);
@@ -164,9 +190,13 @@ struct dso_st
          * don't touch meth_data! */
         CRYPTO_EX_DATA ex_data;
         /* If this callback function pointer is set to non-NULL, then it will
-         * be used on DSO_load() in place of meth->dso_name_converter. NB: This
+         * be used in DSO_load() in place of meth->dso_name_converter. NB: This
          * should normally set using DSO_set_name_converter(). */
         DSO_NAME_CONVERTER_FUNC name_converter;
+        /* If this callback function pointer is set to non-NULL, then it will
+         * be used in DSO_load() in place of meth->dso_merger. NB: This
+         * should normally set using DSO_set_merger(). */
+        DSO_MERGER_FUNC merger;
         /* This is populated with (a copy of) the platform-independant
          * filename used for this DSO. */
         char *filename;
@@ -209,6 +239,11 @@ int	DSO_set_filename(DSO *dso, const char *filename);
  * caller-created DSO_METHODs can do the same thing. A non-NULL return value
  * will need to be OPENSSL_free()'d. */
 char    *DSO_convert_filename(DSO *dso, const char *filename);
+/* This function will invoke the DSO's merger callback to merge two file
+ * specifications, or if the callback isn't set it will instead use the
+ * DSO_METHOD's merger.  A non-NULL return value will need to be
+ * OPENSSL_free()'d. */
+char    *DSO_merge(DSO *dso, const char *filespec1, const char *filespec2);
 /* If the DSO is currently loaded, this returns the filename that it was loaded
  * under, otherwise it returns NULL. So it is also useful as a test as to
  * whether the DSO is currently loaded. NB: This will not necessarily return
@@ -273,11 +308,13 @@ void ERR_load_DSO_strings(void);
 #define DSO_F_DLFCN_BIND_FUNC                            100
 #define DSO_F_DLFCN_BIND_VAR                             101
 #define DSO_F_DLFCN_LOAD                                 102
+#define DSO_F_DLFCN_MERGER                               130
 #define DSO_F_DLFCN_NAME_CONVERTER                       123
 #define DSO_F_DLFCN_UNLOAD                               103
 #define DSO_F_DL_BIND_FUNC                               104
 #define DSO_F_DL_BIND_VAR                                105
 #define DSO_F_DL_LOAD                                    106
+#define DSO_F_DL_MERGER                                  131
 #define DSO_F_DL_NAME_CONVERTER                          124
 #define DSO_F_DL_UNLOAD                                  107
 #define DSO_F_DSO_BIND_FUNC                              108
@@ -288,27 +325,36 @@ void ERR_load_DSO_strings(void);
 #define DSO_F_DSO_GET_FILENAME                           127
 #define DSO_F_DSO_GET_LOADED_FILENAME                    128
 #define DSO_F_DSO_LOAD                                   112
+#define DSO_F_DSO_MERGE                                  132
 #define DSO_F_DSO_NEW_METHOD                             113
 #define DSO_F_DSO_SET_FILENAME                           129
 #define DSO_F_DSO_SET_NAME_CONVERTER                     122
 #define DSO_F_DSO_UP_REF                                 114
-#define DSO_F_VMS_BIND_VAR                               115
+#define DSO_F_VMS_BIND_SYM                               115
 #define DSO_F_VMS_LOAD                                   116
+#define DSO_F_VMS_MERGER                                 133
 #define DSO_F_VMS_UNLOAD                                 117
 #define DSO_F_WIN32_BIND_FUNC                            118
 #define DSO_F_WIN32_BIND_VAR                             119
+#define DSO_F_WIN32_JOINER                               135
 #define DSO_F_WIN32_LOAD                                 120
+#define DSO_F_WIN32_MERGER                               134
 #define DSO_F_WIN32_NAME_CONVERTER                       125
+#define DSO_F_WIN32_SPLITTER                             136
 #define DSO_F_WIN32_UNLOAD                               121
 
 /* Reason codes. */
 #define DSO_R_CTRL_FAILED                                100
 #define DSO_R_DSO_ALREADY_LOADED                         110
+#define DSO_R_EMPTY_FILE_STRUCTURE                       113
+#define DSO_R_FAILURE                                    114
 #define DSO_R_FILENAME_TOO_BIG                           101
 #define DSO_R_FINISH_FAILED                              102
+#define DSO_R_INCORRECT_FILE_SYNTAX                      115
 #define DSO_R_LOAD_FAILED                                103
 #define DSO_R_NAME_TRANSLATION_FAILED                    109
 #define DSO_R_NO_FILENAME                                111
+#define DSO_R_NO_FILE_SPECIFICATION                      116
 #define DSO_R_NULL_HANDLE                                104
 #define DSO_R_SET_FILENAME_FAILED                        112
 #define DSO_R_STACK_ERROR                                105
diff --git a/src/lib/libssl/src/crypto/dso/dso_dl.c b/src/lib/libssl/src/crypto/dso/dso_dl.c
index f7b4dfc0c3..417abb6ea9 100644
--- a/src/lib/libssl/src/crypto/dso/dso_dl.c
+++ b/src/lib/libssl/src/crypto/dso/dso_dl.c
@@ -1,4 +1,4 @@
-/* dso_dl.c */
+/* dso_dl.c -*- mode:C; c-file-style: "eay" -*- */
 /* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
  * project 2000.
  */
@@ -84,6 +84,7 @@ static int dl_finish(DSO *dso);
 static int dl_ctrl(DSO *dso, int cmd, long larg, void *parg);
 #endif
 static char *dl_name_converter(DSO *dso, const char *filename);
+static char *dl_merger(DSO *dso, const char *filespec1, const char *filespec2);
 
 static DSO_METHOD dso_meth_dl = {
         "OpenSSL 'dl' shared library method",
@@ -98,6 +99,7 @@ static DSO_METHOD dso_meth_dl = {
 #endif
         NULL, /* ctrl */
         dl_name_converter,
+        dl_merger,
         NULL, /* init */
         NULL  /* finish */
         };
@@ -239,6 +241,72 @@ static DSO_FUNC_TYPE dl_bind_func(DSO *dso, const char *symname)
         return((DSO_FUNC_TYPE)sym);
         }
 
+static char *dl_merger(DSO *dso, const char *filespec1, const char *filespec2)
+        {
+        char *merged;
+
+        if(!filespec1 && !filespec2)
+                {
+                DSOerr(DSO_F_DL_MERGER,
+                                ERR_R_PASSED_NULL_PARAMETER);
+                return(NULL);
+                }
+        /* If the first file specification is a rooted path, it rules.
+           same goes if the second file specification is missing. */
+        if (!filespec2 || filespec1[0] == '/')
+                {
+                merged = OPENSSL_malloc(strlen(filespec1) + 1);
+                if(!merged)
+                        {
+                        DSOerr(DSO_F_DL_MERGER,
+                                ERR_R_MALLOC_FAILURE);
+                        return(NULL);
+                        }
+                strcpy(merged, filespec1);
+                }
+        /* If the first file specification is missing, the second one rules. */
+        else if (!filespec1)
+                {
+                merged = OPENSSL_malloc(strlen(filespec2) + 1);
+                if(!merged)
+                        {
+                        DSOerr(DSO_F_DL_MERGER,
+                                ERR_R_MALLOC_FAILURE);
+                        return(NULL);
+                        }
+                strcpy(merged, filespec2);
+                }
+        else
+                /* This part isn't as trivial as it looks.  It assumes that
+                   the second file specification really is a directory, and
+                   makes no checks whatsoever.  Therefore, the result becomes
+                   the concatenation of filespec2 followed by a slash followed
+                   by filespec1. */
+                {
+                int spec2len, len;
+
+                spec2len = (filespec2 ? strlen(filespec2) : 0);
+                len = spec2len + (filespec1 ? strlen(filespec1) : 0);
+
+                if(filespec2 && filespec2[spec2len - 1] == '/')
+                        {
+                        spec2len--;
+                        len--;
+                        }
+                merged = OPENSSL_malloc(len + 2);
+                if(!merged)
+                        {
+                        DSOerr(DSO_F_DL_MERGER,
+                                ERR_R_MALLOC_FAILURE);
+                        return(NULL);
+                        }
+                strcpy(merged, filespec2);
+                merged[spec2len] = '/';
+                strcpy(&merged[spec2len + 1], filespec1);
+                }
+        return(merged);
+        }
+
 /* This function is identical to the one in dso_dlfcn.c, but as it is highly
  * unlikely that both the "dl" *and* "dlfcn" variants are being compiled at the
  * same time, there's no great duplicating the code. Figuring out an elegant 
@@ -282,36 +350,4 @@ static char *dl_name_converter(DSO *dso, const char *filename)
         return(translated);
         }
 
-#ifdef OPENSSL_FIPS
-static void dl_ref_point(){}
-
-int DSO_pathbyaddr(void *addr,char *path,int sz)
-        {
-        struct shl_descriptor inf;
-        int i,len;
-
-        if (addr == NULL)
-                {
-                union { void(*f)(); void *p; } t = { dl_ref_point };
-                addr = t.p;
-                }
-
-        for (i=-1;shl_get_r(i,&inf)==0;i++)
-                {
-                if (((size_t)addr >= inf.tstart && (size_t)addr < inf.tend) ||
-                    ((size_t)addr >= inf.dstart && (size_t)addr < inf.dend))
-                        {
-                        len = (int)strlen(inf.filename);
-                        if (sz <= 0) return len+1;
-                        if (len >= sz) len=sz-1;
-                        memcpy(path,inf.filename,len);
-                        path[len++] = 0;
-                        return len;
-                        }
-                }
-
-        return -1;
-        }
-#endif
-
 #endif /* DSO_DL */
diff --git a/src/lib/libssl/src/crypto/dso/dso_dlfcn.c b/src/lib/libssl/src/crypto/dso/dso_dlfcn.c
index d48b4202f2..f734c1c6b7 100644
--- a/src/lib/libssl/src/crypto/dso/dso_dlfcn.c
+++ b/src/lib/libssl/src/crypto/dso/dso_dlfcn.c
@@ -1,4 +1,4 @@
-/* dso_dlfcn.c */
+/* dso_dlfcn.c -*- mode:C; c-file-style: "eay" -*- */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -56,10 +56,6 @@
  *
  */
 
-#ifdef __linux
-#define _GNU_SOURCE
-#endif
-
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/dso.h>
@@ -89,6 +85,8 @@ static int dlfcn_finish(DSO *dso);
 static long dlfcn_ctrl(DSO *dso, int cmd, long larg, void *parg);
 #endif
 static char *dlfcn_name_converter(DSO *dso, const char *filename);
+static char *dlfcn_merger(DSO *dso, const char *filespec1,
+        const char *filespec2);
 
 static DSO_METHOD dso_meth_dlfcn = {
         "OpenSSL 'dlfcn' shared library method",
@@ -103,6 +101,7 @@ static DSO_METHOD dso_meth_dlfcn = {
 #endif
         NULL, /* ctrl */
         dlfcn_name_converter,
+        dlfcn_merger,
         NULL, /* init */
         NULL  /* finish */
         };
@@ -145,13 +144,19 @@ static int dlfcn_load(DSO *dso)
         void *ptr = NULL;
         /* See applicable comments in dso_dl.c */
         char *filename = DSO_convert_filename(dso, NULL);
+        int flags = DLOPEN_FLAG;
 
         if(filename == NULL)
                 {
                 DSOerr(DSO_F_DLFCN_LOAD,DSO_R_NO_FILENAME);
                 goto err;
                 }
-        ptr = dlopen(filename, DLOPEN_FLAG);
+
+#ifdef RTLD_GLOBAL
+        if (dso->flags & DSO_FLAG_GLOBAL_SYMBOLS)
+                flags |= RTLD_GLOBAL;
+#endif
+        ptr = dlopen(filename, flags);
         if(ptr == NULL)
                 {
                 DSOerr(DSO_F_DLFCN_LOAD,DSO_R_LOAD_FAILED);
@@ -250,7 +255,7 @@ static DSO_FUNC_TYPE dlfcn_bind_func(DSO *dso, const char *symname)
                 DSOerr(DSO_F_DLFCN_BIND_FUNC,DSO_R_NULL_HANDLE);
                 return(NULL);
                 }
-        *(void**)(tsym) = dlsym(ptr, symname);
+        *(void **)(tsym) = dlsym(ptr, symname);
         if(sym == NULL)
                 {
                 DSOerr(DSO_F_DLFCN_BIND_FUNC,DSO_R_SYM_FAILURE);
@@ -260,6 +265,73 @@ static DSO_FUNC_TYPE dlfcn_bind_func(DSO *dso, const char *symname)
         return(sym);
         }
 
+static char *dlfcn_merger(DSO *dso, const char *filespec1,
+        const char *filespec2)
+        {
+        char *merged;
+
+        if(!filespec1 && !filespec2)
+                {
+                DSOerr(DSO_F_DLFCN_MERGER,
+                                ERR_R_PASSED_NULL_PARAMETER);
+                return(NULL);
+                }
+        /* If the first file specification is a rooted path, it rules.
+           same goes if the second file specification is missing. */
+        if (!filespec2 || filespec1[0] == '/')
+                {
+                merged = OPENSSL_malloc(strlen(filespec1) + 1);
+                if(!merged)
+                        {
+                        DSOerr(DSO_F_DLFCN_MERGER,
+                                ERR_R_MALLOC_FAILURE);
+                        return(NULL);
+                        }
+                strcpy(merged, filespec1);
+                }
+        /* If the first file specification is missing, the second one rules. */
+        else if (!filespec1)
+                {
+                merged = OPENSSL_malloc(strlen(filespec2) + 1);
+                if(!merged)
+                        {
+                        DSOerr(DSO_F_DLFCN_MERGER,
+                                ERR_R_MALLOC_FAILURE);
+                        return(NULL);
+                        }
+                strcpy(merged, filespec2);
+                }
+        else
+                /* This part isn't as trivial as it looks.  It assumes that
+                   the second file specification really is a directory, and
+                   makes no checks whatsoever.  Therefore, the result becomes
+                   the concatenation of filespec2 followed by a slash followed
+                   by filespec1. */
+                {
+                int spec2len, len;
+
+                spec2len = (filespec2 ? strlen(filespec2) : 0);
+                len = spec2len + (filespec1 ? strlen(filespec1) : 0);
+
+                if(filespec2 && filespec2[spec2len - 1] == '/')
+                        {
+                        spec2len--;
+                        len--;
+                        }
+                merged = OPENSSL_malloc(len + 2);
+                if(!merged)
+                        {
+                        DSOerr(DSO_F_DLFCN_MERGER,
+                                ERR_R_MALLOC_FAILURE);
+                        return(NULL);
+                        }
+                strcpy(merged, filespec2);
+                merged[spec2len] = '/';
+                strcpy(&merged[spec2len + 1], filespec1);
+                }
+        return(merged);
+        }
+
 static char *dlfcn_name_converter(DSO *dso, const char *filename)
         {
         char *translated;
@@ -294,32 +366,4 @@ static char *dlfcn_name_converter(DSO *dso, const char *filename)
         return(translated);
         }
 
-#ifdef OPENSSL_FIPS
-static void dlfcn_ref_point(){}
-
-int DSO_pathbyaddr(void *addr,char *path,int sz)
-        {
-        Dl_info dli;
-        int len;
-
-        if (addr == NULL)
-                {
-                union { void(*f)(void); void *p; } t = { dlfcn_ref_point };
-                addr = t.p;
-                }
-
-        if (dladdr(addr,&dli))
-                {
-                len = (int)strlen(dli.dli_fname);
-                if (sz <= 0) return len+1;
-                if (len >= sz) len=sz-1;
-                memcpy(path,dli.dli_fname,len);
-                path[len++]=0;
-                return len;
-                }
-
-        ERR_add_error_data(4, "dlfcn_pathbyaddr(): ", dlerror());
-        return -1;
-        }
-#endif
 #endif /* DSO_DLFCN */
diff --git a/src/lib/libssl/src/crypto/dso/dso_err.c b/src/lib/libssl/src/crypto/dso/dso_err.c
index 581677cc36..a8b0a210de 100644
--- a/src/lib/libssl/src/crypto/dso/dso_err.c
+++ b/src/lib/libssl/src/crypto/dso/dso_err.c
@@ -73,11 +73,13 @@ static ERR_STRING_DATA DSO_str_functs[]=
 {ERR_FUNC(DSO_F_DLFCN_BIND_FUNC),       "DLFCN_BIND_FUNC"},
 {ERR_FUNC(DSO_F_DLFCN_BIND_VAR),        "DLFCN_BIND_VAR"},
 {ERR_FUNC(DSO_F_DLFCN_LOAD),    "DLFCN_LOAD"},
+{ERR_FUNC(DSO_F_DLFCN_MERGER),  "DLFCN_MERGER"},
 {ERR_FUNC(DSO_F_DLFCN_NAME_CONVERTER),  "DLFCN_NAME_CONVERTER"},
 {ERR_FUNC(DSO_F_DLFCN_UNLOAD),  "DLFCN_UNLOAD"},
 {ERR_FUNC(DSO_F_DL_BIND_FUNC),  "DL_BIND_FUNC"},
 {ERR_FUNC(DSO_F_DL_BIND_VAR),   "DL_BIND_VAR"},
 {ERR_FUNC(DSO_F_DL_LOAD),       "DL_LOAD"},
+{ERR_FUNC(DSO_F_DL_MERGER),     "DL_MERGER"},
 {ERR_FUNC(DSO_F_DL_NAME_CONVERTER),     "DL_NAME_CONVERTER"},
 {ERR_FUNC(DSO_F_DL_UNLOAD),     "DL_UNLOAD"},
 {ERR_FUNC(DSO_F_DSO_BIND_FUNC), "DSO_bind_func"},
@@ -88,17 +90,22 @@ static ERR_STRING_DATA DSO_str_functs[]=
 {ERR_FUNC(DSO_F_DSO_GET_FILENAME),      "DSO_get_filename"},
 {ERR_FUNC(DSO_F_DSO_GET_LOADED_FILENAME),       "DSO_get_loaded_filename"},
 {ERR_FUNC(DSO_F_DSO_LOAD),      "DSO_load"},
+{ERR_FUNC(DSO_F_DSO_MERGE),     "DSO_merge"},
 {ERR_FUNC(DSO_F_DSO_NEW_METHOD),        "DSO_new_method"},
 {ERR_FUNC(DSO_F_DSO_SET_FILENAME),      "DSO_set_filename"},
 {ERR_FUNC(DSO_F_DSO_SET_NAME_CONVERTER),        "DSO_set_name_converter"},
 {ERR_FUNC(DSO_F_DSO_UP_REF),    "DSO_up_ref"},
-{ERR_FUNC(DSO_F_VMS_BIND_VAR),  "VMS_BIND_VAR"},
+{ERR_FUNC(DSO_F_VMS_BIND_SYM),  "VMS_BIND_SYM"},
 {ERR_FUNC(DSO_F_VMS_LOAD),      "VMS_LOAD"},
+{ERR_FUNC(DSO_F_VMS_MERGER),    "VMS_MERGER"},
 {ERR_FUNC(DSO_F_VMS_UNLOAD),    "VMS_UNLOAD"},
 {ERR_FUNC(DSO_F_WIN32_BIND_FUNC),       "WIN32_BIND_FUNC"},
 {ERR_FUNC(DSO_F_WIN32_BIND_VAR),        "WIN32_BIND_VAR"},
+{ERR_FUNC(DSO_F_WIN32_JOINER),  "WIN32_JOINER"},
 {ERR_FUNC(DSO_F_WIN32_LOAD),    "WIN32_LOAD"},
+{ERR_FUNC(DSO_F_WIN32_MERGER),  "WIN32_MERGER"},
 {ERR_FUNC(DSO_F_WIN32_NAME_CONVERTER),  "WIN32_NAME_CONVERTER"},
+{ERR_FUNC(DSO_F_WIN32_SPLITTER),        "WIN32_SPLITTER"},
 {ERR_FUNC(DSO_F_WIN32_UNLOAD),  "WIN32_UNLOAD"},
 {0,NULL}
         };
@@ -107,11 +114,15 @@ static ERR_STRING_DATA DSO_str_reasons[]=
         {
 {ERR_REASON(DSO_R_CTRL_FAILED)           ,"control command failed"},
 {ERR_REASON(DSO_R_DSO_ALREADY_LOADED)    ,"dso already loaded"},
+{ERR_REASON(DSO_R_EMPTY_FILE_STRUCTURE)  ,"empty file structure"},
+{ERR_REASON(DSO_R_FAILURE)               ,"failure"},
 {ERR_REASON(DSO_R_FILENAME_TOO_BIG)      ,"filename too big"},
 {ERR_REASON(DSO_R_FINISH_FAILED)         ,"cleanup method function failed"},
+{ERR_REASON(DSO_R_INCORRECT_FILE_SYNTAX) ,"incorrect file syntax"},
 {ERR_REASON(DSO_R_LOAD_FAILED)           ,"could not load the shared library"},
 {ERR_REASON(DSO_R_NAME_TRANSLATION_FAILED),"name translation failed"},
 {ERR_REASON(DSO_R_NO_FILENAME)           ,"no filename"},
+{ERR_REASON(DSO_R_NO_FILE_SPECIFICATION) ,"no file specification"},
 {ERR_REASON(DSO_R_NULL_HANDLE)           ,"a null shared library handle was used"},
 {ERR_REASON(DSO_R_SET_FILENAME_FAILED)   ,"set filename failed"},
 {ERR_REASON(DSO_R_STACK_ERROR)           ,"the meth_data stack is corrupt"},
@@ -125,15 +136,12 @@ static ERR_STRING_DATA DSO_str_reasons[]=
 
 void ERR_load_DSO_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(DSO_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,DSO_str_functs);
                 ERR_load_strings(0,DSO_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/dso/dso_lib.c b/src/lib/libssl/src/crypto/dso/dso_lib.c
index 48d9fdb25e..49bdd71309 100644
--- a/src/lib/libssl/src/crypto/dso/dso_lib.c
+++ b/src/lib/libssl/src/crypto/dso/dso_lib.c
@@ -1,4 +1,4 @@
-/* dso_lib.c */
+/* dso_lib.c -*- mode:C; c-file-style: "eay" -*- */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -390,6 +390,33 @@ int DSO_set_filename(DSO *dso, const char *filename)
         return(1);
         }
 
+char *DSO_merge(DSO *dso, const char *filespec1, const char *filespec2)
+        {
+        char *result = NULL;
+
+        if(dso == NULL || filespec1 == NULL)
+                {
+                DSOerr(DSO_F_DSO_MERGE,ERR_R_PASSED_NULL_PARAMETER);
+                return(NULL);
+                }
+        if(filespec1 == NULL)
+                filespec1 = dso->filename;
+        if(filespec1 == NULL)
+                {
+                DSOerr(DSO_F_DSO_MERGE,DSO_R_NO_FILE_SPECIFICATION);
+                return(NULL);
+                }
+        if((dso->flags & DSO_FLAG_NO_NAME_TRANSLATION) == 0)
+                {
+                if(dso->merger != NULL)
+                        result = dso->merger(dso, filespec1, filespec2);
+                else if(dso->meth->dso_merger != NULL)
+                        result = dso->meth->dso_merger(dso,
+                                filespec1, filespec2);
+                }
+        return(result);
+        }
+
 char *DSO_convert_filename(DSO *dso, const char *filename)
         {
         char *result = NULL;
diff --git a/src/lib/libssl/src/crypto/dso/dso_null.c b/src/lib/libssl/src/crypto/dso/dso_null.c
index fa13a7cb0f..4972984651 100644
--- a/src/lib/libssl/src/crypto/dso/dso_null.c
+++ b/src/lib/libssl/src/crypto/dso/dso_null.c
@@ -75,6 +75,8 @@ static DSO_METHOD dso_meth_null = {
         NULL, /* unbind_func */
 #endif
         NULL, /* ctrl */
+        NULL, /* dso_name_converter */
+        NULL, /* dso_merger */
         NULL, /* init */
         NULL  /* finish */
         };
diff --git a/src/lib/libssl/src/crypto/dso/dso_vms.c b/src/lib/libssl/src/crypto/dso/dso_vms.c
index 1674619d17..2c434ee8a6 100644
--- a/src/lib/libssl/src/crypto/dso/dso_vms.c
+++ b/src/lib/libssl/src/crypto/dso/dso_vms.c
@@ -1,4 +1,4 @@
-/* dso_vms.c */
+/* dso_vms.c -*- mode:C; c-file-style: "eay" -*- */
 /* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
  * project 2000.
  */
@@ -63,6 +63,7 @@
 #include <openssl/dso.h>
 #ifdef OPENSSL_SYS_VMS
 #pragma message disable DOLLARID
+#include <rms.h>
 #include <lib$routines.h>
 #include <stsdef.h>
 #include <descrip.h>
@@ -89,6 +90,8 @@ static int vms_finish(DSO *dso);
 static long vms_ctrl(DSO *dso, int cmd, long larg, void *parg);
 #endif
 static char *vms_name_converter(DSO *dso, const char *filename);
+static char *vms_merger(DSO *dso, const char *filespec1,
+        const char *filespec2);
 
 static DSO_METHOD dso_meth_vms = {
         "OpenSSL 'VMS' shared library method",
@@ -103,6 +106,7 @@ static DSO_METHOD dso_meth_vms = {
 #endif
         NULL, /* ctrl */
         vms_name_converter,
+        vms_merger,
         NULL, /* init */
         NULL  /* finish */
         };
@@ -140,7 +144,7 @@ static int vms_load(DSO *dso)
 
         if(filename == NULL)
                 {
-                DSOerr(DSO_F_DLFCN_LOAD,DSO_R_NO_FILENAME);
+                DSOerr(DSO_F_VMS_LOAD,DSO_R_NO_FILENAME);
                 goto err;
                 }
 
@@ -295,19 +299,19 @@ void vms_bind_sym(DSO *dso, const char *symname, void **sym)
 
         if((dso == NULL) || (symname == NULL))
                 {
-                DSOerr(DSO_F_VMS_BIND_VAR,ERR_R_PASSED_NULL_PARAMETER);
+                DSOerr(DSO_F_VMS_BIND_SYM,ERR_R_PASSED_NULL_PARAMETER);
                 return;
                 }
         if(sk_num(dso->meth_data) < 1)
                 {
-                DSOerr(DSO_F_VMS_BIND_VAR,DSO_R_STACK_ERROR);
+                DSOerr(DSO_F_VMS_BIND_SYM,DSO_R_STACK_ERROR);
                 return;
                 }
         ptr = (DSO_VMS_INTERNAL *)sk_value(dso->meth_data,
                 sk_num(dso->meth_data) - 1);
         if(ptr == NULL)
                 {
-                DSOerr(DSO_F_VMS_BIND_VAR,DSO_R_NULL_HANDLE);
+                DSOerr(DSO_F_VMS_BIND_SYM,DSO_R_NULL_HANDLE);
                 return;
                 }
 
@@ -336,7 +340,7 @@ void vms_bind_sym(DSO *dso, const char *symname, void **sym)
                         {
                         errstring[length] = '\0';
 
-                        DSOerr(DSO_F_VMS_BIND_VAR,DSO_R_SYM_FAILURE);
+                        DSOerr(DSO_F_VMS_BIND_SYM,DSO_R_SYM_FAILURE);
                         if (ptr->imagename_dsc.dsc$w_length)
                                 ERR_add_error_data(9,
                                         "Symbol ", symname,
@@ -368,6 +372,127 @@ static DSO_FUNC_TYPE vms_bind_func(DSO *dso, const char *symname)
         return sym;
         }
 
+static char *vms_merger(DSO *dso, const char *filespec1, const char *filespec2)
+        {
+        int status;
+        int filespec1len, filespec2len;
+        struct FAB fab;
+#ifdef NAML$C_MAXRSS
+        struct NAML nam;
+        char esa[NAML$C_MAXRSS];
+#else
+        struct NAM nam;
+        char esa[NAM$C_MAXRSS];
+#endif
+        char *merged;
+
+        if (!filespec1) filespec1 = "";
+        if (!filespec2) filespec2 = "";
+        filespec1len = strlen(filespec1);
+        filespec2len = strlen(filespec2);
+
+        fab = cc$rms_fab;
+#ifdef NAML$C_MAXRSS
+        nam = cc$rms_naml;
+#else
+        nam = cc$rms_nam;
+#endif
+
+        fab.fab$l_fna = (char *)filespec1;
+        fab.fab$b_fns = filespec1len;
+        fab.fab$l_dna = (char *)filespec2;
+        fab.fab$b_dns = filespec2len;
+#ifdef NAML$C_MAXRSS
+        if (filespec1len > NAM$C_MAXRSS)
+                {
+                fab.fab$l_fna = 0;
+                fab.fab$b_fns = 0;
+                nam.naml$l_long_filename = (char *)filespec1;
+                nam.naml$l_long_filename_size = filespec1len;
+                }
+        if (filespec2len > NAM$C_MAXRSS)
+                {
+                fab.fab$l_dna = 0;
+                fab.fab$b_dns = 0;
+                nam.naml$l_long_defname = (char *)filespec2;
+                nam.naml$l_long_defname_size = filespec2len;
+                }
+        nam.naml$l_esa = esa;
+        nam.naml$b_ess = NAM$C_MAXRSS;
+        nam.naml$l_long_expand = esa;
+        nam.naml$l_long_expand_alloc = sizeof(esa);
+        nam.naml$b_nop = NAM$M_SYNCHK | NAM$M_PWD;
+        nam.naml$v_no_short_upcase = 1;
+        fab.fab$l_naml = &nam;
+#else
+        nam.nam$l_esa = esa;
+        nam.nam$b_ess = NAM$C_MAXRSS;
+        nam.nam$b_nop = NAM$M_SYNCHK | NAM$M_PWD;
+        fab.fab$l_nam = &nam;
+#endif
+
+        status = sys$parse(&fab, 0, 0);
+
+        if(!$VMS_STATUS_SUCCESS(status))
+                {
+                unsigned short length;
+                char errstring[257];
+                struct dsc$descriptor_s errstring_dsc;
+
+                errstring_dsc.dsc$w_length = sizeof(errstring);
+                errstring_dsc.dsc$b_dtype = DSC$K_DTYPE_T;
+                errstring_dsc.dsc$b_class = DSC$K_CLASS_S;
+                errstring_dsc.dsc$a_pointer = errstring;
+
+                status = sys$getmsg(status, &length, &errstring_dsc, 1, 0);
+
+                if (!$VMS_STATUS_SUCCESS(status))
+                        lib$signal(status); /* This is really bad.  Abort!  */
+                else
+                        {
+                        errstring[length] = '\0';
+
+                        DSOerr(DSO_F_VMS_MERGER,DSO_R_FAILURE);
+                        ERR_add_error_data(7,
+                                           "filespec \"", filespec1, "\", ",
+                                           "defaults \"", filespec2, "\": ",
+                                           errstring);
+                        }
+                return(NULL);
+                }
+#ifdef NAML$C_MAXRSS
+        if (nam.naml$l_long_expand_size)
+                {
+                merged = OPENSSL_malloc(nam.naml$l_long_expand_size + 1);
+                if(!merged)
+                        goto malloc_err;
+                strncpy(merged, nam.naml$l_long_expand,
+                        nam.naml$l_long_expand_size);
+                merged[nam.naml$l_long_expand_size] = '\0';
+                }
+        else
+                {
+                merged = OPENSSL_malloc(nam.naml$b_esl + 1);
+                if(!merged)
+                        goto malloc_err;
+                strncpy(merged, nam.naml$l_esa,
+                        nam.naml$b_esl);
+                merged[nam.naml$b_esl] = '\0';
+                }
+#else
+        merged = OPENSSL_malloc(nam.nam$b_esl + 1);
+        if(!merged)
+                goto malloc_err;
+        strncpy(merged, nam.nam$l_esa,
+                nam.nam$b_esl);
+        merged[nam.nam$b_esl] = '\0';
+#endif
+        return(merged);
+ malloc_err:
+        DSOerr(DSO_F_VMS_MERGER,
+                ERR_R_MALLOC_FAILURE);
+        }
+
 static char *vms_name_converter(DSO *dso, const char *filename)
         {
         int len = strlen(filename);
diff --git a/src/lib/libssl/src/crypto/dso/dso_win32.c b/src/lib/libssl/src/crypto/dso/dso_win32.c
index cc4ac68696..fd3dd6a7fe 100644
--- a/src/lib/libssl/src/crypto/dso/dso_win32.c
+++ b/src/lib/libssl/src/crypto/dso/dso_win32.c
@@ -1,4 +1,4 @@
-/* dso_win32.c */
+/* dso_win32.c -*- mode:C; c-file-style: "eay" -*- */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -85,6 +85,26 @@ static FARPROC GetProcAddressA(HMODULE hModule,LPCSTR lpProcName)
 # endif
 # undef GetProcAddress
 # define GetProcAddress GetProcAddressA
+
+static HINSTANCE LoadLibraryA(LPCSTR lpLibFileName)
+        {
+        WCHAR *fnamw;
+        size_t len_0=strlen(lpLibFileName)+1,i;
+
+#ifdef _MSC_VER
+        fnamw = (WCHAR *)_alloca (len_0*sizeof(WCHAR));
+#else
+        fnamw = (WCHAR *)alloca (len_0*sizeof(WCHAR));
+#endif
+        if (fnamw == NULL) return NULL;
+
+#if defined(_WIN32_WCE) && _WIN32_WCE>=101
+        if (!MultiByteToWideChar(CP_ACP,0,lpLibFileName,len_0,fnamw,len_0))
+#endif
+                for (i=0;i<len_0;i++) fnamw[i]=(WCHAR)lpLibFileName[i];
+
+        return LoadLibraryW(fnamw);
+        }
 #endif
 
 /* Part of the hack in "win32_load" ... */
@@ -102,6 +122,10 @@ static int win32_finish(DSO *dso);
 static long win32_ctrl(DSO *dso, int cmd, long larg, void *parg);
 #endif
 static char *win32_name_converter(DSO *dso, const char *filename);
+static char *win32_merger(DSO *dso, const char *filespec1,
+        const char *filespec2);
+
+static const char *openssl_strnchr(const char *string, int c, size_t len);
 
 static DSO_METHOD dso_meth_win32 = {
         "OpenSSL 'win32' shared library method",
@@ -116,6 +140,7 @@ static DSO_METHOD dso_meth_win32 = {
 #endif
         NULL, /* ctrl */
         win32_name_converter,
+        win32_merger,
         NULL, /* init */
         NULL  /* finish */
         };
@@ -267,6 +292,330 @@ static DSO_FUNC_TYPE win32_bind_func(DSO *dso, const char *symname)
         return((DSO_FUNC_TYPE)sym);
         }
 
+struct file_st
+        {
+        const char *node; int nodelen;
+        const char *device; int devicelen;
+        const char *predir; int predirlen;
+        const char *dir; int dirlen;
+        const char *file; int filelen;
+        };
+
+static struct file_st *win32_splitter(DSO *dso, const char *filename,
+        int assume_last_is_dir)
+        {
+        struct file_st *result = NULL;
+        enum { IN_NODE, IN_DEVICE, IN_FILE } position;
+        const char *start = filename;
+        char last;
+
+        if (!filename)
+                {
+                DSOerr(DSO_F_WIN32_SPLITTER,DSO_R_NO_FILENAME);
+                /*goto err;*/
+                return(NULL);
+                }
+
+        result = OPENSSL_malloc(sizeof(struct file_st));
+        if(result == NULL)
+                {
+                DSOerr(DSO_F_WIN32_SPLITTER,
+                        ERR_R_MALLOC_FAILURE);
+                return(NULL);
+                }
+
+        memset(result, 0, sizeof(struct file_st));
+        position = IN_DEVICE;
+
+        if(filename[0] == '\\' && filename[1] == '\\'
+                || filename[0] == '/' && filename[1] == '/')
+                {
+                position = IN_NODE;
+                filename += 2;
+                start = filename;
+                result->node = start;
+                }
+
+        do
+                {
+                last = filename[0];
+                switch(last)
+                        {
+                case ':':
+                        if(position != IN_DEVICE)
+                                {
+                                DSOerr(DSO_F_WIN32_SPLITTER,
+                                        DSO_R_INCORRECT_FILE_SYNTAX);
+                                /*goto err;*/
+                                return(NULL);
+                                }
+                        result->device = start;
+                        result->devicelen = filename - start;
+                        position = IN_FILE;
+                        start = ++filename;
+                        result->dir = start;
+                        break;
+                case '\\':
+                case '/':
+                        if(position == IN_NODE)
+                                {
+                                result->nodelen = filename - start;
+                                position = IN_FILE;
+                                start = ++filename;
+                                result->dir = start;
+                                }
+                        else if(position == IN_DEVICE)
+                                {
+                                position = IN_FILE;
+                                filename++;
+                                result->dir = start;
+                                result->dirlen = filename - start;
+                                start = filename;
+                                }
+                        else
+                                {
+                                filename++;
+                                result->dirlen += filename - start;
+                                start = filename;
+                                }
+                        break;
+                case '\0':
+                        if(position == IN_NODE)
+                                {
+                                result->nodelen = filename - start;
+                                }
+                        else
+                                {
+                                if(filename - start > 0)
+                                        {
+                                        if (assume_last_is_dir)
+                                                {
+                                                if (position == IN_DEVICE)
+                                                        {
+                                                        result->dir = start;
+                                                        result->dirlen = 0;
+                                                        }
+                                                result->dirlen +=
+                                                        filename - start;
+                                                }
+                                        else
+                                                {
+                                                result->file = start;
+                                                result->filelen =
+                                                        filename - start;
+                                                }
+                                        }
+                                }
+                        break;
+                default:
+                        filename++;
+                        break;
+                        }
+                }
+        while(last);
+
+        if(!result->nodelen) result->node = NULL;
+        if(!result->devicelen) result->device = NULL;
+        if(!result->dirlen) result->dir = NULL;
+        if(!result->filelen) result->file = NULL;
+
+        return(result);
+        }
+
+static char *win32_joiner(DSO *dso, const struct file_st *file_split)
+        {
+        int len = 0, offset = 0;
+        char *result = NULL;
+        const char *start;
+
+        if(!file_split)
+                {
+                DSOerr(DSO_F_WIN32_JOINER,
+                                ERR_R_PASSED_NULL_PARAMETER);
+                return(NULL);
+                }
+        if(file_split->node)
+                {
+                len += 2 + file_split->nodelen; /* 2 for starting \\ */
+                if(file_split->predir || file_split->dir || file_split->file)
+                        len++;  /* 1 for ending \ */
+                }
+        else if(file_split->device)
+                {
+                len += file_split->devicelen + 1; /* 1 for ending : */
+                }
+        len += file_split->predirlen;
+        if(file_split->predir && (file_split->dir || file_split->file))
+                {
+                len++;  /* 1 for ending \ */
+                }
+        len += file_split->dirlen;
+        if(file_split->dir && file_split->file)
+                {
+                len++;  /* 1 for ending \ */
+                }
+        len += file_split->filelen;
+
+        if(!len)
+                {
+                DSOerr(DSO_F_WIN32_JOINER, DSO_R_EMPTY_FILE_STRUCTURE);
+                return(NULL);
+                }
+
+        result = OPENSSL_malloc(len + 1);
+        if (!result)
+                {
+                DSOerr(DSO_F_WIN32_JOINER,
+                        ERR_R_MALLOC_FAILURE);
+                return(NULL);
+                }
+
+        if(file_split->node)
+                {
+                strcpy(&result[offset], "\\\\"); offset += 2;
+                strncpy(&result[offset], file_split->node,
+                        file_split->nodelen); offset += file_split->nodelen;
+                if(file_split->predir || file_split->dir || file_split->file)
+                        {
+                        result[offset] = '\\'; offset++;
+                        }
+                }
+        else if(file_split->device)
+                {
+                strncpy(&result[offset], file_split->device,
+                        file_split->devicelen); offset += file_split->devicelen;
+                result[offset] = ':'; offset++;
+                }
+        start = file_split->predir;
+        while(file_split->predirlen > (start - file_split->predir))
+                {
+                const char *end = openssl_strnchr(start, '/',
+                        file_split->predirlen - (start - file_split->predir));
+                if(!end)
+                        end = start
+                                + file_split->predirlen
+                                - (start - file_split->predir);
+                strncpy(&result[offset], start,
+                        end - start); offset += end - start;
+                result[offset] = '\\'; offset++;
+                start = end + 1;
+                }
+#if 0 /* Not needed, since the directory converter above already appeneded
+         a backslash */
+        if(file_split->predir && (file_split->dir || file_split->file))
+                {
+                result[offset] = '\\'; offset++;
+                }
+#endif
+        start = file_split->dir;
+        while(file_split->dirlen > (start - file_split->dir))
+                {
+                const char *end = openssl_strnchr(start, '/',
+                        file_split->dirlen - (start - file_split->dir));
+                if(!end)
+                        end = start
+                                + file_split->dirlen
+                                - (start - file_split->dir);
+                strncpy(&result[offset], start,
+                        end - start); offset += end - start;
+                result[offset] = '\\'; offset++;
+                start = end + 1;
+                }
+#if 0 /* Not needed, since the directory converter above already appeneded
+         a backslash */
+        if(file_split->dir && file_split->file)
+                {
+                result[offset] = '\\'; offset++;
+                }
+#endif
+        strncpy(&result[offset], file_split->file,
+                file_split->filelen); offset += file_split->filelen;
+        result[offset] = '\0';
+        return(result);
+        }
+
+static char *win32_merger(DSO *dso, const char *filespec1, const char *filespec2)
+        {
+        char *merged = NULL;
+        struct file_st *filespec1_split = NULL;
+        struct file_st *filespec2_split = NULL;
+
+        if(!filespec1 && !filespec2)
+                {
+                DSOerr(DSO_F_WIN32_MERGER,
+                                ERR_R_PASSED_NULL_PARAMETER);
+                return(NULL);
+                }
+        if (!filespec2)
+                {
+                merged = OPENSSL_malloc(strlen(filespec1) + 1);
+                if(!merged)
+                        {
+                        DSOerr(DSO_F_WIN32_MERGER,
+                                ERR_R_MALLOC_FAILURE);
+                        return(NULL);
+                        }
+                strcpy(merged, filespec1);
+                }
+        else if (!filespec1)
+                {
+                merged = OPENSSL_malloc(strlen(filespec2) + 1);
+                if(!merged)
+                        {
+                        DSOerr(DSO_F_WIN32_MERGER,
+                                ERR_R_MALLOC_FAILURE);
+                        return(NULL);
+                        }
+                strcpy(merged, filespec2);
+                }
+        else
+                {
+                filespec1_split = win32_splitter(dso, filespec1, 0);
+                if (!filespec1_split)
+                        {
+                        DSOerr(DSO_F_WIN32_MERGER,
+                                ERR_R_MALLOC_FAILURE);
+                        return(NULL);
+                        }
+                filespec2_split = win32_splitter(dso, filespec2, 1);
+                if (!filespec2_split)
+                        {
+                        DSOerr(DSO_F_WIN32_MERGER,
+                                ERR_R_MALLOC_FAILURE);
+                        OPENSSL_free(filespec1_split);
+                        return(NULL);
+                        }
+
+                /* Fill in into filespec1_split */
+                if (!filespec1_split->node && !filespec1_split->device)
+                        {
+                        filespec1_split->node = filespec2_split->node;
+                        filespec1_split->nodelen = filespec2_split->nodelen;
+                        filespec1_split->device = filespec2_split->device;
+                        filespec1_split->devicelen = filespec2_split->devicelen;
+                        }
+                if (!filespec1_split->dir)
+                        {
+                        filespec1_split->dir = filespec2_split->dir;
+                        filespec1_split->dirlen = filespec2_split->dirlen;
+                        }
+                else if (filespec1_split->dir[0] != '\\'
+                        && filespec1_split->dir[0] != '/')
+                        {
+                        filespec1_split->predir = filespec2_split->dir;
+                        filespec1_split->predirlen = filespec2_split->dirlen;
+                        }
+                if (!filespec1_split->file)
+                        {
+                        filespec1_split->file = filespec2_split->file;
+                        filespec1_split->filelen = filespec2_split->filelen;
+                        }
+
+                merged = win32_joiner(dso, filespec1_split);
+                }
+        return(merged);
+        }
+
 static char *win32_name_converter(DSO *dso, const char *filename)
         {
         char *translated;
@@ -295,4 +644,17 @@ static char *win32_name_converter(DSO *dso, const char *filename)
         return(translated);
         }
 
+static const char *openssl_strnchr(const char *string, int c, size_t len)
+        {
+        size_t i;
+        const char *p;
+        for (i = 0, p = string; i < len && *p; i++, p++)
+                {
+                if (*p == c)
+                        return p;
+                }
+        return NULL;
+        }
+
+
 #endif /* OPENSSL_SYS_WIN32 */
diff --git a/src/lib/libssl/src/crypto/ebcdic.c b/src/lib/libssl/src/crypto/ebcdic.c
index d1bece87f7..43e53bcaf7 100644
--- a/src/lib/libssl/src/crypto/ebcdic.c
+++ b/src/lib/libssl/src/crypto/ebcdic.c
@@ -1,6 +1,14 @@
 /* crypto/ebcdic.c */
 
-#ifdef CHARSET_EBCDIC
+#ifndef CHARSET_EBCDIC
+
+#include <openssl/e_os2.h>
+#if defined(PEDANTIC) || defined(__DECC) || defined(OPENSSL_SYS_MACOSX)
+static void *dummy=&dummy;
+#endif
+
+#else /*CHARSET_EBCDIC*/
+
 #include "ebcdic.h"
 /*      Initial Port for  Apache-1.3     by <Martin.Kraemer@Mch.SNI.De>
  *      Adapted for       OpenSSL-0.9.4  by <Martin.Kraemer@Mch.SNI.De>
@@ -210,9 +218,4 @@ ascii2ebcdic(void *dest, const void *srce, size_t count)
     return dest;
 }
 
-#else /*CHARSET_EBCDIC*/
-#include <openssl/e_os2.h>
-#if defined(PEDANTIC) || defined(__DECC) || defined(OPENSSL_SYS_MACOSX)
-static void *dummy=&dummy;
-#endif
 #endif
diff --git a/src/lib/libssl/src/crypto/ec/ec.h b/src/lib/libssl/src/crypto/ec/ec.h
index 6d6a9b7127..8bc2a235b1 100644
--- a/src/lib/libssl/src/crypto/ec/ec.h
+++ b/src/lib/libssl/src/crypto/ec/ec.h
@@ -1,6 +1,9 @@
 /* crypto/ec/ec.h */
+/*
+ * Originally written by Bodo Moeller for the OpenSSL project.
+ */
 /* ====================================================================
- * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,22 +55,48 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * The elliptic curve binary polynomial software is originally written by 
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
 
 #ifndef HEADER_EC_H
 #define HEADER_EC_H
 
+#include <openssl/opensslconf.h>
+
 #ifdef OPENSSL_NO_EC
 #error EC is disabled.
 #endif
 
-#include <openssl/bn.h>
+#include <openssl/asn1.h>
 #include <openssl/symhacks.h>
+#ifndef OPENSSL_NO_DEPRECATED
+#include <openssl/bn.h>
+#endif
 
 #ifdef  __cplusplus
 extern "C" {
+#elif defined(__SUNPRO_C)
+# if __SUNPRO_C >= 0x520
+# pragma error_messages (off,E_ARRAY_OF_INCOMPLETE_NONAME,E_ARRAY_OF_INCOMPLETE)
+# endif
 #endif
 
 
+#ifndef OPENSSL_ECC_MAX_FIELD_BITS
+# define OPENSSL_ECC_MAX_FIELD_BITS 661
+#endif
+
 typedef enum {
         /* values as defined in X9.62 (ECDSA) and elsewhere */
         POINT_CONVERSION_COMPRESSED = 2,
@@ -84,7 +113,8 @@ typedef struct ec_group_st
          -- field definition
          -- curve coefficients
          -- optional generator with associated information (order, cofactor)
-         -- optional extra data (TODO: precomputed table for fast computation of multiples of generator)
+         -- optional extra data (precomputed table for fast computation of multiples of generator)
+         -- ASN1 stuff
         */
         EC_GROUP;
 
@@ -96,40 +126,84 @@ typedef struct ec_point_st EC_POINT;
  */
 const EC_METHOD *EC_GFp_simple_method(void);
 const EC_METHOD *EC_GFp_mont_method(void);
-#if 0
-const EC_METHOD *EC_GFp_recp_method(void); /* TODO */
-const EC_METHOD *EC_GFp_nist_method(void); /* TODO */
-#endif
+const EC_METHOD *EC_GFp_nist_method(void);
+
+/* EC_METHOD for curves over GF(2^m).
+ */
+const EC_METHOD *EC_GF2m_simple_method(void);
 
 
 EC_GROUP *EC_GROUP_new(const EC_METHOD *);
 void EC_GROUP_free(EC_GROUP *);
 void EC_GROUP_clear_free(EC_GROUP *);
 int EC_GROUP_copy(EC_GROUP *, const EC_GROUP *);
+EC_GROUP *EC_GROUP_dup(const EC_GROUP *);
 
 const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *);
-        
+int EC_METHOD_get_field_type(const EC_METHOD *);
+
+int EC_GROUP_set_generator(EC_GROUP *, const EC_POINT *generator, const BIGNUM *order, const BIGNUM *cofactor);
+const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *);
+int EC_GROUP_get_order(const EC_GROUP *, BIGNUM *order, BN_CTX *);
+int EC_GROUP_get_cofactor(const EC_GROUP *, BIGNUM *cofactor, BN_CTX *);
+
+void EC_GROUP_set_curve_name(EC_GROUP *, int nid);
+int EC_GROUP_get_curve_name(const EC_GROUP *);
+
+void EC_GROUP_set_asn1_flag(EC_GROUP *, int flag);
+int EC_GROUP_get_asn1_flag(const EC_GROUP *);
+
+void EC_GROUP_set_point_conversion_form(EC_GROUP *, point_conversion_form_t);
+point_conversion_form_t EC_GROUP_get_point_conversion_form(const EC_GROUP *);
+
+unsigned char *EC_GROUP_get0_seed(const EC_GROUP *);
+size_t EC_GROUP_get_seed_len(const EC_GROUP *);
+size_t EC_GROUP_set_seed(EC_GROUP *, const unsigned char *, size_t len);
 
-/* We don't have types for field specifications and field elements in general.
- * Otherwise we could declare
- *     int EC_GROUP_set_curve(EC_GROUP *, .....);
- */
 int EC_GROUP_set_curve_GFp(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
 int EC_GROUP_get_curve_GFp(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
+int EC_GROUP_set_curve_GF2m(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
+int EC_GROUP_get_curve_GF2m(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
+
+/* returns the number of bits needed to represent a field element */
+int EC_GROUP_get_degree(const EC_GROUP *);
+
+/* EC_GROUP_check() returns 1 if 'group' defines a valid group, 0 otherwise */
+int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx);
+/* EC_GROUP_check_discriminant() returns 1 if the discriminant of the
+ * elliptic curve is not zero, 0 otherwise */
+int EC_GROUP_check_discriminant(const EC_GROUP *, BN_CTX *);
 
-/* EC_GROUP_new_GFp() calls EC_GROUP_new() and EC_GROUP_set_GFp()
+/* EC_GROUP_cmp() returns 0 if both groups are equal and 1 otherwise */
+int EC_GROUP_cmp(const EC_GROUP *, const EC_GROUP *, BN_CTX *);
+
+/* EC_GROUP_new_GF*() calls EC_GROUP_new() and EC_GROUP_set_GF*()
  * after choosing an appropriate EC_METHOD */
 EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
+EC_GROUP *EC_GROUP_new_curve_GF2m(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
 
-int EC_GROUP_set_generator(EC_GROUP *, const EC_POINT *generator, const BIGNUM *order, const BIGNUM *cofactor);
-EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *);
-int EC_GROUP_get_order(const EC_GROUP *, BIGNUM *order, BN_CTX *);
-int EC_GROUP_get_cofactor(const EC_GROUP *, BIGNUM *cofactor, BN_CTX *);
+/* EC_GROUP_new_by_curve_name() creates a EC_GROUP structure
+ * specified by a curve name (in form of a NID) */
+EC_GROUP *EC_GROUP_new_by_curve_name(int nid);
+/* handling of internal curves */
+typedef struct { 
+        int nid;
+        const char *comment;
+        } EC_builtin_curve;
+/* EC_builtin_curves(EC_builtin_curve *r, size_t size) returns number 
+ * of all available curves or zero if a error occurred. 
+ * In case r ist not zero nitems EC_builtin_curve structures 
+ * are filled with the data of the first nitems internal groups */
+size_t EC_get_builtin_curves(EC_builtin_curve *r, size_t nitems);
+
+
+/* EC_POINT functions */
 
 EC_POINT *EC_POINT_new(const EC_GROUP *);
 void EC_POINT_free(EC_POINT *);
 void EC_POINT_clear_free(EC_POINT *);
 int EC_POINT_copy(EC_POINT *, const EC_POINT *);
+EC_POINT *EC_POINT_dup(const EC_POINT *, const EC_GROUP *);
  
 const EC_METHOD *EC_POINT_method_of(const EC_POINT *);
 
@@ -145,11 +219,28 @@ int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *, const EC_POINT *,
 int EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *, EC_POINT *,
         const BIGNUM *x, int y_bit, BN_CTX *);
 
+int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *, EC_POINT *,
+        const BIGNUM *x, const BIGNUM *y, BN_CTX *);
+int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *, const EC_POINT *,
+        BIGNUM *x, BIGNUM *y, BN_CTX *);
+int EC_POINT_set_compressed_coordinates_GF2m(const EC_GROUP *, EC_POINT *,
+        const BIGNUM *x, int y_bit, BN_CTX *);
+
 size_t EC_POINT_point2oct(const EC_GROUP *, const EC_POINT *, point_conversion_form_t form,
         unsigned char *buf, size_t len, BN_CTX *);
 int EC_POINT_oct2point(const EC_GROUP *, EC_POINT *,
         const unsigned char *buf, size_t len, BN_CTX *);
 
+/* other interfaces to point2oct/oct2point: */
+BIGNUM *EC_POINT_point2bn(const EC_GROUP *, const EC_POINT *,
+        point_conversion_form_t form, BIGNUM *, BN_CTX *);
+EC_POINT *EC_POINT_bn2point(const EC_GROUP *, const BIGNUM *,
+        EC_POINT *, BN_CTX *);
+char *EC_POINT_point2hex(const EC_GROUP *, const EC_POINT *,
+        point_conversion_form_t form, BN_CTX *);
+EC_POINT *EC_POINT_hex2point(const EC_GROUP *, const char *,
+        EC_POINT *, BN_CTX *);
+
 int EC_POINT_add(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, const EC_POINT *b, BN_CTX *);
 int EC_POINT_dbl(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, BN_CTX *);
 int EC_POINT_invert(const EC_GROUP *, EC_POINT *, BN_CTX *);
@@ -164,9 +255,112 @@ int EC_POINTs_make_affine(const EC_GROUP *, size_t num, EC_POINT *[], BN_CTX *);
 
 int EC_POINTs_mul(const EC_GROUP *, EC_POINT *r, const BIGNUM *, size_t num, const EC_POINT *[], const BIGNUM *[], BN_CTX *);
 int EC_POINT_mul(const EC_GROUP *, EC_POINT *r, const BIGNUM *, const EC_POINT *, const BIGNUM *, BN_CTX *);
+
+/* EC_GROUP_precompute_mult() stores multiples of generator for faster point multiplication */
 int EC_GROUP_precompute_mult(EC_GROUP *, BN_CTX *);
+/* EC_GROUP_have_precompute_mult() reports whether such precomputation has been done */
+int EC_GROUP_have_precompute_mult(const EC_GROUP *);
+
+
 
+/* ASN1 stuff */
 
+/* EC_GROUP_get_basis_type() returns the NID of the basis type
+ * used to represent the field elements */
+int EC_GROUP_get_basis_type(const EC_GROUP *);
+int EC_GROUP_get_trinomial_basis(const EC_GROUP *, unsigned int *k);
+int EC_GROUP_get_pentanomial_basis(const EC_GROUP *, unsigned int *k1, 
+        unsigned int *k2, unsigned int *k3);
+
+#define OPENSSL_EC_NAMED_CURVE  0x001
+
+typedef struct ecpk_parameters_st ECPKPARAMETERS;
+
+EC_GROUP *d2i_ECPKParameters(EC_GROUP **, const unsigned char **in, long len);
+int i2d_ECPKParameters(const EC_GROUP *, unsigned char **out);
+
+#define d2i_ECPKParameters_bio(bp,x) ASN1_d2i_bio_of(EC_GROUP,NULL,d2i_ECPKParameters,bp,x)
+#define i2d_ECPKParameters_bio(bp,x) ASN1_i2d_bio_of_const(EC_GROUP,i2d_ECPKParameters,bp,x)
+#define d2i_ECPKParameters_fp(fp,x) (EC_GROUP *)ASN1_d2i_fp(NULL, \
+                (char *(*)())d2i_ECPKParameters,(fp),(unsigned char **)(x))
+#define i2d_ECPKParameters_fp(fp,x) ASN1_i2d_fp(i2d_ECPKParameters,(fp), \
+                (unsigned char *)(x))
+
+#ifndef OPENSSL_NO_BIO
+int     ECPKParameters_print(BIO *bp, const EC_GROUP *x, int off);
+#endif
+#ifndef OPENSSL_NO_FP_API
+int     ECPKParameters_print_fp(FILE *fp, const EC_GROUP *x, int off);
+#endif
+
+/* the EC_KEY stuff */
+typedef struct ec_key_st EC_KEY;
+
+/* some values for the encoding_flag */
+#define EC_PKEY_NO_PARAMETERS   0x001
+#define EC_PKEY_NO_PUBKEY       0x002
+
+EC_KEY *EC_KEY_new(void);
+EC_KEY *EC_KEY_new_by_curve_name(int nid);
+void EC_KEY_free(EC_KEY *);
+EC_KEY *EC_KEY_copy(EC_KEY *, const EC_KEY *);
+EC_KEY *EC_KEY_dup(const EC_KEY *);
+
+int EC_KEY_up_ref(EC_KEY *);
+
+const EC_GROUP *EC_KEY_get0_group(const EC_KEY *);
+int EC_KEY_set_group(EC_KEY *, const EC_GROUP *);
+const BIGNUM *EC_KEY_get0_private_key(const EC_KEY *);
+int EC_KEY_set_private_key(EC_KEY *, const BIGNUM *);
+const EC_POINT *EC_KEY_get0_public_key(const EC_KEY *);
+int EC_KEY_set_public_key(EC_KEY *, const EC_POINT *);
+unsigned EC_KEY_get_enc_flags(const EC_KEY *);
+void EC_KEY_set_enc_flags(EC_KEY *, unsigned int);
+point_conversion_form_t EC_KEY_get_conv_form(const EC_KEY *);
+void EC_KEY_set_conv_form(EC_KEY *, point_conversion_form_t);
+/* functions to set/get method specific data  */
+void *EC_KEY_get_key_method_data(EC_KEY *, 
+        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *));
+void EC_KEY_insert_key_method_data(EC_KEY *, void *data,
+        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *));
+/* wrapper functions for the underlying EC_GROUP object */
+void EC_KEY_set_asn1_flag(EC_KEY *, int);
+int EC_KEY_precompute_mult(EC_KEY *, BN_CTX *ctx);
+
+/* EC_KEY_generate_key() creates a ec private (public) key */
+int EC_KEY_generate_key(EC_KEY *);
+/* EC_KEY_check_key() */
+int EC_KEY_check_key(const EC_KEY *);
+
+/* de- and encoding functions for SEC1 ECPrivateKey */
+EC_KEY *d2i_ECPrivateKey(EC_KEY **a, const unsigned char **in, long len);
+int i2d_ECPrivateKey(EC_KEY *a, unsigned char **out);
+/* de- and encoding functions for EC parameters */
+EC_KEY *d2i_ECParameters(EC_KEY **a, const unsigned char **in, long len);
+int i2d_ECParameters(EC_KEY *a, unsigned char **out);
+/* de- and encoding functions for EC public key
+ * (octet string, not DER -- hence 'o2i' and 'i2o') */
+EC_KEY *o2i_ECPublicKey(EC_KEY **a, const unsigned char **in, long len);
+int i2o_ECPublicKey(EC_KEY *a, unsigned char **out);
+
+#ifndef OPENSSL_NO_BIO
+int     ECParameters_print(BIO *bp, const EC_KEY *x);
+int     EC_KEY_print(BIO *bp, const EC_KEY *x, int off);
+#endif
+#ifndef OPENSSL_NO_FP_API
+int     ECParameters_print_fp(FILE *fp, const EC_KEY *x);
+int     EC_KEY_print_fp(FILE *fp, const EC_KEY *x, int off);
+#endif
+
+#define ECParameters_dup(x) ASN1_dup_of(EC_KEY,i2d_ECParameters,d2i_ECParameters,x)
+
+#ifndef __cplusplus
+#if defined(__SUNPRO_C)
+#  if __SUNPRO_C >= 0x520
+# pragma error_messages (default,E_ARRAY_OF_INCOMPLETE_NONAME,E_ARRAY_OF_INCOMPLETE)
+#  endif
+# endif
+#endif
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -178,51 +372,124 @@ void ERR_load_EC_strings(void);
 
 /* Function codes. */
 #define EC_F_COMPUTE_WNAF                                143
+#define EC_F_D2I_ECPARAMETERS                            144
+#define EC_F_D2I_ECPKPARAMETERS                          145
+#define EC_F_D2I_ECPRIVATEKEY                            146
+#define EC_F_ECPARAMETERS_PRINT                          147
+#define EC_F_ECPARAMETERS_PRINT_FP                       148
+#define EC_F_ECPKPARAMETERS_PRINT                        149
+#define EC_F_ECPKPARAMETERS_PRINT_FP                     150
+#define EC_F_ECP_NIST_MOD_192                            203
+#define EC_F_ECP_NIST_MOD_224                            204
+#define EC_F_ECP_NIST_MOD_256                            205
+#define EC_F_ECP_NIST_MOD_521                            206
+#define EC_F_EC_ASN1_GROUP2CURVE                         153
+#define EC_F_EC_ASN1_GROUP2FIELDID                       154
+#define EC_F_EC_ASN1_GROUP2PARAMETERS                    155
+#define EC_F_EC_ASN1_GROUP2PKPARAMETERS                  156
+#define EC_F_EC_ASN1_PARAMETERS2GROUP                    157
+#define EC_F_EC_ASN1_PKPARAMETERS2GROUP                  158
+#define EC_F_EC_EX_DATA_SET_DATA                         211
+#define EC_F_EC_GF2M_MONTGOMERY_POINT_MULTIPLY           208
+#define EC_F_EC_GF2M_SIMPLE_GROUP_CHECK_DISCRIMINANT     159
+#define EC_F_EC_GF2M_SIMPLE_GROUP_SET_CURVE              195
+#define EC_F_EC_GF2M_SIMPLE_OCT2POINT                    160
+#define EC_F_EC_GF2M_SIMPLE_POINT2OCT                    161
+#define EC_F_EC_GF2M_SIMPLE_POINT_GET_AFFINE_COORDINATES 162
+#define EC_F_EC_GF2M_SIMPLE_POINT_SET_AFFINE_COORDINATES 163
+#define EC_F_EC_GF2M_SIMPLE_SET_COMPRESSED_COORDINATES   164
 #define EC_F_EC_GFP_MONT_FIELD_DECODE                    133
 #define EC_F_EC_GFP_MONT_FIELD_ENCODE                    134
 #define EC_F_EC_GFP_MONT_FIELD_MUL                       131
+#define EC_F_EC_GFP_MONT_FIELD_SET_TO_ONE                209
 #define EC_F_EC_GFP_MONT_FIELD_SQR                       132
+#define EC_F_EC_GFP_MONT_GROUP_SET_CURVE                 189
+#define EC_F_EC_GFP_MONT_GROUP_SET_CURVE_GFP             135
+#define EC_F_EC_GFP_NIST_FIELD_MUL                       200
+#define EC_F_EC_GFP_NIST_FIELD_SQR                       201
+#define EC_F_EC_GFP_NIST_GROUP_SET_CURVE                 202
+#define EC_F_EC_GFP_SIMPLE_GROUP_CHECK_DISCRIMINANT      165
+#define EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE               166
 #define EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE_GFP           100
 #define EC_F_EC_GFP_SIMPLE_GROUP_SET_GENERATOR           101
 #define EC_F_EC_GFP_SIMPLE_MAKE_AFFINE                   102
 #define EC_F_EC_GFP_SIMPLE_OCT2POINT                     103
 #define EC_F_EC_GFP_SIMPLE_POINT2OCT                     104
 #define EC_F_EC_GFP_SIMPLE_POINTS_MAKE_AFFINE            137
+#define EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES  167
 #define EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES_GFP 105
+#define EC_F_EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES  168
 #define EC_F_EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES_GFP 128
+#define EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES    169
 #define EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES_GFP 129
+#define EC_F_EC_GROUP_CHECK                              170
+#define EC_F_EC_GROUP_CHECK_DISCRIMINANT                 171
 #define EC_F_EC_GROUP_COPY                               106
 #define EC_F_EC_GROUP_GET0_GENERATOR                     139
 #define EC_F_EC_GROUP_GET_COFACTOR                       140
+#define EC_F_EC_GROUP_GET_CURVE_GF2M                     172
 #define EC_F_EC_GROUP_GET_CURVE_GFP                      130
+#define EC_F_EC_GROUP_GET_DEGREE                         173
 #define EC_F_EC_GROUP_GET_ORDER                          141
+#define EC_F_EC_GROUP_GET_PENTANOMIAL_BASIS              193
+#define EC_F_EC_GROUP_GET_TRINOMIAL_BASIS                194
 #define EC_F_EC_GROUP_NEW                                108
+#define EC_F_EC_GROUP_NEW_BY_CURVE_NAME                  174
+#define EC_F_EC_GROUP_NEW_FROM_DATA                      175
 #define EC_F_EC_GROUP_PRECOMPUTE_MULT                    142
+#define EC_F_EC_GROUP_SET_CURVE_GF2M                     176
 #define EC_F_EC_GROUP_SET_CURVE_GFP                      109
 #define EC_F_EC_GROUP_SET_EXTRA_DATA                     110
 #define EC_F_EC_GROUP_SET_GENERATOR                      111
+#define EC_F_EC_KEY_CHECK_KEY                            177
+#define EC_F_EC_KEY_COPY                                 178
+#define EC_F_EC_KEY_GENERATE_KEY                         179
+#define EC_F_EC_KEY_NEW                                  182
+#define EC_F_EC_KEY_PRINT                                180
+#define EC_F_EC_KEY_PRINT_FP                             181
 #define EC_F_EC_POINTS_MAKE_AFFINE                       136
 #define EC_F_EC_POINTS_MUL                               138
 #define EC_F_EC_POINT_ADD                                112
 #define EC_F_EC_POINT_CMP                                113
 #define EC_F_EC_POINT_COPY                               114
 #define EC_F_EC_POINT_DBL                                115
+#define EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M        183
 #define EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP         116
 #define EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP    117
+#define EC_F_EC_POINT_INVERT                             210
 #define EC_F_EC_POINT_IS_AT_INFINITY                     118
 #define EC_F_EC_POINT_IS_ON_CURVE                        119
 #define EC_F_EC_POINT_MAKE_AFFINE                        120
+#define EC_F_EC_POINT_MUL                                184
 #define EC_F_EC_POINT_NEW                                121
 #define EC_F_EC_POINT_OCT2POINT                          122
 #define EC_F_EC_POINT_POINT2OCT                          123
+#define EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M        185
 #define EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP         124
+#define EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GF2M    186
 #define EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP     125
 #define EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP    126
 #define EC_F_EC_POINT_SET_TO_INFINITY                    127
-#define EC_F_GFP_MONT_GROUP_SET_CURVE_GFP                135
+#define EC_F_EC_PRE_COMP_DUP                             207
+#define EC_F_EC_PRE_COMP_NEW                             196
+#define EC_F_EC_WNAF_MUL                                 187
+#define EC_F_EC_WNAF_PRECOMPUTE_MULT                     188
+#define EC_F_I2D_ECPARAMETERS                            190
+#define EC_F_I2D_ECPKPARAMETERS                          191
+#define EC_F_I2D_ECPRIVATEKEY                            192
+#define EC_F_I2O_ECPUBLICKEY                             151
+#define EC_F_O2I_ECPUBLICKEY                             152
 
 /* Reason codes. */
+#define EC_R_ASN1_ERROR                                  115
+#define EC_R_ASN1_UNKNOWN_FIELD                          116
 #define EC_R_BUFFER_TOO_SMALL                            100
+#define EC_R_D2I_ECPKPARAMETERS_FAILURE                  117
+#define EC_R_DISCRIMINANT_IS_ZERO                        118
+#define EC_R_EC_GROUP_NEW_BY_NAME_FAILURE                119
+#define EC_R_FIELD_TOO_LARGE                             138
+#define EC_R_GROUP2PKPARAMETERS_FAILURE                  120
+#define EC_R_I2D_ECPKPARAMETERS_FAILURE                  121
 #define EC_R_INCOMPATIBLE_OBJECTS                        101
 #define EC_R_INVALID_ARGUMENT                            112
 #define EC_R_INVALID_COMPRESSED_POINT                    110
@@ -230,12 +497,28 @@ void ERR_load_EC_strings(void);
 #define EC_R_INVALID_ENCODING                            102
 #define EC_R_INVALID_FIELD                               103
 #define EC_R_INVALID_FORM                                104
+#define EC_R_INVALID_GROUP_ORDER                         122
+#define EC_R_INVALID_PENTANOMIAL_BASIS                   132
+#define EC_R_INVALID_PRIVATE_KEY                         123
+#define EC_R_INVALID_TRINOMIAL_BASIS                     137
+#define EC_R_MISSING_PARAMETERS                          124
+#define EC_R_MISSING_PRIVATE_KEY                         125
+#define EC_R_NOT_A_NIST_PRIME                            135
+#define EC_R_NOT_A_SUPPORTED_NIST_PRIME                  136
+#define EC_R_NOT_IMPLEMENTED                             126
 #define EC_R_NOT_INITIALIZED                             111
+#define EC_R_NO_FIELD_MOD                                133
+#define EC_R_PASSED_NULL_PARAMETER                       134
+#define EC_R_PKPARAMETERS2GROUP_FAILURE                  127
 #define EC_R_POINT_AT_INFINITY                           106
 #define EC_R_POINT_IS_NOT_ON_CURVE                       107
 #define EC_R_SLOT_FULL                                   108
 #define EC_R_UNDEFINED_GENERATOR                         113
+#define EC_R_UNDEFINED_ORDER                             128
+#define EC_R_UNKNOWN_GROUP                               129
 #define EC_R_UNKNOWN_ORDER                               114
+#define EC_R_UNSUPPORTED_FIELD                           131
+#define EC_R_WRONG_ORDER                                 130
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/ec/ec_cvt.c b/src/lib/libssl/src/crypto/ec/ec_cvt.c
index 45b0ec33a0..d45640bab9 100644
--- a/src/lib/libssl/src/crypto/ec/ec_cvt.c
+++ b/src/lib/libssl/src/crypto/ec/ec_cvt.c
@@ -1,6 +1,9 @@
 /* crypto/ec/ec_cvt.c */
+/*
+ * Originally written by Bodo Moeller for the OpenSSL project.
+ */
 /* ====================================================================
- * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,7 +55,21 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * The elliptic curve binary polynomial software is originally written by
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
 
+#include <openssl/err.h>
 #include "ec_lcl.h"
 
 
@@ -60,11 +77,8 @@ EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, const BIGNUM
         {
         const EC_METHOD *meth;
         EC_GROUP *ret;
-        
-        /* Finally, this will use EC_GFp_nist_method if 'p' is a special
-         * prime with optimized modular arithmetics (for NIST curves)
-         */
-        meth = EC_GFp_mont_method();
+
+        meth = EC_GFp_nist_method();
         
         ret = EC_GROUP_new(meth);
         if (ret == NULL)
@@ -72,6 +86,56 @@ EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, const BIGNUM
 
         if (!EC_GROUP_set_curve_GFp(ret, p, a, b, ctx))
                 {
+                unsigned long err;
+                  
+                err = ERR_peek_last_error();
+
+                if (!(ERR_GET_LIB(err) == ERR_LIB_EC &&
+                        ((ERR_GET_REASON(err) == EC_R_NOT_A_NIST_PRIME) ||
+                         (ERR_GET_REASON(err) == EC_R_NOT_A_SUPPORTED_NIST_PRIME))))
+                        {
+                        /* real error */
+                        
+                        EC_GROUP_clear_free(ret);
+                        return NULL;
+                        }
+                        
+                
+                /* not an actual error, we just cannot use EC_GFp_nist_method */
+
+                ERR_clear_error();
+
+                EC_GROUP_clear_free(ret);
+                meth = EC_GFp_mont_method();
+
+                ret = EC_GROUP_new(meth);
+                if (ret == NULL)
+                        return NULL;
+
+                if (!EC_GROUP_set_curve_GFp(ret, p, a, b, ctx))
+                        {
+                        EC_GROUP_clear_free(ret);
+                        return NULL;
+                        }
+                }
+
+        return ret;
+        }
+
+
+EC_GROUP *EC_GROUP_new_curve_GF2m(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
+        {
+        const EC_METHOD *meth;
+        EC_GROUP *ret;
+        
+        meth = EC_GF2m_simple_method();
+        
+        ret = EC_GROUP_new(meth);
+        if (ret == NULL)
+                return NULL;
+
+        if (!EC_GROUP_set_curve_GF2m(ret, p, a, b, ctx))
+                {
                 EC_GROUP_clear_free(ret);
                 return NULL;
                 }
diff --git a/src/lib/libssl/src/crypto/ec/ec_err.c b/src/lib/libssl/src/crypto/ec/ec_err.c
index 5b70f94382..d04c895560 100644
--- a/src/lib/libssl/src/crypto/ec/ec_err.c
+++ b/src/lib/libssl/src/crypto/ec/ec_err.c
@@ -1,6 +1,6 @@
 /* crypto/ec/ec_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -71,54 +71,127 @@
 static ERR_STRING_DATA EC_str_functs[]=
         {
 {ERR_FUNC(EC_F_COMPUTE_WNAF),   "COMPUTE_WNAF"},
+{ERR_FUNC(EC_F_D2I_ECPARAMETERS),       "d2i_ECParameters"},
+{ERR_FUNC(EC_F_D2I_ECPKPARAMETERS),     "d2i_ECPKParameters"},
+{ERR_FUNC(EC_F_D2I_ECPRIVATEKEY),       "d2i_ECPrivateKey"},
+{ERR_FUNC(EC_F_ECPARAMETERS_PRINT),     "ECParameters_print"},
+{ERR_FUNC(EC_F_ECPARAMETERS_PRINT_FP),  "ECParameters_print_fp"},
+{ERR_FUNC(EC_F_ECPKPARAMETERS_PRINT),   "ECPKParameters_print"},
+{ERR_FUNC(EC_F_ECPKPARAMETERS_PRINT_FP),        "ECPKParameters_print_fp"},
+{ERR_FUNC(EC_F_ECP_NIST_MOD_192),       "ECP_NIST_MOD_192"},
+{ERR_FUNC(EC_F_ECP_NIST_MOD_224),       "ECP_NIST_MOD_224"},
+{ERR_FUNC(EC_F_ECP_NIST_MOD_256),       "ECP_NIST_MOD_256"},
+{ERR_FUNC(EC_F_ECP_NIST_MOD_521),       "ECP_NIST_MOD_521"},
+{ERR_FUNC(EC_F_EC_ASN1_GROUP2CURVE),    "EC_ASN1_GROUP2CURVE"},
+{ERR_FUNC(EC_F_EC_ASN1_GROUP2FIELDID),  "EC_ASN1_GROUP2FIELDID"},
+{ERR_FUNC(EC_F_EC_ASN1_GROUP2PARAMETERS),       "EC_ASN1_GROUP2PARAMETERS"},
+{ERR_FUNC(EC_F_EC_ASN1_GROUP2PKPARAMETERS),     "EC_ASN1_GROUP2PKPARAMETERS"},
+{ERR_FUNC(EC_F_EC_ASN1_PARAMETERS2GROUP),       "EC_ASN1_PARAMETERS2GROUP"},
+{ERR_FUNC(EC_F_EC_ASN1_PKPARAMETERS2GROUP),     "EC_ASN1_PKPARAMETERS2GROUP"},
+{ERR_FUNC(EC_F_EC_EX_DATA_SET_DATA),    "EC_EX_DATA_set_data"},
+{ERR_FUNC(EC_F_EC_GF2M_MONTGOMERY_POINT_MULTIPLY),      "EC_GF2M_MONTGOMERY_POINT_MULTIPLY"},
+{ERR_FUNC(EC_F_EC_GF2M_SIMPLE_GROUP_CHECK_DISCRIMINANT),        "ec_GF2m_simple_group_check_discriminant"},
+{ERR_FUNC(EC_F_EC_GF2M_SIMPLE_GROUP_SET_CURVE), "ec_GF2m_simple_group_set_curve"},
+{ERR_FUNC(EC_F_EC_GF2M_SIMPLE_OCT2POINT),       "ec_GF2m_simple_oct2point"},
+{ERR_FUNC(EC_F_EC_GF2M_SIMPLE_POINT2OCT),       "ec_GF2m_simple_point2oct"},
+{ERR_FUNC(EC_F_EC_GF2M_SIMPLE_POINT_GET_AFFINE_COORDINATES),    "ec_GF2m_simple_point_get_affine_coordinates"},
+{ERR_FUNC(EC_F_EC_GF2M_SIMPLE_POINT_SET_AFFINE_COORDINATES),    "ec_GF2m_simple_point_set_affine_coordinates"},
+{ERR_FUNC(EC_F_EC_GF2M_SIMPLE_SET_COMPRESSED_COORDINATES),      "ec_GF2m_simple_set_compressed_coordinates"},
 {ERR_FUNC(EC_F_EC_GFP_MONT_FIELD_DECODE),       "ec_GFp_mont_field_decode"},
 {ERR_FUNC(EC_F_EC_GFP_MONT_FIELD_ENCODE),       "ec_GFp_mont_field_encode"},
 {ERR_FUNC(EC_F_EC_GFP_MONT_FIELD_MUL),  "ec_GFp_mont_field_mul"},
+{ERR_FUNC(EC_F_EC_GFP_MONT_FIELD_SET_TO_ONE),   "ec_GFp_mont_field_set_to_one"},
 {ERR_FUNC(EC_F_EC_GFP_MONT_FIELD_SQR),  "ec_GFp_mont_field_sqr"},
-{ERR_FUNC(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE_GFP),      "ec_GFp_simple_group_set_curve_GFp"},
-{ERR_FUNC(EC_F_EC_GFP_SIMPLE_GROUP_SET_GENERATOR),      "ec_GFp_simple_group_set_generator"},
+{ERR_FUNC(EC_F_EC_GFP_MONT_GROUP_SET_CURVE),    "ec_GFp_mont_group_set_curve"},
+{ERR_FUNC(EC_F_EC_GFP_MONT_GROUP_SET_CURVE_GFP),        "EC_GFP_MONT_GROUP_SET_CURVE_GFP"},
+{ERR_FUNC(EC_F_EC_GFP_NIST_FIELD_MUL),  "ec_GFp_nist_field_mul"},
+{ERR_FUNC(EC_F_EC_GFP_NIST_FIELD_SQR),  "ec_GFp_nist_field_sqr"},
+{ERR_FUNC(EC_F_EC_GFP_NIST_GROUP_SET_CURVE),    "ec_GFp_nist_group_set_curve"},
+{ERR_FUNC(EC_F_EC_GFP_SIMPLE_GROUP_CHECK_DISCRIMINANT), "ec_GFp_simple_group_check_discriminant"},
+{ERR_FUNC(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE),  "ec_GFp_simple_group_set_curve"},
+{ERR_FUNC(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE_GFP),      "EC_GFP_SIMPLE_GROUP_SET_CURVE_GFP"},
+{ERR_FUNC(EC_F_EC_GFP_SIMPLE_GROUP_SET_GENERATOR),      "EC_GFP_SIMPLE_GROUP_SET_GENERATOR"},
 {ERR_FUNC(EC_F_EC_GFP_SIMPLE_MAKE_AFFINE),      "ec_GFp_simple_make_affine"},
 {ERR_FUNC(EC_F_EC_GFP_SIMPLE_OCT2POINT),        "ec_GFp_simple_oct2point"},
 {ERR_FUNC(EC_F_EC_GFP_SIMPLE_POINT2OCT),        "ec_GFp_simple_point2oct"},
 {ERR_FUNC(EC_F_EC_GFP_SIMPLE_POINTS_MAKE_AFFINE),       "ec_GFp_simple_points_make_affine"},
-{ERR_FUNC(EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES_GFP), "ec_GFp_simple_point_get_affine_coordinates_GFp"},
-{ERR_FUNC(EC_F_EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES_GFP), "ec_GFp_simple_point_set_affine_coordinates_GFp"},
-{ERR_FUNC(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES_GFP),   "ec_GFp_simple_set_compressed_coordinates_GFp"},
+{ERR_FUNC(EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES),     "ec_GFp_simple_point_get_affine_coordinates"},
+{ERR_FUNC(EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES_GFP), "EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES_GFP"},
+{ERR_FUNC(EC_F_EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES),     "ec_GFp_simple_point_set_affine_coordinates"},
+{ERR_FUNC(EC_F_EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES_GFP), "EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES_GFP"},
+{ERR_FUNC(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES),       "ec_GFp_simple_set_compressed_coordinates"},
+{ERR_FUNC(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES_GFP),   "EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES_GFP"},
+{ERR_FUNC(EC_F_EC_GROUP_CHECK), "EC_GROUP_check"},
+{ERR_FUNC(EC_F_EC_GROUP_CHECK_DISCRIMINANT),    "EC_GROUP_check_discriminant"},
 {ERR_FUNC(EC_F_EC_GROUP_COPY),  "EC_GROUP_copy"},
 {ERR_FUNC(EC_F_EC_GROUP_GET0_GENERATOR),        "EC_GROUP_get0_generator"},
 {ERR_FUNC(EC_F_EC_GROUP_GET_COFACTOR),  "EC_GROUP_get_cofactor"},
+{ERR_FUNC(EC_F_EC_GROUP_GET_CURVE_GF2M),        "EC_GROUP_get_curve_GF2m"},
 {ERR_FUNC(EC_F_EC_GROUP_GET_CURVE_GFP), "EC_GROUP_get_curve_GFp"},
+{ERR_FUNC(EC_F_EC_GROUP_GET_DEGREE),    "EC_GROUP_get_degree"},
 {ERR_FUNC(EC_F_EC_GROUP_GET_ORDER),     "EC_GROUP_get_order"},
+{ERR_FUNC(EC_F_EC_GROUP_GET_PENTANOMIAL_BASIS), "EC_GROUP_get_pentanomial_basis"},
+{ERR_FUNC(EC_F_EC_GROUP_GET_TRINOMIAL_BASIS),   "EC_GROUP_get_trinomial_basis"},
 {ERR_FUNC(EC_F_EC_GROUP_NEW),   "EC_GROUP_new"},
+{ERR_FUNC(EC_F_EC_GROUP_NEW_BY_CURVE_NAME),     "EC_GROUP_new_by_curve_name"},
+{ERR_FUNC(EC_F_EC_GROUP_NEW_FROM_DATA), "EC_GROUP_NEW_FROM_DATA"},
 {ERR_FUNC(EC_F_EC_GROUP_PRECOMPUTE_MULT),       "EC_GROUP_precompute_mult"},
+{ERR_FUNC(EC_F_EC_GROUP_SET_CURVE_GF2M),        "EC_GROUP_set_curve_GF2m"},
 {ERR_FUNC(EC_F_EC_GROUP_SET_CURVE_GFP), "EC_GROUP_set_curve_GFp"},
-{ERR_FUNC(EC_F_EC_GROUP_SET_EXTRA_DATA),        "EC_GROUP_set_extra_data"},
+{ERR_FUNC(EC_F_EC_GROUP_SET_EXTRA_DATA),        "EC_GROUP_SET_EXTRA_DATA"},
 {ERR_FUNC(EC_F_EC_GROUP_SET_GENERATOR), "EC_GROUP_set_generator"},
+{ERR_FUNC(EC_F_EC_KEY_CHECK_KEY),       "EC_KEY_check_key"},
+{ERR_FUNC(EC_F_EC_KEY_COPY),    "EC_KEY_copy"},
+{ERR_FUNC(EC_F_EC_KEY_GENERATE_KEY),    "EC_KEY_generate_key"},
+{ERR_FUNC(EC_F_EC_KEY_NEW),     "EC_KEY_new"},
+{ERR_FUNC(EC_F_EC_KEY_PRINT),   "EC_KEY_print"},
+{ERR_FUNC(EC_F_EC_KEY_PRINT_FP),        "EC_KEY_print_fp"},
 {ERR_FUNC(EC_F_EC_POINTS_MAKE_AFFINE),  "EC_POINTs_make_affine"},
 {ERR_FUNC(EC_F_EC_POINTS_MUL),  "EC_POINTs_mul"},
 {ERR_FUNC(EC_F_EC_POINT_ADD),   "EC_POINT_add"},
 {ERR_FUNC(EC_F_EC_POINT_CMP),   "EC_POINT_cmp"},
 {ERR_FUNC(EC_F_EC_POINT_COPY),  "EC_POINT_copy"},
 {ERR_FUNC(EC_F_EC_POINT_DBL),   "EC_POINT_dbl"},
+{ERR_FUNC(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M),   "EC_POINT_get_affine_coordinates_GF2m"},
 {ERR_FUNC(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP),    "EC_POINT_get_affine_coordinates_GFp"},
 {ERR_FUNC(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP),       "EC_POINT_get_Jprojective_coordinates_GFp"},
+{ERR_FUNC(EC_F_EC_POINT_INVERT),        "EC_POINT_invert"},
 {ERR_FUNC(EC_F_EC_POINT_IS_AT_INFINITY),        "EC_POINT_is_at_infinity"},
 {ERR_FUNC(EC_F_EC_POINT_IS_ON_CURVE),   "EC_POINT_is_on_curve"},
 {ERR_FUNC(EC_F_EC_POINT_MAKE_AFFINE),   "EC_POINT_make_affine"},
+{ERR_FUNC(EC_F_EC_POINT_MUL),   "EC_POINT_mul"},
 {ERR_FUNC(EC_F_EC_POINT_NEW),   "EC_POINT_new"},
 {ERR_FUNC(EC_F_EC_POINT_OCT2POINT),     "EC_POINT_oct2point"},
 {ERR_FUNC(EC_F_EC_POINT_POINT2OCT),     "EC_POINT_point2oct"},
+{ERR_FUNC(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M),   "EC_POINT_set_affine_coordinates_GF2m"},
 {ERR_FUNC(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP),    "EC_POINT_set_affine_coordinates_GFp"},
+{ERR_FUNC(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GF2M),       "EC_POINT_set_compressed_coordinates_GF2m"},
 {ERR_FUNC(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP),        "EC_POINT_set_compressed_coordinates_GFp"},
 {ERR_FUNC(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP),       "EC_POINT_set_Jprojective_coordinates_GFp"},
 {ERR_FUNC(EC_F_EC_POINT_SET_TO_INFINITY),       "EC_POINT_set_to_infinity"},
-{ERR_FUNC(EC_F_GFP_MONT_GROUP_SET_CURVE_GFP),   "GFP_MONT_GROUP_SET_CURVE_GFP"},
+{ERR_FUNC(EC_F_EC_PRE_COMP_DUP),        "EC_PRE_COMP_DUP"},
+{ERR_FUNC(EC_F_EC_PRE_COMP_NEW),        "EC_PRE_COMP_NEW"},
+{ERR_FUNC(EC_F_EC_WNAF_MUL),    "ec_wNAF_mul"},
+{ERR_FUNC(EC_F_EC_WNAF_PRECOMPUTE_MULT),        "ec_wNAF_precompute_mult"},
+{ERR_FUNC(EC_F_I2D_ECPARAMETERS),       "i2d_ECParameters"},
+{ERR_FUNC(EC_F_I2D_ECPKPARAMETERS),     "i2d_ECPKParameters"},
+{ERR_FUNC(EC_F_I2D_ECPRIVATEKEY),       "i2d_ECPrivateKey"},
+{ERR_FUNC(EC_F_I2O_ECPUBLICKEY),        "i2o_ECPublicKey"},
+{ERR_FUNC(EC_F_O2I_ECPUBLICKEY),        "o2i_ECPublicKey"},
 {0,NULL}
         };
 
 static ERR_STRING_DATA EC_str_reasons[]=
         {
+{ERR_REASON(EC_R_ASN1_ERROR)             ,"asn1 error"},
+{ERR_REASON(EC_R_ASN1_UNKNOWN_FIELD)     ,"asn1 unknown field"},
 {ERR_REASON(EC_R_BUFFER_TOO_SMALL)       ,"buffer too small"},
+{ERR_REASON(EC_R_D2I_ECPKPARAMETERS_FAILURE),"d2i ecpkparameters failure"},
+{ERR_REASON(EC_R_DISCRIMINANT_IS_ZERO)   ,"discriminant is zero"},
+{ERR_REASON(EC_R_EC_GROUP_NEW_BY_NAME_FAILURE),"ec group new by name failure"},
+{ERR_REASON(EC_R_FIELD_TOO_LARGE)        ,"field too large"},
+{ERR_REASON(EC_R_GROUP2PKPARAMETERS_FAILURE),"group2pkparameters failure"},
+{ERR_REASON(EC_R_I2D_ECPKPARAMETERS_FAILURE),"i2d ecpkparameters failure"},
 {ERR_REASON(EC_R_INCOMPATIBLE_OBJECTS)   ,"incompatible objects"},
 {ERR_REASON(EC_R_INVALID_ARGUMENT)       ,"invalid argument"},
 {ERR_REASON(EC_R_INVALID_COMPRESSED_POINT),"invalid compressed point"},
@@ -126,12 +199,28 @@ static ERR_STRING_DATA EC_str_reasons[]=
 {ERR_REASON(EC_R_INVALID_ENCODING)       ,"invalid encoding"},
 {ERR_REASON(EC_R_INVALID_FIELD)          ,"invalid field"},
 {ERR_REASON(EC_R_INVALID_FORM)           ,"invalid form"},
+{ERR_REASON(EC_R_INVALID_GROUP_ORDER)    ,"invalid group order"},
+{ERR_REASON(EC_R_INVALID_PENTANOMIAL_BASIS),"invalid pentanomial basis"},
+{ERR_REASON(EC_R_INVALID_PRIVATE_KEY)    ,"invalid private key"},
+{ERR_REASON(EC_R_INVALID_TRINOMIAL_BASIS),"invalid trinomial basis"},
+{ERR_REASON(EC_R_MISSING_PARAMETERS)     ,"missing parameters"},
+{ERR_REASON(EC_R_MISSING_PRIVATE_KEY)    ,"missing private key"},
+{ERR_REASON(EC_R_NOT_A_NIST_PRIME)       ,"not a NIST prime"},
+{ERR_REASON(EC_R_NOT_A_SUPPORTED_NIST_PRIME),"not a supported NIST prime"},
+{ERR_REASON(EC_R_NOT_IMPLEMENTED)        ,"not implemented"},
 {ERR_REASON(EC_R_NOT_INITIALIZED)        ,"not initialized"},
+{ERR_REASON(EC_R_NO_FIELD_MOD)           ,"no field mod"},
+{ERR_REASON(EC_R_PASSED_NULL_PARAMETER)  ,"passed null parameter"},
+{ERR_REASON(EC_R_PKPARAMETERS2GROUP_FAILURE),"pkparameters2group failure"},
 {ERR_REASON(EC_R_POINT_AT_INFINITY)      ,"point at infinity"},
 {ERR_REASON(EC_R_POINT_IS_NOT_ON_CURVE)  ,"point is not on curve"},
 {ERR_REASON(EC_R_SLOT_FULL)              ,"slot full"},
 {ERR_REASON(EC_R_UNDEFINED_GENERATOR)    ,"undefined generator"},
+{ERR_REASON(EC_R_UNDEFINED_ORDER)        ,"undefined order"},
+{ERR_REASON(EC_R_UNKNOWN_GROUP)          ,"unknown group"},
 {ERR_REASON(EC_R_UNKNOWN_ORDER)          ,"unknown order"},
+{ERR_REASON(EC_R_UNSUPPORTED_FIELD)      ,"unsupported field"},
+{ERR_REASON(EC_R_WRONG_ORDER)            ,"wrong order"},
 {0,NULL}
         };
 
@@ -139,15 +228,12 @@ static ERR_STRING_DATA EC_str_reasons[]=
 
 void ERR_load_EC_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(EC_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,EC_str_functs);
                 ERR_load_strings(0,EC_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/ec/ec_lcl.h b/src/lib/libssl/src/crypto/ec/ec_lcl.h
index cc4cf27755..fdd7aa2755 100644
--- a/src/lib/libssl/src/crypto/ec/ec_lcl.h
+++ b/src/lib/libssl/src/crypto/ec/ec_lcl.h
@@ -1,6 +1,9 @@
 /* crypto/ec/ec_lcl.h */
+/*
+ * Originally written by Bodo Moeller for the OpenSSL project.
+ */
 /* ====================================================================
- * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,35 +55,56 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * The elliptic curve binary polynomial software is originally written by 
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
 
 
 #include <stdlib.h>
 
+#include <openssl/obj_mac.h>
 #include <openssl/ec.h>
+#include <openssl/bn.h>
 
+#if defined(__SUNPRO_C)
+# if __SUNPRO_C >= 0x520
+# pragma error_messages (off,E_ARRAY_OF_INCOMPLETE_NONAME,E_ARRAY_OF_INCOMPLETE)
+# endif
+#endif
 
 /* Structure details are not part of the exported interface,
  * so all this may change in future versions. */
 
 struct ec_method_st {
+        /* used by EC_METHOD_get_field_type: */
+        int field_type; /* a NID */
+
         /* used by EC_GROUP_new, EC_GROUP_free, EC_GROUP_clear_free, EC_GROUP_copy: */
         int (*group_init)(EC_GROUP *);
         void (*group_finish)(EC_GROUP *);
         void (*group_clear_finish)(EC_GROUP *);
         int (*group_copy)(EC_GROUP *, const EC_GROUP *);
 
-        /* used by EC_GROUP_set_curve_GFp and EC_GROUP_get_curve_GFp: */
-        int (*group_set_curve_GFp)(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
-        int (*group_get_curve_GFp)(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
+        /* used by EC_GROUP_set_curve_GFp, EC_GROUP_get_curve_GFp, */
+        /* EC_GROUP_set_curve_GF2m, and EC_GROUP_get_curve_GF2m: */
+        int (*group_set_curve)(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
+        int (*group_get_curve)(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
 
-        /* used by EC_GROUP_set_generator, EC_GROUP_get0_generator,
-         * EC_GROUP_get_order, EC_GROUP_get_cofactor:
-         */
-        int (*group_set_generator)(EC_GROUP *, const EC_POINT *generator,
-                const BIGNUM *order, const BIGNUM *cofactor);
-        EC_POINT *(*group_get0_generator)(const EC_GROUP *);
-        int (*group_get_order)(const EC_GROUP *, BIGNUM *order, BN_CTX *);
-        int (*group_get_cofactor)(const EC_GROUP *, BIGNUM *cofactor, BN_CTX *);
+        /* used by EC_GROUP_get_degree: */
+        int (*group_get_degree)(const EC_GROUP *);
+
+        /* used by EC_GROUP_check: */
+        int (*group_check_discriminant)(const EC_GROUP *, BN_CTX *);
 
         /* used by EC_POINT_new, EC_POINT_free, EC_POINT_clear_free, EC_POINT_copy: */
         int (*point_init)(EC_POINT *);
@@ -89,20 +113,22 @@ struct ec_method_st {
         int (*point_copy)(EC_POINT *, const EC_POINT *);
 
         /* used by EC_POINT_set_to_infinity,
-         * EC_POINT_set_Jprojective_coordinates_GFp, EC_POINT_get_Jprojective_coordinates_GFp,
-         * EC_POINT_set_affine_coordinates_GFp, EC_POINT_get_affine_coordinates_GFp,
-         * EC_POINT_set_compressed_coordinates_GFp:
+         * EC_POINT_set_Jprojective_coordinates_GFp,
+         * EC_POINT_get_Jprojective_coordinates_GFp,
+         * EC_POINT_set_affine_coordinates_GFp,     ..._GF2m,
+         * EC_POINT_get_affine_coordinates_GFp,     ..._GF2m,
+         * EC_POINT_set_compressed_coordinates_GFp, ..._GF2m:
          */
         int (*point_set_to_infinity)(const EC_GROUP *, EC_POINT *);
         int (*point_set_Jprojective_coordinates_GFp)(const EC_GROUP *, EC_POINT *,
                 const BIGNUM *x, const BIGNUM *y, const BIGNUM *z, BN_CTX *);
         int (*point_get_Jprojective_coordinates_GFp)(const EC_GROUP *, const EC_POINT *,
                 BIGNUM *x, BIGNUM *y, BIGNUM *z, BN_CTX *);
-        int (*point_set_affine_coordinates_GFp)(const EC_GROUP *, EC_POINT *,
+        int (*point_set_affine_coordinates)(const EC_GROUP *, EC_POINT *,
                 const BIGNUM *x, const BIGNUM *y, BN_CTX *);
-        int (*point_get_affine_coordinates_GFp)(const EC_GROUP *, const EC_POINT *,
+        int (*point_get_affine_coordinates)(const EC_GROUP *, const EC_POINT *,
                 BIGNUM *x, BIGNUM *y, BN_CTX *);
-        int (*point_set_compressed_coordinates_GFp)(const EC_GROUP *, EC_POINT *,
+        int (*point_set_compressed_coordinates)(const EC_GROUP *, EC_POINT *,
                 const BIGNUM *x, int y_bit, BN_CTX *);
 
         /* used by EC_POINT_point2oct, EC_POINT_oct2point: */
@@ -125,34 +151,65 @@ struct ec_method_st {
         int (*make_affine)(const EC_GROUP *, EC_POINT *, BN_CTX *);
         int (*points_make_affine)(const EC_GROUP *, size_t num, EC_POINT *[], BN_CTX *);
 
+        /* used by EC_POINTs_mul, EC_POINT_mul, EC_POINT_precompute_mult, EC_POINT_have_precompute_mult
+         * (default implementations are used if the 'mul' pointer is 0): */
+        int (*mul)(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
+                size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
+        int (*precompute_mult)(EC_GROUP *group, BN_CTX *);
+        int (*have_precompute_mult)(const EC_GROUP *group);
+
 
         /* internal functions */
 
-        /* 'field_mul' and 'field_sqr' can be used by 'add' and 'dbl' so that
+        /* 'field_mul', 'field_sqr', and 'field_div' can be used by 'add' and 'dbl' so that
          * the same implementations of point operations can be used with different
          * optimized implementations of expensive field operations: */
         int (*field_mul)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
         int (*field_sqr)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *);
+        int (*field_div)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
 
         int (*field_encode)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *); /* e.g. to Montgomery */
         int (*field_decode)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *); /* e.g. from Montgomery */
         int (*field_set_to_one)(const EC_GROUP *, BIGNUM *r, BN_CTX *);
 } /* EC_METHOD */;
 
+typedef struct ec_extra_data_st {
+        struct ec_extra_data_st *next;
+        void *data;
+        void *(*dup_func)(void *);
+        void (*free_func)(void *);
+        void (*clear_free_func)(void *);
+} EC_EXTRA_DATA; /* used in EC_GROUP */
 
 struct ec_group_st {
         const EC_METHOD *meth;
 
-        void *extra_data;
-        void *(*extra_data_dup_func)(void *);
-        void (*extra_data_free_func)(void *);
-        void (*extra_data_clear_free_func)(void *);
+        EC_POINT *generator; /* optional */
+        BIGNUM order, cofactor;
+
+        int curve_name;/* optional NID for named curve */
+        int asn1_flag; /* flag to control the asn1 encoding */
+        point_conversion_form_t asn1_form;
+
+        unsigned char *seed; /* optional seed for parameters (appears in ASN1) */
+        size_t seed_len;
 
-        /* All members except 'meth' and 'extra_data...' are handled by
-         * the method functions, even if they appear generic */
+        EC_EXTRA_DATA *extra_data; /* linked list */
+
+        /* The following members are handled by the method functions,
+         * even if they appear generic */
         
         BIGNUM field; /* Field specification.
-                       * For curves over GF(p), this is the modulus. */
+                       * For curves over GF(p), this is the modulus;
+                       * for curves over GF(2^m), this is the 
+                       * irreducible polynomial defining the field.
+                       */
+
+        unsigned int poly[5]; /* Field specification for curves over GF(2^m).
+                               * The irreducible f(t) is then of the form:
+                               *     t^poly[0] + t^poly[1] + ... + t^poly[k]
+                               * where m = poly[0] > poly[1] > ... > poly[k] = 0.
+                               */
 
         BIGNUM a, b; /* Curve coefficients.
                       * (Here the assumption is that BIGNUMs can be used
@@ -160,29 +217,49 @@ struct ec_group_st {
                       * For characteristic  > 3,  the curve is defined
                       * by a Weierstrass equation of the form
                       *     y^2 = x^3 + a*x + b.
+                      * For characteristic  2,  the curve is defined by
+                      * an equation of the form
+                      *     y^2 + x*y = x^3 + a*x^2 + b.
                       */
-        int a_is_minus3; /* enable optimized point arithmetics for special case */
 
-        EC_POINT *generator; /* optional */
-        BIGNUM order, cofactor;
+        int a_is_minus3; /* enable optimized point arithmetics for special case */
 
         void *field_data1; /* method-specific (e.g., Montgomery structure) */
         void *field_data2; /* method-specific */
+        int (*field_mod_func)(BIGNUM *, const BIGNUM *, const BIGNUM *, BN_CTX *); /* method-specific */
 } /* EC_GROUP */;
 
+struct ec_key_st {
+        int version;
+
+        EC_GROUP *group;
+
+        EC_POINT *pub_key;
+        BIGNUM   *priv_key;
+
+        unsigned int enc_flag;
+        point_conversion_form_t conv_form;
 
-/* Basically a 'mixin' for extra data, but available for EC_GROUPs only
+        int     references;
+
+        EC_EXTRA_DATA *method_data;
+} /* EC_KEY */;
+
+/* Basically a 'mixin' for extra data, but available for EC_GROUPs/EC_KEYs only
  * (with visibility limited to 'package' level for now).
  * We use the function pointers as index for retrieval; this obviates
  * global ex_data-style index tables.
- * (Currently, we have one slot only, but is is possible to extend this
- * if necessary.) */
-int EC_GROUP_set_extra_data(EC_GROUP *, void *extra_data, void *(*extra_data_dup_func)(void *),
-        void (*extra_data_free_func)(void *), void (*extra_data_clear_free_func)(void *));
-void *EC_GROUP_get_extra_data(const EC_GROUP *, void *(*extra_data_dup_func)(void *),
-        void (*extra_data_free_func)(void *), void (*extra_data_clear_free_func)(void *));
-void EC_GROUP_free_extra_data(EC_GROUP *);
-void EC_GROUP_clear_free_extra_data(EC_GROUP *);
+ */
+int EC_EX_DATA_set_data(EC_EXTRA_DATA **, void *data,
+        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *));
+void *EC_EX_DATA_get_data(const EC_EXTRA_DATA *,
+        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *));
+void EC_EX_DATA_free_data(EC_EXTRA_DATA **,
+        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *));
+void EC_EX_DATA_clear_free_data(EC_EXTRA_DATA **,
+        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *));
+void EC_EX_DATA_free_all_data(EC_EXTRA_DATA **);
+void EC_EX_DATA_clear_free_all_data(EC_EXTRA_DATA **);
 
 
 
@@ -201,18 +278,23 @@ struct ec_point_st {
 
 
 
+/* method functions in ec_mult.c
+ * (ec_lib.c uses these as defaults if group->method->mul is 0) */
+int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
+        size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
+int ec_wNAF_precompute_mult(EC_GROUP *group, BN_CTX *);
+int ec_wNAF_have_precompute_mult(const EC_GROUP *group);
+
+
 /* method functions in ecp_smpl.c */
 int ec_GFp_simple_group_init(EC_GROUP *);
 void ec_GFp_simple_group_finish(EC_GROUP *);
 void ec_GFp_simple_group_clear_finish(EC_GROUP *);
 int ec_GFp_simple_group_copy(EC_GROUP *, const EC_GROUP *);
-int ec_GFp_simple_group_set_curve_GFp(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
-int ec_GFp_simple_group_get_curve_GFp(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
-int ec_GFp_simple_group_set_generator(EC_GROUP *, const EC_POINT *generator,
-        const BIGNUM *order, const BIGNUM *cofactor);
-EC_POINT *ec_GFp_simple_group_get0_generator(const EC_GROUP *);
-int ec_GFp_simple_group_get_order(const EC_GROUP *, BIGNUM *order, BN_CTX *);
-int ec_GFp_simple_group_get_cofactor(const EC_GROUP *, BIGNUM *cofactor, BN_CTX *);
+int ec_GFp_simple_group_set_curve(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
+int ec_GFp_simple_group_get_curve(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
+int ec_GFp_simple_group_get_degree(const EC_GROUP *);
+int ec_GFp_simple_group_check_discriminant(const EC_GROUP *, BN_CTX *);
 int ec_GFp_simple_point_init(EC_POINT *);
 void ec_GFp_simple_point_finish(EC_POINT *);
 void ec_GFp_simple_point_clear_finish(EC_POINT *);
@@ -222,11 +304,11 @@ int ec_GFp_simple_set_Jprojective_coordinates_GFp(const EC_GROUP *, EC_POINT *,
         const BIGNUM *x, const BIGNUM *y, const BIGNUM *z, BN_CTX *);
 int ec_GFp_simple_get_Jprojective_coordinates_GFp(const EC_GROUP *, const EC_POINT *,
         BIGNUM *x, BIGNUM *y, BIGNUM *z, BN_CTX *);
-int ec_GFp_simple_point_set_affine_coordinates_GFp(const EC_GROUP *, EC_POINT *,
+int ec_GFp_simple_point_set_affine_coordinates(const EC_GROUP *, EC_POINT *,
         const BIGNUM *x, const BIGNUM *y, BN_CTX *);
-int ec_GFp_simple_point_get_affine_coordinates_GFp(const EC_GROUP *, const EC_POINT *,
+int ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP *, const EC_POINT *,
         BIGNUM *x, BIGNUM *y, BN_CTX *);
-int ec_GFp_simple_set_compressed_coordinates_GFp(const EC_GROUP *, EC_POINT *,
+int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *, EC_POINT *,
         const BIGNUM *x, int y_bit, BN_CTX *);
 size_t ec_GFp_simple_point2oct(const EC_GROUP *, const EC_POINT *, point_conversion_form_t form,
         unsigned char *buf, size_t len, BN_CTX *);
@@ -246,7 +328,7 @@ int ec_GFp_simple_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX
 
 /* method functions in ecp_mont.c */
 int ec_GFp_mont_group_init(EC_GROUP *);
-int ec_GFp_mont_group_set_curve_GFp(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
+int ec_GFp_mont_group_set_curve(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
 void ec_GFp_mont_group_finish(EC_GROUP *);
 void ec_GFp_mont_group_clear_finish(EC_GROUP *);
 int ec_GFp_mont_group_copy(EC_GROUP *, const EC_GROUP *);
@@ -257,21 +339,52 @@ int ec_GFp_mont_field_decode(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CT
 int ec_GFp_mont_field_set_to_one(const EC_GROUP *, BIGNUM *r, BN_CTX *);
 
 
-/* method functions in ecp_recp.c */
-int ec_GFp_recp_group_init(EC_GROUP *);
-int ec_GFp_recp_group_set_curve_GFp(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
-void ec_GFp_recp_group_finish(EC_GROUP *);
-void ec_GFp_recp_group_clear_finish(EC_GROUP *);
-int ec_GFp_recp_group_copy(EC_GROUP *, const EC_GROUP *);
-int ec_GFp_recp_field_mul(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
-int ec_GFp_recp_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *);
-
-
 /* method functions in ecp_nist.c */
-int ec_GFp_nist_group_init(EC_GROUP *);
-int ec_GFp_nist_group_set_curve_GFp(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
-void ec_GFp_nist_group_finish(EC_GROUP *);
-void ec_GFp_nist_group_clear_finish(EC_GROUP *);
-int ec_GFp_nist_group_copy(EC_GROUP *, const EC_GROUP *);
+int ec_GFp_nist_group_copy(EC_GROUP *dest, const EC_GROUP *src);
+int ec_GFp_nist_group_set_curve(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
 int ec_GFp_nist_field_mul(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
 int ec_GFp_nist_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *);
+
+
+/* method functions in ec2_smpl.c */
+int ec_GF2m_simple_group_init(EC_GROUP *);
+void ec_GF2m_simple_group_finish(EC_GROUP *);
+void ec_GF2m_simple_group_clear_finish(EC_GROUP *);
+int ec_GF2m_simple_group_copy(EC_GROUP *, const EC_GROUP *);
+int ec_GF2m_simple_group_set_curve(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
+int ec_GF2m_simple_group_get_curve(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
+int ec_GF2m_simple_group_get_degree(const EC_GROUP *);
+int ec_GF2m_simple_group_check_discriminant(const EC_GROUP *, BN_CTX *);
+int ec_GF2m_simple_point_init(EC_POINT *);
+void ec_GF2m_simple_point_finish(EC_POINT *);
+void ec_GF2m_simple_point_clear_finish(EC_POINT *);
+int ec_GF2m_simple_point_copy(EC_POINT *, const EC_POINT *);
+int ec_GF2m_simple_point_set_to_infinity(const EC_GROUP *, EC_POINT *);
+int ec_GF2m_simple_point_set_affine_coordinates(const EC_GROUP *, EC_POINT *,
+        const BIGNUM *x, const BIGNUM *y, BN_CTX *);
+int ec_GF2m_simple_point_get_affine_coordinates(const EC_GROUP *, const EC_POINT *,
+        BIGNUM *x, BIGNUM *y, BN_CTX *);
+int ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP *, EC_POINT *,
+        const BIGNUM *x, int y_bit, BN_CTX *);
+size_t ec_GF2m_simple_point2oct(const EC_GROUP *, const EC_POINT *, point_conversion_form_t form,
+        unsigned char *buf, size_t len, BN_CTX *);
+int ec_GF2m_simple_oct2point(const EC_GROUP *, EC_POINT *,
+        const unsigned char *buf, size_t len, BN_CTX *);
+int ec_GF2m_simple_add(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, const EC_POINT *b, BN_CTX *);
+int ec_GF2m_simple_dbl(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, BN_CTX *);
+int ec_GF2m_simple_invert(const EC_GROUP *, EC_POINT *, BN_CTX *);
+int ec_GF2m_simple_is_at_infinity(const EC_GROUP *, const EC_POINT *);
+int ec_GF2m_simple_is_on_curve(const EC_GROUP *, const EC_POINT *, BN_CTX *);
+int ec_GF2m_simple_cmp(const EC_GROUP *, const EC_POINT *a, const EC_POINT *b, BN_CTX *);
+int ec_GF2m_simple_make_affine(const EC_GROUP *, EC_POINT *, BN_CTX *);
+int ec_GF2m_simple_points_make_affine(const EC_GROUP *, size_t num, EC_POINT *[], BN_CTX *);
+int ec_GF2m_simple_field_mul(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
+int ec_GF2m_simple_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *);
+int ec_GF2m_simple_field_div(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
+
+
+/* method functions in ec2_mult.c */
+int ec_GF2m_simple_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
+        size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
+int ec_GF2m_precompute_mult(EC_GROUP *group, BN_CTX *ctx);
+int ec_GF2m_have_precompute_mult(const EC_GROUP *group);
diff --git a/src/lib/libssl/src/crypto/ec/ec_lib.c b/src/lib/libssl/src/crypto/ec/ec_lib.c
index deb522060f..5af84376c6 100644
--- a/src/lib/libssl/src/crypto/ec/ec_lib.c
+++ b/src/lib/libssl/src/crypto/ec/ec_lib.c
@@ -1,6 +1,9 @@
 /* crypto/ec/ec_lib.c */
+/*
+ * Originally written by Bodo Moeller for the OpenSSL project.
+ */
 /* ====================================================================
- * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,6 +55,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * Binary polynomial ECC support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #include <string.h>
 
@@ -90,10 +98,18 @@ EC_GROUP *EC_GROUP_new(const EC_METHOD *meth)
         ret->meth = meth;
 
         ret->extra_data = NULL;
-        ret->extra_data_dup_func = 0;
-        ret->extra_data_free_func = 0;
-        ret->extra_data_clear_free_func = 0;
-        
+
+        ret->generator = NULL;
+        BN_init(&ret->order);
+        BN_init(&ret->cofactor);
+
+        ret->curve_name = 0;    
+        ret->asn1_flag  = 0;
+        ret->asn1_form  = POINT_CONVERSION_UNCOMPRESSED;
+
+        ret->seed = NULL;
+        ret->seed_len = 0;
+
         if (!meth->group_init(ret))
                 {
                 OPENSSL_free(ret);
@@ -111,7 +127,15 @@ void EC_GROUP_free(EC_GROUP *group)
         if (group->meth->group_finish != 0)
                 group->meth->group_finish(group);
 
-        EC_GROUP_free_extra_data(group);
+        EC_EX_DATA_free_all_data(&group->extra_data);
+
+        if (group->generator != NULL)
+                EC_POINT_free(group->generator);
+        BN_free(&group->order);
+        BN_free(&group->cofactor);
+
+        if (group->seed)
+                OPENSSL_free(group->seed);
 
         OPENSSL_free(group);
         }
@@ -123,10 +147,21 @@ void EC_GROUP_clear_free(EC_GROUP *group)
 
         if (group->meth->group_clear_finish != 0)
                 group->meth->group_clear_finish(group);
-        else if (group->meth != NULL && group->meth->group_finish != 0)
+        else if (group->meth->group_finish != 0)
                 group->meth->group_finish(group);
 
-        EC_GROUP_clear_free_extra_data(group);
+        EC_EX_DATA_clear_free_all_data(&group->extra_data);
+
+        if (group->generator != NULL)
+                EC_POINT_clear_free(group->generator);
+        BN_clear_free(&group->order);
+        BN_clear_free(&group->cofactor);
+
+        if (group->seed)
+                {
+                OPENSSL_cleanse(group->seed, group->seed_len);
+                OPENSSL_free(group->seed);
+                }
 
         OPENSSL_cleanse(group, sizeof *group);
         OPENSSL_free(group);
@@ -135,6 +170,8 @@ void EC_GROUP_clear_free(EC_GROUP *group)
 
 int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
         {
+        EC_EXTRA_DATA *d;
+
         if (dest->meth->group_copy == 0)
                 {
                 ECerr(EC_F_EC_GROUP_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
@@ -148,161 +185,507 @@ int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
         if (dest == src)
                 return 1;
         
-        EC_GROUP_clear_free_extra_data(dest);
-        if (src->extra_data_dup_func)
+        EC_EX_DATA_free_all_data(&dest->extra_data);
+
+        for (d = src->extra_data; d != NULL; d = d->next)
                 {
-                if (src->extra_data != NULL)
+                void *t = d->dup_func(d->data);
+                
+                if (t == NULL)
+                        return 0;
+                if (!EC_EX_DATA_set_data(&dest->extra_data, t, d->dup_func, d->free_func, d->clear_free_func))
+                        return 0;
+                }
+
+        if (src->generator != NULL)
+                {
+                if (dest->generator == NULL)
+                        {
+                        dest->generator = EC_POINT_new(dest);
+                        if (dest->generator == NULL) return 0;
+                        }
+                if (!EC_POINT_copy(dest->generator, src->generator)) return 0;
+                }
+        else
+                {
+                /* src->generator == NULL */
+                if (dest->generator != NULL)
                         {
-                        dest->extra_data = src->extra_data_dup_func(src->extra_data);
-                        if (dest->extra_data == NULL)
-                                return 0;
+                        EC_POINT_clear_free(dest->generator);
+                        dest->generator = NULL;
                         }
+                }
+
+        if (!BN_copy(&dest->order, &src->order)) return 0;
+        if (!BN_copy(&dest->cofactor, &src->cofactor)) return 0;
 
-                dest->extra_data_dup_func = src->extra_data_dup_func;
-                dest->extra_data_free_func = src->extra_data_free_func;
-                dest->extra_data_clear_free_func = src->extra_data_clear_free_func;
+        dest->curve_name = src->curve_name;
+        dest->asn1_flag  = src->asn1_flag;
+        dest->asn1_form  = src->asn1_form;
+
+        if (src->seed)
+                {
+                if (dest->seed)
+                        OPENSSL_free(dest->seed);
+                dest->seed = OPENSSL_malloc(src->seed_len);
+                if (dest->seed == NULL)
+                        return 0;
+                if (!memcpy(dest->seed, src->seed, src->seed_len))
+                        return 0;
+                dest->seed_len = src->seed_len;
+                }
+        else
+                {
+                if (dest->seed)
+                        OPENSSL_free(dest->seed);
+                dest->seed = NULL;
+                dest->seed_len = 0;
                 }
+        
 
         return dest->meth->group_copy(dest, src);
         }
 
 
+EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
+        {
+        EC_GROUP *t = NULL;
+        int ok = 0;
+
+        if (a == NULL) return NULL;
+
+        if ((t = EC_GROUP_new(a->meth)) == NULL) return(NULL);
+        if (!EC_GROUP_copy(t, a)) goto err;
+
+        ok = 1;
+
+  err:  
+        if (!ok)
+                {
+                if (t) EC_GROUP_free(t);
+                return NULL;
+                }
+        else return t;
+        }
+
+
 const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *group)
         {
         return group->meth;
         }
 
 
+int EC_METHOD_get_field_type(const EC_METHOD *meth)
+        {
+        return meth->field_type;
+        }
+
+
+int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator, const BIGNUM *order, const BIGNUM *cofactor)
+        {
+        if (generator == NULL)
+                {
+                ECerr(EC_F_EC_GROUP_SET_GENERATOR, ERR_R_PASSED_NULL_PARAMETER);
+                return 0   ;
+                }
+
+        if (group->generator == NULL)
+                {
+                group->generator = EC_POINT_new(group);
+                if (group->generator == NULL) return 0;
+                }
+        if (!EC_POINT_copy(group->generator, generator)) return 0;
+
+        if (order != NULL)
+                { if (!BN_copy(&group->order, order)) return 0; }       
+        else
+                BN_zero(&group->order);
+
+        if (cofactor != NULL)
+                { if (!BN_copy(&group->cofactor, cofactor)) return 0; } 
+        else
+                BN_zero(&group->cofactor);
+
+        return 1;
+        }
+
+
+const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group)
+        {
+        return group->generator;
+        }
+
+
+int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx)
+        {
+        if (!BN_copy(order, &group->order))
+                return 0;
+
+        return !BN_is_zero(order);
+        }
+
+
+int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor, BN_CTX *ctx)
+        {
+        if (!BN_copy(cofactor, &group->cofactor))
+                return 0;
+
+        return !BN_is_zero(&group->cofactor);
+        }
+
+
+void EC_GROUP_set_curve_name(EC_GROUP *group, int nid)
+        {
+        group->curve_name = nid;
+        }
+
+
+int EC_GROUP_get_curve_name(const EC_GROUP *group)
+        {
+        return group->curve_name;
+        }
+
+
+void EC_GROUP_set_asn1_flag(EC_GROUP *group, int flag)
+        {
+        group->asn1_flag = flag;
+        }
+
+
+int EC_GROUP_get_asn1_flag(const EC_GROUP *group)
+        {
+        return group->asn1_flag;
+        }
+
+
+void EC_GROUP_set_point_conversion_form(EC_GROUP *group, 
+                                        point_conversion_form_t form)
+        {
+        group->asn1_form = form;
+        }
+
+
+point_conversion_form_t EC_GROUP_get_point_conversion_form(const EC_GROUP *group)
+        {
+        return group->asn1_form;
+        }
+
+
+size_t EC_GROUP_set_seed(EC_GROUP *group, const unsigned char *p, size_t len)
+        {
+        if (group->seed)
+                {
+                OPENSSL_free(group->seed);
+                group->seed = NULL;
+                group->seed_len = 0;
+                }
+
+        if (!len || !p)
+                return 1;
+
+        if ((group->seed = OPENSSL_malloc(len)) == NULL)
+                return 0;
+        memcpy(group->seed, p, len);
+        group->seed_len = len;
+
+        return len;
+        }
+
+
+unsigned char *EC_GROUP_get0_seed(const EC_GROUP *group)
+        {
+        return group->seed;
+        }
+
+
+size_t EC_GROUP_get_seed_len(const EC_GROUP *group)
+        {
+        return group->seed_len;
+        }
+
+
 int EC_GROUP_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
         {
-        if (group->meth->group_set_curve_GFp == 0)
+        if (group->meth->group_set_curve == 0)
                 {
                 ECerr(EC_F_EC_GROUP_SET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return 0;
                 }
-        return group->meth->group_set_curve_GFp(group, p, a, b, ctx);
+        return group->meth->group_set_curve(group, p, a, b, ctx);
         }
 
 
 int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
         {
-        if (group->meth->group_get_curve_GFp == 0)
+        if (group->meth->group_get_curve == 0)
                 {
                 ECerr(EC_F_EC_GROUP_GET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return 0;
                 }
-        return group->meth->group_get_curve_GFp(group, p, a, b, ctx);
+        return group->meth->group_get_curve(group, p, a, b, ctx);
         }
 
 
-int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator, const BIGNUM *order, const BIGNUM *cofactor)
+int EC_GROUP_set_curve_GF2m(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
         {
-        if (group->meth->group_set_generator == 0)
+        if (group->meth->group_set_curve == 0)
                 {
-                ECerr(EC_F_EC_GROUP_SET_GENERATOR, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                ECerr(EC_F_EC_GROUP_SET_CURVE_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return 0;
                 }
-        return group->meth->group_set_generator(group, generator, order, cofactor);
+        return group->meth->group_set_curve(group, p, a, b, ctx);
         }
 
 
-EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group)
+int EC_GROUP_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
         {
-        if (group->meth->group_get0_generator == 0)
+        if (group->meth->group_get_curve == 0)
                 {
-                ECerr(EC_F_EC_GROUP_GET0_GENERATOR, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                ECerr(EC_F_EC_GROUP_GET_CURVE_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return 0;
                 }
-        return group->meth->group_get0_generator(group);
+        return group->meth->group_get_curve(group, p, a, b, ctx);
         }
 
 
-int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx)
+int EC_GROUP_get_degree(const EC_GROUP *group)
         {
-        if (group->meth->group_get_order == 0)
+        if (group->meth->group_get_degree == 0)
                 {
-                ECerr(EC_F_EC_GROUP_GET_ORDER, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                ECerr(EC_F_EC_GROUP_GET_DEGREE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return 0;
                 }
-        return group->meth->group_get_order(group, order, ctx);
+        return group->meth->group_get_degree(group);
         }
 
 
-int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor, BN_CTX *ctx)
+int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
         {
-        if (group->meth->group_get_cofactor == 0)
+        if (group->meth->group_check_discriminant == 0)
                 {
-                ECerr(EC_F_EC_GROUP_GET_COFACTOR, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                ECerr(EC_F_EC_GROUP_CHECK_DISCRIMINANT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return 0;
                 }
-        return group->meth->group_get_cofactor(group, cofactor, ctx);
+        return group->meth->group_check_discriminant(group, ctx);
         }
 
 
-/* this has 'package' visibility */
-int EC_GROUP_set_extra_data(EC_GROUP *group, void *extra_data, void *(*extra_data_dup_func)(void *),
-        void (*extra_data_free_func)(void *), void (*extra_data_clear_free_func)(void *))
+int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)
         {
-        if ((group->extra_data != NULL)
-                || (group->extra_data_dup_func != 0)
-                || (group->extra_data_free_func != 0)
-                || (group->extra_data_clear_free_func != 0))
-                {
-                ECerr(EC_F_EC_GROUP_SET_EXTRA_DATA, EC_R_SLOT_FULL);
+        int    r = 0;
+        BIGNUM *a1, *a2, *a3, *b1, *b2, *b3;
+        BN_CTX *ctx_new = NULL;
+
+        /* compare the field types*/
+        if (EC_METHOD_get_field_type(EC_GROUP_method_of(a)) !=
+            EC_METHOD_get_field_type(EC_GROUP_method_of(b)))
+                return 1;
+        /* compare the curve name (if present) */
+        if (EC_GROUP_get_curve_name(a) && EC_GROUP_get_curve_name(b) &&
+            EC_GROUP_get_curve_name(a) == EC_GROUP_get_curve_name(b))
                 return 0;
+
+        if (!ctx)
+                ctx_new = ctx = BN_CTX_new();
+        if (!ctx)
+                return -1;
+        
+        BN_CTX_start(ctx);
+        a1 = BN_CTX_get(ctx);
+        a2 = BN_CTX_get(ctx);
+        a3 = BN_CTX_get(ctx);
+        b1 = BN_CTX_get(ctx);
+        b2 = BN_CTX_get(ctx);
+        b3 = BN_CTX_get(ctx);
+        if (!b3)
+                {
+                BN_CTX_end(ctx);
+                if (ctx_new)
+                        BN_CTX_free(ctx);
+                return -1;
                 }
 
-        group->extra_data = extra_data;
-        group->extra_data_dup_func = extra_data_dup_func;
-        group->extra_data_free_func = extra_data_free_func;
-        group->extra_data_clear_free_func = extra_data_clear_free_func;
-        return 1;
+        /* XXX This approach assumes that the external representation
+         * of curves over the same field type is the same.
+         */
+        if (!a->meth->group_get_curve(a, a1, a2, a3, ctx) ||
+            !b->meth->group_get_curve(b, b1, b2, b3, ctx))
+                r = 1;
+
+        if (r || BN_cmp(a1, b1) || BN_cmp(a2, b2) || BN_cmp(a3, b3))
+                r = 1;
+
+        /* XXX EC_POINT_cmp() assumes that the methods are equal */
+        if (r || EC_POINT_cmp(a, EC_GROUP_get0_generator(a),
+            EC_GROUP_get0_generator(b), ctx))
+                r = 1;
+
+        if (!r)
+                {
+                /* compare the order and cofactor */
+                if (!EC_GROUP_get_order(a, a1, ctx) ||
+                    !EC_GROUP_get_order(b, b1, ctx) ||
+                    !EC_GROUP_get_cofactor(a, a2, ctx) ||
+                    !EC_GROUP_get_cofactor(b, b2, ctx))
+                        {
+                        BN_CTX_end(ctx);
+                        if (ctx_new)
+                                BN_CTX_free(ctx);
+                        return -1;
+                        }
+                if (BN_cmp(a1, b1) || BN_cmp(a2, b2))
+                        r = 1;
+                }
+
+        BN_CTX_end(ctx);
+        if (ctx_new)
+                BN_CTX_free(ctx);
+
+        return r;
         }
 
 
 /* this has 'package' visibility */
-void *EC_GROUP_get_extra_data(const EC_GROUP *group, void *(*extra_data_dup_func)(void *),
-        void (*extra_data_free_func)(void *), void (*extra_data_clear_free_func)(void *))
+int EC_EX_DATA_set_data(EC_EXTRA_DATA **ex_data, void *data,
+        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *))
         {
-        if ((group->extra_data_dup_func != extra_data_dup_func)
-                || (group->extra_data_free_func != extra_data_free_func)
-                || (group->extra_data_clear_free_func != extra_data_clear_free_func))
+        EC_EXTRA_DATA *d;
+
+        if (ex_data == NULL)
+                return 0;
+
+        for (d = *ex_data; d != NULL; d = d->next)
                 {
-#if 0 /* this was an error in 0.9.7, but that does not make a lot of sense */
-                ECerr(..._F_EC_GROUP_GET_EXTRA_DATA, ..._R_NO_SUCH_EXTRA_DATA);
-#endif
-                return NULL;
+                if (d->dup_func == dup_func && d->free_func == free_func && d->clear_free_func == clear_free_func)
+                        {
+                        ECerr(EC_F_EC_EX_DATA_SET_DATA, EC_R_SLOT_FULL);
+                        return 0;
+                        }
                 }
 
-        return group->extra_data;
+        if (data == NULL)
+                /* no explicit entry needed */
+                return 1;
+
+        d = OPENSSL_malloc(sizeof *d);
+        if (d == NULL)
+                return 0;
+
+        d->data = data;
+        d->dup_func = dup_func;
+        d->free_func = free_func;
+        d->clear_free_func = clear_free_func;
+
+        d->next = *ex_data;
+        *ex_data = d;
+
+        return 1;
         }
 
+/* this has 'package' visibility */
+void *EC_EX_DATA_get_data(const EC_EXTRA_DATA *ex_data,
+        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *))
+        {
+        const EC_EXTRA_DATA *d;
+
+        for (d = ex_data; d != NULL; d = d->next)
+                {
+                if (d->dup_func == dup_func && d->free_func == free_func && d->clear_free_func == clear_free_func)
+                        return d->data;
+                }
+        
+        return NULL;
+        }
 
 /* this has 'package' visibility */
-void EC_GROUP_free_extra_data(EC_GROUP *group)
+void EC_EX_DATA_free_data(EC_EXTRA_DATA **ex_data,
+        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *))
         {
-        if (group->extra_data_free_func)
-                group->extra_data_free_func(group->extra_data);
-        group->extra_data = NULL;
-        group->extra_data_dup_func = 0;
-        group->extra_data_free_func = 0;
-        group->extra_data_clear_free_func = 0;
+        EC_EXTRA_DATA **p;
+
+        if (ex_data == NULL)
+                return;
+
+        for (p = ex_data; *p != NULL; p = &((*p)->next))
+                {
+                if ((*p)->dup_func == dup_func && (*p)->free_func == free_func && (*p)->clear_free_func == clear_free_func)
+                        {
+                        EC_EXTRA_DATA *next = (*p)->next;
+
+                        (*p)->free_func((*p)->data);
+                        OPENSSL_free(*p);
+                        
+                        *p = next;
+                        return;
+                        }
+                }
         }
 
+/* this has 'package' visibility */
+void EC_EX_DATA_clear_free_data(EC_EXTRA_DATA **ex_data,
+        void *(*dup_func)(void *), void (*free_func)(void *), void (*clear_free_func)(void *))
+        {
+        EC_EXTRA_DATA **p;
+
+        if (ex_data == NULL)
+                return;
+
+        for (p = ex_data; *p != NULL; p = &((*p)->next))
+                {
+                if ((*p)->dup_func == dup_func && (*p)->free_func == free_func && (*p)->clear_free_func == clear_free_func)
+                        {
+                        EC_EXTRA_DATA *next = (*p)->next;
+
+                        (*p)->clear_free_func((*p)->data);
+                        OPENSSL_free(*p);
+                        
+                        *p = next;
+                        return;
+                        }
+                }
+        }
 
 /* this has 'package' visibility */
-void EC_GROUP_clear_free_extra_data(EC_GROUP *group)
+void EC_EX_DATA_free_all_data(EC_EXTRA_DATA **ex_data)
         {
-        if (group->extra_data_clear_free_func)
-                group->extra_data_clear_free_func(group->extra_data);
-        else if (group->extra_data_free_func)
-                group->extra_data_free_func(group->extra_data);
-        group->extra_data = NULL;
-        group->extra_data_dup_func = 0;
-        group->extra_data_free_func = 0;
-        group->extra_data_clear_free_func = 0;
+        EC_EXTRA_DATA *d;
+
+        if (ex_data == NULL)
+                return;
+
+        d = *ex_data;
+        while (d)
+                {
+                EC_EXTRA_DATA *next = d->next;
+                
+                d->free_func(d->data);
+                OPENSSL_free(d);
+                
+                d = next;
+                }
+        *ex_data = NULL;
         }
 
+/* this has 'package' visibility */
+void EC_EX_DATA_clear_free_all_data(EC_EXTRA_DATA **ex_data)
+        {
+        EC_EXTRA_DATA *d;
+
+        if (ex_data == NULL)
+                return;
+
+        d = *ex_data;
+        while (d)
+                {
+                EC_EXTRA_DATA *next = d->next;
+                
+                d->clear_free_func(d->data);
+                OPENSSL_free(d);
+                
+                d = next;
+                }
+        *ex_data = NULL;
+        }
 
 
 /* functions for EC_POINT objects */
@@ -382,6 +765,25 @@ int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src)
         }
 
 
+EC_POINT *EC_POINT_dup(const EC_POINT *a, const EC_GROUP *group)
+        {
+        EC_POINT *t;
+        int r;
+
+        if (a == NULL) return NULL;
+
+        t = EC_POINT_new(group);
+        if (t == NULL) return(NULL);
+        r = EC_POINT_copy(t, a);
+        if (!r)
+                {
+                EC_POINT_free(t);
+                return NULL;
+                }
+        else return t;
+        }
+
+
 const EC_METHOD *EC_POINT_method_of(const EC_POINT *point)
         {
         return point->meth;
@@ -441,7 +843,7 @@ int EC_POINT_get_Jprojective_coordinates_GFp(const EC_GROUP *group, const EC_POI
 int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
         const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx)
         {
-        if (group->meth->point_set_affine_coordinates_GFp == 0)
+        if (group->meth->point_set_affine_coordinates == 0)
                 {
                 ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return 0;
@@ -451,14 +853,31 @@ int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
                 ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP, EC_R_INCOMPATIBLE_OBJECTS);
                 return 0;
                 }
-        return group->meth->point_set_affine_coordinates_GFp(group, point, x, y, ctx);
+        return group->meth->point_set_affine_coordinates(group, point, x, y, ctx);
+        }
+
+
+int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *group, EC_POINT *point,
+        const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx)
+        {
+        if (group->meth->point_set_affine_coordinates == 0)
+                {
+                ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return 0;
+                }
+        if (group->meth != point->meth)
+                {
+                ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M, EC_R_INCOMPATIBLE_OBJECTS);
+                return 0;
+                }
+        return group->meth->point_set_affine_coordinates(group, point, x, y, ctx);
         }
 
 
 int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group, const EC_POINT *point,
         BIGNUM *x, BIGNUM *y, BN_CTX *ctx)
         {
-        if (group->meth->point_get_affine_coordinates_GFp == 0)
+        if (group->meth->point_get_affine_coordinates == 0)
                 {
                 ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return 0;
@@ -468,14 +887,31 @@ int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group, const EC_POINT *p
                 ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP, EC_R_INCOMPATIBLE_OBJECTS);
                 return 0;
                 }
-        return group->meth->point_get_affine_coordinates_GFp(group, point, x, y, ctx);
+        return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
+        }
+
+
+int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *group, const EC_POINT *point,
+        BIGNUM *x, BIGNUM *y, BN_CTX *ctx)
+        {
+        if (group->meth->point_get_affine_coordinates == 0)
+                {
+                ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return 0;
+                }
+        if (group->meth != point->meth)
+                {
+                ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M, EC_R_INCOMPATIBLE_OBJECTS);
+                return 0;
+                }
+        return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
         }
 
 
 int EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
         const BIGNUM *x, int y_bit, BN_CTX *ctx)
         {
-        if (group->meth->point_set_compressed_coordinates_GFp == 0)
+        if (group->meth->point_set_compressed_coordinates == 0)
                 {
                 ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return 0;
@@ -485,7 +921,24 @@ int EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *group, EC_POINT *poi
                 ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP, EC_R_INCOMPATIBLE_OBJECTS);
                 return 0;
                 }
-        return group->meth->point_set_compressed_coordinates_GFp(group, point, x, y_bit, ctx);
+        return group->meth->point_set_compressed_coordinates(group, point, x, y_bit, ctx);
+        }
+
+
+int EC_POINT_set_compressed_coordinates_GF2m(const EC_GROUP *group, EC_POINT *point,
+        const BIGNUM *x, int y_bit, BN_CTX *ctx)
+        {
+        if (group->meth->point_set_compressed_coordinates == 0)
+                {
+                ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return 0;
+                }
+        if (group->meth != point->meth)
+                {
+                ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GF2M, EC_R_INCOMPATIBLE_OBJECTS);
+                return 0;
+                }
+        return group->meth->point_set_compressed_coordinates(group, point, x, y_bit, ctx);
         }
 
 
@@ -559,12 +1012,12 @@ int EC_POINT_invert(const EC_GROUP *group, EC_POINT *a, BN_CTX *ctx)
         {
         if (group->meth->dbl == 0)
                 {
-                ECerr(EC_F_EC_POINT_DBL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                ECerr(EC_F_EC_POINT_INVERT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return 0;
                 }
         if (group->meth != a->meth)
                 {
-                ECerr(EC_F_EC_POINT_DBL, EC_R_INCOMPATIBLE_OBJECTS);
+                ECerr(EC_F_EC_POINT_INVERT, EC_R_INCOMPATIBLE_OBJECTS);
                 return 0;
                 }
         return group->meth->invert(group, a, ctx);
@@ -654,3 +1107,58 @@ int EC_POINTs_make_affine(const EC_GROUP *group, size_t num, EC_POINT *points[],
                 }
         return group->meth->points_make_affine(group, num, points, ctx);
         }
+
+
+/* Functions for point multiplication.
+ *
+ * If group->meth->mul is 0, we use the wNAF-based implementations in ec_mult.c;
+ * otherwise we dispatch through methods.
+ */
+
+int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
+        size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx)
+        {
+        if (group->meth->mul == 0)
+                /* use default */
+                return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
+
+        return group->meth->mul(group, r, scalar, num, points, scalars, ctx);
+        }
+
+int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
+        const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
+        {
+        /* just a convenient interface to EC_POINTs_mul() */
+
+        const EC_POINT *points[1];
+        const BIGNUM *scalars[1];
+
+        points[0] = point;
+        scalars[0] = p_scalar;
+
+        return EC_POINTs_mul(group, r, g_scalar, (point != NULL && p_scalar != NULL), points, scalars, ctx);
+        }
+
+int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
+        {
+        if (group->meth->mul == 0)
+                /* use default */
+                return ec_wNAF_precompute_mult(group, ctx);
+
+        if (group->meth->precompute_mult != 0)
+                return group->meth->precompute_mult(group, ctx);
+        else
+                return 1; /* nothing to do, so report success */
+        }
+
+int EC_GROUP_have_precompute_mult(const EC_GROUP *group)
+        {
+        if (group->meth->mul == 0)
+                /* use default */
+                return ec_wNAF_have_precompute_mult(group);
+
+        if (group->meth->have_precompute_mult != 0)
+                return group->meth->have_precompute_mult(group);
+        else
+                return 0; /* cannot tell whether precomputation has been performed */
+        }
diff --git a/src/lib/libssl/src/crypto/ec/ec_mult.c b/src/lib/libssl/src/crypto/ec/ec_mult.c
index 16822a73cf..2ba173ef36 100644
--- a/src/lib/libssl/src/crypto/ec/ec_mult.c
+++ b/src/lib/libssl/src/crypto/ec/ec_mult.c
@@ -1,6 +1,9 @@
 /* crypto/ec/ec_mult.c */
+/*
+ * Originally written by Bodo Moeller and Nils Larsch for the OpenSSL project.
+ */
 /* ====================================================================
- * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,41 +55,161 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * Portions of this software developed by SUN MICROSYSTEMS, INC.,
+ * and contributed to the OpenSSL project.
+ */
+
+#include <string.h>
 
 #include <openssl/err.h>
 
 #include "ec_lcl.h"
 
 
-/* TODO: optional precomputation of multiples of the generator */
+/*
+ * This file implements the wNAF-based interleaving multi-exponentation method
+ * (<URL:http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#multiexp>);
+ * for multiplication with precomputation, we use wNAF splitting
+ * (<URL:http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#fastexp>).
+ */
 
 
 
-/*
- * wNAF-based interleaving multi-exponentation method
- * (<URL:http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#multiexp>)
- */
+
+/* structure for precomputed multiples of the generator */
+typedef struct ec_pre_comp_st {
+        const EC_GROUP *group; /* parent EC_GROUP object */
+        size_t blocksize;      /* block size for wNAF splitting */
+        size_t numblocks;      /* max. number of blocks for which we have precomputation */
+        size_t w;              /* window size */
+        EC_POINT **points;     /* array with pre-calculated multiples of generator:
+                                * 'num' pointers to EC_POINT objects followed by a NULL */
+        size_t num;            /* numblocks * 2^(w-1) */
+        int references;
+} EC_PRE_COMP;
+ 
+/* functions to manage EC_PRE_COMP within the EC_GROUP extra_data framework */
+static void *ec_pre_comp_dup(void *);
+static void ec_pre_comp_free(void *);
+static void ec_pre_comp_clear_free(void *);
+
+static EC_PRE_COMP *ec_pre_comp_new(const EC_GROUP *group)
+        {
+        EC_PRE_COMP *ret = NULL;
+
+        if (!group)
+                return NULL;
+
+        ret = (EC_PRE_COMP *)OPENSSL_malloc(sizeof(EC_PRE_COMP));
+        if (!ret)
+                {
+                ECerr(EC_F_EC_PRE_COMP_NEW, ERR_R_MALLOC_FAILURE);
+                return ret;
+                }
+        ret->group = group;
+        ret->blocksize = 8; /* default */
+        ret->numblocks = 0;
+        ret->w = 4; /* default */
+        ret->points = NULL;
+        ret->num = 0;
+        ret->references = 1;
+        return ret;
+        }
+
+static void *ec_pre_comp_dup(void *src_)
+        {
+        EC_PRE_COMP *src = src_;
+
+        /* no need to actually copy, these objects never change! */
+
+        CRYPTO_add(&src->references, 1, CRYPTO_LOCK_EC_PRE_COMP);
+
+        return src_;
+        }
+
+static void ec_pre_comp_free(void *pre_)
+        {
+        int i;
+        EC_PRE_COMP *pre = pre_;
+
+        if (!pre)
+                return;
+
+        i = CRYPTO_add(&pre->references, -1, CRYPTO_LOCK_EC_PRE_COMP);
+        if (i > 0)
+                return;
+
+        if (pre->points)
+                {
+                EC_POINT **p;
+
+                for (p = pre->points; *p != NULL; p++)
+                        EC_POINT_free(*p);
+                OPENSSL_free(pre->points);
+                }
+        OPENSSL_free(pre);
+        }
+
+static void ec_pre_comp_clear_free(void *pre_)
+        {
+        int i;
+        EC_PRE_COMP *pre = pre_;
+
+        if (!pre)
+                return;
+
+        i = CRYPTO_add(&pre->references, -1, CRYPTO_LOCK_EC_PRE_COMP);
+        if (i > 0)
+                return;
+
+        if (pre->points)
+                {
+                EC_POINT **p;
+
+                for (p = pre->points; *p != NULL; p++)
+                        EC_POINT_clear_free(*p);
+                OPENSSL_cleanse(pre->points, sizeof pre->points);
+                OPENSSL_free(pre->points);
+                }
+        OPENSSL_cleanse(pre, sizeof pre);
+        OPENSSL_free(pre);
+        }
+
 
 
-/* Determine the width-(w+1) Non-Adjacent Form (wNAF) of 'scalar'.
+
+/* Determine the modified width-(w+1) Non-Adjacent Form (wNAF) of 'scalar'.
  * This is an array  r[]  of values that are either zero or odd with an
  * absolute value less than  2^w  satisfying
  *     scalar = \sum_j r[j]*2^j
- * where at most one of any  w+1  consecutive digits is non-zero.
+ * where at most one of any  w+1  consecutive digits is non-zero
+ * with the exception that the most significant digit may be only
+ * w-1 zeros away from that next non-zero digit.
  */
-static signed char *compute_wNAF(const BIGNUM *scalar, int w, size_t *ret_len, BN_CTX *ctx)
+static signed char *compute_wNAF(const BIGNUM *scalar, int w, size_t *ret_len)
         {
-        BIGNUM *c;
+        int window_val;
         int ok = 0;
         signed char *r = NULL;
         int sign = 1;
         int bit, next_bit, mask;
         size_t len = 0, j;
         
-        BN_CTX_start(ctx);
-        c = BN_CTX_get(ctx);
-        if (c == NULL) goto err;
-        
+        if (BN_is_zero(scalar))
+                {
+                r = OPENSSL_malloc(1);
+                if (!r)
+                        {
+                        ECerr(EC_F_COMPUTE_WNAF, ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                r[0] = 0;
+                *ret_len = 1;
+                return r;
+                }
+                
         if (w <= 0 || w > 7) /* 'signed char' can represent integers with absolute values less than 2^7 */
                 {
                 ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
@@ -96,60 +219,90 @@ static signed char *compute_wNAF(const BIGNUM *scalar, int w, size_t *ret_len, B
         next_bit = bit << 1; /* at most 256 */
         mask = next_bit - 1; /* at most 255 */
 
-        if (!BN_copy(c, scalar)) goto err;
-        if (c->neg)
+        if (BN_is_negative(scalar))
                 {
                 sign = -1;
-                c->neg = 0;
                 }
 
-        len = BN_num_bits(c) + 1; /* wNAF may be one digit longer than binary representation */
-        r = OPENSSL_malloc(len);
-        if (r == NULL) goto err;
+        len = BN_num_bits(scalar);
+        r = OPENSSL_malloc(len + 1); /* modified wNAF may be one digit longer than binary representation
+                                      * (*ret_len will be set to the actual length, i.e. at most
+                                      * BN_num_bits(scalar) + 1) */
+        if (r == NULL)
+                {
+                ECerr(EC_F_COMPUTE_WNAF, ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
 
+        if (scalar->d == NULL || scalar->top == 0)
+                {
+                ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
+                goto err;
+                }
+        window_val = scalar->d[0] & mask;
         j = 0;
-        while (!BN_is_zero(c))
+        while ((window_val != 0) || (j + w + 1 < len)) /* if j+w+1 >= len, window_val will not increase */
                 {
-                int u = 0;
+                int digit = 0;
 
-                if (BN_is_odd(c)) 
+                /* 0 <= window_val <= 2^(w+1) */
+
+                if (window_val & 1)
                         {
-                        if (c->d == NULL || c->top == 0)
+                        /* 0 < window_val < 2^(w+1) */
+
+                        if (window_val & bit)
                                 {
-                                ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
-                                goto err;
+                                digit = window_val - next_bit; /* -2^w < digit < 0 */
+
+#if 1 /* modified wNAF */
+                                if (j + w + 1 >= len)
+                                        {
+                                        /* special case for generating modified wNAFs:
+                                         * no new bits will be added into window_val,
+                                         * so using a positive digit here will decrease
+                                         * the total length of the representation */
+                                        
+                                        digit = window_val & (mask >> 1); /* 0 < digit < 2^w */
+                                        }
+#endif
                                 }
-                        u = c->d[0] & mask;
-                        if (u & bit)
+                        else
                                 {
-                                u -= next_bit;
-                                /* u < 0 */
-                                if (!BN_add_word(c, -u)) goto err;
+                                digit = window_val; /* 0 < digit < 2^w */
                                 }
-                        else
+                        
+                        if (digit <= -bit || digit >= bit || !(digit & 1))
                                 {
-                                /* u > 0 */
-                                if (!BN_sub_word(c, u)) goto err;
+                                ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
+                                goto err;
                                 }
 
-                        if (u <= -bit || u >= bit || !(u & 1) || c->neg)
+                        window_val -= digit;
+
+                        /* now window_val is 0 or 2^(w+1) in standard wNAF generation;
+                         * for modified window NAFs, it may also be 2^w
+                         */
+                        if (window_val != 0 && window_val != next_bit && window_val != bit)
                                 {
                                 ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
                                 goto err;
                                 }
                         }
 
-                r[j++] = sign * u;
-                
-                if (BN_is_odd(c))
+                r[j++] = sign * digit;
+
+                window_val >>= 1;
+                window_val += bit * BN_is_bit_set(scalar, j + w);
+
+                if (window_val > next_bit)
                         {
                         ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
                         goto err;
                         }
-                if (!BN_rshift1(c, c)) goto err;
                 }
 
-        if (j > len)
+        if (j > len + 1)
                 {
                 ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
                 goto err;
@@ -158,7 +311,6 @@ static signed char *compute_wNAF(const BIGNUM *scalar, int w, size_t *ret_len, B
         ok = 1;
 
  err:
-        BN_CTX_end(ctx);
         if (!ok)
                 {
                 OPENSSL_free(r);
@@ -181,7 +333,7 @@ static signed char *compute_wNAF(const BIGNUM *scalar, int w, size_t *ret_len, B
                   (b) >=  300 ? 4 : \
                   (b) >=   70 ? 3 : \
                   (b) >=   20 ? 2 : \
-                   1))
+                  1))
 
 /* Compute
  *      \sum scalars[i]*points[i],
@@ -189,13 +341,15 @@ static signed char *compute_wNAF(const BIGNUM *scalar, int w, size_t *ret_len, B
  *      scalar*generator
  * in the addition if scalar != NULL
  */
-int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
+int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
         size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx)
         {
         BN_CTX *new_ctx = NULL;
-        EC_POINT *generator = NULL;
+        const EC_POINT *generator = NULL;
         EC_POINT *tmp = NULL;
         size_t totalnum;
+        size_t blocksize = 0, numblocks = 0; /* for wNAF splitting */
+        size_t pre_points_per_block = 0;
         size_t i, j;
         int k;
         int r_is_inverted = 0;
@@ -207,12 +361,15 @@ int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
         size_t num_val;
         EC_POINT **val = NULL; /* precomputation */
         EC_POINT **v;
-        EC_POINT ***val_sub = NULL; /* pointers to sub-arrays of 'val' */
+        EC_POINT ***val_sub = NULL; /* pointers to sub-arrays of 'val' or 'pre_comp->points' */
+        const EC_PRE_COMP *pre_comp = NULL;
+        int num_scalar = 0; /* flag: will be set to 1 if 'scalar' must be treated like other scalars,
+                             * i.e. precomputation is not available */
         int ret = 0;
         
         if (group->meth != r->meth)
                 {
-                ECerr(EC_F_EC_POINTS_MUL, EC_R_INCOMPATIBLE_OBJECTS);
+                ECerr(EC_F_EC_WNAF_MUL, EC_R_INCOMPATIBLE_OBJECTS);
                 return 0;
                 }
 
@@ -221,59 +378,226 @@ int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
                 return EC_POINT_set_to_infinity(group, r);
                 }
 
-        if (scalar != NULL)
+        for (i = 0; i < num; i++)
                 {
-                generator = EC_GROUP_get0_generator(group);
-                if (generator == NULL)
+                if (group->meth != points[i]->meth)
                         {
-                        ECerr(EC_F_EC_POINTS_MUL, EC_R_UNDEFINED_GENERATOR);
+                        ECerr(EC_F_EC_WNAF_MUL, EC_R_INCOMPATIBLE_OBJECTS);
                         return 0;
                         }
                 }
-        
-        for (i = 0; i < num; i++)
+
+        if (ctx == NULL)
                 {
-                if (group->meth != points[i]->meth)
+                ctx = new_ctx = BN_CTX_new();
+                if (ctx == NULL)
+                        goto err;
+                }
+
+        if (scalar != NULL)
+                {
+                generator = EC_GROUP_get0_generator(group);
+                if (generator == NULL)
                         {
-                        ECerr(EC_F_EC_POINTS_MUL, EC_R_INCOMPATIBLE_OBJECTS);
-                        return 0;
+                        ECerr(EC_F_EC_WNAF_MUL, EC_R_UNDEFINED_GENERATOR);
+                        goto err;
                         }
-                }
+                
+                /* look if we can use precomputed multiples of generator */
+
+                pre_comp = EC_EX_DATA_get_data(group->extra_data, ec_pre_comp_dup, ec_pre_comp_free, ec_pre_comp_clear_free);
+
+                if (pre_comp && pre_comp->numblocks && (EC_POINT_cmp(group, generator, pre_comp->points[0], ctx) == 0))
+                        {
+                        blocksize = pre_comp->blocksize;
 
-        totalnum = num + (scalar != NULL);
+                        /* determine maximum number of blocks that wNAF splitting may yield
+                         * (NB: maximum wNAF length is bit length plus one) */
+                        numblocks = (BN_num_bits(scalar) / blocksize) + 1;
 
-        wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);
+                        /* we cannot use more blocks than we have precomputation for */
+                        if (numblocks > pre_comp->numblocks)
+                                numblocks = pre_comp->numblocks;
+
+                        pre_points_per_block = 1u << (pre_comp->w - 1);
+
+                        /* check that pre_comp looks sane */
+                        if (pre_comp->num != (pre_comp->numblocks * pre_points_per_block))
+                                {
+                                ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+                        }
+                else
+                        {
+                        /* can't use precomputation */
+                        pre_comp = NULL;
+                        numblocks = 1;
+                        num_scalar = 1; /* treat 'scalar' like 'num'-th element of 'scalars' */
+                        }
+                }
+        
+        totalnum = num + numblocks;
+
+        wsize    = OPENSSL_malloc(totalnum * sizeof wsize[0]);
         wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]);
-        wNAF = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]);
-        if (wNAF != NULL)
+        wNAF     = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]); /* includes space for pivot */
+        val_sub  = OPENSSL_malloc(totalnum * sizeof val_sub[0]);
+                 
+        if (!wsize || !wNAF_len || !wNAF || !val_sub)
                 {
-                wNAF[0] = NULL; /* preliminary pivot */
+                ECerr(EC_F_EC_WNAF_MUL, ERR_R_MALLOC_FAILURE);
+                goto err;
                 }
-        if (wsize == NULL || wNAF_len == NULL || wNAF == NULL) goto err;
 
-        /* num_val := total number of points to precompute */
+        wNAF[0] = NULL; /* preliminary pivot */
+
+        /* num_val will be the total number of temporarily precomputed points */
         num_val = 0;
-        for (i = 0; i < totalnum; i++)
+
+        for (i = 0; i < num + num_scalar; i++)
                 {
                 size_t bits;
 
                 bits = i < num ? BN_num_bits(scalars[i]) : BN_num_bits(scalar);
                 wsize[i] = EC_window_bits_for_scalar_size(bits);
                 num_val += 1u << (wsize[i] - 1);
+                wNAF[i + 1] = NULL; /* make sure we always have a pivot */
+                wNAF[i] = compute_wNAF((i < num ? scalars[i] : scalar), wsize[i], &wNAF_len[i]);
+                if (wNAF[i] == NULL)
+                        goto err;
+                if (wNAF_len[i] > max_len)
+                        max_len = wNAF_len[i];
+                }
+
+        if (numblocks)
+                {
+                /* we go here iff scalar != NULL */
+                
+                if (pre_comp == NULL)
+                        {
+                        if (num_scalar != 1)
+                                {
+                                ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+                        /* we have already generated a wNAF for 'scalar' */
+                        }
+                else
+                        {
+                        signed char *tmp_wNAF = NULL;
+                        size_t tmp_len = 0;
+                        
+                        if (num_scalar != 0)
+                                {
+                                ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+
+                        /* use the window size for which we have precomputation */
+                        wsize[num] = pre_comp->w;
+                        tmp_wNAF = compute_wNAF(scalar, wsize[num], &tmp_len);
+                        if (!tmp_wNAF)
+                                goto err;
+
+                        if (tmp_len <= max_len)
+                                {
+                                /* One of the other wNAFs is at least as long
+                                 * as the wNAF belonging to the generator,
+                                 * so wNAF splitting will not buy us anything. */
+
+                                numblocks = 1;
+                                totalnum = num + 1; /* don't use wNAF splitting */
+                                wNAF[num] = tmp_wNAF;
+                                wNAF[num + 1] = NULL;
+                                wNAF_len[num] = tmp_len;
+                                if (tmp_len > max_len)
+                                        max_len = tmp_len;
+                                /* pre_comp->points starts with the points that we need here: */
+                                val_sub[num] = pre_comp->points;
+                                }
+                        else
+                                {
+                                /* don't include tmp_wNAF directly into wNAF array
+                                 * - use wNAF splitting and include the blocks */
+
+                                signed char *pp;
+                                EC_POINT **tmp_points;
+                                
+                                if (tmp_len < numblocks * blocksize)
+                                        {
+                                        /* possibly we can do with fewer blocks than estimated */
+                                        numblocks = (tmp_len + blocksize - 1) / blocksize;
+                                        if (numblocks > pre_comp->numblocks)
+                                                {
+                                                ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);
+                                                goto err;
+                                                }
+                                        totalnum = num + numblocks;
+                                        }
+                                
+                                /* split wNAF in 'numblocks' parts */
+                                pp = tmp_wNAF;
+                                tmp_points = pre_comp->points;
+
+                                for (i = num; i < totalnum; i++)
+                                        {
+                                        if (i < totalnum - 1)
+                                                {
+                                                wNAF_len[i] = blocksize;
+                                                if (tmp_len < blocksize)
+                                                        {
+                                                        ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);
+                                                        goto err;
+                                                        }
+                                                tmp_len -= blocksize;
+                                                }
+                                        else
+                                                /* last block gets whatever is left
+                                                 * (this could be more or less than 'blocksize'!) */
+                                                wNAF_len[i] = tmp_len;
+                                        
+                                        wNAF[i + 1] = NULL;
+                                        wNAF[i] = OPENSSL_malloc(wNAF_len[i]);
+                                        if (wNAF[i] == NULL)
+                                                {
+                                                ECerr(EC_F_EC_WNAF_MUL, ERR_R_MALLOC_FAILURE);
+                                                OPENSSL_free(tmp_wNAF);
+                                                goto err;
+                                                }
+                                        memcpy(wNAF[i], pp, wNAF_len[i]);
+                                        if (wNAF_len[i] > max_len)
+                                                max_len = wNAF_len[i];
+
+                                        if (*tmp_points == NULL)
+                                                {
+                                                ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);
+                                                OPENSSL_free(tmp_wNAF);
+                                                goto err;
+                                                }
+                                        val_sub[i] = tmp_points;
+                                        tmp_points += pre_points_per_block;
+                                        pp += blocksize;
+                                        }
+                                OPENSSL_free(tmp_wNAF);
+                                }
+                        }
                 }
 
-        /* all precomputed points go into a single array 'val',
-         * 'val_sub[i]' is a pointer to the subarray for the i-th point */
+        /* All points we precompute now go into a single array 'val'.
+         * 'val_sub[i]' is a pointer to the subarray for the i-th point,
+         * or to a subarray of 'pre_comp->points' if we already have precomputation. */
         val = OPENSSL_malloc((num_val + 1) * sizeof val[0]);
-        if (val == NULL) goto err;
+        if (val == NULL)
+                {
+                ECerr(EC_F_EC_WNAF_MUL, ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
         val[num_val] = NULL; /* pivot element */
 
-        val_sub = OPENSSL_malloc(totalnum * sizeof val_sub[0]);
-        if (val_sub == NULL) goto err;
-
         /* allocate points for precomputation */
         v = val;
-        for (i = 0; i < totalnum; i++)
+        for (i = 0; i < num + num_scalar; i++)
                 {
                 val_sub[i] = v;
                 for (j = 0; j < (1u << (wsize[i] - 1)); j++)
@@ -285,19 +609,12 @@ int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
                 }
         if (!(v == val + num_val))
                 {
-                ECerr(EC_F_EC_POINTS_MUL, ERR_R_INTERNAL_ERROR);
+                ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);
                 goto err;
                 }
 
-        if (ctx == NULL)
-                {
-                ctx = new_ctx = BN_CTX_new();
-                if (ctx == NULL)
-                        goto err;
-                }
-        
-        tmp = EC_POINT_new(group);
-        if (tmp == NULL) goto err;
+        if (!(tmp = EC_POINT_new(group)))
+                goto err;
 
         /* prepare precomputed values:
          *    val_sub[i][0] :=     points[i]
@@ -305,7 +622,7 @@ int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
          *    val_sub[i][2] := 5 * points[i]
          *    ...
          */
-        for (i = 0; i < totalnum; i++)
+        for (i = 0; i < num + num_scalar; i++)
                 {
                 if (i < num)
                         {
@@ -324,16 +641,11 @@ int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
                                 if (!EC_POINT_add(group, val_sub[i][j], val_sub[i][j - 1], tmp, ctx)) goto err;
                                 }
                         }
-
-                wNAF[i + 1] = NULL; /* make sure we always have a pivot */
-                wNAF[i] = compute_wNAF((i < num ? scalars[i] : scalar), wsize[i], &wNAF_len[i], ctx);
-                if (wNAF[i] == NULL) goto err;
-                if (wNAF_len[i] > max_len)
-                        max_len = wNAF_len[i];
                 }
 
 #if 1 /* optional; EC_window_bits_for_scalar_size assumes we do this step */
-        if (!EC_POINTs_make_affine(group, num_val, val, ctx)) goto err;
+        if (!EC_POINTs_make_affine(group, num_val, val, ctx))
+                goto err;
 #endif
 
         r_is_at_infinity = 1;
@@ -429,57 +741,198 @@ int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
         }
 
 
-int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar, const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
-        {
-        const EC_POINT *points[1];
-        const BIGNUM *scalars[1];
-
-        points[0] = point;
-        scalars[0] = p_scalar;
-
-        return EC_POINTs_mul(group, r, g_scalar, (point != NULL && p_scalar != NULL), points, scalars, ctx);
-        }
-
-
-int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
+/* ec_wNAF_precompute_mult()
+ * creates an EC_PRE_COMP object with preprecomputed multiples of the generator
+ * for use with wNAF splitting as implemented in ec_wNAF_mul().
+ * 
+ * 'pre_comp->points' is an array of multiples of the generator
+ * of the following form:
+ * points[0] =     generator;
+ * points[1] = 3 * generator;
+ * ...
+ * points[2^(w-1)-1] =     (2^(w-1)-1) * generator;
+ * points[2^(w-1)]   =     2^blocksize * generator;
+ * points[2^(w-1)+1] = 3 * 2^blocksize * generator;
+ * ...
+ * points[2^(w-1)*(numblocks-1)-1] = (2^(w-1)) *  2^(blocksize*(numblocks-2)) * generator
+ * points[2^(w-1)*(numblocks-1)]   =              2^(blocksize*(numblocks-1)) * generator
+ * ...
+ * points[2^(w-1)*numblocks-1]     = (2^(w-1)) *  2^(blocksize*(numblocks-1)) * generator
+ * points[2^(w-1)*numblocks]       = NULL
+ */
+int ec_wNAF_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
         {
         const EC_POINT *generator;
+        EC_POINT *tmp_point = NULL, *base = NULL, **var;
         BN_CTX *new_ctx = NULL;
         BIGNUM *order;
+        size_t i, bits, w, pre_points_per_block, blocksize, numblocks, num;
+        EC_POINT **points = NULL;
+        EC_PRE_COMP *pre_comp;
         int ret = 0;
 
+        /* if there is an old EC_PRE_COMP object, throw it away */
+        EC_EX_DATA_free_data(&group->extra_data, ec_pre_comp_dup, ec_pre_comp_free, ec_pre_comp_clear_free);
+
+        if ((pre_comp = ec_pre_comp_new(group)) == NULL)
+                return 0;
+
         generator = EC_GROUP_get0_generator(group);
         if (generator == NULL)
                 {
-                ECerr(EC_F_EC_GROUP_PRECOMPUTE_MULT, EC_R_UNDEFINED_GENERATOR);
-                return 0;
+                ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, EC_R_UNDEFINED_GENERATOR);
+                goto err;
                 }
 
         if (ctx == NULL)
                 {
                 ctx = new_ctx = BN_CTX_new();
                 if (ctx == NULL)
-                        return 0;
+                        goto err;
                 }
         
         BN_CTX_start(ctx);
         order = BN_CTX_get(ctx);
         if (order == NULL) goto err;
         
-        if (!EC_GROUP_get_order(group, order, ctx)) return 0;
+        if (!EC_GROUP_get_order(group, order, ctx)) goto err;           
         if (BN_is_zero(order))
                 {
-                ECerr(EC_F_EC_GROUP_PRECOMPUTE_MULT, EC_R_UNKNOWN_ORDER);
+                ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, EC_R_UNKNOWN_ORDER);
                 goto err;
                 }
 
-        /* TODO */
+        bits = BN_num_bits(order);
+        /* The following parameters mean we precompute (approximately)
+         * one point per bit.
+         *
+         * TBD: The combination  8, 4  is perfect for 160 bits; for other
+         * bit lengths, other parameter combinations might provide better
+         * efficiency.
+         */
+        blocksize = 8;
+        w = 4;
+        if (EC_window_bits_for_scalar_size(bits) > w)
+                {
+                /* let's not make the window too small ... */
+                w = EC_window_bits_for_scalar_size(bits);
+                }
+
+        numblocks = (bits + blocksize - 1) / blocksize; /* max. number of blocks to use for wNAF splitting */
+        
+        pre_points_per_block = 1u << (w - 1);
+        num = pre_points_per_block * numblocks; /* number of points to compute and store */
 
-        ret = 1;
+        points = OPENSSL_malloc(sizeof (EC_POINT*)*(num + 1));
+        if (!points)
+                {
+                ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+
+        var = points;
+        var[num] = NULL; /* pivot */
+        for (i = 0; i < num; i++)
+                {
+                if ((var[i] = EC_POINT_new(group)) == NULL)
+                        {
+                        ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                }
+
+        if (!(tmp_point = EC_POINT_new(group)) || !(base = EC_POINT_new(group)))
+                {
+                ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, ERR_R_MALLOC_FAILURE);
+                goto err;
+                }       
+        
+        if (!EC_POINT_copy(base, generator))
+                goto err;
+        
+        /* do the precomputation */
+        for (i = 0; i < numblocks; i++)
+                {
+                size_t j;
+
+                if (!EC_POINT_dbl(group, tmp_point, base, ctx))
+                        goto err;
+
+                if (!EC_POINT_copy(*var++, base))
+                        goto err;
+
+                for (j = 1; j < pre_points_per_block; j++, var++)
+                        {
+                        /* calculate odd multiples of the current base point */
+                        if (!EC_POINT_add(group, *var, tmp_point, *(var - 1), ctx))
+                                goto err;
+                        }
+
+                if (i < numblocks - 1)
+                        {
+                        /* get the next base (multiply current one by 2^blocksize) */
+                        size_t k;
+
+                        if (blocksize <= 2)
+                                {
+                                ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }                               
+
+                        if (!EC_POINT_dbl(group, base, tmp_point, ctx))
+                                goto err;
+                        for (k = 2; k < blocksize; k++)
+                                {
+                                if (!EC_POINT_dbl(group,base,base,ctx))
+                                        goto err;
+                                }
+                        }
+                }
+
+        if (!EC_POINTs_make_affine(group, num, points, ctx))
+                goto err;
         
+        pre_comp->group = group;
+        pre_comp->blocksize = blocksize;
+        pre_comp->numblocks = numblocks;
+        pre_comp->w = w;
+        pre_comp->points = points;
+        points = NULL;
+        pre_comp->num = num;
+
+        if (!EC_EX_DATA_set_data(&group->extra_data, pre_comp,
+                ec_pre_comp_dup, ec_pre_comp_free, ec_pre_comp_clear_free))
+                goto err;
+        pre_comp = NULL;
+
+        ret = 1;
  err:
-        BN_CTX_end(ctx);
+        if (ctx != NULL)
+                BN_CTX_end(ctx);
         if (new_ctx != NULL)
                 BN_CTX_free(new_ctx);
+        if (pre_comp)
+                ec_pre_comp_free(pre_comp);
+        if (points)
+                {
+                EC_POINT **p;
+
+                for (p = points; *p != NULL; p++)
+                        EC_POINT_free(*p);
+                OPENSSL_free(points);
+                }
+        if (tmp_point)
+                EC_POINT_free(tmp_point);
+        if (base)
+                EC_POINT_free(base);
         return ret;
         }
+
+
+int ec_wNAF_have_precompute_mult(const EC_GROUP *group)
+        {
+        if (EC_EX_DATA_get_data(group->extra_data, ec_pre_comp_dup, ec_pre_comp_free, ec_pre_comp_clear_free) != NULL)
+                return 1;
+        else
+                return 0;
+        }
diff --git a/src/lib/libssl/src/crypto/ec/ecp_mont.c b/src/lib/libssl/src/crypto/ec/ecp_mont.c
index 7b30d4c38a..9fc4a466a5 100644
--- a/src/lib/libssl/src/crypto/ec/ecp_mont.c
+++ b/src/lib/libssl/src/crypto/ec/ecp_mont.c
@@ -1,4 +1,7 @@
 /* crypto/ec/ecp_mont.c */
+/*
+ * Originally written by Bodo Moeller for the OpenSSL project.
+ */
 /* ====================================================================
  * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
  *
@@ -52,6 +55,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * Portions of this software developed by SUN MICROSYSTEMS, INC.,
+ * and contributed to the OpenSSL project.
+ */
 
 #include <openssl/err.h>
 
@@ -61,16 +69,15 @@
 const EC_METHOD *EC_GFp_mont_method(void)
         {
         static const EC_METHOD ret = {
+                NID_X9_62_prime_field,
                 ec_GFp_mont_group_init,
                 ec_GFp_mont_group_finish,
                 ec_GFp_mont_group_clear_finish,
                 ec_GFp_mont_group_copy,
-                ec_GFp_mont_group_set_curve_GFp,
-                ec_GFp_simple_group_get_curve_GFp,
-                ec_GFp_simple_group_set_generator,
-                ec_GFp_simple_group_get0_generator,
-                ec_GFp_simple_group_get_order,
-                ec_GFp_simple_group_get_cofactor,
+                ec_GFp_mont_group_set_curve,
+                ec_GFp_simple_group_get_curve,
+                ec_GFp_simple_group_get_degree,
+                ec_GFp_simple_group_check_discriminant,
                 ec_GFp_simple_point_init,
                 ec_GFp_simple_point_finish,
                 ec_GFp_simple_point_clear_finish,
@@ -78,9 +85,9 @@ const EC_METHOD *EC_GFp_mont_method(void)
                 ec_GFp_simple_point_set_to_infinity,
                 ec_GFp_simple_set_Jprojective_coordinates_GFp,
                 ec_GFp_simple_get_Jprojective_coordinates_GFp,
-                ec_GFp_simple_point_set_affine_coordinates_GFp,
-                ec_GFp_simple_point_get_affine_coordinates_GFp,
-                ec_GFp_simple_set_compressed_coordinates_GFp,
+                ec_GFp_simple_point_set_affine_coordinates,
+                ec_GFp_simple_point_get_affine_coordinates,
+                ec_GFp_simple_set_compressed_coordinates,
                 ec_GFp_simple_point2oct,
                 ec_GFp_simple_oct2point,
                 ec_GFp_simple_add,
@@ -91,8 +98,12 @@ const EC_METHOD *EC_GFp_mont_method(void)
                 ec_GFp_simple_cmp,
                 ec_GFp_simple_make_affine,
                 ec_GFp_simple_points_make_affine,
+                0 /* mul */,
+                0 /* precompute_mult */,
+                0 /* have_precompute_mult */,   
                 ec_GFp_mont_field_mul,
                 ec_GFp_mont_field_sqr,
+                0 /* field_div */,
                 ec_GFp_mont_field_encode,
                 ec_GFp_mont_field_decode,
                 ec_GFp_mont_field_set_to_one };
@@ -112,66 +123,6 @@ int ec_GFp_mont_group_init(EC_GROUP *group)
         }
 
 
-int ec_GFp_mont_group_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
-        {
-        BN_CTX *new_ctx = NULL;
-        BN_MONT_CTX *mont = NULL;
-        BIGNUM *one = NULL;
-        int ret = 0;
-
-        if (group->field_data1 != NULL)
-                {
-                BN_MONT_CTX_free(group->field_data1);
-                group->field_data1 = NULL;
-                }
-        if (group->field_data2 != NULL)
-                {
-                BN_free(group->field_data2);
-                group->field_data2 = NULL;
-                }
-        
-        if (ctx == NULL)
-                {
-                ctx = new_ctx = BN_CTX_new();
-                if (ctx == NULL)
-                        return 0;
-                }
-
-        mont = BN_MONT_CTX_new();
-        if (mont == NULL) goto err;
-        if (!BN_MONT_CTX_set(mont, p, ctx))
-                {
-                ECerr(EC_F_GFP_MONT_GROUP_SET_CURVE_GFP, ERR_R_BN_LIB);
-                goto err;
-                }
-        one = BN_new();
-        if (one == NULL) goto err;
-        if (!BN_to_montgomery(one, BN_value_one(), mont, ctx)) goto err;
-
-        group->field_data1 = mont;
-        mont = NULL;
-        group->field_data2 = one;
-        one = NULL;
-
-        ret = ec_GFp_simple_group_set_curve_GFp(group, p, a, b, ctx);
-
-        if (!ret)
-                {
-                BN_MONT_CTX_free(group->field_data1);
-                group->field_data1 = NULL;
-                BN_free(group->field_data2);
-                group->field_data2 = NULL;
-                }
-
- err:
-        if (new_ctx != NULL)
-                BN_CTX_free(new_ctx);
-        if (mont != NULL)
-                BN_MONT_CTX_free(mont);
-        return ret;
-        }
-
-
 void ec_GFp_mont_group_finish(EC_GROUP *group)
         {
         if (group->field_data1 != NULL)
@@ -243,6 +194,66 @@ int ec_GFp_mont_group_copy(EC_GROUP *dest, const EC_GROUP *src)
         }
 
 
+int ec_GFp_mont_group_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
+        {
+        BN_CTX *new_ctx = NULL;
+        BN_MONT_CTX *mont = NULL;
+        BIGNUM *one = NULL;
+        int ret = 0;
+
+        if (group->field_data1 != NULL)
+                {
+                BN_MONT_CTX_free(group->field_data1);
+                group->field_data1 = NULL;
+                }
+        if (group->field_data2 != NULL)
+                {
+                BN_free(group->field_data2);
+                group->field_data2 = NULL;
+                }
+        
+        if (ctx == NULL)
+                {
+                ctx = new_ctx = BN_CTX_new();
+                if (ctx == NULL)
+                        return 0;
+                }
+
+        mont = BN_MONT_CTX_new();
+        if (mont == NULL) goto err;
+        if (!BN_MONT_CTX_set(mont, p, ctx))
+                {
+                ECerr(EC_F_EC_GFP_MONT_GROUP_SET_CURVE, ERR_R_BN_LIB);
+                goto err;
+                }
+        one = BN_new();
+        if (one == NULL) goto err;
+        if (!BN_to_montgomery(one, BN_value_one(), mont, ctx)) goto err;
+
+        group->field_data1 = mont;
+        mont = NULL;
+        group->field_data2 = one;
+        one = NULL;
+
+        ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
+
+        if (!ret)
+                {
+                BN_MONT_CTX_free(group->field_data1);
+                group->field_data1 = NULL;
+                BN_free(group->field_data2);
+                group->field_data2 = NULL;
+                }
+
+ err:
+        if (new_ctx != NULL)
+                BN_CTX_free(new_ctx);
+        if (mont != NULL)
+                BN_MONT_CTX_free(mont);
+        return ret;
+        }
+
+
 int ec_GFp_mont_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
         {
         if (group->field_data1 == NULL)
@@ -295,7 +306,7 @@ int ec_GFp_mont_field_set_to_one(const EC_GROUP *group, BIGNUM *r, BN_CTX *ctx)
         {
         if (group->field_data2 == NULL)
                 {
-                ECerr(EC_F_EC_GFP_MONT_FIELD_DECODE, EC_R_NOT_INITIALIZED);
+                ECerr(EC_F_EC_GFP_MONT_FIELD_SET_TO_ONE, EC_R_NOT_INITIALIZED);
                 return 0;
                 }
 
diff --git a/src/lib/libssl/src/crypto/ec/ecp_nist.c b/src/lib/libssl/src/crypto/ec/ecp_nist.c
index ed07748675..71893d5eab 100644
--- a/src/lib/libssl/src/crypto/ec/ecp_nist.c
+++ b/src/lib/libssl/src/crypto/ec/ecp_nist.c
@@ -1,6 +1,9 @@
 /* crypto/ec/ecp_nist.c */
+/*
+ * Written by Nils Larsch for the OpenSSL project.
+ */
 /* ====================================================================
- * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,23 +55,30 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * Portions of this software developed by SUN MICROSYSTEMS, INC.,
+ * and contributed to the OpenSSL project.
+ */
 
+#include <limits.h>
+
+#include <openssl/err.h>
+#include <openssl/obj_mac.h>
 #include "ec_lcl.h"
 
-#if 0
 const EC_METHOD *EC_GFp_nist_method(void)
         {
         static const EC_METHOD ret = {
-                ec_GFp_nist_group_init,
-                ec_GFp_nist_group_finish,
-                ec_GFp_nist_group_clear_finish,
+                NID_X9_62_prime_field,
+                ec_GFp_simple_group_init,
+                ec_GFp_simple_group_finish,
+                ec_GFp_simple_group_clear_finish,
                 ec_GFp_nist_group_copy,
-                ec_GFp_nist_group_set_curve_GFp,
-                ec_GFp_simple_group_get_curve_GFp,
-                ec_GFp_simple_group_set_generator,
-                ec_GFp_simple_group_get0_generator,
-                ec_GFp_simple_group_get_order,
-                ec_GFp_simple_group_get_cofactor,
+                ec_GFp_nist_group_set_curve,
+                ec_GFp_simple_group_get_curve,
+                ec_GFp_simple_group_get_degree,
+                ec_GFp_simple_group_check_discriminant,
                 ec_GFp_simple_point_init,
                 ec_GFp_simple_point_finish,
                 ec_GFp_simple_point_clear_finish,
@@ -76,9 +86,9 @@ const EC_METHOD *EC_GFp_nist_method(void)
                 ec_GFp_simple_point_set_to_infinity,
                 ec_GFp_simple_set_Jprojective_coordinates_GFp,
                 ec_GFp_simple_get_Jprojective_coordinates_GFp,
-                ec_GFp_simple_point_set_affine_coordinates_GFp,
-                ec_GFp_simple_point_get_affine_coordinates_GFp,
-                ec_GFp_simple_set_compressed_coordinates_GFp,
+                ec_GFp_simple_point_set_affine_coordinates,
+                ec_GFp_simple_point_get_affine_coordinates,
+                ec_GFp_simple_set_compressed_coordinates,
                 ec_GFp_simple_point2oct,
                 ec_GFp_simple_oct2point,
                 ec_GFp_simple_add,
@@ -89,46 +99,138 @@ const EC_METHOD *EC_GFp_nist_method(void)
                 ec_GFp_simple_cmp,
                 ec_GFp_simple_make_affine,
                 ec_GFp_simple_points_make_affine,
+                0 /* mul */,
+                0 /* precompute_mult */,
+                0 /* have_precompute_mult */,   
                 ec_GFp_nist_field_mul,
                 ec_GFp_nist_field_sqr,
+                0 /* field_div */,
                 0 /* field_encode */,
                 0 /* field_decode */,
                 0 /* field_set_to_one */ };
 
         return &ret;
         }
-#endif
 
+#if BN_BITS2 == 64
+#define NO_32_BIT_TYPE
+#endif
 
-int ec_GFp_nist_group_init(EC_GROUP *group)
+int ec_GFp_nist_group_copy(EC_GROUP *dest, const EC_GROUP *src)
         {
-        int ok;
+        dest->field_mod_func = src->field_mod_func;
 
-        ok = ec_GFp_simple_group_init(group);
-        group->field_data1 = NULL;
-        return ok;
+        return ec_GFp_simple_group_copy(dest, src);
         }
 
-
-int ec_GFp_nist_group_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx);
-/* TODO */
-
-
-void ec_GFp_nist_group_finish(EC_GROUP *group);
-/* TODO */
-
-
-void ec_GFp_nist_group_clear_finish(EC_GROUP *group);
-/* TODO */
-
-
-int ec_GFp_nist_group_copy(EC_GROUP *dest, const EC_GROUP *src);
-/* TODO */
+int ec_GFp_nist_group_set_curve(EC_GROUP *group, const BIGNUM *p,
+        const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
+        {
+        int ret = 0;
+        BN_CTX *new_ctx = NULL;
+        BIGNUM *tmp_bn;
+        
+        if (ctx == NULL)
+                if ((ctx = new_ctx = BN_CTX_new()) == NULL) return 0;
+
+        BN_CTX_start(ctx);
+        if ((tmp_bn = BN_CTX_get(ctx)) == NULL) goto err;
+
+        if (BN_ucmp(BN_get0_nist_prime_192(), p) == 0)
+                group->field_mod_func = BN_nist_mod_192;
+        else if (BN_ucmp(BN_get0_nist_prime_224(), p) == 0)
+                {
+#ifndef NO_32_BIT_TYPE
+                group->field_mod_func = BN_nist_mod_224;
+#else
+                ECerr(EC_F_EC_GFP_NIST_GROUP_SET_CURVE, EC_R_NOT_A_SUPPORTED_NIST_PRIME);
+                goto err;
+#endif
+                }
+        else if (BN_ucmp(BN_get0_nist_prime_256(), p) == 0)
+                {
+#ifndef NO_32_BIT_TYPE
+                group->field_mod_func = BN_nist_mod_256;
+#else
+                ECerr(EC_F_EC_GFP_NIST_GROUP_SET_CURVE, EC_R_NOT_A_SUPPORTED_NIST_PRIME);
+                goto err;
+#endif
+                }
+        else if (BN_ucmp(BN_get0_nist_prime_384(), p) == 0)
+                {
+#ifndef NO_32_BIT_TYPE
+                group->field_mod_func = BN_nist_mod_384;
+#else
+                ECerr(EC_F_EC_GFP_NIST_GROUP_SET_CURVE, EC_R_NOT_A_SUPPORTED_NIST_PRIME);
+                goto err;
+#endif
+                }
+        else if (BN_ucmp(BN_get0_nist_prime_521(), p) == 0)
+                /* this one works in the NO_32_BIT_TYPE case */
+                group->field_mod_func = BN_nist_mod_521;
+        else
+                {
+                ECerr(EC_F_EC_GFP_NIST_GROUP_SET_CURVE, EC_R_NOT_A_NIST_PRIME);
+                goto err;
+                }
+
+        ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
+
+ err:
+        BN_CTX_end(ctx);
+        if (new_ctx != NULL)
+                BN_CTX_free(new_ctx);
+        return ret;
+        }
 
 
-int ec_GFp_nist_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx);
-/* TODO */
+int ec_GFp_nist_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
+        const BIGNUM *b, BN_CTX *ctx)
+        {
+        int     ret=0;
+        BN_CTX  *ctx_new=NULL;
+
+        if (!group || !r || !a || !b)
+                {
+                ECerr(EC_F_EC_GFP_NIST_FIELD_MUL, ERR_R_PASSED_NULL_PARAMETER);
+                goto err;
+                }
+        if (!ctx)
+                if ((ctx_new = ctx = BN_CTX_new()) == NULL) goto err;
+
+        if (!BN_mul(r, a, b, ctx)) goto err;
+        if (!group->field_mod_func(r, r, &group->field, ctx))
+                goto err;
+
+        ret=1;
+err:
+        if (ctx_new)
+                BN_CTX_free(ctx_new);
+        return ret;
+        }
 
 
-int ec_GFp_nist_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, BN_CTX *ctx);
-/* TODO */
+int ec_GFp_nist_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
+        BN_CTX *ctx)
+        {
+        int     ret=0;
+        BN_CTX  *ctx_new=NULL;
+
+        if (!group || !r || !a)
+                {
+                ECerr(EC_F_EC_GFP_NIST_FIELD_SQR, EC_R_PASSED_NULL_PARAMETER);
+                goto err;
+                }
+        if (!ctx)
+                if ((ctx_new = ctx = BN_CTX_new()) == NULL) goto err;
+
+        if (!BN_sqr(r, a, ctx)) goto err;
+        if (!group->field_mod_func(r, r, &group->field, ctx))
+                goto err;
+
+        ret=1;
+err:
+        if (ctx_new)
+                BN_CTX_free(ctx_new);
+        return ret;
+        }
diff --git a/src/lib/libssl/src/crypto/ec/ecp_smpl.c b/src/lib/libssl/src/crypto/ec/ecp_smpl.c
index e9a51fb87a..4d26f8bdf6 100644
--- a/src/lib/libssl/src/crypto/ec/ecp_smpl.c
+++ b/src/lib/libssl/src/crypto/ec/ecp_smpl.c
@@ -1,8 +1,10 @@
 /* crypto/ec/ecp_smpl.c */
 /* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
- * for the OpenSSL project. */
+ * for the OpenSSL project. 
+ * Includes code written by Bodo Moeller for the OpenSSL project.
+*/
 /* ====================================================================
- * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -54,25 +56,29 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * Portions of this software developed by SUN MICROSYSTEMS, INC.,
+ * and contributed to the OpenSSL project.
+ */
 
 #include <openssl/err.h>
+#include <openssl/symhacks.h>
 
 #include "ec_lcl.h"
 
-
 const EC_METHOD *EC_GFp_simple_method(void)
         {
         static const EC_METHOD ret = {
+                NID_X9_62_prime_field,
                 ec_GFp_simple_group_init,
                 ec_GFp_simple_group_finish,
                 ec_GFp_simple_group_clear_finish,
                 ec_GFp_simple_group_copy,
-                ec_GFp_simple_group_set_curve_GFp,
-                ec_GFp_simple_group_get_curve_GFp,
-                ec_GFp_simple_group_set_generator,
-                ec_GFp_simple_group_get0_generator,
-                ec_GFp_simple_group_get_order,
-                ec_GFp_simple_group_get_cofactor,
+                ec_GFp_simple_group_set_curve,
+                ec_GFp_simple_group_get_curve,
+                ec_GFp_simple_group_get_degree,
+                ec_GFp_simple_group_check_discriminant,
                 ec_GFp_simple_point_init,
                 ec_GFp_simple_point_finish,
                 ec_GFp_simple_point_clear_finish,
@@ -80,9 +86,9 @@ const EC_METHOD *EC_GFp_simple_method(void)
                 ec_GFp_simple_point_set_to_infinity,
                 ec_GFp_simple_set_Jprojective_coordinates_GFp,
                 ec_GFp_simple_get_Jprojective_coordinates_GFp,
-                ec_GFp_simple_point_set_affine_coordinates_GFp,
-                ec_GFp_simple_point_get_affine_coordinates_GFp,
-                ec_GFp_simple_set_compressed_coordinates_GFp,
+                ec_GFp_simple_point_set_affine_coordinates,
+                ec_GFp_simple_point_get_affine_coordinates,
+                ec_GFp_simple_set_compressed_coordinates,
                 ec_GFp_simple_point2oct,
                 ec_GFp_simple_oct2point,
                 ec_GFp_simple_add,
@@ -93,8 +99,12 @@ const EC_METHOD *EC_GFp_simple_method(void)
                 ec_GFp_simple_cmp,
                 ec_GFp_simple_make_affine,
                 ec_GFp_simple_points_make_affine,
+                0 /* mul */,
+                0 /* precompute_mult */,
+                0 /* have_precompute_mult */,   
                 ec_GFp_simple_field_mul,
                 ec_GFp_simple_field_sqr,
+                0 /* field_div */,
                 0 /* field_encode */,
                 0 /* field_decode */,
                 0 /* field_set_to_one */ };
@@ -103,15 +113,26 @@ const EC_METHOD *EC_GFp_simple_method(void)
         }
 
 
+/* Most method functions in this file are designed to work with
+ * non-trivial representations of field elements if necessary
+ * (see ecp_mont.c): while standard modular addition and subtraction
+ * are used, the field_mul and field_sqr methods will be used for
+ * multiplication, and field_encode and field_decode (if defined)
+ * will be used for converting between representations.
+
+ * Functions ec_GFp_simple_points_make_affine() and
+ * ec_GFp_simple_point_get_affine_coordinates() specifically assume
+ * that if a non-trivial representation is used, it is a Montgomery
+ * representation (i.e. 'encoding' means multiplying by some factor R).
+ */
+
+
 int ec_GFp_simple_group_init(EC_GROUP *group)
         {
         BN_init(&group->field);
         BN_init(&group->a);
         BN_init(&group->b);
         group->a_is_minus3 = 0;
-        group->generator = NULL;
-        BN_init(&group->order);
-        BN_init(&group->cofactor);
         return 1;
         }
 
@@ -121,10 +142,6 @@ void ec_GFp_simple_group_finish(EC_GROUP *group)
         BN_free(&group->field);
         BN_free(&group->a);
         BN_free(&group->b);
-        if (group->generator != NULL)
-                EC_POINT_free(group->generator);
-        BN_free(&group->order);
-        BN_free(&group->cofactor);
         }
 
 
@@ -133,13 +150,6 @@ void ec_GFp_simple_group_clear_finish(EC_GROUP *group)
         BN_clear_free(&group->field);
         BN_clear_free(&group->a);
         BN_clear_free(&group->b);
-        if (group->generator != NULL)
-                {
-                EC_POINT_clear_free(group->generator);
-                group->generator = NULL;
-                }
-        BN_clear_free(&group->order);
-        BN_clear_free(&group->cofactor);
         }
 
 
@@ -151,33 +161,11 @@ int ec_GFp_simple_group_copy(EC_GROUP *dest, const EC_GROUP *src)
 
         dest->a_is_minus3 = src->a_is_minus3;
 
-        if (src->generator != NULL)
-                {
-                if (dest->generator == NULL)
-                        {
-                        dest->generator = EC_POINT_new(dest);
-                        if (dest->generator == NULL) return 0;
-                        }
-                if (!EC_POINT_copy(dest->generator, src->generator)) return 0;
-                }
-        else
-                {
-                /* src->generator == NULL */
-                if (dest->generator != NULL)
-                        {
-                        EC_POINT_clear_free(dest->generator);
-                        dest->generator = NULL;
-                        }
-                }
-
-        if (!BN_copy(&dest->order, &src->order)) return 0;
-        if (!BN_copy(&dest->cofactor, &src->cofactor)) return 0;
-
         return 1;
         }
 
 
-int ec_GFp_simple_group_set_curve_GFp(EC_GROUP *group,
+int ec_GFp_simple_group_set_curve(EC_GROUP *group,
         const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
         {
         int ret = 0;
@@ -187,7 +175,7 @@ int ec_GFp_simple_group_set_curve_GFp(EC_GROUP *group,
         /* p must be a prime > 3 */
         if (BN_num_bits(p) <= 2 || !BN_is_odd(p))
                 {
-                ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE_GFP, EC_R_INVALID_FIELD);
+                ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_INVALID_FIELD);
                 return 0;
                 }
 
@@ -204,7 +192,7 @@ int ec_GFp_simple_group_set_curve_GFp(EC_GROUP *group,
 
         /* group->field */
         if (!BN_copy(&group->field, p)) goto err;
-        group->field.neg = 0;
+        BN_set_negative(&group->field, 0);
 
         /* group->a */
         if (!BN_nnmod(tmp_a, a, p, ctx)) goto err;
@@ -232,7 +220,7 @@ int ec_GFp_simple_group_set_curve_GFp(EC_GROUP *group,
         }
 
 
-int ec_GFp_simple_group_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
+int ec_GFp_simple_group_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
         {
         int ret = 0;
         BN_CTX *new_ctx = NULL;
@@ -283,58 +271,76 @@ int ec_GFp_simple_group_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *
         }
 
 
+int ec_GFp_simple_group_get_degree(const EC_GROUP *group)
+        {
+        return BN_num_bits(&group->field);
+        }
+
 
-int ec_GFp_simple_group_set_generator(EC_GROUP *group, const EC_POINT *generator,
-        const BIGNUM *order, const BIGNUM *cofactor)
+int ec_GFp_simple_group_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
         {
-        if (generator == NULL)
+        int ret = 0;
+        BIGNUM *a,*b,*order,*tmp_1,*tmp_2;
+        const BIGNUM *p = &group->field;
+        BN_CTX *new_ctx = NULL;
+
+        if (ctx == NULL)
                 {
-                ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_GENERATOR, ERR_R_PASSED_NULL_PARAMETER);
-                return 0   ;
+                ctx = new_ctx = BN_CTX_new();
+                if (ctx == NULL)
+                        {
+                        ECerr(EC_F_EC_GFP_SIMPLE_GROUP_CHECK_DISCRIMINANT, ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
                 }
+        BN_CTX_start(ctx);
+        a = BN_CTX_get(ctx);
+        b = BN_CTX_get(ctx);
+        tmp_1 = BN_CTX_get(ctx);
+        tmp_2 = BN_CTX_get(ctx);
+        order = BN_CTX_get(ctx);
+        if (order == NULL) goto err;
 
-        if (group->generator == NULL)
+        if (group->meth->field_decode)
                 {
-                group->generator = EC_POINT_new(group);
-                if (group->generator == NULL) return 0;
+                if (!group->meth->field_decode(group, a, &group->a, ctx)) goto err;
+                if (!group->meth->field_decode(group, b, &group->b, ctx)) goto err;
                 }
-        if (!EC_POINT_copy(group->generator, generator)) return 0;
-
-        if (order != NULL)
-                { if (!BN_copy(&group->order, order)) return 0; }       
-        else
-                { if (!BN_zero(&group->order)) return 0; }      
-
-        if (cofactor != NULL)
-                { if (!BN_copy(&group->cofactor, cofactor)) return 0; } 
         else
-                { if (!BN_zero(&group->cofactor)) return 0; }   
-
-        return 1;
-        }
-
-
-EC_POINT *ec_GFp_simple_group_get0_generator(const EC_GROUP *group)
-        {
-        return group->generator;
-        }
-
-
-int ec_GFp_simple_group_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx)
-        {
-        if (!BN_copy(order, &group->order))
-                return 0;
-
-        return !BN_is_zero(&group->order);
-        }
+                {
+                if (!BN_copy(a, &group->a)) goto err;
+                if (!BN_copy(b, &group->b)) goto err;
+                }
+        
+        /* check the discriminant:
+         * y^2 = x^3 + a*x + b is an elliptic curve <=> 4*a^3 + 27*b^2 != 0 (mod p) 
+         * 0 =< a, b < p */
+        if (BN_is_zero(a))
+                {
+                if (BN_is_zero(b)) goto err;
+                }
+        else if (!BN_is_zero(b))
+                {
+                if (!BN_mod_sqr(tmp_1, a, p, ctx)) goto err;
+                if (!BN_mod_mul(tmp_2, tmp_1, a, p, ctx)) goto err;
+                if (!BN_lshift(tmp_1, tmp_2, 2)) goto err;
+                /* tmp_1 = 4*a^3 */
 
+                if (!BN_mod_sqr(tmp_2, b, p, ctx)) goto err;
+                if (!BN_mul_word(tmp_2, 27)) goto err;
+                /* tmp_2 = 27*b^2 */
 
-int ec_GFp_simple_group_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor, BN_CTX *ctx)
-        {
-        if (!BN_copy(cofactor, &group->cofactor))
-                return 0;
+                if (!BN_mod_add(a, tmp_1, tmp_2, p, ctx)) goto err;
+                if (BN_is_zero(a)) goto err;
+                }
+        ret = 1;
 
-        return !BN_is_zero(&group->cofactor);
+err:
+        if (ctx != NULL)
+                BN_CTX_end(ctx);
+        if (new_ctx != NULL)
+                BN_CTX_free(new_ctx);
+        return ret;
         }
 
 
@@ -380,7 +386,8 @@ int ec_GFp_simple_point_copy(EC_POINT *dest, const EC_POINT *src)
 int ec_GFp_simple_point_set_to_infinity(const EC_GROUP *group, EC_POINT *point)
         {
         point->Z_is_one = 0;
-        return (BN_zero(&point->Z));
+        BN_zero(&point->Z);
+        return 1;
         }
 
 
@@ -497,13 +504,13 @@ int ec_GFp_simple_get_Jprojective_coordinates_GFp(const EC_GROUP *group, const E
         }
 
 
-int ec_GFp_simple_point_set_affine_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
+int ec_GFp_simple_point_set_affine_coordinates(const EC_GROUP *group, EC_POINT *point,
         const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx)
         {
         if (x == NULL || y == NULL)
                 {
                 /* unlike for projective coordinates, we do not tolerate this */
-                ECerr(EC_F_EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES_GFP, ERR_R_PASSED_NULL_PARAMETER);
+                ECerr(EC_F_EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES, ERR_R_PASSED_NULL_PARAMETER);
                 return 0;
                 }
 
@@ -511,17 +518,17 @@ int ec_GFp_simple_point_set_affine_coordinates_GFp(const EC_GROUP *group, EC_POI
         }
 
 
-int ec_GFp_simple_point_get_affine_coordinates_GFp(const EC_GROUP *group, const EC_POINT *point,
+int ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *point,
         BIGNUM *x, BIGNUM *y, BN_CTX *ctx)
         {
         BN_CTX *new_ctx = NULL;
-        BIGNUM *X, *Y, *Z, *Z_1, *Z_2, *Z_3;
-        const BIGNUM *X_, *Y_, *Z_;
+        BIGNUM *Z, *Z_1, *Z_2, *Z_3;
+        const BIGNUM *Z_;
         int ret = 0;
 
         if (EC_POINT_is_at_infinity(group, point))
                 {
-                ECerr(EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES_GFP, EC_R_POINT_AT_INFINITY);
+                ECerr(EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES, EC_R_POINT_AT_INFINITY);
                 return 0;
                 }
 
@@ -533,8 +540,6 @@ int ec_GFp_simple_point_get_affine_coordinates_GFp(const EC_GROUP *group, const
                 }
 
         BN_CTX_start(ctx);
-        X = BN_CTX_get(ctx);
-        Y = BN_CTX_get(ctx);
         Z = BN_CTX_get(ctx);
         Z_1 = BN_CTX_get(ctx);
         Z_2 = BN_CTX_get(ctx);
@@ -545,34 +550,44 @@ int ec_GFp_simple_point_get_affine_coordinates_GFp(const EC_GROUP *group, const
         
         if (group->meth->field_decode)
                 {
-                if (!group->meth->field_decode(group, X, &point->X, ctx)) goto err;
-                if (!group->meth->field_decode(group, Y, &point->Y, ctx)) goto err;
                 if (!group->meth->field_decode(group, Z, &point->Z, ctx)) goto err;
-                X_ = X; Y_ = Y; Z_ = Z;
+                Z_ = Z;
                 }
         else
                 {
-                X_ = &point->X;
-                Y_ = &point->Y;
                 Z_ = &point->Z;
                 }
         
         if (BN_is_one(Z_))
                 {
-                if (x != NULL)
+                if (group->meth->field_decode)
                         {
-                        if (!BN_copy(x, X_)) goto err;
+                        if (x != NULL)
+                                {
+                                if (!group->meth->field_decode(group, x, &point->X, ctx)) goto err;
+                                }
+                        if (y != NULL)
+                                {
+                                if (!group->meth->field_decode(group, y, &point->Y, ctx)) goto err;
+                                }
                         }
-                if (y != NULL)
+                else
                         {
-                        if (!BN_copy(y, Y_)) goto err;
+                        if (x != NULL)
+                                {
+                                if (!BN_copy(x, &point->X)) goto err;
+                                }
+                        if (y != NULL)
+                                {
+                                if (!BN_copy(y, &point->Y)) goto err;
+                                }
                         }
                 }
         else
                 {
                 if (!BN_mod_inverse(Z_1, Z_, &group->field, ctx))
                         {
-                        ECerr(EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES_GFP, ERR_R_BN_LIB);
+                        ECerr(EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES, ERR_R_BN_LIB);
                         goto err;
                         }
                 
@@ -588,15 +603,8 @@ int ec_GFp_simple_point_get_affine_coordinates_GFp(const EC_GROUP *group, const
         
                 if (x != NULL)
                         {
-                        if (group->meth->field_encode == 0)
-                                {
-                                /* field_mul works on standard representation */
-                                if (!group->meth->field_mul(group, x, X_, Z_2, ctx)) goto err;
-                                }
-                        else
-                                {
-                                if (!BN_mod_mul(x, X_, Z_2, &group->field, ctx)) goto err;
-                                }
+                        /* in the Montgomery case, field_mul will cancel out Montgomery factor in X: */
+                        if (!group->meth->field_mul(group, x, &point->X, Z_2, ctx)) goto err;
                         }
 
                 if (y != NULL)
@@ -605,14 +613,14 @@ int ec_GFp_simple_point_get_affine_coordinates_GFp(const EC_GROUP *group, const
                                 {
                                 /* field_mul works on standard representation */
                                 if (!group->meth->field_mul(group, Z_3, Z_2, Z_1, ctx)) goto err;
-                                if (!group->meth->field_mul(group, y, Y_, Z_3, ctx)) goto err;
-                                
                                 }
                         else
                                 {
                                 if (!BN_mod_mul(Z_3, Z_2, Z_1, &group->field, ctx)) goto err;
-                                if (!BN_mod_mul(y, Y_, Z_3, &group->field, ctx)) goto err;
                                 }
+
+                        /* in the Montgomery case, field_mul will cancel out Montgomery factor in Y: */
+                        if (!group->meth->field_mul(group, y, &point->Y, Z_3, ctx)) goto err;
                         }
                 }
 
@@ -626,13 +634,16 @@ int ec_GFp_simple_point_get_affine_coordinates_GFp(const EC_GROUP *group, const
         }
 
 
-int ec_GFp_simple_set_compressed_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
+int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
         const BIGNUM *x_, int y_bit, BN_CTX *ctx)
         {
         BN_CTX *new_ctx = NULL;
         BIGNUM *tmp1, *tmp2, *x, *y;
         int ret = 0;
 
+        /* clear error queue*/
+        ERR_clear_error();
+
         if (ctx == NULL)
                 {
                 ctx = new_ctx = BN_CTX_new();
@@ -704,19 +715,17 @@ int ec_GFp_simple_set_compressed_coordinates_GFp(const EC_GROUP *group, EC_POINT
         
         if (!BN_mod_sqrt(y, tmp1, &group->field, ctx))
                 {
-                unsigned long err = ERR_peek_error();
+                unsigned long err = ERR_peek_last_error();
                 
                 if (ERR_GET_LIB(err) == ERR_LIB_BN && ERR_GET_REASON(err) == BN_R_NOT_A_SQUARE)
                         {
-                        (void)ERR_get_error();
-                        ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES_GFP, EC_R_INVALID_COMPRESSED_POINT);
+                        ERR_clear_error();
+                        ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES, EC_R_INVALID_COMPRESSED_POINT);
                         }
                 else
-                        ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES_GFP, ERR_R_BN_LIB);
+                        ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES, ERR_R_BN_LIB);
                 goto err;
                 }
-        /* If tmp1 is not a square (i.e. there is no point on the curve with
-         * our x), then y now is a nonsense value too */
 
         if (y_bit != BN_is_odd(y))
                 {
@@ -728,16 +737,17 @@ int ec_GFp_simple_set_compressed_coordinates_GFp(const EC_GROUP *group, EC_POINT
                         if (kron == -2) goto err;
 
                         if (kron == 1)
-                                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES_GFP, EC_R_INVALID_COMPRESSION_BIT);
+                                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES, EC_R_INVALID_COMPRESSION_BIT);
                         else
-                                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES_GFP, EC_R_INVALID_COMPRESSED_POINT);
+                                /* BN_mod_sqrt() should have cought this error (not a square) */
+                                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES, EC_R_INVALID_COMPRESSED_POINT);
                         goto err;
                         }
                 if (!BN_usub(y, &group->field, y)) goto err;
                 }
         if (y_bit != BN_is_odd(y))
                 {
-                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES_GFP, ERR_R_INTERNAL_ERROR);
+                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES, ERR_R_INTERNAL_ERROR);
                 goto err;
                 }
 
@@ -1088,7 +1098,7 @@ int ec_GFp_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, con
                 else
                         {
                         /* a is the inverse of b */
-                        if (!BN_zero(&r->Z)) goto end;
+                        BN_zero(&r->Z);
                         r->Z_is_one = 0;
                         ret = 1;
                         goto end;
@@ -1164,7 +1174,7 @@ int ec_GFp_simple_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, BN_
         
         if (EC_POINT_is_at_infinity(group, a))
                 {
-                if (!BN_zero(&r->Z)) return 0;
+                BN_zero(&r->Z);
                 r->Z_is_one = 0;
                 return 1;
                 }
@@ -1292,7 +1302,7 @@ int ec_GFp_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point, BN_C
         int (*field_sqr)(const EC_GROUP *, BIGNUM *, const BIGNUM *, BN_CTX *);
         const BIGNUM *p;
         BN_CTX *new_ctx = NULL;
-        BIGNUM *rh, *tmp1, *tmp2, *Z4, *Z6;
+        BIGNUM *rh, *tmp, *Z4, *Z6;
         int ret = -1;
 
         if (EC_POINT_is_at_infinity(group, point))
@@ -1311,8 +1321,7 @@ int ec_GFp_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point, BN_C
 
         BN_CTX_start(ctx);
         rh = BN_CTX_get(ctx);
-        tmp1 = BN_CTX_get(ctx);
-        tmp2 = BN_CTX_get(ctx);
+        tmp = BN_CTX_get(ctx);
         Z4 = BN_CTX_get(ctx);
         Z6 = BN_CTX_get(ctx);
         if (Z6 == NULL) goto err;
@@ -1326,59 +1335,49 @@ int ec_GFp_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point, BN_C
          * To test this, we add up the right-hand side in 'rh'.
          */
 
-        /* rh := X^3 */
+        /* rh := X^2 */
         if (!field_sqr(group, rh, &point->X, ctx)) goto err;
-        if (!field_mul(group, rh, rh, &point->X, ctx)) goto err;
 
         if (!point->Z_is_one)
                 {
-                if (!field_sqr(group, tmp1, &point->Z, ctx)) goto err;
-                if (!field_sqr(group, Z4, tmp1, ctx)) goto err;
-                if (!field_mul(group, Z6, Z4, tmp1, ctx)) goto err;
+                if (!field_sqr(group, tmp, &point->Z, ctx)) goto err;
+                if (!field_sqr(group, Z4, tmp, ctx)) goto err;
+                if (!field_mul(group, Z6, Z4, tmp, ctx)) goto err;
 
-                /* rh := rh + a*X*Z^4 */
-                if (!field_mul(group, tmp1, &point->X, Z4, ctx)) goto err;
+                /* rh := (rh + a*Z^4)*X */
                 if (group->a_is_minus3)
                         {
-                        if (!BN_mod_lshift1_quick(tmp2, tmp1, p)) goto err;
-                        if (!BN_mod_add_quick(tmp2, tmp2, tmp1, p)) goto err;
-                        if (!BN_mod_sub_quick(rh, rh, tmp2, p)) goto err;
+                        if (!BN_mod_lshift1_quick(tmp, Z4, p)) goto err;
+                        if (!BN_mod_add_quick(tmp, tmp, Z4, p)) goto err;
+                        if (!BN_mod_sub_quick(rh, rh, tmp, p)) goto err;
+                        if (!field_mul(group, rh, rh, &point->X, ctx)) goto err;
                         }
                 else
                         {
-                        if (!field_mul(group, tmp2, tmp1, &group->a, ctx)) goto err;
-                        if (!BN_mod_add_quick(rh, rh, tmp2, p)) goto err;
+                        if (!field_mul(group, tmp, Z4, &group->a, ctx)) goto err;
+                        if (!BN_mod_add_quick(rh, rh, tmp, p)) goto err;
+                        if (!field_mul(group, rh, rh, &point->X, ctx)) goto err;
                         }
 
                 /* rh := rh + b*Z^6 */
-                if (!field_mul(group, tmp1, &group->b, Z6, ctx)) goto err;
-                if (!BN_mod_add_quick(rh, rh, tmp1, p)) goto err;
+                if (!field_mul(group, tmp, &group->b, Z6, ctx)) goto err;
+                if (!BN_mod_add_quick(rh, rh, tmp, p)) goto err;
                 }
         else
                 {
                 /* point->Z_is_one */
 
-                /* rh := rh + a*X */
-                if (group->a_is_minus3)
-                        {
-                        if (!BN_mod_lshift1_quick(tmp2, &point->X, p)) goto err;
-                        if (!BN_mod_add_quick(tmp2, tmp2, &point->X, p)) goto err;
-                        if (!BN_mod_sub_quick(rh, rh, tmp2, p)) goto err;
-                        }
-                else
-                        {
-                        if (!field_mul(group, tmp2, &point->X, &group->a, ctx)) goto err;
-                        if (!BN_mod_add_quick(rh, rh, tmp2, p)) goto err;
-                        }
-
+                /* rh := (rh + a)*X */
+                if (!BN_mod_add_quick(rh, rh, &group->a, p)) goto err;
+                if (!field_mul(group, rh, rh, &point->X, ctx)) goto err;
                 /* rh := rh + b */
                 if (!BN_mod_add_quick(rh, rh, &group->b, p)) goto err;
                 }
 
         /* 'lh' := Y^2 */
-        if (!field_sqr(group, tmp1, &point->Y, ctx)) goto err;
+        if (!field_sqr(group, tmp, &point->Y, ctx)) goto err;
 
-        ret = (0 == BN_cmp(tmp1, rh));
+        ret = (0 == BN_ucmp(tmp, rh));
 
  err:
         BN_CTX_end(ctx);
diff --git a/src/lib/libssl/src/crypto/ec/ectest.c b/src/lib/libssl/src/crypto/ec/ectest.c
index fcf969f3cf..6148d553f9 100644
--- a/src/lib/libssl/src/crypto/ec/ectest.c
+++ b/src/lib/libssl/src/crypto/ec/ectest.c
@@ -1,4 +1,7 @@
 /* crypto/ec/ectest.c */
+/*
+ * Originally written by Bodo Moeller for the OpenSSL project.
+ */
 /* ====================================================================
  * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
  *
@@ -52,6 +55,19 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * The elliptic curve binary polynomial software is originally written by 
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
+ *
+ */
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -74,6 +90,15 @@ int main(int argc, char * argv[]) { puts("Elliptic curves are disabled."); retur
 #include <openssl/engine.h>
 #endif
 #include <openssl/err.h>
+#include <openssl/obj_mac.h>
+#include <openssl/objects.h>
+#include <openssl/rand.h>
+#include <openssl/bn.h>
+
+#if defined(_MSC_VER) && defined(_MIPS_) && (_MSC_VER/100==12)
+/* suppress "too big too optimize" warning */
+#pragma warning(disable:4959)
+#endif
 
 #define ABORT do { \
         fflush(stdout); \
@@ -82,47 +107,59 @@ int main(int argc, char * argv[]) { puts("Elliptic curves are disabled."); retur
         EXIT(1); \
 } while (0)
 
+void prime_field_tests(void);
+void char2_field_tests(void);
+void internal_curve_test(void);
+
+#define TIMING_BASE_PT 0
+#define TIMING_RAND_PT 1
+#define TIMING_SIMUL 2
+
 #if 0
-static void timings(EC_GROUP *group, int multi, BN_CTX *ctx)
+static void timings(EC_GROUP *group, int type, BN_CTX *ctx)
         {
         clock_t clck;
         int i, j;
-        BIGNUM *s, *s0;
+        BIGNUM *s;
+        BIGNUM *r[10], *r0[10];
         EC_POINT *P;
                 
         s = BN_new();
-        s0 = BN_new();
-        if (s == NULL || s0 == NULL) ABORT;
+        if (s == NULL) ABORT;
 
-        if (!EC_GROUP_get_curve_GFp(group, s, NULL, NULL, ctx)) ABORT;
-        fprintf(stdout, "Timings for %d bit prime, ", (int)BN_num_bits(s));
+        fprintf(stdout, "Timings for %d-bit field, ", EC_GROUP_get_degree(group));
         if (!EC_GROUP_get_order(group, s, ctx)) ABORT;
-        fprintf(stdout, "%d bit scalars ", (int)BN_num_bits(s));
+        fprintf(stdout, "%d-bit scalars ", (int)BN_num_bits(s));
         fflush(stdout);
 
         P = EC_POINT_new(group);
         if (P == NULL) ABORT;
         EC_POINT_copy(P, EC_GROUP_get0_generator(group));
 
-        clck = clock();
         for (i = 0; i < 10; i++)
                 {
-                if (!BN_pseudo_rand(s, BN_num_bits(s), 0, 0)) ABORT;
-                if (multi)
+                if ((r[i] = BN_new()) == NULL) ABORT;
+                if (!BN_pseudo_rand(r[i], BN_num_bits(s), 0, 0)) ABORT;
+                if (type != TIMING_BASE_PT)
                         {
-                        if (!BN_pseudo_rand(s0, BN_num_bits(s), 0, 0)) ABORT;
+                        if ((r0[i] = BN_new()) == NULL) ABORT;
+                        if (!BN_pseudo_rand(r0[i], BN_num_bits(s), 0, 0)) ABORT;
                         }
+                }
+
+        clck = clock();
+        for (i = 0; i < 10; i++)
+                {
                 for (j = 0; j < 10; j++)
                         {
-                        if (!EC_POINT_mul(group, P, s, multi ? P : NULL, multi ? s0 : NULL, ctx)) ABORT;
+                        if (!EC_POINT_mul(group, P, (type != TIMING_RAND_PT) ? r[i] : NULL, 
+                                (type != TIMING_BASE_PT) ? P : NULL, (type != TIMING_BASE_PT) ? r0[i] : NULL, ctx)) ABORT;
                         }
-                fprintf(stdout, ".");
-                fflush(stdout);
                 }
-        fprintf(stdout, "\n");
-        
         clck = clock() - clck;
 
+        fprintf(stdout, "\n");
+
 #ifdef CLOCKS_PER_SEC
         /* "To determine the time in seconds, the value returned
          * by the clock function should be divided by the value
@@ -136,43 +173,40 @@ static void timings(EC_GROUP *group, int multi, BN_CTX *ctx)
 #       define CLOCKS_PER_SEC 1
 #endif
 
-        fprintf(stdout, "%i %s in %.2f " UNIT "\n", i*j,
-                multi ? "s*P+t*Q operations" : "point multiplications",
-                (double)clck/CLOCKS_PER_SEC);
+        if (type == TIMING_BASE_PT) {
+                fprintf(stdout, "%i %s in %.2f " UNIT "\n", i*j,
+                        "base point multiplications", (double)clck/CLOCKS_PER_SEC);
+        } else if (type == TIMING_RAND_PT) {
+                fprintf(stdout, "%i %s in %.2f " UNIT "\n", i*j,
+                        "random point multiplications", (double)clck/CLOCKS_PER_SEC);
+        } else if (type == TIMING_SIMUL) {
+                fprintf(stdout, "%i %s in %.2f " UNIT "\n", i*j,
+                        "s*P+t*Q operations", (double)clck/CLOCKS_PER_SEC);
+        }
         fprintf(stdout, "average: %.4f " UNIT "\n", (double)clck/(CLOCKS_PER_SEC*i*j));
 
         EC_POINT_free(P);
         BN_free(s);
-        BN_free(s0);
+        for (i = 0; i < 10; i++)
+                {
+                BN_free(r[i]);
+                if (type != TIMING_BASE_PT) BN_free(r0[i]);
+                }
         }
 #endif
 
-int main(int argc, char *argv[])
+void prime_field_tests()
         {       
         BN_CTX *ctx = NULL;
         BIGNUM *p, *a, *b;
         EC_GROUP *group;
-        EC_GROUP *P_192 = NULL, *P_224 = NULL, *P_256 = NULL, *P_384 = NULL, *P_521 = NULL;
+        EC_GROUP *P_160 = NULL, *P_192 = NULL, *P_224 = NULL, *P_256 = NULL, *P_384 = NULL, *P_521 = NULL;
         EC_POINT *P, *Q, *R;
         BIGNUM *x, *y, *z;
         unsigned char buf[100];
         size_t i, len;
         int k;
         
-        /* enable memory leak checking unless explicitly disabled */
-        if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
-                {
-                CRYPTO_malloc_debug_init();
-                CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
-                }
-        else
-                {
-                /* OPENSSL_DEBUG_MEMORY=off */
-                CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
-                }
-        CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
-        ERR_load_crypto_strings();
-
 #if 1 /* optional */
         ctx = BN_CTX_new();
         if (!ctx) ABORT;
@@ -317,10 +351,56 @@ int main(int argc, char *argv[])
         if (0 != EC_POINT_cmp(group, P, R, ctx)) ABORT;
 
 
+        /* Curve secp160r1 (Certicom Research SEC 2 Version 1.0, section 2.4.2, 2000)
+         * -- not a NIST curve, but commonly used */
+        
+        if (!BN_hex2bn(&p, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF")) ABORT;
+        if (1 != BN_is_prime_ex(p, BN_prime_checks, ctx, NULL)) ABORT;
+        if (!BN_hex2bn(&a, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC")) ABORT;
+        if (!BN_hex2bn(&b, "1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45")) ABORT;
+        if (!EC_GROUP_set_curve_GFp(group, p, a, b, ctx)) ABORT;
+
+        if (!BN_hex2bn(&x, "4A96B5688EF573284664698968C38BB913CBFC82")) ABORT;
+        if (!BN_hex2bn(&y, "23a628553168947d59dcc912042351377ac5fb32")) ABORT;
+        if (!EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx)) ABORT;
+        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT;
+        if (!BN_hex2bn(&z, "0100000000000000000001F4C8F927AED3CA752257")) ABORT;
+        if (!EC_GROUP_set_generator(group, P, z, BN_value_one())) ABORT;
+
+        if (!EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)) ABORT;
+        fprintf(stdout, "\nSEC2 curve secp160r1 -- Generator:\n     x = 0x");
+        BN_print_fp(stdout, x);
+        fprintf(stdout, "\n     y = 0x");
+        BN_print_fp(stdout, y);
+        fprintf(stdout, "\n");
+        /* G_y value taken from the standard: */
+        if (!BN_hex2bn(&z, "23a628553168947d59dcc912042351377ac5fb32")) ABORT;
+        if (0 != BN_cmp(y, z)) ABORT;
+
+        fprintf(stdout, "verify degree ...");
+        if (EC_GROUP_get_degree(group) != 160) ABORT;
+        fprintf(stdout, " ok\n");
+        
+        fprintf(stdout, "verify group order ...");
+        fflush(stdout);
+        if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
+        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
+        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
+        fprintf(stdout, ".");
+        fflush(stdout);
+        if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
+        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
+        if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
+        fprintf(stdout, " ok\n");
+
+        if (!(P_160 = EC_GROUP_new(EC_GROUP_method_of(group)))) ABORT;
+        if (!EC_GROUP_copy(P_160, group)) ABORT;
+
+
         /* Curve P-192 (FIPS PUB 186-2, App. 6) */
         
         if (!BN_hex2bn(&p, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF")) ABORT;
-        if (1 != BN_is_prime(p, BN_prime_checks, 0, ctx, NULL)) ABORT;
+        if (1 != BN_is_prime_ex(p, BN_prime_checks, ctx, NULL)) ABORT;
         if (!BN_hex2bn(&a, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC")) ABORT;
         if (!BN_hex2bn(&b, "64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1")) ABORT;
         if (!EC_GROUP_set_curve_GFp(group, p, a, b, ctx)) ABORT;
@@ -340,6 +420,10 @@ int main(int argc, char *argv[])
         /* G_y value taken from the standard: */
         if (!BN_hex2bn(&z, "07192B95FFC8DA78631011ED6B24CDD573F977A11E794811")) ABORT;
         if (0 != BN_cmp(y, z)) ABORT;
+
+        fprintf(stdout, "verify degree ...");
+        if (EC_GROUP_get_degree(group) != 192) ABORT;
+        fprintf(stdout, " ok\n");
         
         fprintf(stdout, "verify group order ...");
         fflush(stdout);
@@ -348,7 +432,9 @@ int main(int argc, char *argv[])
         if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
         fprintf(stdout, ".");
         fflush(stdout);
+#if 0
         if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
+#endif
         if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
         if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
         fprintf(stdout, " ok\n");
@@ -360,7 +446,7 @@ int main(int argc, char *argv[])
         /* Curve P-224 (FIPS PUB 186-2, App. 6) */
         
         if (!BN_hex2bn(&p, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001")) ABORT;
-        if (1 != BN_is_prime(p, BN_prime_checks, 0, ctx, NULL)) ABORT;
+        if (1 != BN_is_prime_ex(p, BN_prime_checks, ctx, NULL)) ABORT;
         if (!BN_hex2bn(&a, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE")) ABORT;
         if (!BN_hex2bn(&b, "B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4")) ABORT;
         if (!EC_GROUP_set_curve_GFp(group, p, a, b, ctx)) ABORT;
@@ -381,6 +467,10 @@ int main(int argc, char *argv[])
         if (!BN_hex2bn(&z, "BD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34")) ABORT;
         if (0 != BN_cmp(y, z)) ABORT;
         
+        fprintf(stdout, "verify degree ...");
+        if (EC_GROUP_get_degree(group) != 224) ABORT;
+        fprintf(stdout, " ok\n");
+        
         fprintf(stdout, "verify group order ...");
         fflush(stdout);
         if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
@@ -388,7 +478,9 @@ int main(int argc, char *argv[])
         if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
         fprintf(stdout, ".");
         fflush(stdout);
+#if 0
         if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
+#endif
         if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
         if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
         fprintf(stdout, " ok\n");
@@ -400,7 +492,7 @@ int main(int argc, char *argv[])
         /* Curve P-256 (FIPS PUB 186-2, App. 6) */
         
         if (!BN_hex2bn(&p, "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF")) ABORT;
-        if (1 != BN_is_prime(p, BN_prime_checks, 0, ctx, NULL)) ABORT;
+        if (1 != BN_is_prime_ex(p, BN_prime_checks, ctx, NULL)) ABORT;
         if (!BN_hex2bn(&a, "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC")) ABORT;
         if (!BN_hex2bn(&b, "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B")) ABORT;
         if (!EC_GROUP_set_curve_GFp(group, p, a, b, ctx)) ABORT;
@@ -422,6 +514,10 @@ int main(int argc, char *argv[])
         if (!BN_hex2bn(&z, "4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5")) ABORT;
         if (0 != BN_cmp(y, z)) ABORT;
         
+        fprintf(stdout, "verify degree ...");
+        if (EC_GROUP_get_degree(group) != 256) ABORT;
+        fprintf(stdout, " ok\n");
+        
         fprintf(stdout, "verify group order ...");
         fflush(stdout);
         if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
@@ -429,7 +525,9 @@ int main(int argc, char *argv[])
         if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
         fprintf(stdout, ".");
         fflush(stdout);
+#if 0
         if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
+#endif
         if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
         if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
         fprintf(stdout, " ok\n");
@@ -442,7 +540,7 @@ int main(int argc, char *argv[])
         
         if (!BN_hex2bn(&p, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                 "FFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF")) ABORT;
-        if (1 != BN_is_prime(p, BN_prime_checks, 0, ctx, NULL)) ABORT;
+        if (1 != BN_is_prime_ex(p, BN_prime_checks, ctx, NULL)) ABORT;
         if (!BN_hex2bn(&a, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                 "FFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC")) ABORT;
         if (!BN_hex2bn(&b, "B3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141"
@@ -468,6 +566,10 @@ int main(int argc, char *argv[])
                 "7CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F")) ABORT;
         if (0 != BN_cmp(y, z)) ABORT;
         
+        fprintf(stdout, "verify degree ...");
+        if (EC_GROUP_get_degree(group) != 384) ABORT;
+        fprintf(stdout, " ok\n");
+        
         fprintf(stdout, "verify group order ...");
         fflush(stdout);
         if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
@@ -475,7 +577,9 @@ int main(int argc, char *argv[])
         if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
         fprintf(stdout, ".");
         fflush(stdout);
+#if 0
         if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
+#endif
         if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
         if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
         fprintf(stdout, " ok\n");
@@ -489,7 +593,7 @@ int main(int argc, char *argv[])
         if (!BN_hex2bn(&p, "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                 "FFFFFFFFFFFFFFFFFFFFFFFFFFFF")) ABORT;
-        if (1 != BN_is_prime(p, BN_prime_checks, 0, ctx, NULL)) ABORT;
+        if (1 != BN_is_prime_ex(p, BN_prime_checks, ctx, NULL)) ABORT;
         if (!BN_hex2bn(&a, "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
                 "FFFFFFFFFFFFFFFFFFFFFFFFFFFC")) ABORT;
@@ -520,6 +624,10 @@ int main(int argc, char *argv[])
                 "7086A272C24088BE94769FD16650")) ABORT;
         if (0 != BN_cmp(y, z)) ABORT;
         
+        fprintf(stdout, "verify degree ...");
+        if (EC_GROUP_get_degree(group) != 521) ABORT;
+        fprintf(stdout, " ok\n");
+        
         fprintf(stdout, "verify group order ...");
         fflush(stdout);
         if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
@@ -527,7 +635,9 @@ int main(int argc, char *argv[])
         if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
         fprintf(stdout, ".");
         fflush(stdout);
+#if 0
         if (!EC_GROUP_precompute_mult(group, ctx)) ABORT;
+#endif
         if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT;
         if (!EC_POINT_is_at_infinity(group, Q)) ABORT;
         fprintf(stdout, " ok\n");
@@ -549,13 +659,15 @@ int main(int argc, char *argv[])
         if (!EC_POINT_is_at_infinity(group, R)) ABORT; /* R = P + 2Q */
 
         {
-                const EC_POINT *points[3];
-                const BIGNUM *scalars[3];
+                const EC_POINT *points[4];
+                const BIGNUM *scalars[4];
+                BIGNUM scalar3;
         
                 if (EC_POINT_is_at_infinity(group, Q)) ABORT;
                 points[0] = Q;
                 points[1] = Q;
                 points[2] = Q;
+                points[3] = Q;
 
                 if (!BN_add(y, z, BN_value_one())) ABORT;
                 if (BN_is_odd(y)) ABORT;
@@ -577,7 +689,7 @@ int main(int argc, char *argv[])
 
                 if (!BN_pseudo_rand(y, BN_num_bits(y), 0, 0)) ABORT;
                 if (!BN_add(z, z, y)) ABORT;
-                z->neg = 1;
+                BN_set_negative(z, 1);
                 scalars[0] = y;
                 scalars[1] = z; /* z = -(order + y) */
 
@@ -589,29 +701,43 @@ int main(int argc, char *argv[])
 
                 if (!BN_pseudo_rand(x, BN_num_bits(y) - 1, 0, 0)) ABORT;
                 if (!BN_add(z, x, y)) ABORT;
-                z->neg = 1;
+                BN_set_negative(z, 1);
                 scalars[0] = x;
                 scalars[1] = y;
                 scalars[2] = z; /* z = -(x+y) */
 
-                if (!EC_POINTs_mul(group, P, NULL, 3, points, scalars, ctx)) ABORT;
+                BN_init(&scalar3);
+                BN_zero(&scalar3);
+                scalars[3] = &scalar3;
+
+                if (!EC_POINTs_mul(group, P, NULL, 4, points, scalars, ctx)) ABORT;
                 if (!EC_POINT_is_at_infinity(group, P)) ABORT;
 
                 fprintf(stdout, " ok\n\n");
+
+                BN_free(&scalar3);
         }
 
 
 #if 0
-        timings(P_192, 0, ctx);
-        timings(P_192, 1, ctx);
-        timings(P_224, 0, ctx);
-        timings(P_224, 1, ctx);
-        timings(P_256, 0, ctx);
-        timings(P_256, 1, ctx);
-        timings(P_384, 0, ctx);
-        timings(P_384, 1, ctx);
-        timings(P_521, 0, ctx);
-        timings(P_521, 1, ctx);
+        timings(P_160, TIMING_BASE_PT, ctx);
+        timings(P_160, TIMING_RAND_PT, ctx);
+        timings(P_160, TIMING_SIMUL, ctx);
+        timings(P_192, TIMING_BASE_PT, ctx);
+        timings(P_192, TIMING_RAND_PT, ctx);
+        timings(P_192, TIMING_SIMUL, ctx);
+        timings(P_224, TIMING_BASE_PT, ctx);
+        timings(P_224, TIMING_RAND_PT, ctx);
+        timings(P_224, TIMING_SIMUL, ctx);
+        timings(P_256, TIMING_BASE_PT, ctx);
+        timings(P_256, TIMING_RAND_PT, ctx);
+        timings(P_256, TIMING_SIMUL, ctx);
+        timings(P_384, TIMING_BASE_PT, ctx);
+        timings(P_384, TIMING_RAND_PT, ctx);
+        timings(P_384, TIMING_SIMUL, ctx);
+        timings(P_521, TIMING_BASE_PT, ctx);
+        timings(P_521, TIMING_RAND_PT, ctx);
+        timings(P_521, TIMING_SIMUL, ctx);
 #endif
 
 
@@ -624,12 +750,587 @@ int main(int argc, char *argv[])
         EC_POINT_free(R);
         BN_free(x); BN_free(y); BN_free(z);
 
+        if (P_160) EC_GROUP_free(P_160);
         if (P_192) EC_GROUP_free(P_192);
         if (P_224) EC_GROUP_free(P_224);
         if (P_256) EC_GROUP_free(P_256);
         if (P_384) EC_GROUP_free(P_384);
         if (P_521) EC_GROUP_free(P_521);
 
+        }
+
+/* Change test based on whether binary point compression is enabled or not. */
+#ifdef OPENSSL_EC_BIN_PT_COMP
+#define CHAR2_CURVE_TEST_INTERNAL(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
+        if (!BN_hex2bn(&x, _x)) ABORT; \
+        if (!EC_POINT_set_compressed_coordinates_GF2m(group, P, x, _y_bit, ctx)) ABORT; \
+        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
+        if (!BN_hex2bn(&z, _order)) ABORT; \
+        if (!BN_hex2bn(&cof, _cof)) ABORT; \
+        if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
+        if (!EC_POINT_get_affine_coordinates_GF2m(group, P, x, y, ctx)) ABORT; \
+        fprintf(stdout, "\n%s -- Generator:\n     x = 0x", _name); \
+        BN_print_fp(stdout, x); \
+        fprintf(stdout, "\n     y = 0x"); \
+        BN_print_fp(stdout, y); \
+        fprintf(stdout, "\n"); \
+        /* G_y value taken from the standard: */ \
+        if (!BN_hex2bn(&z, _y)) ABORT; \
+        if (0 != BN_cmp(y, z)) ABORT;
+#else 
+#define CHAR2_CURVE_TEST_INTERNAL(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
+        if (!BN_hex2bn(&x, _x)) ABORT; \
+        if (!BN_hex2bn(&y, _y)) ABORT; \
+        if (!EC_POINT_set_affine_coordinates_GF2m(group, P, x, y, ctx)) ABORT; \
+        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
+        if (!BN_hex2bn(&z, _order)) ABORT; \
+        if (!BN_hex2bn(&cof, _cof)) ABORT; \
+        if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
+        fprintf(stdout, "\n%s -- Generator:\n     x = 0x", _name); \
+        BN_print_fp(stdout, x); \
+        fprintf(stdout, "\n     y = 0x"); \
+        BN_print_fp(stdout, y); \
+        fprintf(stdout, "\n");
+#endif
+
+#define CHAR2_CURVE_TEST(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
+        if (!BN_hex2bn(&p, _p)) ABORT; \
+        if (!BN_hex2bn(&a, _a)) ABORT; \
+        if (!BN_hex2bn(&b, _b)) ABORT; \
+        if (!EC_GROUP_set_curve_GF2m(group, p, a, b, ctx)) ABORT; \
+        CHAR2_CURVE_TEST_INTERNAL(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
+        fprintf(stdout, "verify degree ..."); \
+        if (EC_GROUP_get_degree(group) != _degree) ABORT; \
+        fprintf(stdout, " ok\n"); \
+        fprintf(stdout, "verify group order ..."); \
+        fflush(stdout); \
+        if (!EC_GROUP_get_order(group, z, ctx)) ABORT; \
+        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT; \
+        if (!EC_POINT_is_at_infinity(group, Q)) ABORT; \
+        fprintf(stdout, "."); \
+        fflush(stdout); \
+        /* if (!EC_GROUP_precompute_mult(group, ctx)) ABORT; */ \
+        if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT; \
+        if (!EC_POINT_is_at_infinity(group, Q)) ABORT; \
+        fprintf(stdout, " ok\n"); \
+        if (!(_variable = EC_GROUP_new(EC_GROUP_method_of(group)))) ABORT; \
+        if (!EC_GROUP_copy(_variable, group)) ABORT;
+
+void char2_field_tests()
+        {       
+        BN_CTX *ctx = NULL;
+        BIGNUM *p, *a, *b;
+        EC_GROUP *group;
+        EC_GROUP *C2_K163 = NULL, *C2_K233 = NULL, *C2_K283 = NULL, *C2_K409 = NULL, *C2_K571 = NULL;
+        EC_GROUP *C2_B163 = NULL, *C2_B233 = NULL, *C2_B283 = NULL, *C2_B409 = NULL, *C2_B571 = NULL;
+        EC_POINT *P, *Q, *R;
+        BIGNUM *x, *y, *z, *cof;
+        unsigned char buf[100];
+        size_t i, len;
+        int k;
+        
+#if 1 /* optional */
+        ctx = BN_CTX_new();
+        if (!ctx) ABORT;
+#endif
+
+        p = BN_new();
+        a = BN_new();
+        b = BN_new();
+        if (!p || !a || !b) ABORT;
+
+        if (!BN_hex2bn(&p, "13")) ABORT;
+        if (!BN_hex2bn(&a, "3")) ABORT;
+        if (!BN_hex2bn(&b, "1")) ABORT;
+        
+        group = EC_GROUP_new(EC_GF2m_simple_method()); /* applications should use EC_GROUP_new_curve_GF2m
+                                                        * so that the library gets to choose the EC_METHOD */
+        if (!group) ABORT;
+        if (!EC_GROUP_set_curve_GF2m(group, p, a, b, ctx)) ABORT;
+
+        {
+                EC_GROUP *tmp;
+                tmp = EC_GROUP_new(EC_GROUP_method_of(group));
+                if (!tmp) ABORT;
+                if (!EC_GROUP_copy(tmp, group)) ABORT;
+                EC_GROUP_free(group);
+                group = tmp;
+        }
+        
+        if (!EC_GROUP_get_curve_GF2m(group, p, a, b, ctx)) ABORT;
+
+        fprintf(stdout, "Curve defined by Weierstrass equation\n     y^2 + x*y = x^3 + a*x^2 + b  (mod 0x");
+        BN_print_fp(stdout, p);
+        fprintf(stdout, ")\n     a = 0x");
+        BN_print_fp(stdout, a);
+        fprintf(stdout, "\n     b = 0x");
+        BN_print_fp(stdout, b);
+        fprintf(stdout, "\n(0x... means binary polynomial)\n");
+
+        P = EC_POINT_new(group);
+        Q = EC_POINT_new(group);
+        R = EC_POINT_new(group);
+        if (!P || !Q || !R) ABORT;
+        
+        if (!EC_POINT_set_to_infinity(group, P)) ABORT;
+        if (!EC_POINT_is_at_infinity(group, P)) ABORT;
+
+        buf[0] = 0;
+        if (!EC_POINT_oct2point(group, Q, buf, 1, ctx)) ABORT;
+
+        if (!EC_POINT_add(group, P, P, Q, ctx)) ABORT;
+        if (!EC_POINT_is_at_infinity(group, P)) ABORT;
+
+        x = BN_new();
+        y = BN_new();
+        z = BN_new();
+        cof = BN_new();
+        if (!x || !y || !z || !cof) ABORT;
+
+        if (!BN_hex2bn(&x, "6")) ABORT;
+/* Change test based on whether binary point compression is enabled or not. */
+#ifdef OPENSSL_EC_BIN_PT_COMP
+        if (!EC_POINT_set_compressed_coordinates_GF2m(group, Q, x, 1, ctx)) ABORT;
+#else
+        if (!BN_hex2bn(&y, "8")) ABORT;
+        if (!EC_POINT_set_affine_coordinates_GF2m(group, Q, x, y, ctx)) ABORT;
+#endif
+        if (!EC_POINT_is_on_curve(group, Q, ctx))
+                {
+/* Change test based on whether binary point compression is enabled or not. */
+#ifdef OPENSSL_EC_BIN_PT_COMP
+                if (!EC_POINT_get_affine_coordinates_GF2m(group, Q, x, y, ctx)) ABORT;
+#endif
+                fprintf(stderr, "Point is not on curve: x = 0x");
+                BN_print_fp(stderr, x);
+                fprintf(stderr, ", y = 0x");
+                BN_print_fp(stderr, y);
+                fprintf(stderr, "\n");
+                ABORT;
+                }
+
+        fprintf(stdout, "A cyclic subgroup:\n");
+        k = 100;
+        do
+                {
+                if (k-- == 0) ABORT;
+
+                if (EC_POINT_is_at_infinity(group, P))
+                        fprintf(stdout, "     point at infinity\n");
+                else
+                        {
+                        if (!EC_POINT_get_affine_coordinates_GF2m(group, P, x, y, ctx)) ABORT;
+
+                        fprintf(stdout, "     x = 0x");
+                        BN_print_fp(stdout, x);
+                        fprintf(stdout, ", y = 0x");
+                        BN_print_fp(stdout, y);
+                        fprintf(stdout, "\n");
+                        }
+                
+                if (!EC_POINT_copy(R, P)) ABORT;
+                if (!EC_POINT_add(group, P, P, Q, ctx)) ABORT;
+                }
+        while (!EC_POINT_is_at_infinity(group, P));
+
+        if (!EC_POINT_add(group, P, Q, R, ctx)) ABORT;
+        if (!EC_POINT_is_at_infinity(group, P)) ABORT;
+
+/* Change test based on whether binary point compression is enabled or not. */
+#ifdef OPENSSL_EC_BIN_PT_COMP
+        len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_COMPRESSED, buf, sizeof buf, ctx);
+        if (len == 0) ABORT;
+        if (!EC_POINT_oct2point(group, P, buf, len, ctx)) ABORT;
+        if (0 != EC_POINT_cmp(group, P, Q, ctx)) ABORT;
+        fprintf(stdout, "Generator as octet string, compressed form:\n     ");
+        for (i = 0; i < len; i++) fprintf(stdout, "%02X", buf[i]);
+#endif
+        
+        len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_UNCOMPRESSED, buf, sizeof buf, ctx);
+        if (len == 0) ABORT;
+        if (!EC_POINT_oct2point(group, P, buf, len, ctx)) ABORT;
+        if (0 != EC_POINT_cmp(group, P, Q, ctx)) ABORT;
+        fprintf(stdout, "\nGenerator as octet string, uncompressed form:\n     ");
+        for (i = 0; i < len; i++) fprintf(stdout, "%02X", buf[i]);
+        
+/* Change test based on whether binary point compression is enabled or not. */
+#ifdef OPENSSL_EC_BIN_PT_COMP
+        len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_HYBRID, buf, sizeof buf, ctx);
+        if (len == 0) ABORT;
+        if (!EC_POINT_oct2point(group, P, buf, len, ctx)) ABORT;
+        if (0 != EC_POINT_cmp(group, P, Q, ctx)) ABORT;
+        fprintf(stdout, "\nGenerator as octet string, hybrid form:\n     ");
+        for (i = 0; i < len; i++) fprintf(stdout, "%02X", buf[i]);
+#endif
+
+        fprintf(stdout, "\n");
+        
+        if (!EC_POINT_invert(group, P, ctx)) ABORT;
+        if (0 != EC_POINT_cmp(group, P, R, ctx)) ABORT;
+
+
+        /* Curve K-163 (FIPS PUB 186-2, App. 6) */
+        CHAR2_CURVE_TEST
+                (
+                "NIST curve K-163",
+                "0800000000000000000000000000000000000000C9",
+                "1",
+                "1",
+                "02FE13C0537BBC11ACAA07D793DE4E6D5E5C94EEE8",
+                "0289070FB05D38FF58321F2E800536D538CCDAA3D9",
+                1,
+                "04000000000000000000020108A2E0CC0D99F8A5EF",
+                "2",
+                163,
+                C2_K163
+                );
+
+        /* Curve B-163 (FIPS PUB 186-2, App. 6) */
+        CHAR2_CURVE_TEST
+                (
+                "NIST curve B-163",
+                "0800000000000000000000000000000000000000C9",
+                "1",
+                "020A601907B8C953CA1481EB10512F78744A3205FD",
+                "03F0EBA16286A2D57EA0991168D4994637E8343E36",
+                "00D51FBC6C71A0094FA2CDD545B11C5C0C797324F1",
+                1,
+                "040000000000000000000292FE77E70C12A4234C33",
+                "2",
+                163,
+                C2_B163
+                );
+
+        /* Curve K-233 (FIPS PUB 186-2, App. 6) */
+        CHAR2_CURVE_TEST
+                (
+                "NIST curve K-233",
+                "020000000000000000000000000000000000000004000000000000000001",
+                "0",
+                "1",
+                "017232BA853A7E731AF129F22FF4149563A419C26BF50A4C9D6EEFAD6126",
+                "01DB537DECE819B7F70F555A67C427A8CD9BF18AEB9B56E0C11056FAE6A3",
+                0,
+                "008000000000000000000000000000069D5BB915BCD46EFB1AD5F173ABDF",
+                "4",
+                233,
+                C2_K233
+                );
+
+        /* Curve B-233 (FIPS PUB 186-2, App. 6) */
+        CHAR2_CURVE_TEST
+                (
+                "NIST curve B-233",
+                "020000000000000000000000000000000000000004000000000000000001",
+                "000000000000000000000000000000000000000000000000000000000001",
+                "0066647EDE6C332C7F8C0923BB58213B333B20E9CE4281FE115F7D8F90AD",
+                "00FAC9DFCBAC8313BB2139F1BB755FEF65BC391F8B36F8F8EB7371FD558B",
+                "01006A08A41903350678E58528BEBF8A0BEFF867A7CA36716F7E01F81052",
+                1,
+                "01000000000000000000000000000013E974E72F8A6922031D2603CFE0D7",
+                "2",
+                233,
+                C2_B233
+                );
+
+        /* Curve K-283 (FIPS PUB 186-2, App. 6) */
+        CHAR2_CURVE_TEST
+                (
+                "NIST curve K-283",
+                "0800000000000000000000000000000000000000000000000000000000000000000010A1",
+                "0",
+                "1",
+                "0503213F78CA44883F1A3B8162F188E553CD265F23C1567A16876913B0C2AC2458492836",
+                "01CCDA380F1C9E318D90F95D07E5426FE87E45C0E8184698E45962364E34116177DD2259",
+                0,
+                "01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE9AE2ED07577265DFF7F94451E061E163C61",
+                "4",
+                283,
+                C2_K283
+                );
+
+        /* Curve B-283 (FIPS PUB 186-2, App. 6) */
+        CHAR2_CURVE_TEST
+                (
+                "NIST curve B-283",
+                "0800000000000000000000000000000000000000000000000000000000000000000010A1",
+                "000000000000000000000000000000000000000000000000000000000000000000000001",
+                "027B680AC8B8596DA5A4AF8A19A0303FCA97FD7645309FA2A581485AF6263E313B79A2F5",
+                "05F939258DB7DD90E1934F8C70B0DFEC2EED25B8557EAC9C80E2E198F8CDBECD86B12053",
+                "03676854FE24141CB98FE6D4B20D02B4516FF702350EDDB0826779C813F0DF45BE8112F4",
+                1,
+                "03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEF90399660FC938A90165B042A7CEFADB307",
+                "2",
+                283,
+                C2_B283
+                );
+
+        /* Curve K-409 (FIPS PUB 186-2, App. 6) */
+        CHAR2_CURVE_TEST
+                (
+                "NIST curve K-409",
+                "02000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000001",
+                "0",
+                "1",
+                "0060F05F658F49C1AD3AB1890F7184210EFD0987E307C84C27ACCFB8F9F67CC2C460189EB5AAAA62EE222EB1B35540CFE9023746",
+                "01E369050B7C4E42ACBA1DACBF04299C3460782F918EA427E6325165E9EA10E3DA5F6C42E9C55215AA9CA27A5863EC48D8E0286B",
+                1,
+                "007FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE5F83B2D4EA20400EC4557D5ED3E3E7CA5B4B5C83B8E01E5FCF",
+                "4",
+                409,
+                C2_K409
+                );
+
+        /* Curve B-409 (FIPS PUB 186-2, App. 6) */
+        CHAR2_CURVE_TEST
+                (
+                "NIST curve B-409",
+                "02000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000001",
+                "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
+                "0021A5C2C8EE9FEB5C4B9A753B7B476B7FD6422EF1F3DD674761FA99D6AC27C8A9A197B272822F6CD57A55AA4F50AE317B13545F",
+                "015D4860D088DDB3496B0C6064756260441CDE4AF1771D4DB01FFE5B34E59703DC255A868A1180515603AEAB60794E54BB7996A7",
+                "0061B1CFAB6BE5F32BBFA78324ED106A7636B9C5A7BD198D0158AA4F5488D08F38514F1FDF4B4F40D2181B3681C364BA0273C706",
+                1,
+                "010000000000000000000000000000000000000000000000000001E2AAD6A612F33307BE5FA47C3C9E052F838164CD37D9A21173",
+                "2",
+                409,
+                C2_B409
+                );
+
+        /* Curve K-571 (FIPS PUB 186-2, App. 6) */
+        CHAR2_CURVE_TEST
+                (
+                "NIST curve K-571",
+                "80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000425",
+                "0",
+                "1",
+                "026EB7A859923FBC82189631F8103FE4AC9CA2970012D5D46024804801841CA44370958493B205E647DA304DB4CEB08CBBD1BA39494776FB988B47174DCA88C7E2945283A01C8972",
+                "0349DC807F4FBF374F4AEADE3BCA95314DD58CEC9F307A54FFC61EFC006D8A2C9D4979C0AC44AEA74FBEBBB9F772AEDCB620B01A7BA7AF1B320430C8591984F601CD4C143EF1C7A3",
+                0,
+                "020000000000000000000000000000000000000000000000000000000000000000000000131850E1F19A63E4B391A8DB917F4138B630D84BE5D639381E91DEB45CFE778F637C1001",
+                "4",
+                571,
+                C2_K571
+                );
+
+        /* Curve B-571 (FIPS PUB 186-2, App. 6) */
+        CHAR2_CURVE_TEST
+                (
+                "NIST curve B-571",
+                "80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000425",
+                "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
+                "02F40E7E2221F295DE297117B7F3D62F5C6A97FFCB8CEFF1CD6BA8CE4A9A18AD84FFABBD8EFA59332BE7AD6756A66E294AFD185A78FF12AA520E4DE739BACA0C7FFEFF7F2955727A",
+                "0303001D34B856296C16C0D40D3CD7750A93D1D2955FA80AA5F40FC8DB7B2ABDBDE53950F4C0D293CDD711A35B67FB1499AE60038614F1394ABFA3B4C850D927E1E7769C8EEC2D19",
+                "037BF27342DA639B6DCCFFFEB73D69D78C6C27A6009CBBCA1980F8533921E8A684423E43BAB08A576291AF8F461BB2A8B3531D2F0485C19B16E2F1516E23DD3C1A4827AF1B8AC15B",
+                1,
+                "03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE661CE18FF55987308059B186823851EC7DD9CA1161DE93D5174D66E8382E9BB2FE84E47",
+                "2",
+                571,
+                C2_B571
+                );
+
+        /* more tests using the last curve */
+
+        if (!EC_POINT_copy(Q, P)) ABORT;
+        if (EC_POINT_is_at_infinity(group, Q)) ABORT;
+        if (!EC_POINT_dbl(group, P, P, ctx)) ABORT;
+        if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT;
+        if (!EC_POINT_invert(group, Q, ctx)) ABORT; /* P = -2Q */
+
+        if (!EC_POINT_add(group, R, P, Q, ctx)) ABORT;
+        if (!EC_POINT_add(group, R, R, Q, ctx)) ABORT;
+        if (!EC_POINT_is_at_infinity(group, R)) ABORT; /* R = P + 2Q */
+
+        {
+                const EC_POINT *points[3];
+                const BIGNUM *scalars[3];
+        
+                if (EC_POINT_is_at_infinity(group, Q)) ABORT;
+                points[0] = Q;
+                points[1] = Q;
+                points[2] = Q;
+
+                if (!BN_add(y, z, BN_value_one())) ABORT;
+                if (BN_is_odd(y)) ABORT;
+                if (!BN_rshift1(y, y)) ABORT;
+                scalars[0] = y; /* (group order + 1)/2,  so  y*Q + y*Q = Q */
+                scalars[1] = y;
+
+                fprintf(stdout, "combined multiplication ...");
+                fflush(stdout);
+
+                /* z is still the group order */
+                if (!EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx)) ABORT;
+                if (!EC_POINTs_mul(group, R, z, 2, points, scalars, ctx)) ABORT;
+                if (0 != EC_POINT_cmp(group, P, R, ctx)) ABORT;
+                if (0 != EC_POINT_cmp(group, R, Q, ctx)) ABORT;
+
+                fprintf(stdout, ".");
+                fflush(stdout);
+
+                if (!BN_pseudo_rand(y, BN_num_bits(y), 0, 0)) ABORT;
+                if (!BN_add(z, z, y)) ABORT;
+                BN_set_negative(z, 1);
+                scalars[0] = y;
+                scalars[1] = z; /* z = -(order + y) */
+
+                if (!EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx)) ABORT;
+                if (!EC_POINT_is_at_infinity(group, P)) ABORT;
+
+                fprintf(stdout, ".");
+                fflush(stdout);
+
+                if (!BN_pseudo_rand(x, BN_num_bits(y) - 1, 0, 0)) ABORT;
+                if (!BN_add(z, x, y)) ABORT;
+                BN_set_negative(z, 1);
+                scalars[0] = x;
+                scalars[1] = y;
+                scalars[2] = z; /* z = -(x+y) */
+
+                if (!EC_POINTs_mul(group, P, NULL, 3, points, scalars, ctx)) ABORT;
+                if (!EC_POINT_is_at_infinity(group, P)) ABORT;
+
+                fprintf(stdout, " ok\n\n");
+        }
+
+
+#if 0
+        timings(C2_K163, TIMING_BASE_PT, ctx);
+        timings(C2_K163, TIMING_RAND_PT, ctx);
+        timings(C2_K163, TIMING_SIMUL, ctx);
+        timings(C2_B163, TIMING_BASE_PT, ctx);
+        timings(C2_B163, TIMING_RAND_PT, ctx);
+        timings(C2_B163, TIMING_SIMUL, ctx);
+        timings(C2_K233, TIMING_BASE_PT, ctx);
+        timings(C2_K233, TIMING_RAND_PT, ctx);
+        timings(C2_K233, TIMING_SIMUL, ctx);
+        timings(C2_B233, TIMING_BASE_PT, ctx);
+        timings(C2_B233, TIMING_RAND_PT, ctx);
+        timings(C2_B233, TIMING_SIMUL, ctx);
+        timings(C2_K283, TIMING_BASE_PT, ctx);
+        timings(C2_K283, TIMING_RAND_PT, ctx);
+        timings(C2_K283, TIMING_SIMUL, ctx);
+        timings(C2_B283, TIMING_BASE_PT, ctx);
+        timings(C2_B283, TIMING_RAND_PT, ctx);
+        timings(C2_B283, TIMING_SIMUL, ctx);
+        timings(C2_K409, TIMING_BASE_PT, ctx);
+        timings(C2_K409, TIMING_RAND_PT, ctx);
+        timings(C2_K409, TIMING_SIMUL, ctx);
+        timings(C2_B409, TIMING_BASE_PT, ctx);
+        timings(C2_B409, TIMING_RAND_PT, ctx);
+        timings(C2_B409, TIMING_SIMUL, ctx);
+        timings(C2_K571, TIMING_BASE_PT, ctx);
+        timings(C2_K571, TIMING_RAND_PT, ctx);
+        timings(C2_K571, TIMING_SIMUL, ctx);
+        timings(C2_B571, TIMING_BASE_PT, ctx);
+        timings(C2_B571, TIMING_RAND_PT, ctx);
+        timings(C2_B571, TIMING_SIMUL, ctx);
+#endif
+
+
+        if (ctx)
+                BN_CTX_free(ctx);
+        BN_free(p); BN_free(a); BN_free(b);
+        EC_GROUP_free(group);
+        EC_POINT_free(P);
+        EC_POINT_free(Q);
+        EC_POINT_free(R);
+        BN_free(x); BN_free(y); BN_free(z); BN_free(cof);
+
+        if (C2_K163) EC_GROUP_free(C2_K163);
+        if (C2_B163) EC_GROUP_free(C2_B163);
+        if (C2_K233) EC_GROUP_free(C2_K233);
+        if (C2_B233) EC_GROUP_free(C2_B233);
+        if (C2_K283) EC_GROUP_free(C2_K283);
+        if (C2_B283) EC_GROUP_free(C2_B283);
+        if (C2_K409) EC_GROUP_free(C2_K409);
+        if (C2_B409) EC_GROUP_free(C2_B409);
+        if (C2_K571) EC_GROUP_free(C2_K571);
+        if (C2_B571) EC_GROUP_free(C2_B571);
+
+        }
+
+void internal_curve_test(void)
+        {
+        EC_builtin_curve *curves = NULL;
+        size_t crv_len = 0, n = 0;
+        int    ok = 1;
+
+        crv_len = EC_get_builtin_curves(NULL, 0);
+
+        curves = OPENSSL_malloc(sizeof(EC_builtin_curve) * crv_len);
+
+        if (curves == NULL)
+                return;
+
+        if (!EC_get_builtin_curves(curves, crv_len))
+                {
+                OPENSSL_free(curves);
+                return;
+                }
+
+        fprintf(stdout, "testing internal curves: ");
+                
+        for (n = 0; n < crv_len; n++)
+                {
+                EC_GROUP *group = NULL;
+                int nid = curves[n].nid;
+                if ((group = EC_GROUP_new_by_curve_name(nid)) == NULL)
+                        {
+                        ok = 0;
+                        fprintf(stdout, "\nEC_GROUP_new_curve_name() failed with"
+                                " curve %s\n", OBJ_nid2sn(nid));
+                        /* try next curve */
+                        continue;
+                        }
+                if (!EC_GROUP_check(group, NULL))
+                        {
+                        ok = 0;
+                        fprintf(stdout, "\nEC_GROUP_check() failed with"
+                                " curve %s\n", OBJ_nid2sn(nid));
+                        EC_GROUP_free(group);
+                        /* try the next curve */
+                        continue;
+                        }
+                fprintf(stdout, ".");
+                fflush(stdout);
+                EC_GROUP_free(group);
+                }
+        if (ok)
+                fprintf(stdout, " ok\n");
+        else
+                fprintf(stdout, " failed\n");
+        OPENSSL_free(curves);
+        return;
+        }
+
+static const char rnd_seed[] = "string to make the random number generator think it has entropy";
+
+int main(int argc, char *argv[])
+        {       
+        
+        /* enable memory leak checking unless explicitly disabled */
+        if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
+                {
+                CRYPTO_malloc_debug_init();
+                CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
+                }
+        else
+                {
+                /* OPENSSL_DEBUG_MEMORY=off */
+                CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
+                }
+        CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+        ERR_load_crypto_strings();
+
+        RAND_seed(rnd_seed, sizeof rnd_seed); /* or BN_generate_prime may fail */
+
+        prime_field_tests();
+        puts("");
+        char2_field_tests();
+        /* test the internal curves */
+        internal_curve_test();
+
 #ifndef OPENSSL_NO_ENGINE
         ENGINE_cleanup();
 #endif
diff --git a/src/lib/libssl/src/crypto/engine/eng_all.c b/src/lib/libssl/src/crypto/engine/eng_all.c
index 0f6992a40d..8599046717 100644
--- a/src/lib/libssl/src/crypto/engine/eng_all.c
+++ b/src/lib/libssl/src/crypto/engine/eng_all.c
@@ -56,8 +56,7 @@
  *
  */
 
-#include <openssl/err.h>
-#include <openssl/engine.h>
+#include "cryptlib.h"
 #include "eng_int.h"
 
 void ENGINE_load_builtin_engines(void)
@@ -69,32 +68,42 @@ void ENGINE_load_builtin_engines(void)
 #if 0
         ENGINE_load_openssl();
 #endif
+#if !defined(OPENSSL_NO_HW) && !defined(OPENSSL_NO_HW_PADLOCK)
+        ENGINE_load_padlock();
+#endif
         ENGINE_load_dynamic();
+#ifndef OPENSSL_NO_STATIC_ENGINE
 #ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_4758_CCA
+        ENGINE_load_4758cca();
+#endif
+#ifndef OPENSSL_NO_HW_AEP
+        ENGINE_load_aep();
+#endif
+#ifndef OPENSSL_NO_HW_ATALLA
+        ENGINE_load_atalla();
+#endif
 #ifndef OPENSSL_NO_HW_CSWIFT
         ENGINE_load_cswift();
 #endif
 #ifndef OPENSSL_NO_HW_NCIPHER
         ENGINE_load_chil();
 #endif
-#ifndef OPENSSL_NO_HW_ATALLA
-        ENGINE_load_atalla();
-#endif
 #ifndef OPENSSL_NO_HW_NURON
         ENGINE_load_nuron();
 #endif
+#ifndef OPENSSL_NO_HW_SUREWARE
+        ENGINE_load_sureware();
+#endif
 #ifndef OPENSSL_NO_HW_UBSEC
         ENGINE_load_ubsec();
 #endif
-#ifndef OPENSSL_NO_HW_AEP
-        ENGINE_load_aep();
 #endif
-#ifndef OPENSSL_NO_HW_SUREWARE
-        ENGINE_load_sureware();
+#if !defined(OPENSSL_NO_GMP) && !defined(OPENSSL_NO_HW_GMP)
+        ENGINE_load_gmp();
 #endif
-#ifndef OPENSSL_NO_HW_4758_CCA
-        ENGINE_load_4758cca();
 #endif
+#ifndef OPENSSL_NO_HW
 #if defined(__OpenBSD__) || defined(__FreeBSD__)
         ENGINE_load_cryptodev();
 #endif
diff --git a/src/lib/libssl/src/crypto/engine/eng_cnf.c b/src/lib/libssl/src/crypto/engine/eng_cnf.c
index 4225760af1..a97e01e619 100644
--- a/src/lib/libssl/src/crypto/engine/eng_cnf.c
+++ b/src/lib/libssl/src/crypto/engine/eng_cnf.c
@@ -56,11 +56,8 @@
  *
  */
 
-#include <stdio.h>
-#include <openssl/crypto.h>
-#include "cryptlib.h"
+#include "eng_int.h"
 #include <openssl/conf.h>
-#include <openssl/engine.h>
 
 /* #define ENGINE_CONF_DEBUG */
 
@@ -210,7 +207,7 @@ static int int_engine_module_init(CONF_IMODULE *md, const CONF *cnf)
 
         if (!elist)
                 {
-                ENGINEerr(ENGINE_F_ENGINE_MODULE_INIT, ENGINE_R_ENGINES_SECTION_ERROR);
+                ENGINEerr(ENGINE_F_INT_ENGINE_MODULE_INIT, ENGINE_R_ENGINES_SECTION_ERROR);
                 return 0;
                 }
 
diff --git a/src/lib/libssl/src/crypto/engine/eng_ctrl.c b/src/lib/libssl/src/crypto/engine/eng_ctrl.c
index 412c73fb0f..95b6b455aa 100644
--- a/src/lib/libssl/src/crypto/engine/eng_ctrl.c
+++ b/src/lib/libssl/src/crypto/engine/eng_ctrl.c
@@ -53,10 +53,7 @@
  *
  */
 
-#include <openssl/crypto.h>
-#include "cryptlib.h"
 #include "eng_int.h"
-#include <openssl/engine.h>
 
 /* When querying a ENGINE-specific control command's 'description', this string
  * is used if the ENGINE_CMD_DEFN has cmd_desc set to NULL. */
@@ -103,7 +100,8 @@ static int int_ctrl_cmd_by_num(const ENGINE_CMD_DEFN *defn, unsigned int num)
         return -1;
         }
 
-static int int_ctrl_helper(ENGINE *e, int cmd, long i, void *p, void (*f)())
+static int int_ctrl_helper(ENGINE *e, int cmd, long i, void *p,
+                           void (*f)(void))
         {
         int idx;
         char *s = (char *)p;
@@ -181,7 +179,7 @@ static int int_ctrl_helper(ENGINE *e, int cmd, long i, void *p, void (*f)())
         return -1;
         }
 
-int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
+int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
         {
         int ctrl_exists, ref_exists;
         if(e == NULL)
@@ -251,13 +249,13 @@ int ENGINE_cmd_is_executable(ENGINE *e, int cmd)
         }
 
 int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name,
-        long i, void *p, void (*f)(), int cmd_optional)
+        long i, void *p, void (*f)(void), int cmd_optional)
         {
         int num;
 
         if((e == NULL) || (cmd_name == NULL))
                 {
-                ENGINEerr(ENGINE_F_ENGINE_CTRL_CMD_STRING,
+                ENGINEerr(ENGINE_F_ENGINE_CTRL_CMD,
                         ERR_R_PASSED_NULL_PARAMETER);
                 return 0;
                 }
diff --git a/src/lib/libssl/src/crypto/engine/eng_dyn.c b/src/lib/libssl/src/crypto/engine/eng_dyn.c
index 4139a16e76..acb30c34d8 100644
--- a/src/lib/libssl/src/crypto/engine/eng_dyn.c
+++ b/src/lib/libssl/src/crypto/engine/eng_dyn.c
@@ -57,11 +57,7 @@
  */
 
 
-#include <stdio.h>
-#include <openssl/crypto.h>
-#include "cryptlib.h"
 #include "eng_int.h"
-#include <openssl/engine.h>
 #include <openssl/dso.h>
 
 /* Shared libraries implementing ENGINEs for use by the "dynamic" ENGINE loader
@@ -70,7 +66,7 @@
 /* Our ENGINE handlers */
 static int dynamic_init(ENGINE *e);
 static int dynamic_finish(ENGINE *e);
-static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
+static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void));
 /* Predeclare our context type */
 typedef struct st_dynamic_data_ctx dynamic_data_ctx;
 /* The implementation for the important control command */
@@ -80,7 +76,9 @@ static int dynamic_load(ENGINE *e, dynamic_data_ctx *ctx);
 #define DYNAMIC_CMD_NO_VCHECK           (ENGINE_CMD_BASE + 1)
 #define DYNAMIC_CMD_ID                  (ENGINE_CMD_BASE + 2)
 #define DYNAMIC_CMD_LIST_ADD            (ENGINE_CMD_BASE + 3)
-#define DYNAMIC_CMD_LOAD                (ENGINE_CMD_BASE + 4)
+#define DYNAMIC_CMD_DIR_LOAD            (ENGINE_CMD_BASE + 4)
+#define DYNAMIC_CMD_DIR_ADD             (ENGINE_CMD_BASE + 5)
+#define DYNAMIC_CMD_LOAD                (ENGINE_CMD_BASE + 6)
 
 /* The constants used when creating the ENGINE */
 static const char *engine_dynamic_id = "dynamic";
@@ -102,6 +100,14 @@ static const ENGINE_CMD_DEFN dynamic_cmd_defns[] = {
                 "LIST_ADD",
                 "Whether to add a loaded ENGINE to the internal list (0=no,1=yes,2=mandatory)",
                 ENGINE_CMD_FLAG_NUMERIC},
+        {DYNAMIC_CMD_DIR_LOAD,
+                "DIR_LOAD",
+                "Specifies whether to load from 'DIR_ADD' directories (0=no,1=yes,2=mandatory)",
+                ENGINE_CMD_FLAG_NUMERIC},
+        {DYNAMIC_CMD_DIR_ADD,
+                "DIR_ADD",
+                "Adds a directory from which ENGINEs can be loaded",
+                ENGINE_CMD_FLAG_STRING},
         {DYNAMIC_CMD_LOAD,
                 "LOAD",
                 "Load up the ENGINE specified by other settings",
@@ -136,12 +142,18 @@ struct st_dynamic_data_ctx
         const char *DYNAMIC_F1;
         /* The symbol name for the "initialise ENGINE structure" function */
         const char *DYNAMIC_F2;
+        /* Whether to never use 'dirs', use 'dirs' as a fallback, or only use
+         * 'dirs' for loading. Default is to use 'dirs' as a fallback. */
+        int dir_load;
+        /* A stack of directories from which ENGINEs could be loaded */
+        STACK *dirs;
         };
 
 /* This is the "ex_data" index we obtain and reserve for use with our context
  * structure. */
 static int dynamic_ex_data_idx = -1;
 
+static void int_free_str(void *s) { OPENSSL_free(s); }
 /* Because our ex_data element may or may not get allocated depending on whether
  * a "first-use" occurs before the ENGINE is freed, we have a memory leak
  * problem to solve. We can't declare a "new" handler for the ex_data as we
@@ -161,6 +173,8 @@ static void dynamic_data_ctx_free_func(void *parent, void *ptr,
                         OPENSSL_free((void*)ctx->DYNAMIC_LIBNAME);
                 if(ctx->engine_id)
                         OPENSSL_free((void*)ctx->engine_id);
+                if(ctx->dirs)
+                        sk_pop_free(ctx->dirs, int_free_str);
                 OPENSSL_free(ctx);
                 }
         }
@@ -175,7 +189,7 @@ static int dynamic_set_data_ctx(ENGINE *e, dynamic_data_ctx **ctx)
         c = OPENSSL_malloc(sizeof(dynamic_data_ctx));
         if(!c)
                 {
-                ENGINEerr(ENGINE_F_SET_DATA_CTX,ERR_R_MALLOC_FAILURE);
+                ENGINEerr(ENGINE_F_DYNAMIC_SET_DATA_CTX,ERR_R_MALLOC_FAILURE);
                 return 0;
                 }
         memset(c, 0, sizeof(dynamic_data_ctx));
@@ -188,6 +202,14 @@ static int dynamic_set_data_ctx(ENGINE *e, dynamic_data_ctx **ctx)
         c->list_add_value = 0;
         c->DYNAMIC_F1 = "v_check";
         c->DYNAMIC_F2 = "bind_engine";
+        c->dir_load = 1;
+        c->dirs = sk_new_null();
+        if(!c->dirs)
+                {
+                ENGINEerr(ENGINE_F_DYNAMIC_SET_DATA_CTX,ERR_R_MALLOC_FAILURE);
+                OPENSSL_free(c);
+                return 0;
+                }
         CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
         if((*ctx = (dynamic_data_ctx *)ENGINE_get_ex_data(e,
                                 dynamic_ex_data_idx)) == NULL)
@@ -290,7 +312,7 @@ static int dynamic_finish(ENGINE *e)
         return 0;
         }
 
-static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
+static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
         {
         dynamic_data_ctx *ctx = dynamic_get_data_ctx(e);
         int initialised;
@@ -346,6 +368,34 @@ static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
                 return 1;
         case DYNAMIC_CMD_LOAD:
                 return dynamic_load(e, ctx);
+        case DYNAMIC_CMD_DIR_LOAD:
+                if((i < 0) || (i > 2))
+                        {
+                        ENGINEerr(ENGINE_F_DYNAMIC_CTRL,
+                                ENGINE_R_INVALID_ARGUMENT);
+                        return 0;
+                        }
+                ctx->dir_load = (int)i;
+                return 1;
+        case DYNAMIC_CMD_DIR_ADD:
+                /* a NULL 'p' or a string of zero-length is the same thing */
+                if(!p || (strlen((const char *)p) < 1))
+                        {
+                        ENGINEerr(ENGINE_F_DYNAMIC_CTRL,
+                                ENGINE_R_INVALID_ARGUMENT);
+                        return 0;
+                        }
+                {
+                char *tmp_str = BUF_strdup(p);
+                if(!tmp_str)
+                        {
+                        ENGINEerr(ENGINE_F_DYNAMIC_CTRL,
+                                ERR_R_MALLOC_FAILURE);
+                        return 0;
+                        }
+                sk_insert(ctx->dirs, tmp_str, -1);
+                }
+                return 1;
         default:
                 break;
                 }
@@ -353,16 +403,53 @@ static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
         return 0;
         }
 
+static int int_load(dynamic_data_ctx *ctx)
+        {
+        int num, loop;
+        /* Unless told not to, try a direct load */
+        if((ctx->dir_load != 2) && (DSO_load(ctx->dynamic_dso,
+                                ctx->DYNAMIC_LIBNAME, NULL, 0)) != NULL)
+                return 1;
+        /* If we're not allowed to use 'dirs' or we have none, fail */
+        if(!ctx->dir_load || ((num = sk_num(ctx->dirs)) < 1))
+                return 0;
+        for(loop = 0; loop < num; loop++)
+                {
+                const char *s = sk_value(ctx->dirs, loop);
+                char *merge = DSO_merge(ctx->dynamic_dso, ctx->DYNAMIC_LIBNAME, s);
+                if(!merge)
+                        return 0;
+                if(DSO_load(ctx->dynamic_dso, merge, NULL, 0))
+                        {
+                        /* Found what we're looking for */
+                        OPENSSL_free(merge);
+                        return 1;
+                        }
+                OPENSSL_free(merge);
+                }
+        return 0;
+        }
+
 static int dynamic_load(ENGINE *e, dynamic_data_ctx *ctx)
         {
         ENGINE cpy;
         dynamic_fns fns;
 
-        if(!ctx->DYNAMIC_LIBNAME || ((ctx->dynamic_dso = DSO_load(NULL,
-                                ctx->DYNAMIC_LIBNAME, NULL, 0)) == NULL))
+        if(!ctx->dynamic_dso)
+                ctx->dynamic_dso = DSO_new();
+        if(!ctx->DYNAMIC_LIBNAME)
+                {
+                if(!ctx->engine_id)
+                        return 0;
+                ctx->DYNAMIC_LIBNAME =
+                        DSO_convert_filename(ctx->dynamic_dso, ctx->engine_id);
+                }
+        if(!int_load(ctx))
                 {
                 ENGINEerr(ENGINE_F_DYNAMIC_LOAD,
                         ENGINE_R_DSO_NOT_FOUND);
+                DSO_free(ctx->dynamic_dso);
+                ctx->dynamic_dso = NULL;
                 return 0;
                 }
         /* We have to find a bind function otherwise it'll always end badly */
@@ -409,6 +496,7 @@ static int dynamic_load(ENGINE *e, dynamic_data_ctx *ctx)
          * engine.h, much of this would be simplified if each area of code
          * provided its own "summary" structure of all related callbacks. It
          * would also increase opaqueness. */
+        fns.static_state = ENGINE_get_static_state();
         fns.err_fns = ERR_get_implementation();
         fns.ex_data_fns = CRYPTO_get_ex_data_implementation();
         CRYPTO_get_mem_functions(&fns.mem_fns.malloc_cb,
diff --git a/src/lib/libssl/src/crypto/engine/eng_err.c b/src/lib/libssl/src/crypto/engine/eng_err.c
index fdc0e7be0f..369f2e22d3 100644
--- a/src/lib/libssl/src/crypto/engine/eng_err.c
+++ b/src/lib/libssl/src/crypto/engine/eng_err.c
@@ -73,6 +73,7 @@ static ERR_STRING_DATA ENGINE_str_functs[]=
 {ERR_FUNC(ENGINE_F_DYNAMIC_CTRL),       "DYNAMIC_CTRL"},
 {ERR_FUNC(ENGINE_F_DYNAMIC_GET_DATA_CTX),       "DYNAMIC_GET_DATA_CTX"},
 {ERR_FUNC(ENGINE_F_DYNAMIC_LOAD),       "DYNAMIC_LOAD"},
+{ERR_FUNC(ENGINE_F_DYNAMIC_SET_DATA_CTX),       "DYNAMIC_SET_DATA_CTX"},
 {ERR_FUNC(ENGINE_F_ENGINE_ADD), "ENGINE_add"},
 {ERR_FUNC(ENGINE_F_ENGINE_BY_ID),       "ENGINE_by_id"},
 {ERR_FUNC(ENGINE_F_ENGINE_CMD_IS_EXECUTABLE),   "ENGINE_cmd_is_executable"},
@@ -80,7 +81,7 @@ static ERR_STRING_DATA ENGINE_str_functs[]=
 {ERR_FUNC(ENGINE_F_ENGINE_CTRL_CMD),    "ENGINE_ctrl_cmd"},
 {ERR_FUNC(ENGINE_F_ENGINE_CTRL_CMD_STRING),     "ENGINE_ctrl_cmd_string"},
 {ERR_FUNC(ENGINE_F_ENGINE_FINISH),      "ENGINE_finish"},
-{ERR_FUNC(ENGINE_F_ENGINE_FREE),        "ENGINE_free"},
+{ERR_FUNC(ENGINE_F_ENGINE_FREE_UTIL),   "ENGINE_FREE_UTIL"},
 {ERR_FUNC(ENGINE_F_ENGINE_GET_CIPHER),  "ENGINE_get_cipher"},
 {ERR_FUNC(ENGINE_F_ENGINE_GET_DEFAULT_TYPE),    "ENGINE_GET_DEFAULT_TYPE"},
 {ERR_FUNC(ENGINE_F_ENGINE_GET_DIGEST),  "ENGINE_get_digest"},
@@ -91,7 +92,6 @@ static ERR_STRING_DATA ENGINE_str_functs[]=
 {ERR_FUNC(ENGINE_F_ENGINE_LIST_REMOVE), "ENGINE_LIST_REMOVE"},
 {ERR_FUNC(ENGINE_F_ENGINE_LOAD_PRIVATE_KEY),    "ENGINE_load_private_key"},
 {ERR_FUNC(ENGINE_F_ENGINE_LOAD_PUBLIC_KEY),     "ENGINE_load_public_key"},
-{ERR_FUNC(ENGINE_F_ENGINE_MODULE_INIT), "ENGINE_MODULE_INIT"},
 {ERR_FUNC(ENGINE_F_ENGINE_NEW), "ENGINE_new"},
 {ERR_FUNC(ENGINE_F_ENGINE_REMOVE),      "ENGINE_remove"},
 {ERR_FUNC(ENGINE_F_ENGINE_SET_DEFAULT_STRING),  "ENGINE_set_default_string"},
@@ -100,11 +100,12 @@ static ERR_STRING_DATA ENGINE_str_functs[]=
 {ERR_FUNC(ENGINE_F_ENGINE_SET_NAME),    "ENGINE_set_name"},
 {ERR_FUNC(ENGINE_F_ENGINE_TABLE_REGISTER),      "ENGINE_TABLE_REGISTER"},
 {ERR_FUNC(ENGINE_F_ENGINE_UNLOAD_KEY),  "ENGINE_UNLOAD_KEY"},
+{ERR_FUNC(ENGINE_F_ENGINE_UNLOCKED_FINISH),     "ENGINE_UNLOCKED_FINISH"},
 {ERR_FUNC(ENGINE_F_ENGINE_UP_REF),      "ENGINE_up_ref"},
 {ERR_FUNC(ENGINE_F_INT_CTRL_HELPER),    "INT_CTRL_HELPER"},
 {ERR_FUNC(ENGINE_F_INT_ENGINE_CONFIGURE),       "INT_ENGINE_CONFIGURE"},
+{ERR_FUNC(ENGINE_F_INT_ENGINE_MODULE_INIT),     "INT_ENGINE_MODULE_INIT"},
 {ERR_FUNC(ENGINE_F_LOG_MESSAGE),        "LOG_MESSAGE"},
-{ERR_FUNC(ENGINE_F_SET_DATA_CTX),       "SET_DATA_CTX"},
 {0,NULL}
         };
 
@@ -156,15 +157,12 @@ static ERR_STRING_DATA ENGINE_str_reasons[]=
 
 void ERR_load_ENGINE_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(ENGINE_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,ENGINE_str_functs);
                 ERR_load_strings(0,ENGINE_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/engine/eng_fat.c b/src/lib/libssl/src/crypto/engine/eng_fat.c
index 7ccf7022ee..27c1662f62 100644
--- a/src/lib/libssl/src/crypto/engine/eng_fat.c
+++ b/src/lib/libssl/src/crypto/engine/eng_fat.c
@@ -52,11 +52,13 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
-#include <openssl/crypto.h>
-#include "cryptlib.h"
 #include "eng_int.h"
-#include <openssl/engine.h>
 #include <openssl/conf.h>
 
 int ENGINE_set_default(ENGINE *e, unsigned int flags)
@@ -77,6 +79,14 @@ int ENGINE_set_default(ENGINE *e, unsigned int flags)
         if((flags & ENGINE_METHOD_DH) && !ENGINE_set_default_DH(e))
                 return 0;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        if((flags & ENGINE_METHOD_ECDH) && !ENGINE_set_default_ECDH(e))
+                return 0;
+#endif
+#ifndef OPENSSL_NO_ECDSA
+        if((flags & ENGINE_METHOD_ECDSA) && !ENGINE_set_default_ECDSA(e))
+                return 0;
+#endif
         if((flags & ENGINE_METHOD_RAND) && !ENGINE_set_default_RAND(e))
                 return 0;
         return 1;
@@ -93,6 +103,10 @@ static int int_def_cb(const char *alg, int len, void *arg)
                 *pflags |= ENGINE_METHOD_RSA;
         else if (!strncmp(alg, "DSA", len))
                 *pflags |= ENGINE_METHOD_DSA;
+        else if (!strncmp(alg, "ECDH", len))
+                *pflags |= ENGINE_METHOD_ECDH;
+        else if (!strncmp(alg, "ECDSA", len))
+                *pflags |= ENGINE_METHOD_ECDSA;
         else if (!strncmp(alg, "DH", len))
                 *pflags |= ENGINE_METHOD_DH;
         else if (!strncmp(alg, "RAND", len))
@@ -133,6 +147,12 @@ int ENGINE_register_complete(ENGINE *e)
 #ifndef OPENSSL_NO_DH
         ENGINE_register_DH(e);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        ENGINE_register_ECDH(e);
+#endif
+#ifndef OPENSSL_NO_ECDSA
+        ENGINE_register_ECDSA(e);
+#endif
         ENGINE_register_RAND(e);
         return 1;
         }
diff --git a/src/lib/libssl/src/crypto/engine/eng_init.c b/src/lib/libssl/src/crypto/engine/eng_init.c
index 170c1791b3..7633cf5f1d 100644
--- a/src/lib/libssl/src/crypto/engine/eng_init.c
+++ b/src/lib/libssl/src/crypto/engine/eng_init.c
@@ -53,10 +53,7 @@
  *
  */
 
-#include <openssl/crypto.h>
-#include "cryptlib.h"
 #include "eng_int.h"
-#include <openssl/engine.h>
 
 /* Initialise a engine type for use (or up its functional reference count
  * if it's already in use). This version is only used internally. */
@@ -114,7 +111,7 @@ int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers)
         /* Release the structural reference too */
         if(!engine_free_util(e, 0))
                 {
-                ENGINEerr(ENGINE_F_ENGINE_FINISH,ENGINE_R_FINISH_FAILED);
+                ENGINEerr(ENGINE_F_ENGINE_UNLOCKED_FINISH,ENGINE_R_FINISH_FAILED);
                 return 0;
                 }
         return to_return;
diff --git a/src/lib/libssl/src/crypto/engine/eng_int.h b/src/lib/libssl/src/crypto/engine/eng_int.h
index 38335f99cd..a5b1edebf4 100644
--- a/src/lib/libssl/src/crypto/engine/eng_int.h
+++ b/src/lib/libssl/src/crypto/engine/eng_int.h
@@ -55,10 +55,16 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #ifndef HEADER_ENGINE_INT_H
 #define HEADER_ENGINE_INT_H
 
+#include "cryptlib.h"
 /* Take public definitions from engine.h */
 #include <openssl/engine.h>
 
@@ -146,7 +152,10 @@ struct engine_st
         const RSA_METHOD *rsa_meth;
         const DSA_METHOD *dsa_meth;
         const DH_METHOD *dh_meth;
+        const ECDH_METHOD *ecdh_meth;
+        const ECDSA_METHOD *ecdsa_meth;
         const RAND_METHOD *rand_meth;
+        const STORE_METHOD *store_meth;
         /* Cipher handling is via this callback */
         ENGINE_CIPHERS_PTR ciphers;
         /* Digest handling is via this callback */
diff --git a/src/lib/libssl/src/crypto/engine/eng_lib.c b/src/lib/libssl/src/crypto/engine/eng_lib.c
index a66d0f08af..5815b867f4 100644
--- a/src/lib/libssl/src/crypto/engine/eng_lib.c
+++ b/src/lib/libssl/src/crypto/engine/eng_lib.c
@@ -56,11 +56,8 @@
  *
  */
 
-#include <openssl/crypto.h>
-#include "cryptlib.h"
 #include "eng_int.h"
-#include <openssl/rand.h> /* FIXME: This shouldn't be needed */
-#include <openssl/engine.h>
+#include <openssl/rand.h>
 
 /* The "new"/"free" stuff first */
 
@@ -92,6 +89,7 @@ void engine_set_all_null(ENGINE *e)
         e->dsa_meth = NULL;
         e->dh_meth = NULL;
         e->rand_meth = NULL;
+        e->store_meth = NULL;
         e->ciphers = NULL;
         e->digests = NULL;
         e->destroy = NULL;
@@ -110,7 +108,7 @@ int engine_free_util(ENGINE *e, int locked)
 
         if(e == NULL)
                 {
-                ENGINEerr(ENGINE_F_ENGINE_FREE,
+                ENGINEerr(ENGINE_F_ENGINE_FREE_UTIL,
                         ERR_R_PASSED_NULL_PARAMETER);
                 return 0;
                 }
@@ -319,3 +317,13 @@ const ENGINE_CMD_DEFN *ENGINE_get_cmd_defns(const ENGINE *e)
         {
         return e->cmd_defns;
         }
+
+/* eng_lib.o is pretty much linked into anything that touches ENGINE already, so
+ * put the "static_state" hack here. */
+
+static int internal_static_hack = 0;
+
+void *ENGINE_get_static_state(void)
+        {
+        return &internal_static_hack;
+        }
diff --git a/src/lib/libssl/src/crypto/engine/eng_list.c b/src/lib/libssl/src/crypto/engine/eng_list.c
index 1cc3217f4c..bd511944ba 100644
--- a/src/lib/libssl/src/crypto/engine/eng_list.c
+++ b/src/lib/libssl/src/crypto/engine/eng_list.c
@@ -55,11 +55,13 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
-#include <openssl/crypto.h>
-#include "cryptlib.h"
 #include "eng_int.h"
-#include <openssl/engine.h>
 
 /* The linked-list of pointers to engine types. engine_list_head
  * incorporates an implicit structural reference but engine_list_tail
@@ -324,7 +326,14 @@ static void engine_cpy(ENGINE *dest, const ENGINE *src)
 #ifndef OPENSSL_NO_DH
         dest->dh_meth = src->dh_meth;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        dest->ecdh_meth = src->ecdh_meth;
+#endif
+#ifndef OPENSSL_NO_ECDSA
+        dest->ecdsa_meth = src->ecdsa_meth;
+#endif
         dest->rand_meth = src->rand_meth;
+        dest->store_meth = src->store_meth;
         dest->ciphers = src->ciphers;
         dest->digests = src->digests;
         dest->destroy = src->destroy;
@@ -340,6 +349,7 @@ static void engine_cpy(ENGINE *dest, const ENGINE *src)
 ENGINE *ENGINE_by_id(const char *id)
         {
         ENGINE *iterator;
+        char *load_dir = NULL;
         if(id == NULL)
                 {
                 ENGINEerr(ENGINE_F_ENGINE_BY_ID,
@@ -373,6 +383,7 @@ ENGINE *ENGINE_by_id(const char *id)
                         }
                 }
         CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+#if 0
         if(iterator == NULL)
                 {
                 ENGINEerr(ENGINE_F_ENGINE_BY_ID,
@@ -380,6 +391,32 @@ ENGINE *ENGINE_by_id(const char *id)
                 ERR_add_error_data(2, "id=", id);
                 }
         return iterator;
+#else
+        /* EEK! Experimental code starts */
+        if(iterator) return iterator;
+        /* Prevent infinite recusrion if we're looking for the dynamic engine. */
+        if (strcmp(id, "dynamic"))
+                {
+#ifdef OPENSSL_SYS_VMS
+                if((load_dir = getenv("OPENSSL_ENGINES")) == 0) load_dir = "SSLROOT:[ENGINES]";
+#else
+                if((load_dir = getenv("OPENSSL_ENGINES")) == 0) load_dir = ENGINESDIR;
+#endif
+                iterator = ENGINE_by_id("dynamic");
+                if(!iterator || !ENGINE_ctrl_cmd_string(iterator, "ID", id, 0) ||
+                                !ENGINE_ctrl_cmd_string(iterator, "DIR_LOAD", "2", 0) ||
+                                !ENGINE_ctrl_cmd_string(iterator, "DIR_ADD",
+                                        load_dir, 0) ||
+                                !ENGINE_ctrl_cmd_string(iterator, "LOAD", NULL, 0))
+                                goto notfound;
+                return iterator;
+                }
+notfound:
+        ENGINEerr(ENGINE_F_ENGINE_BY_ID,ENGINE_R_NO_SUCH_ENGINE);
+        ERR_add_error_data(2, "id=", id);
+        return NULL;
+        /* EEK! Experimental code ends */
+#endif
         }
 
 int ENGINE_up_ref(ENGINE *e)
diff --git a/src/lib/libssl/src/crypto/engine/eng_openssl.c b/src/lib/libssl/src/crypto/engine/eng_openssl.c
index 54579eea2e..7c139ae2ef 100644
--- a/src/lib/libssl/src/crypto/engine/eng_openssl.c
+++ b/src/lib/libssl/src/crypto/engine/eng_openssl.c
@@ -55,6 +55,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 
 #include <stdio.h>
@@ -64,6 +69,16 @@
 #include <openssl/dso.h>
 #include <openssl/pem.h>
 #include <openssl/evp.h>
+#include <openssl/rand.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
 
 /* This testing gunk is implemented (and explained) lower down. It also assumes
  * the application explicitly calls "ENGINE_load_openssl()" because this is no
@@ -125,6 +140,12 @@ static int bind_helper(ENGINE *e)
 #ifndef OPENSSL_NO_DSA
                         || !ENGINE_set_DSA(e, DSA_get_default_method())
 #endif
+#ifndef OPENSSL_NO_ECDH
+                        || !ENGINE_set_ECDH(e, ECDH_OpenSSL())
+#endif
+#ifndef OPENSSL_NO_ECDSA
+                        || !ENGINE_set_ECDSA(e, ECDSA_OpenSSL())
+#endif
 #ifndef OPENSSL_NO_DH
                         || !ENGINE_set_DH(e, DH_get_default_method())
 #endif
@@ -236,6 +257,7 @@ static const EVP_CIPHER test_r4_cipher=
         sizeof(TEST_RC4_KEY),
         NULL,
         NULL,
+        NULL,
         NULL
         };
 static const EVP_CIPHER test_r4_40_cipher=
@@ -249,6 +271,7 @@ static const EVP_CIPHER test_r4_40_cipher=
         sizeof(TEST_RC4_KEY),
         NULL, 
         NULL,
+        NULL,
         NULL
         };
 static int openssl_ciphers(ENGINE *e, const EVP_CIPHER **cipher,
@@ -290,7 +313,7 @@ static int test_sha1_init(EVP_MD_CTX *ctx)
 #endif
         return SHA1_Init(ctx->md_data);
         }
-static int test_sha1_update(EVP_MD_CTX *ctx,const void *data,unsigned long count)
+static int test_sha1_update(EVP_MD_CTX *ctx,const void *data,size_t count)
         {
 #ifdef TEST_ENG_OPENSSL_SHA_P_UPDATE
         fprintf(stderr, "(TEST_ENG_OPENSSL_SHA) test_sha1_update() called\n");
diff --git a/src/lib/libssl/src/crypto/engine/eng_pkey.c b/src/lib/libssl/src/crypto/engine/eng_pkey.c
index 8c69171511..bc8b21abec 100644
--- a/src/lib/libssl/src/crypto/engine/eng_pkey.c
+++ b/src/lib/libssl/src/crypto/engine/eng_pkey.c
@@ -53,10 +53,7 @@
  *
  */
 
-#include <openssl/crypto.h>
-#include "cryptlib.h"
 #include "eng_int.h"
-#include <openssl/engine.h>
 
 /* Basic get/set stuff */
 
diff --git a/src/lib/libssl/src/crypto/engine/eng_table.c b/src/lib/libssl/src/crypto/engine/eng_table.c
index c69a84a8bf..8879a267d1 100644
--- a/src/lib/libssl/src/crypto/engine/eng_table.c
+++ b/src/lib/libssl/src/crypto/engine/eng_table.c
@@ -52,49 +52,31 @@
  *
  */
 
+#include "cryptlib.h"
 #include <openssl/evp.h>
-#include <openssl/engine.h>
+#include <openssl/lhash.h>
 #include "eng_int.h"
 
-/* This is the type of item in the 'implementation' table. Each 'nid' hashes to
- * a (potentially NULL) ENGINE_PILE structure which contains a stack of ENGINE*
- * pointers. These pointers aren't references, because they're inserted and
- * removed during ENGINE creation and ENGINE destruction. They point to ENGINEs
- * that *exist* (ie. have a structural reference count greater than zero) rather
- * than ENGINEs that are *functional*. Each pointer in those stacks are to
- * ENGINEs that implements the algorithm corresponding to each 'nid'. */
-
 /* The type of the items in the table */
 typedef struct st_engine_pile
         {
-        /* The 'nid' of the algorithm/mode this ENGINE_PILE structure represents
-         * */
+        /* The 'nid' of this algorithm/mode */
         int nid;
-        /* A stack of ENGINE pointers for ENGINEs that support this
-         * algorithm/mode. In the event that 'funct' is NULL, the first entry in
-         * this stack that initialises will be set as 'funct' and assumed as the
-         * default for operations of this type. */
+        /* ENGINEs that implement this algorithm/mode. */
         STACK_OF(ENGINE) *sk;
         /* The default ENGINE to perform this algorithm/mode. */
         ENGINE *funct;
-        /* This value optimises engine_table_select(). If it is called it sets
-         * this value to 1. Any changes to this ENGINE_PILE resets it to zero.
-         * As such, no ENGINE_init() thrashing is done unless ENGINEs
-         * continually register (and/or unregister). */
+        /* Zero if 'sk' is newer than the cached 'funct', non-zero otherwise */
         int uptodate;
         } ENGINE_PILE;
 
-/* The type of the hash table of ENGINE_PILE structures such that each are
- * unique and keyed by the 'nid' value. */
+/* The type exposed in eng_int.h */
 struct st_engine_table
         {
         LHASH piles;
         }; /* ENGINE_TABLE */
 
-/* This value stores global options controlling behaviour of (mostly) the
- * engine_table_select() function. It's a bitmask of flag values of the form
- * ENGINE_TABLE_FLAG_*** (as defined in engine.h) and is controlled by the
- * ENGINE_[get|set]_table_flags() function. */
+/* Global flags (ENGINE_TABLE_FLAG_***). */
 static unsigned int table_flags = 0;
 
 /* API function manipulating 'table_flags' */
@@ -121,10 +103,8 @@ static IMPLEMENT_LHASH_COMP_FN(engine_pile_cmp, const ENGINE_PILE *)
 static int int_table_check(ENGINE_TABLE **t, int create)
         {
         LHASH *lh;
-        if(*t)
-                return 1;
-        if(!create)
-                return 0;
+        if(*t) return 1;
+        if(!create) return 0;
         if((lh = lh_new(LHASH_HASH_FN(engine_pile_hash),
                         LHASH_COMP_FN(engine_pile_cmp))) == NULL)
                 return 0;
@@ -154,8 +134,7 @@ int engine_table_register(ENGINE_TABLE **table, ENGINE_CLEANUP_CB *cleanup,
                 if(!fnd)
                         {
                         fnd = OPENSSL_malloc(sizeof(ENGINE_PILE));
-                        if(!fnd)
-                                goto end;
+                        if(!fnd) goto end;
                         fnd->uptodate = 1;
                         fnd->nid = *nids;
                         fnd->sk = sk_ENGINE_new_null();
@@ -164,11 +143,11 @@ int engine_table_register(ENGINE_TABLE **table, ENGINE_CLEANUP_CB *cleanup,
                                 OPENSSL_free(fnd);
                                 goto end;
                                 }
-                        fnd->funct= NULL;
+                        fnd->funct = NULL;
                         lh_insert(&(*table)->piles, fnd);
                         }
                 /* A registration shouldn't add duplciate entries */
-                sk_ENGINE_delete_ptr(fnd->sk, e);
+                (void)sk_ENGINE_delete_ptr(fnd->sk, e);
                 /* if 'setdefault', this ENGINE goes to the head of the list */
                 if(!sk_ENGINE_push(fnd->sk, e))
                         goto end;
@@ -185,6 +164,7 @@ int engine_table_register(ENGINE_TABLE **table, ENGINE_CLEANUP_CB *cleanup,
                         if(fnd->funct)
                                 engine_unlocked_finish(fnd->funct, 0);
                         fnd->funct = e;
+                        fnd->uptodate = 1;
                         }
                 nids++;
                 }
@@ -199,8 +179,7 @@ static void int_unregister_cb(ENGINE_PILE *pile, ENGINE *e)
         /* Iterate the 'c->sk' stack removing any occurance of 'e' */
         while((n = sk_ENGINE_find(pile->sk, e)) >= 0)
                 {
-                sk_ENGINE_delete(pile->sk, n);
-                /* "touch" this ENGINE_CIPHER */
+                (void)sk_ENGINE_delete(pile->sk, n);
                 pile->uptodate = 0;
                 }
         if(pile->funct == e)
@@ -239,9 +218,7 @@ void engine_table_cleanup(ENGINE_TABLE **table)
         CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
         }
 
-/* Exposed API function to get a functional reference from the implementation
- * table (ie. try to get a functional reference from the tabled structural
- * references) for a given cipher 'nid' */
+/* return a functional reference for a given 'nid' */
 #ifndef ENGINE_TABLE_DEBUG
 ENGINE *engine_table_select(ENGINE_TABLE **table, int nid)
 #else
@@ -252,25 +229,21 @@ ENGINE *engine_table_select_tmp(ENGINE_TABLE **table, int nid, const char *f, in
         ENGINE_PILE tmplate, *fnd=NULL;
         int initres, loop = 0;
 
-        /* If 'engine_ciphers' is NULL, then it's absolutely *sure* that no
-         * ENGINEs have registered any implementations! */
         if(!(*table))
                 {
 #ifdef ENGINE_TABLE_DEBUG
-                fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, no "
-                        "registered for anything!\n", f, l, nid);
+                fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, nothing "
+                        "registered!\n", f, l, nid);
 #endif
                 return NULL;
                 }
         CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
         /* Check again inside the lock otherwise we could race against cleanup
          * operations. But don't worry about a fprintf(stderr). */
-        if(!int_table_check(table, 0))
-                goto end;
+        if(!int_table_check(table, 0)) goto end;
         tmplate.nid = nid;
         fnd = lh_retrieve(&(*table)->piles, &tmplate);
-        if(!fnd)
-                goto end;
+        if(!fnd) goto end;
         if(fnd->funct && engine_unlocked_init(fnd->funct))
                 {
 #ifdef ENGINE_TABLE_DEBUG
@@ -296,34 +269,19 @@ trynext:
 #endif
                 goto end;
                 }
-#if 0
-        /* Don't need to get a reference if we hold the lock. If the locking has
-         * to change in future, that would be different ... */
-        ret->struct_ref++; engine_ref_debug(ret, 0, 1)
-#endif
-        /* Try and initialise the ENGINE if it's already functional *or* if the
-         * ENGINE_TABLE_FLAG_NOINIT flag is not set. */
+        /* Try to initialise the ENGINE? */
         if((ret->funct_ref > 0) || !(table_flags & ENGINE_TABLE_FLAG_NOINIT))
                 initres = engine_unlocked_init(ret);
         else
                 initres = 0;
-#if 0
-        /* Release the structural reference */
-        ret->struct_ref--; engine_ref_debug(ret, 0, -1);
-#endif
         if(initres)
                 {
-                /* If we didn't have a default (functional reference) for this
-                 * 'nid' (or we had one but for whatever reason we're now
-                 * initialising a different one), use this opportunity to set
-                 * 'funct'. */
+                /* Update 'funct' */
                 if((fnd->funct != ret) && engine_unlocked_init(ret))
                         {
                         /* If there was a previous default we release it. */
                         if(fnd->funct)
                                 engine_unlocked_finish(fnd->funct, 0);
-                        /* We got an extra functional reference for the
-                         * per-'nid' default */
                         fnd->funct = ret;
 #ifdef ENGINE_TABLE_DEBUG
                         fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, "
@@ -338,13 +296,9 @@ trynext:
                 }
         goto trynext;
 end:
-        /* Whatever happened - we should "untouch" our uptodate file seeing as
-         * we have tried our best to find a functional reference for 'nid'. If
-         * it failed, it is unlikely to succeed again until some future
-         * registrations (or unregistrations) have taken place that affect that
-         * 'nid'. */
-        if(fnd)
-                fnd->uptodate = 1;
+        /* If it failed, it is unlikely to succeed again until some future
+         * registrations have taken place. In all cases, we cache. */
+        if(fnd) fnd->uptodate = 1;
 #ifdef ENGINE_TABLE_DEBUG
         if(ret)
                 fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, caching "
diff --git a/src/lib/libssl/src/crypto/engine/engine.h b/src/lib/libssl/src/crypto/engine/engine.h
index 900f75ce8d..3ec59338ff 100644
--- a/src/lib/libssl/src/crypto/engine/engine.h
+++ b/src/lib/libssl/src/crypto/engine/engine.h
@@ -3,7 +3,7 @@
  * project 2000.
  */
 /* ====================================================================
- * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -55,6 +55,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #ifndef HEADER_ENGINE_H
 #define HEADER_ENGINE_H
@@ -65,7 +70,7 @@
 #error ENGINE is disabled.
 #endif
 
-#include <openssl/ossl_typ.h>
+#ifndef OPENSSL_NO_DEPRECATED
 #include <openssl/bn.h>
 #ifndef OPENSSL_NO_RSA
 #include <openssl/rsa.h>
@@ -76,34 +81,36 @@
 #ifndef OPENSSL_NO_DH
 #include <openssl/dh.h>
 #endif
+#ifndef OPENSSL_NO_ECDH
+#include <openssl/ecdh.h>
+#endif
+#ifndef OPENSSL_NO_ECDSA
+#include <openssl/ecdsa.h>
+#endif
 #include <openssl/rand.h>
+#include <openssl/store.h>
 #include <openssl/ui.h>
-#include <openssl/symhacks.h>
 #include <openssl/err.h>
+#endif
+
+#include <openssl/ossl_typ.h>
+#include <openssl/symhacks.h>
 
 #ifdef  __cplusplus
 extern "C" {
 #endif
 
-/* Fixups for missing algorithms */
-#ifdef OPENSSL_NO_RSA
-typedef void RSA_METHOD;
-#endif
-#ifdef OPENSSL_NO_DSA
-typedef void DSA_METHOD;
-#endif
-#ifdef OPENSSL_NO_DH
-typedef void DH_METHOD;
-#endif
-
 /* These flags are used to control combinations of algorithm (methods)
  * by bitwise "OR"ing. */
 #define ENGINE_METHOD_RSA               (unsigned int)0x0001
 #define ENGINE_METHOD_DSA               (unsigned int)0x0002
 #define ENGINE_METHOD_DH                (unsigned int)0x0004
 #define ENGINE_METHOD_RAND              (unsigned int)0x0008
+#define ENGINE_METHOD_ECDH              (unsigned int)0x0010
+#define ENGINE_METHOD_ECDSA             (unsigned int)0x0020
 #define ENGINE_METHOD_CIPHERS           (unsigned int)0x0040
 #define ENGINE_METHOD_DIGESTS           (unsigned int)0x0080
+#define ENGINE_METHOD_STORE             (unsigned int)0x0100
 /* Obvious all-or-nothing cases. */
 #define ENGINE_METHOD_ALL               (unsigned int)0xFFFF
 #define ENGINE_METHOD_NONE              (unsigned int)0x0000
@@ -173,9 +180,15 @@ typedef void DH_METHOD;
                                                      handles/connections etc. */
 #define ENGINE_CTRL_SET_USER_INTERFACE          4 /* Alternative to callback */
 #define ENGINE_CTRL_SET_CALLBACK_DATA           5 /* User-specific data, used
-                                                     when calling the password
-                                                     callback and the user
-                                                     interface */
+                                                     when calling the password
+                                                     callback and the user
+                                                     interface */
+#define ENGINE_CTRL_LOAD_CONFIGURATION          6 /* Load a configuration, given
+                                                     a string that represents a
+                                                     file name or so */
+#define ENGINE_CTRL_LOAD_SECTION                7 /* Load data from a given
+                                                     section in the already loaded
+                                                     configuration */
 
 /* These control commands allow an application to deal with an arbitrary engine
  * in a dynamic way. Warn: Negative return values indicate errors FOR THESE
@@ -222,7 +235,7 @@ typedef void DH_METHOD;
 
 /* ENGINE implementations should start the numbering of their own control
  * commands from this value. (ie. ENGINE_CMD_BASE, ENGINE_CMD_BASE + 1, etc). */
-#define ENGINE_CMD_BASE         200
+#define ENGINE_CMD_BASE                         200
 
 /* NB: These 2 nCipher "chil" control commands are deprecated, and their
  * functionality is now available through ENGINE-specific control commands
@@ -257,11 +270,11 @@ typedef struct ENGINE_CMD_DEFN_st
         } ENGINE_CMD_DEFN;
 
 /* Generic function pointer */
-typedef int (*ENGINE_GEN_FUNC_PTR)();
+typedef int (*ENGINE_GEN_FUNC_PTR)(void);
 /* Generic function pointer taking no arguments */
 typedef int (*ENGINE_GEN_INT_FUNC_PTR)(ENGINE *);
 /* Specific control function pointer */
-typedef int (*ENGINE_CTRL_FUNC_PTR)(ENGINE *, int, long, void *, void (*f)());
+typedef int (*ENGINE_CTRL_FUNC_PTR)(ENGINE *, int, long, void *, void (*f)(void));
 /* Generic load_key function pointer */
 typedef EVP_PKEY * (*ENGINE_LOAD_KEY_PTR)(ENGINE *, const char *,
         UI_METHOD *ui_method, void *callback_data);
@@ -305,15 +318,21 @@ ENGINE *ENGINE_by_id(const char *id);
 /* Add all the built-in engines. */
 void ENGINE_load_openssl(void);
 void ENGINE_load_dynamic(void);
-void ENGINE_load_cswift(void);
-void ENGINE_load_chil(void);
+#ifndef OPENSSL_NO_STATIC_ENGINE
+void ENGINE_load_4758cca(void);
+void ENGINE_load_aep(void);
 void ENGINE_load_atalla(void);
+void ENGINE_load_chil(void);
+void ENGINE_load_cswift(void);
+#ifndef OPENSSL_NO_GMP
+void ENGINE_load_gmp(void);
+#endif
 void ENGINE_load_nuron(void);
-void ENGINE_load_ubsec(void);
-void ENGINE_load_aep(void);
 void ENGINE_load_sureware(void);
-void ENGINE_load_4758cca(void);
+void ENGINE_load_ubsec(void);
+#endif
 void ENGINE_load_cryptodev(void);
+void ENGINE_load_padlock(void);
 void ENGINE_load_builtin_engines(void);
 
 /* Get and set global flags (ENGINE_TABLE_FLAG_***) for the implementation
@@ -337,6 +356,14 @@ int ENGINE_register_DSA(ENGINE *e);
 void ENGINE_unregister_DSA(ENGINE *e);
 void ENGINE_register_all_DSA(void);
 
+int ENGINE_register_ECDH(ENGINE *e);
+void ENGINE_unregister_ECDH(ENGINE *e);
+void ENGINE_register_all_ECDH(void);
+
+int ENGINE_register_ECDSA(ENGINE *e);
+void ENGINE_unregister_ECDSA(ENGINE *e);
+void ENGINE_register_all_ECDSA(void);
+
 int ENGINE_register_DH(ENGINE *e);
 void ENGINE_unregister_DH(ENGINE *e);
 void ENGINE_register_all_DH(void);
@@ -345,6 +372,10 @@ int ENGINE_register_RAND(ENGINE *e);
 void ENGINE_unregister_RAND(ENGINE *e);
 void ENGINE_register_all_RAND(void);
 
+int ENGINE_register_STORE(ENGINE *e);
+void ENGINE_unregister_STORE(ENGINE *e);
+void ENGINE_register_all_STORE(void);
+
 int ENGINE_register_ciphers(ENGINE *e);
 void ENGINE_unregister_ciphers(ENGINE *e);
 void ENGINE_register_all_ciphers(void);
@@ -367,7 +398,7 @@ int ENGINE_register_all_complete(void);
  * reference to an engine, but many control commands may require the engine be
  * functional. The caller should be aware of trying commands that require an
  * operational ENGINE, and only use functional references in such situations. */
-int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
+int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void));
 
 /* This function tests if an ENGINE-specific command is usable as a "setting".
  * Eg. in an application's config file that gets processed through
@@ -380,7 +411,7 @@ int ENGINE_cmd_is_executable(ENGINE *e, int cmd);
  * See the comment on ENGINE_ctrl_cmd_string() for an explanation on how to
  * use the cmd_name and cmd_optional. */
 int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name,
-        long i, void *p, void (*f)(), int cmd_optional);
+        long i, void *p, void (*f)(void), int cmd_optional);
 
 /* This function passes a command-name and argument to an ENGINE. The cmd_name
  * is converted to a command number and the control command is called using
@@ -417,8 +448,11 @@ int ENGINE_set_id(ENGINE *e, const char *id);
 int ENGINE_set_name(ENGINE *e, const char *name);
 int ENGINE_set_RSA(ENGINE *e, const RSA_METHOD *rsa_meth);
 int ENGINE_set_DSA(ENGINE *e, const DSA_METHOD *dsa_meth);
+int ENGINE_set_ECDH(ENGINE *e, const ECDH_METHOD *ecdh_meth);
+int ENGINE_set_ECDSA(ENGINE *e, const ECDSA_METHOD *ecdsa_meth);
 int ENGINE_set_DH(ENGINE *e, const DH_METHOD *dh_meth);
 int ENGINE_set_RAND(ENGINE *e, const RAND_METHOD *rand_meth);
+int ENGINE_set_STORE(ENGINE *e, const STORE_METHOD *store_meth);
 int ENGINE_set_destroy_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR destroy_f);
 int ENGINE_set_init_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR init_f);
 int ENGINE_set_finish_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR finish_f);
@@ -429,11 +463,11 @@ int ENGINE_set_ciphers(ENGINE *e, ENGINE_CIPHERS_PTR f);
 int ENGINE_set_digests(ENGINE *e, ENGINE_DIGESTS_PTR f);
 int ENGINE_set_flags(ENGINE *e, int flags);
 int ENGINE_set_cmd_defns(ENGINE *e, const ENGINE_CMD_DEFN *defns);
-/* These functions (and the "get" function lower down) allow control over any
- * per-structure ENGINE data. */
+/* These functions allow control over any per-structure ENGINE data. */
 int ENGINE_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
                 CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 int ENGINE_set_ex_data(ENGINE *e, int idx, void *arg);
+void *ENGINE_get_ex_data(const ENGINE *e, int idx);
 
 /* This function cleans up anything that needs it. Eg. the ENGINE_add() function
  * automatically ensures the list cleanup function is registered to be called
@@ -449,8 +483,11 @@ const char *ENGINE_get_id(const ENGINE *e);
 const char *ENGINE_get_name(const ENGINE *e);
 const RSA_METHOD *ENGINE_get_RSA(const ENGINE *e);
 const DSA_METHOD *ENGINE_get_DSA(const ENGINE *e);
+const ECDH_METHOD *ENGINE_get_ECDH(const ENGINE *e);
+const ECDSA_METHOD *ENGINE_get_ECDSA(const ENGINE *e);
 const DH_METHOD *ENGINE_get_DH(const ENGINE *e);
 const RAND_METHOD *ENGINE_get_RAND(const ENGINE *e);
+const STORE_METHOD *ENGINE_get_STORE(const ENGINE *e);
 ENGINE_GEN_INT_FUNC_PTR ENGINE_get_destroy_function(const ENGINE *e);
 ENGINE_GEN_INT_FUNC_PTR ENGINE_get_init_function(const ENGINE *e);
 ENGINE_GEN_INT_FUNC_PTR ENGINE_get_finish_function(const ENGINE *e);
@@ -463,7 +500,6 @@ const EVP_CIPHER *ENGINE_get_cipher(ENGINE *e, int nid);
 const EVP_MD *ENGINE_get_digest(ENGINE *e, int nid);
 const ENGINE_CMD_DEFN *ENGINE_get_cmd_defns(const ENGINE *e);
 int ENGINE_get_flags(const ENGINE *e);
-void *ENGINE_get_ex_data(const ENGINE *e, int idx);
 
 /* FUNCTIONAL functions. These functions deal with ENGINE structures
  * that have (or will) be initialised for use. Broadly speaking, the
@@ -501,6 +537,8 @@ EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id,
 ENGINE *ENGINE_get_default_RSA(void);
 /* Same for the other "methods" */
 ENGINE *ENGINE_get_default_DSA(void);
+ENGINE *ENGINE_get_default_ECDH(void);
+ENGINE *ENGINE_get_default_ECDSA(void);
 ENGINE *ENGINE_get_default_DH(void);
 ENGINE *ENGINE_get_default_RAND(void);
 /* These functions can be used to get a functional reference to perform
@@ -516,6 +554,8 @@ int ENGINE_set_default_RSA(ENGINE *e);
 int ENGINE_set_default_string(ENGINE *e, const char *def_list);
 /* Same for the other "methods" */
 int ENGINE_set_default_DSA(ENGINE *e);
+int ENGINE_set_default_ECDH(ENGINE *e);
+int ENGINE_set_default_ECDSA(ENGINE *e);
 int ENGINE_set_default_DH(ENGINE *e);
 int ENGINE_set_default_RAND(ENGINE *e);
 int ENGINE_set_default_ciphers(ENGINE *e);
@@ -538,17 +578,20 @@ void ENGINE_add_conf_module(void);
 /**************************/
 
 /* Binary/behaviour compatibility levels */
-#define OSSL_DYNAMIC_VERSION            (unsigned long)0x00010200
+#define OSSL_DYNAMIC_VERSION            (unsigned long)0x00020000
 /* Binary versions older than this are too old for us (whether we're a loader or
  * a loadee) */
-#define OSSL_DYNAMIC_OLDEST             (unsigned long)0x00010200
+#define OSSL_DYNAMIC_OLDEST             (unsigned long)0x00020000
 
 /* When compiling an ENGINE entirely as an external shared library, loadable by
  * the "dynamic" ENGINE, these types are needed. The 'dynamic_fns' structure
  * type provides the calling application's (or library's) error functionality
  * and memory management function pointers to the loaded library. These should
  * be used/set in the loaded library code so that the loading application's
- * 'state' will be used/changed in all operations. */
+ * 'state' will be used/changed in all operations. The 'static_state' pointer
+ * allows the loaded library to know if it shares the same static data as the
+ * calling application (or library), and thus whether these callbacks need to be
+ * set or not. */
 typedef void *(*dyn_MEM_malloc_cb)(size_t);
 typedef void *(*dyn_MEM_realloc_cb)(void *, size_t);
 typedef void (*dyn_MEM_free_cb)(void *);
@@ -576,6 +619,7 @@ typedef struct st_dynamic_LOCK_fns {
         } dynamic_LOCK_fns;
 /* The top-level structure */
 typedef struct st_dynamic_fns {
+        void                                    *static_state;
         const ERR_FNS                           *err_fns;
         const CRYPTO_EX_DATA_IMPL               *ex_data_fns;
         dynamic_MEM_fns                         mem_fns;
@@ -593,7 +637,7 @@ typedef struct st_dynamic_fns {
  * can be fully instantiated with IMPLEMENT_DYNAMIC_CHECK_FN(). */
 typedef unsigned long (*dynamic_v_check_fn)(unsigned long ossl_version);
 #define IMPLEMENT_DYNAMIC_CHECK_FN() \
-        unsigned long v_check(unsigned long v) { \
+        OPENSSL_EXPORT unsigned long v_check(unsigned long v) { \
                 if(v >= OSSL_DYNAMIC_OLDEST) return OSSL_DYNAMIC_VERSION; \
                 return 0; }
 
@@ -615,24 +659,35 @@ typedef unsigned long (*dynamic_v_check_fn)(unsigned long ossl_version);
 typedef int (*dynamic_bind_engine)(ENGINE *e, const char *id,
                                 const dynamic_fns *fns);
 #define IMPLEMENT_DYNAMIC_BIND_FN(fn) \
+        OPENSSL_EXPORT \
         int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { \
-                if (ERR_get_implementation() != fns->err_fns) \
-                        { \
-                        if(!CRYPTO_set_mem_functions(fns->mem_fns.malloc_cb, \
-                                fns->mem_fns.realloc_cb, fns->mem_fns.free_cb)) \
-                                return 0; \
-                        CRYPTO_set_locking_callback(fns->lock_fns.lock_locking_cb); \
-                        CRYPTO_set_add_lock_callback(fns->lock_fns.lock_add_lock_cb); \
-                        CRYPTO_set_dynlock_create_callback(fns->lock_fns.dynlock_create_cb); \
-                        CRYPTO_set_dynlock_lock_callback(fns->lock_fns.dynlock_lock_cb); \
-                        CRYPTO_set_dynlock_destroy_callback(fns->lock_fns.dynlock_destroy_cb); \
-                        if(!CRYPTO_set_ex_data_implementation(fns->ex_data_fns)) \
-                                return 0; \
-                        if(!ERR_set_implementation(fns->err_fns)) return 0; \
-                        } \
+                if(ENGINE_get_static_state() == fns->static_state) goto skip_cbs; \
+                if(!CRYPTO_set_mem_functions(fns->mem_fns.malloc_cb, \
+                        fns->mem_fns.realloc_cb, fns->mem_fns.free_cb)) \
+                        return 0; \
+                CRYPTO_set_locking_callback(fns->lock_fns.lock_locking_cb); \
+                CRYPTO_set_add_lock_callback(fns->lock_fns.lock_add_lock_cb); \
+                CRYPTO_set_dynlock_create_callback(fns->lock_fns.dynlock_create_cb); \
+                CRYPTO_set_dynlock_lock_callback(fns->lock_fns.dynlock_lock_cb); \
+                CRYPTO_set_dynlock_destroy_callback(fns->lock_fns.dynlock_destroy_cb); \
+                if(!CRYPTO_set_ex_data_implementation(fns->ex_data_fns)) \
+                        return 0; \
+                if(!ERR_set_implementation(fns->err_fns)) return 0; \
+        skip_cbs: \
                 if(!fn(e,id)) return 0; \
                 return 1; }
 
+/* If the loading application (or library) and the loaded ENGINE library share
+ * the same static data (eg. they're both dynamically linked to the same
+ * libcrypto.so) we need a way to avoid trying to set system callbacks - this
+ * would fail, and for the same reason that it's unnecessary to try. If the
+ * loaded ENGINE has (or gets from through the loader) its own copy of the
+ * libcrypto static data, we will need to set the callbacks. The easiest way to
+ * detect this is to have a function that returns a pointer to some static data
+ * and let the loading application and loaded ENGINE compare their respective
+ * values. */
+void *ENGINE_get_static_state(void);
+
 #if defined(__OpenBSD__) || defined(__FreeBSD__)
 void ENGINE_setup_bsd_cryptodev(void);
 #endif
@@ -649,6 +704,7 @@ void ERR_load_ENGINE_strings(void);
 #define ENGINE_F_DYNAMIC_CTRL                            180
 #define ENGINE_F_DYNAMIC_GET_DATA_CTX                    181
 #define ENGINE_F_DYNAMIC_LOAD                            182
+#define ENGINE_F_DYNAMIC_SET_DATA_CTX                    183
 #define ENGINE_F_ENGINE_ADD                              105
 #define ENGINE_F_ENGINE_BY_ID                            106
 #define ENGINE_F_ENGINE_CMD_IS_EXECUTABLE                170
@@ -656,7 +712,7 @@ void ERR_load_ENGINE_strings(void);
 #define ENGINE_F_ENGINE_CTRL_CMD                         178
 #define ENGINE_F_ENGINE_CTRL_CMD_STRING                  171
 #define ENGINE_F_ENGINE_FINISH                           107
-#define ENGINE_F_ENGINE_FREE                             108
+#define ENGINE_F_ENGINE_FREE_UTIL                        108
 #define ENGINE_F_ENGINE_GET_CIPHER                       185
 #define ENGINE_F_ENGINE_GET_DEFAULT_TYPE                 177
 #define ENGINE_F_ENGINE_GET_DIGEST                       186
@@ -667,7 +723,6 @@ void ERR_load_ENGINE_strings(void);
 #define ENGINE_F_ENGINE_LIST_REMOVE                      121
 #define ENGINE_F_ENGINE_LOAD_PRIVATE_KEY                 150
 #define ENGINE_F_ENGINE_LOAD_PUBLIC_KEY                  151
-#define ENGINE_F_ENGINE_MODULE_INIT                      187
 #define ENGINE_F_ENGINE_NEW                              122
 #define ENGINE_F_ENGINE_REMOVE                           123
 #define ENGINE_F_ENGINE_SET_DEFAULT_STRING               189
@@ -676,11 +731,12 @@ void ERR_load_ENGINE_strings(void);
 #define ENGINE_F_ENGINE_SET_NAME                         130
 #define ENGINE_F_ENGINE_TABLE_REGISTER                   184
 #define ENGINE_F_ENGINE_UNLOAD_KEY                       152
+#define ENGINE_F_ENGINE_UNLOCKED_FINISH                  191
 #define ENGINE_F_ENGINE_UP_REF                           190
 #define ENGINE_F_INT_CTRL_HELPER                         172
 #define ENGINE_F_INT_ENGINE_CONFIGURE                    188
+#define ENGINE_F_INT_ENGINE_MODULE_INIT                  187
 #define ENGINE_F_LOG_MESSAGE                             141
-#define ENGINE_F_SET_DATA_CTX                            183
 
 /* Reason codes. */
 #define ENGINE_R_ALREADY_LOADED                          100
diff --git a/src/lib/libssl/src/crypto/engine/enginetest.c b/src/lib/libssl/src/crypto/engine/enginetest.c
index c2d0297392..cf82f490db 100644
--- a/src/lib/libssl/src/crypto/engine/enginetest.c
+++ b/src/lib/libssl/src/crypto/engine/enginetest.c
@@ -72,7 +72,7 @@ int main(int argc, char *argv[])
 #include <openssl/engine.h>
 #include <openssl/err.h>
 
-static void display_engine_list()
+static void display_engine_list(void)
         {
         ENGINE *h;
         int loop;
diff --git a/src/lib/libssl/src/crypto/engine/tb_cipher.c b/src/lib/libssl/src/crypto/engine/tb_cipher.c
index 50b3cec1fa..177fc1fb73 100644
--- a/src/lib/libssl/src/crypto/engine/tb_cipher.c
+++ b/src/lib/libssl/src/crypto/engine/tb_cipher.c
@@ -52,8 +52,6 @@
  *
  */
 
-#include <openssl/evp.h>
-#include <openssl/engine.h>
 #include "eng_int.h"
 
 /* If this symbol is defined then ENGINE_get_cipher_engine(), the function that
diff --git a/src/lib/libssl/src/crypto/engine/tb_dh.c b/src/lib/libssl/src/crypto/engine/tb_dh.c
index e290e1702b..6e9d428761 100644
--- a/src/lib/libssl/src/crypto/engine/tb_dh.c
+++ b/src/lib/libssl/src/crypto/engine/tb_dh.c
@@ -52,8 +52,6 @@
  *
  */
 
-#include <openssl/evp.h>
-#include <openssl/engine.h>
 #include "eng_int.h"
 
 /* If this symbol is defined then ENGINE_get_default_DH(), the function that is
diff --git a/src/lib/libssl/src/crypto/engine/tb_digest.c b/src/lib/libssl/src/crypto/engine/tb_digest.c
index e82d2a17c9..d3f4bb2747 100644
--- a/src/lib/libssl/src/crypto/engine/tb_digest.c
+++ b/src/lib/libssl/src/crypto/engine/tb_digest.c
@@ -52,8 +52,6 @@
  *
  */
 
-#include <openssl/evp.h>
-#include <openssl/engine.h>
 #include "eng_int.h"
 
 /* If this symbol is defined then ENGINE_get_digest_engine(), the function that
diff --git a/src/lib/libssl/src/crypto/engine/tb_dsa.c b/src/lib/libssl/src/crypto/engine/tb_dsa.c
index 7efe181927..e4674f5f07 100644
--- a/src/lib/libssl/src/crypto/engine/tb_dsa.c
+++ b/src/lib/libssl/src/crypto/engine/tb_dsa.c
@@ -52,8 +52,6 @@
  *
  */
 
-#include <openssl/evp.h>
-#include <openssl/engine.h>
 #include "eng_int.h"
 
 /* If this symbol is defined then ENGINE_get_default_DSA(), the function that is
diff --git a/src/lib/libssl/src/crypto/engine/tb_rand.c b/src/lib/libssl/src/crypto/engine/tb_rand.c
index 69b67111bc..f36f67c0f6 100644
--- a/src/lib/libssl/src/crypto/engine/tb_rand.c
+++ b/src/lib/libssl/src/crypto/engine/tb_rand.c
@@ -52,8 +52,6 @@
  *
  */
 
-#include <openssl/evp.h>
-#include <openssl/engine.h>
 #include "eng_int.h"
 
 /* If this symbol is defined then ENGINE_get_default_RAND(), the function that is
diff --git a/src/lib/libssl/src/crypto/engine/tb_rsa.c b/src/lib/libssl/src/crypto/engine/tb_rsa.c
index fee4867f52..fbc707fd26 100644
--- a/src/lib/libssl/src/crypto/engine/tb_rsa.c
+++ b/src/lib/libssl/src/crypto/engine/tb_rsa.c
@@ -52,8 +52,6 @@
  *
  */
 
-#include <openssl/evp.h>
-#include <openssl/engine.h>
 #include "eng_int.h"
 
 /* If this symbol is defined then ENGINE_get_default_RSA(), the function that is
diff --git a/src/lib/libssl/src/crypto/err/err.c b/src/lib/libssl/src/crypto/err/err.c
index 53687d79ab..b6ff070e8f 100644
--- a/src/lib/libssl/src/crypto/err/err.c
+++ b/src/lib/libssl/src/crypto/err/err.c
@@ -112,9 +112,9 @@
 #include <stdio.h>
 #include <stdarg.h>
 #include <string.h>
+#include "cryptlib.h"
 #include <openssl/lhash.h>
 #include <openssl/crypto.h>
-#include "cryptlib.h"
 #include <openssl/buffer.h>
 #include <openssl/bio.h>
 #include <openssl/err.h>
@@ -149,7 +149,7 @@ static ERR_STRING_DATA ERR_str_libraries[]=
 {ERR_PACK(ERR_LIB_DSO,0,0)              ,"DSO support routines"},
 {ERR_PACK(ERR_LIB_ENGINE,0,0)           ,"engine routines"},
 {ERR_PACK(ERR_LIB_OCSP,0,0)             ,"OCSP routines"},
-{ERR_PACK(ERR_LIB_FIPS,0,0)             ,"FIPS routines"},
+{ERR_PACK(ERR_LIB_CMS,0,0)              ,"CMS routines"},
 {0,NULL},
         };
 
@@ -168,7 +168,6 @@ static ERR_STRING_DATA ERR_str_functs[]=
 #endif
         {ERR_PACK(0,SYS_F_OPENDIR,0),           "opendir"},
         {ERR_PACK(0,SYS_F_FREAD,0),             "fread"},
-        {ERR_PACK(0,SYS_F_GETADDRINFO,0),       "getaddrinfo"},
         {0,NULL},
         };
 
@@ -210,6 +209,7 @@ static ERR_STRING_DATA ERR_str_reasons[]=
 {ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED      ,"called a function you should not call"},
 {ERR_R_PASSED_NULL_PARAMETER            ,"passed a null parameter"},
 {ERR_R_INTERNAL_ERROR                   ,"internal error"},
+{ERR_R_DISABLED                         ,"called a function that was disabled at compile-time"},
 
 {0,NULL},
         };
@@ -542,16 +542,27 @@ static ERR_STRING_DATA SYS_str_reasons[NUM_SYS_STR_REASONS + 1];
  * will be returned for SYSerr(), which always gets an errno
  * value and never one of those 'standard' reason codes. */
 
-static void build_SYS_str_reasons()
+static void build_SYS_str_reasons(void)
         {
         /* OPENSSL_malloc cannot be used here, use static storage instead */
         static char strerror_tab[NUM_SYS_STR_REASONS][LEN_SYS_STR_REASON];
         int i;
         static int init = 1;
 
-        if (!init) return;
-
+        CRYPTO_r_lock(CRYPTO_LOCK_ERR);
+        if (!init)
+                {
+                CRYPTO_r_unlock(CRYPTO_LOCK_ERR);
+                return;
+                }
+        
+        CRYPTO_r_unlock(CRYPTO_LOCK_ERR);
         CRYPTO_w_lock(CRYPTO_LOCK_ERR);
+        if (!init)
+                {
+                CRYPTO_w_unlock(CRYPTO_LOCK_ERR);
+                return;
+                }
 
         for (i = 1; i <= NUM_SYS_STR_REASONS; i++)
                 {
@@ -583,13 +594,24 @@ static void build_SYS_str_reasons()
 #endif
 
 #define err_clear_data(p,i) \
+        do { \
         if (((p)->err_data[i] != NULL) && \
                 (p)->err_data_flags[i] & ERR_TXT_MALLOCED) \
                 {  \
                 OPENSSL_free((p)->err_data[i]); \
                 (p)->err_data[i]=NULL; \
                 } \
-        (p)->err_data_flags[i]=0;
+        (p)->err_data_flags[i]=0; \
+        } while(0)
+
+#define err_clear(p,i) \
+        do { \
+        (p)->err_flags[i]=0; \
+        (p)->err_buffer[i]=0; \
+        err_clear_data(p,i); \
+        (p)->err_file[i]=NULL; \
+        (p)->err_line[i]= -1; \
+        } while(0)
 
 static void ERR_STATE_free(ERR_STATE *s)
         {
@@ -682,6 +704,7 @@ void ERR_put_error(int lib, int func, int reason, const char *file,
         es->top=(es->top+1)%ERR_NUM_ERRORS;
         if (es->top == es->bottom)
                 es->bottom=(es->bottom+1)%ERR_NUM_ERRORS;
+        es->err_flags[es->top]=0;
         es->err_buffer[es->top]=ERR_PACK(lib,func,reason);
         es->err_file[es->top]=file;
         es->err_line[es->top]=line;
@@ -697,10 +720,7 @@ void ERR_clear_error(void)
 
         for (i=0; i<ERR_NUM_ERRORS; i++)
                 {
-                es->err_buffer[i]=0;
-                err_clear_data(es,i);
-                es->err_file[i]=NULL;
-                es->err_line[i]= -1;
+                err_clear(es,i);
                 }
         es->top=es->bottom=0;
         }
@@ -937,7 +957,7 @@ static unsigned long err_hash(const void *a_void)
         {
         unsigned long ret,l;
 
-        l=((ERR_STRING_DATA *)a_void)->error;
+        l=((const ERR_STRING_DATA *)a_void)->error;
         ret=l^ERR_GET_LIB(l)^ERR_GET_FUNC(l);
         return(ret^ret%19*13);
         }
@@ -945,21 +965,21 @@ static unsigned long err_hash(const void *a_void)
 /* static int err_cmp(ERR_STRING_DATA *a, ERR_STRING_DATA *b) */
 static int err_cmp(const void *a_void, const void *b_void)
         {
-        return((int)(((ERR_STRING_DATA *)a_void)->error -
-                        ((ERR_STRING_DATA *)b_void)->error));
+        return((int)(((const ERR_STRING_DATA *)a_void)->error -
+                        ((const ERR_STRING_DATA *)b_void)->error));
         }
 
 /* static unsigned long pid_hash(ERR_STATE *a) */
 static unsigned long pid_hash(const void *a_void)
         {
-        return(((ERR_STATE *)a_void)->pid*13);
+        return(((const ERR_STATE *)a_void)->pid*13);
         }
 
 /* static int pid_cmp(ERR_STATE *a, ERR_STATE *b) */
 static int pid_cmp(const void *a_void, const void *b_void)
         {
-        return((int)((long)((ERR_STATE *)a_void)->pid -
-                        (long)((ERR_STATE *)b_void)->pid));
+        return((int)((long)((const ERR_STATE *)a_void)->pid -
+                        (long)((const ERR_STATE *)b_void)->pid));
         }
 
 void ERR_remove_state(unsigned long pid)
@@ -1069,7 +1089,7 @@ void ERR_add_error_data(int num, ...)
                                 else
                                         str=p;
                                 }
-                        BUF_strlcat(str,a,s+1);
+                        BUF_strlcat(str,a,(size_t)s+1);
                         }
                 }
         ERR_set_error_data(str,ERR_TXT_MALLOCED|ERR_TXT_STRING);
@@ -1077,3 +1097,33 @@ void ERR_add_error_data(int num, ...)
 err:
         va_end(args);
         }
+
+int ERR_set_mark(void)
+        {
+        ERR_STATE *es;
+
+        es=ERR_get_state();
+
+        if (es->bottom == es->top) return 0;
+        es->err_flags[es->top]|=ERR_FLAG_MARK;
+        return 1;
+        }
+
+int ERR_pop_to_mark(void)
+        {
+        ERR_STATE *es;
+
+        es=ERR_get_state();
+
+        while(es->bottom != es->top
+                && (es->err_flags[es->top] & ERR_FLAG_MARK) == 0)
+                {
+                err_clear(es,es->top);
+                es->top-=1;
+                if (es->top == -1) es->top=ERR_NUM_ERRORS-1;
+                }
+                
+        if (es->bottom == es->top) return 0;
+        es->err_flags[es->top]&=~ERR_FLAG_MARK;
+        return 1;
+        }
diff --git a/src/lib/libssl/src/crypto/err/err.h b/src/lib/libssl/src/crypto/err/err.h
index 2efa18866a..bf28fce492 100644
--- a/src/lib/libssl/src/crypto/err/err.h
+++ b/src/lib/libssl/src/crypto/err/err.h
@@ -59,11 +59,14 @@
 #ifndef HEADER_ERR_H
 #define HEADER_ERR_H
 
+#include <openssl/e_os2.h>
+
 #ifndef OPENSSL_NO_FP_API
 #include <stdio.h>
 #include <stdlib.h>
 #endif
 
+#include <openssl/ossl_typ.h>
 #ifndef OPENSSL_NO_BIO
 #include <openssl/bio.h>
 #endif
@@ -86,10 +89,13 @@ extern "C" {
 #define ERR_TXT_MALLOCED        0x01
 #define ERR_TXT_STRING          0x02
 
+#define ERR_FLAG_MARK           0x01
+
 #define ERR_NUM_ERRORS  16
 typedef struct err_state_st
         {
         unsigned long pid;
+        int err_flags[ERR_NUM_ERRORS];
         unsigned long err_buffer[ERR_NUM_ERRORS];
         char *err_data[ERR_NUM_ERRORS];
         int err_data_flags[ERR_NUM_ERRORS];
@@ -131,7 +137,10 @@ typedef struct err_state_st
 #define ERR_LIB_OCSP            39
 #define ERR_LIB_UI              40
 #define ERR_LIB_COMP            41
-#define ERR_LIB_FIPS            42
+#define ERR_LIB_ECDSA           42
+#define ERR_LIB_ECDH            43
+#define ERR_LIB_STORE           44
+#define ERR_LIB_CMS             45
 
 #define ERR_LIB_USER            128
 
@@ -160,7 +169,10 @@ typedef struct err_state_st
 #define OCSPerr(f,r) ERR_PUT_error(ERR_LIB_OCSP,(f),(r),__FILE__,__LINE__)
 #define UIerr(f,r) ERR_PUT_error(ERR_LIB_UI,(f),(r),__FILE__,__LINE__)
 #define COMPerr(f,r) ERR_PUT_error(ERR_LIB_COMP,(f),(r),__FILE__,__LINE__)
-#define FIPSerr(f,r) ERR_PUT_error(ERR_LIB_FIPS,(f),(r),__FILE__,__LINE__)
+#define ECDSAerr(f,r)  ERR_PUT_error(ERR_LIB_ECDSA,(f),(r),__FILE__,__LINE__)
+#define ECDHerr(f,r)  ERR_PUT_error(ERR_LIB_ECDH,(f),(r),__FILE__,__LINE__)
+#define STOREerr(f,r) ERR_PUT_error(ERR_LIB_STORE,(f),(r),__FILE__,__LINE__)
+#define CMSerr(f,r) ERR_PUT_error(ERR_LIB_CMS,(f),(r),__FILE__,__LINE__)
 
 /* Borland C seems too stupid to be able to shift and do longs in
  * the pre-processor :-( */
@@ -185,7 +197,6 @@ typedef struct err_state_st
 #define SYS_F_WSASTARTUP        9 /* Winsock stuff */
 #define SYS_F_OPENDIR           10
 #define SYS_F_FREAD             11
-#define SYS_F_GETADDRINFO       12
 
 
 /* reasons */
@@ -214,6 +225,9 @@ typedef struct err_state_st
 #define ERR_R_OCSP_LIB  ERR_LIB_OCSP     /* 39 */
 #define ERR_R_UI_LIB    ERR_LIB_UI       /* 40 */
 #define ERR_R_COMP_LIB  ERR_LIB_COMP     /* 41 */
+#define ERR_R_ECDSA_LIB ERR_LIB_ECDSA    /* 42 */
+#define ERR_R_ECDH_LIB  ERR_LIB_ECDH     /* 43 */
+#define ERR_R_STORE_LIB ERR_LIB_STORE    /* 44 */
 
 #define ERR_R_NESTED_ASN1_ERROR                 58
 #define ERR_R_BAD_ASN1_OBJECT_HEADER            59
@@ -228,6 +242,7 @@ typedef struct err_state_st
 #define ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED       (2|ERR_R_FATAL)
 #define ERR_R_PASSED_NULL_PARAMETER             (3|ERR_R_FATAL)
 #define ERR_R_INTERNAL_ERROR                    (4|ERR_R_FATAL)
+#define ERR_R_DISABLED                          (5|ERR_R_FATAL)
 
 /* 99 is the maximum possible ERR_R_... code, higher values
  * are reserved for the individual libraries */
@@ -286,8 +301,11 @@ void ERR_release_err_state_table(LHASH **hash);
 
 int ERR_get_next_error_library(void);
 
-/* This opaque type encapsulates the low-level error-state functions */
-typedef struct st_ERR_FNS ERR_FNS;
+int ERR_set_mark(void);
+int ERR_pop_to_mark(void);
+
+/* Already defined in ossl_typ.h */
+/* typedef struct st_ERR_FNS ERR_FNS; */
 /* An application can use this function and provide the return value to loaded
  * modules that should use the application's ERR state/functionality */
 const ERR_FNS *ERR_get_implementation(void);
diff --git a/src/lib/libssl/src/crypto/err/err_all.c b/src/lib/libssl/src/crypto/err/err_all.c
index 4dc9300892..5813060ce2 100644
--- a/src/lib/libssl/src/crypto/err/err_all.c
+++ b/src/lib/libssl/src/crypto/err/err_all.c
@@ -73,6 +73,12 @@
 #ifndef OPENSSL_NO_DSA
 #include <openssl/dsa.h>
 #endif
+#ifndef OPENSSL_NO_ECDSA
+#include <openssl/ecdsa.h>
+#endif
+#ifndef OPENSSL_NO_ECDH
+#include <openssl/ecdh.h>
+#endif
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/pem2.h>
@@ -85,16 +91,15 @@
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
+#include <openssl/ui.h>
 #include <openssl/ocsp.h>
 #include <openssl/err.h>
-#include <openssl/fips.h>
+#ifndef OPENSSL_NO_CMS
+#include <openssl/cms.h>
+#endif
 
 void ERR_load_crypto_strings(void)
         {
-        static int done=0;
-
-        if (done) return;
-        done=1;
 #ifndef OPENSSL_NO_ERR
         ERR_load_ERR_strings(); /* include error strings for SYSerr */
         ERR_load_BN_strings();
@@ -118,6 +123,12 @@ void ERR_load_crypto_strings(void)
 #ifndef OPENSSL_NO_EC
         ERR_load_EC_strings();
 #endif
+#ifndef OPENSSL_NO_ECDSA
+        ERR_load_ECDSA_strings();
+#endif
+#ifndef OPENSSL_NO_ECDH
+        ERR_load_ECDH_strings();
+#endif
         /* skip ERR_load_SSL_strings() because it is not in this library */
         ERR_load_BIO_strings();
         ERR_load_PKCS7_strings();       
@@ -130,8 +141,8 @@ void ERR_load_crypto_strings(void)
 #endif
         ERR_load_OCSP_strings();
         ERR_load_UI_strings();
+#ifndef OPENSSL_NO_CMS
+        ERR_load_CMS_strings();
 #endif
-#ifdef OPENSSL_FIPS
-        ERR_load_FIPS_strings();
 #endif
         }
diff --git a/src/lib/libssl/src/crypto/err/err_prn.c b/src/lib/libssl/src/crypto/err/err_prn.c
index 81e34bd6ce..2224a901e5 100644
--- a/src/lib/libssl/src/crypto/err/err_prn.c
+++ b/src/lib/libssl/src/crypto/err/err_prn.c
@@ -57,9 +57,9 @@
  */
 
 #include <stdio.h>
+#include "cryptlib.h"
 #include <openssl/lhash.h>
 #include <openssl/crypto.h>
-#include "cryptlib.h"
 #include <openssl/buffer.h>
 #include <openssl/err.h>
 
@@ -86,7 +86,12 @@ void ERR_print_errors_cb(int (*cb)(const char *str, size_t len, void *u),
 #ifndef OPENSSL_NO_FP_API
 static int print_fp(const char *str, size_t len, void *fp)
         {
-        return fprintf((FILE *)fp, "%s", str);
+        BIO bio;
+
+        BIO_set(&bio,BIO_s_file());
+        BIO_set_fp(&bio,fp,BIO_NOCLOSE);
+
+        return BIO_printf(&bio, "%s", str);
         }
 void ERR_print_errors_fp(FILE *fp)
         {
diff --git a/src/lib/libssl/src/crypto/err/openssl.ec b/src/lib/libssl/src/crypto/err/openssl.ec
index f8cd6937e7..1938f081ac 100644
--- a/src/lib/libssl/src/crypto/err/openssl.ec
+++ b/src/lib/libssl/src/crypto/err/openssl.ec
@@ -27,11 +27,16 @@ L DSO		crypto/dso/dso.h		crypto/dso/dso_err.c
 L ENGINE        crypto/engine/engine.h          crypto/engine/eng_err.c
 L OCSP          crypto/ocsp/ocsp.h              crypto/ocsp/ocsp_err.c
 L UI            crypto/ui/ui.h                  crypto/ui/ui_err.c
-L FIPS          fips-1.0/fips.h                 fips-1.0/fips_err.h
+L COMP          crypto/comp/comp.h              crypto/comp/comp_err.c
+L ECDSA         crypto/ecdsa/ecdsa.h            crypto/ecdsa/ecs_err.c
+L ECDH          crypto/ecdh/ecdh.h              crypto/ecdh/ech_err.c
+L STORE         crypto/store/store.h            crypto/store/str_err.c
+L CMS           crypto/cms/cms.h                crypto/cms/cms_err.c
 
 # additional header files to be scanned for function names
 L NONE          crypto/x509/x509_vfy.h          NONE
 L NONE          crypto/ec/ec_lcl.h              NONE
+L NONE          crypto/cms/cms_lcl.h            NONE
 
 
 F RSAREF_F_RSA_BN2BIN
diff --git a/src/lib/libssl/src/crypto/evp/bio_b64.c b/src/lib/libssl/src/crypto/evp/bio_b64.c
index 33349c2f98..fa5cbc7eb1 100644
--- a/src/lib/libssl/src/crypto/evp/bio_b64.c
+++ b/src/lib/libssl/src/crypto/evp/bio_b64.c
@@ -165,7 +165,7 @@ static int b64_read(BIO *b, char *out, int outl)
                 {
                 i=ctx->buf_len-ctx->buf_off;
                 if (i > outl) i=outl;
-                OPENSSL_assert(ctx->buf_off+i < sizeof ctx->buf);
+                OPENSSL_assert(ctx->buf_off+i < (int)sizeof(ctx->buf));
                 memcpy(out,&(ctx->buf[ctx->buf_off]),i);
                 ret=i;
                 out+=i;
diff --git a/src/lib/libssl/src/crypto/evp/bio_enc.c b/src/lib/libssl/src/crypto/evp/bio_enc.c
index b8cda1a9f0..f6ac94c6e1 100644
--- a/src/lib/libssl/src/crypto/evp/bio_enc.c
+++ b/src/lib/libssl/src/crypto/evp/bio_enc.c
@@ -405,8 +405,8 @@ EVP_CIPHER_ctx *c;
         }
 */
 
-void BIO_set_cipher(BIO *b, const EVP_CIPHER *c, unsigned char *k,
-             unsigned char *i, int e)
+void BIO_set_cipher(BIO *b, const EVP_CIPHER *c, const unsigned char *k,
+             const unsigned char *i, int e)
         {
         BIO_ENC_CTX *ctx;
 
diff --git a/src/lib/libssl/src/crypto/evp/bio_md.c b/src/lib/libssl/src/crypto/evp/bio_md.c
index f4aa41ac4b..d648ac6da6 100644
--- a/src/lib/libssl/src/crypto/evp/bio_md.c
+++ b/src/lib/libssl/src/crypto/evp/bio_md.c
@@ -153,7 +153,7 @@ static int md_write(BIO *b, const char *in, int inl)
                 {
                 if (ret > 0)
                         {
-                        EVP_DigestUpdate(ctx,(unsigned char *)in,
+                        EVP_DigestUpdate(ctx,(const unsigned char *)in,
                                 (unsigned int)ret);
                         }
                 }
@@ -192,8 +192,13 @@ static long md_ctrl(BIO *b, int cmd, long num, void *ptr)
                         ret=0;
                 break;
         case BIO_C_GET_MD_CTX:
-                pctx=ptr;
-                *pctx=ctx;
+                if (b->init)
+                        {
+                        pctx=ptr;
+                        *pctx=ctx;
+                        }
+                else
+                        ret=0;
                 break;
         case BIO_C_SET_MD_CTX:
                 if (b->init)
diff --git a/src/lib/libssl/src/crypto/evp/bio_ok.c b/src/lib/libssl/src/crypto/evp/bio_ok.c
index 4e3f10141b..98bc1ab409 100644
--- a/src/lib/libssl/src/crypto/evp/bio_ok.c
+++ b/src/lib/libssl/src/crypto/evp/bio_ok.c
@@ -119,6 +119,7 @@
 
 #include <stdio.h>
 #include <errno.h>
+#include <assert.h>
 #include "cryptlib.h"
 #include <openssl/buffer.h>
 #include <openssl/bio.h>
@@ -141,22 +142,12 @@ static void block_in(BIO* b);
 #define IOBS            (OK_BLOCK_SIZE+ OK_BLOCK_BLOCK+ 3*EVP_MAX_MD_SIZE)
 #define WELLKNOWN "The quick brown fox jumped over the lazy dog's back."
 
-#ifndef L_ENDIAN
-#define swapem(x) \
-        ((unsigned long int)((((unsigned long int)(x) & 0x000000ffU) << 24) | \
-                             (((unsigned long int)(x) & 0x0000ff00U) <<  8) | \
-                             (((unsigned long int)(x) & 0x00ff0000U) >>  8) | \
-                             (((unsigned long int)(x) & 0xff000000U) >> 24)))
-#else
-#define swapem(x) (x)
-#endif
-
 typedef struct ok_struct
         {
-        int buf_len;
-        int buf_off;
-        int buf_len_save;
-        int buf_off_save;
+        size_t buf_len;
+        size_t buf_off;
+        size_t buf_len_save;
+        size_t buf_off_save;
         int cont;               /* <= 0 when finished */
         int finished;
         EVP_MD_CTX md;
@@ -295,6 +286,8 @@ static int ok_write(BIO *b, const char *in, int inl)
         int ret=0,n,i;
         BIO_OK_CTX *ctx;
 
+        if (inl <= 0) return inl;
+
         ctx=(BIO_OK_CTX *)b->ptr;
         ret=inl;
 
@@ -330,7 +323,7 @@ static int ok_write(BIO *b, const char *in, int inl)
                 if ((in == NULL) || (inl <= 0)) return(0);
 
                 n= (inl+ ctx->buf_len > OK_BLOCK_SIZE+ OK_BLOCK_BLOCK) ? 
-                                OK_BLOCK_SIZE+ OK_BLOCK_BLOCK- ctx->buf_len : inl;
+                        (int)(OK_BLOCK_SIZE+OK_BLOCK_BLOCK-ctx->buf_len) : inl;
 
                 memcpy((unsigned char *)(&(ctx->buf[ctx->buf_len])),(unsigned char *)in,n);
                 ctx->buf_len+= n;
@@ -448,16 +441,18 @@ static long ok_callback_ctrl(BIO *b, int cmd, bio_info_cb *fp)
         return(ret);
         }
 
-static void longswap(void *_ptr, int len)
-{
-#ifndef L_ENDIAN
-        int i;
-        char *ptr=_ptr;
+static void longswap(void *_ptr, size_t len)
+{       const union { long one; char little; } is_endian = {1};
 
-        for(i= 0;i < len;i+= 4){
-                *((unsigned long *)&(ptr[i]))= swapem(*((unsigned long *)&(ptr[i])));
+        if (is_endian.little) {
+                size_t i;
+                unsigned char *p=_ptr,c;
+
+                for(i= 0;i < len;i+= 4) {
+                        c=p[0],p[0]=p[3],p[3]=c;
+                        c=p[1],p[1]=p[2],p[2]=c;
+                }
         }
-#endif
 }
 
 static void sig_out(BIO* b)
@@ -496,7 +491,7 @@ static void sig_in(BIO* b)
         ctx=b->ptr;
         md=&ctx->md;
 
-        if(ctx->buf_len- ctx->buf_off < 2* md->digest->md_size) return;
+        if((int)(ctx->buf_len-ctx->buf_off) < 2*md->digest->md_size) return;
 
         EVP_DigestInit_ex(md, md->digest, NULL);
         memcpy(md->md_data, &(ctx->buf[ctx->buf_off]), md->digest->md_size);
@@ -533,9 +528,10 @@ static void block_out(BIO* b)
         md=&ctx->md;
 
         tl= ctx->buf_len- OK_BLOCK_BLOCK;
-        tl= swapem(tl);
-        memcpy(ctx->buf, &tl, OK_BLOCK_BLOCK);
-        tl= swapem(tl);
+        ctx->buf[0]=(unsigned char)(tl>>24);
+        ctx->buf[1]=(unsigned char)(tl>>16);
+        ctx->buf[2]=(unsigned char)(tl>>8);
+        ctx->buf[3]=(unsigned char)(tl);
         EVP_DigestUpdate(md, (unsigned char*) &(ctx->buf[OK_BLOCK_BLOCK]), tl);
         EVP_DigestFinal_ex(md, &(ctx->buf[ctx->buf_len]), NULL);
         ctx->buf_len+= md->digest->md_size;
@@ -546,14 +542,18 @@ static void block_in(BIO* b)
         {
         BIO_OK_CTX *ctx;
         EVP_MD_CTX *md;
-        long tl= 0;
+        unsigned long tl= 0;
         unsigned char tmp[EVP_MAX_MD_SIZE];
 
         ctx=b->ptr;
         md=&ctx->md;
 
-        memcpy(&tl, ctx->buf, OK_BLOCK_BLOCK);
-        tl= swapem(tl);
+        assert(sizeof(tl)>=OK_BLOCK_BLOCK);     /* always true */
+        tl =ctx->buf[0]; tl<<=8;
+        tl|=ctx->buf[1]; tl<<=8;
+        tl|=ctx->buf[2]; tl<<=8;
+        tl|=ctx->buf[3];
+
         if (ctx->buf_len < tl+ OK_BLOCK_BLOCK+ md->digest->md_size) return;
  
         EVP_DigestUpdate(md, (unsigned char*) &(ctx->buf[OK_BLOCK_BLOCK]), tl);
diff --git a/src/lib/libssl/src/crypto/evp/c_all.c b/src/lib/libssl/src/crypto/evp/c_all.c
index fa60a73ead..a5da52e62d 100644
--- a/src/lib/libssl/src/crypto/evp/c_all.c
+++ b/src/lib/libssl/src/crypto/evp/c_all.c
@@ -74,6 +74,12 @@ void OpenSSL_add_all_algorithms(void)
 
 void OPENSSL_add_all_algorithms_noconf(void)
         {
+        /*
+         * For the moment OPENSSL_cpuid_setup does something
+         * only on IA-32, but we reserve the option for all
+         * platforms...
+         */
+        OPENSSL_cpuid_setup();
         OpenSSL_add_all_ciphers();
         OpenSSL_add_all_digests();
 #ifndef OPENSSL_NO_ENGINE
diff --git a/src/lib/libssl/src/crypto/evp/c_allc.c b/src/lib/libssl/src/crypto/evp/c_allc.c
index fc96812365..7054d8125d 100644
--- a/src/lib/libssl/src/crypto/evp/c_allc.c
+++ b/src/lib/libssl/src/crypto/evp/c_allc.c
@@ -107,6 +107,15 @@ void OpenSSL_add_all_ciphers(void)
         EVP_add_cipher_alias(SN_idea_cbc,"idea");
 #endif
 
+#ifndef OPENSSL_NO_SEED
+        EVP_add_cipher(EVP_seed_ecb());
+        EVP_add_cipher(EVP_seed_cfb());
+        EVP_add_cipher(EVP_seed_ofb());
+        EVP_add_cipher(EVP_seed_cbc());
+        EVP_add_cipher_alias(SN_seed_cbc,"SEED");
+        EVP_add_cipher_alias(SN_seed_cbc,"seed");
+#endif
+
 #ifndef OPENSSL_NO_RC2
         EVP_add_cipher(EVP_rc2_ecb());
         EVP_add_cipher(EVP_rc2_cfb());
@@ -183,6 +192,34 @@ void OpenSSL_add_all_ciphers(void)
         EVP_add_cipher_alias(SN_aes_256_cbc,"AES256");
         EVP_add_cipher_alias(SN_aes_256_cbc,"aes256");
 #endif
+
+#ifndef OPENSSL_NO_CAMELLIA
+        EVP_add_cipher(EVP_camellia_128_ecb());
+        EVP_add_cipher(EVP_camellia_128_cbc());
+        EVP_add_cipher(EVP_camellia_128_cfb());
+        EVP_add_cipher(EVP_camellia_128_cfb1());
+        EVP_add_cipher(EVP_camellia_128_cfb8());
+        EVP_add_cipher(EVP_camellia_128_ofb());
+        EVP_add_cipher_alias(SN_camellia_128_cbc,"CAMELLIA128");
+        EVP_add_cipher_alias(SN_camellia_128_cbc,"camellia128");
+        EVP_add_cipher(EVP_camellia_192_ecb());
+        EVP_add_cipher(EVP_camellia_192_cbc());
+        EVP_add_cipher(EVP_camellia_192_cfb());
+        EVP_add_cipher(EVP_camellia_192_cfb1());
+        EVP_add_cipher(EVP_camellia_192_cfb8());
+        EVP_add_cipher(EVP_camellia_192_ofb());
+        EVP_add_cipher_alias(SN_camellia_192_cbc,"CAMELLIA192");
+        EVP_add_cipher_alias(SN_camellia_192_cbc,"camellia192");
+        EVP_add_cipher(EVP_camellia_256_ecb());
+        EVP_add_cipher(EVP_camellia_256_cbc());
+        EVP_add_cipher(EVP_camellia_256_cfb());
+        EVP_add_cipher(EVP_camellia_256_cfb1());
+        EVP_add_cipher(EVP_camellia_256_cfb8());
+        EVP_add_cipher(EVP_camellia_256_ofb());
+        EVP_add_cipher_alias(SN_camellia_256_cbc,"CAMELLIA256");
+        EVP_add_cipher_alias(SN_camellia_256_cbc,"camellia256");
+#endif
+
         PKCS12_PBE_add();
         PKCS5_PBE_add();
         }
diff --git a/src/lib/libssl/src/crypto/evp/c_alld.c b/src/lib/libssl/src/crypto/evp/c_alld.c
index 929ea56a3e..d270b0ee03 100644
--- a/src/lib/libssl/src/crypto/evp/c_alld.c
+++ b/src/lib/libssl/src/crypto/evp/c_alld.c
@@ -91,6 +91,9 @@ void OpenSSL_add_all_digests(void)
         EVP_add_digest_alias(SN_dsaWithSHA1,"DSS1");
         EVP_add_digest_alias(SN_dsaWithSHA1,"dss1");
 #endif
+#ifndef OPENSSL_NO_ECDSA
+        EVP_add_digest(EVP_ecdsa());
+#endif
 #endif
 #if !defined(OPENSSL_NO_MDC2) && !defined(OPENSSL_NO_DES)
         EVP_add_digest(EVP_mdc2());
@@ -100,7 +103,6 @@ void OpenSSL_add_all_digests(void)
         EVP_add_digest_alias(SN_ripemd160,"ripemd");
         EVP_add_digest_alias(SN_ripemd160,"rmd160");
 #endif
-#ifdef OPENSSL_FIPS
 #ifndef OPENSSL_NO_SHA256
         EVP_add_digest(EVP_sha224());
         EVP_add_digest(EVP_sha256());
@@ -109,5 +111,4 @@ void OpenSSL_add_all_digests(void)
         EVP_add_digest(EVP_sha384());
         EVP_add_digest(EVP_sha512());
 #endif
-#endif
         }
diff --git a/src/lib/libssl/src/crypto/evp/digest.c b/src/lib/libssl/src/crypto/evp/digest.c
index f21c63842c..762e6d3450 100644
--- a/src/lib/libssl/src/crypto/evp/digest.c
+++ b/src/lib/libssl/src/crypto/evp/digest.c
@@ -137,39 +137,6 @@ int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type)
         return EVP_DigestInit_ex(ctx, type, NULL);
         }
 
-#ifdef OPENSSL_FIPS
-
-/* The purpose of these is to trap programs that attempt to use non FIPS
- * algorithms in FIPS mode and ignore the errors.
- */
-
-static int bad_init(EVP_MD_CTX *ctx)
-        { FIPS_ERROR_IGNORED("Digest init"); return 0;}
-
-static int bad_update(EVP_MD_CTX *ctx,const void *data,unsigned long count)
-        { FIPS_ERROR_IGNORED("Digest update"); return 0;}
-
-static int bad_final(EVP_MD_CTX *ctx,unsigned char *md)
-        { FIPS_ERROR_IGNORED("Digest Final"); return 0;}
-
-static const EVP_MD bad_md =
-        {
-        0,
-        0,
-        0,
-        0,
-        bad_init,
-        bad_update,
-        bad_final,
-        NULL,
-        NULL,
-        NULL,
-        0,
-        {0,0,0,0},
-        };
-
-#endif
-
 int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
         {
         EVP_MD_CTX_clear_flags(ctx,EVP_MD_CTX_FLAG_CLEANED);
@@ -192,7 +159,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
                         {
                         if (!ENGINE_init(impl))
                                 {
-                                EVPerr(EVP_F_EVP_DIGESTINIT, EVP_R_INITIALIZATION_ERROR);
+                                EVPerr(EVP_F_EVP_DIGESTINIT_EX,EVP_R_INITIALIZATION_ERROR);
                                 return 0;
                                 }
                         }
@@ -206,7 +173,7 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
                         if(!d)
                                 {
                                 /* Same comment from evp_enc.c */
-                                EVPerr(EVP_F_EVP_DIGESTINIT, EVP_R_INITIALIZATION_ERROR);
+                                EVPerr(EVP_F_EVP_DIGESTINIT_EX,EVP_R_INITIALIZATION_ERROR);
                                 return 0;
                                 }
                         /* We'll use the ENGINE's private digest definition */
@@ -222,24 +189,12 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
         else
         if(!ctx->digest)
                 {
-                EVPerr(EVP_F_EVP_DIGESTINIT, EVP_R_NO_DIGEST_SET);
+                EVPerr(EVP_F_EVP_DIGESTINIT_EX,EVP_R_NO_DIGEST_SET);
                 return 0;
                 }
 #endif
         if (ctx->digest != type)
                 {
-#ifdef OPENSSL_FIPS
-                if (FIPS_mode())
-                        {
-                        if (!(type->flags & EVP_MD_FLAG_FIPS) 
-                         && !(ctx->flags & EVP_MD_CTX_FLAG_NON_FIPS_ALLOW))
-                                {
-                                EVPerr(EVP_F_EVP_DIGESTINIT, EVP_R_DISABLED_FOR_FIPS);
-                                ctx->digest = &bad_md;
-                                return 0;
-                                }
-                        }
-#endif
                 if (ctx->digest && ctx->digest->ctx_size)
                         OPENSSL_free(ctx->md_data);
                 ctx->digest=type;
@@ -253,9 +208,9 @@ skip_to_init:
         }
 
 int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data,
-             unsigned int count)
+             size_t count)
         {
-        return ctx->digest->update(ctx,data,(unsigned long)count);
+        return ctx->digest->update(ctx,data,count);
         }
 
 /* The caller can assume that this removes any secret data from the context */
@@ -296,14 +251,14 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
         unsigned char *tmp_buf;
         if ((in == NULL) || (in->digest == NULL))
                 {
-                EVPerr(EVP_F_EVP_MD_CTX_COPY,EVP_R_INPUT_NOT_INITIALIZED);
+                EVPerr(EVP_F_EVP_MD_CTX_COPY_EX,EVP_R_INPUT_NOT_INITIALIZED);
                 return 0;
                 }
 #ifndef OPENSSL_NO_ENGINE
         /* Make sure it's safe to copy a digest context using an ENGINE */
         if (in->engine && !ENGINE_init(in->engine))
                 {
-                EVPerr(EVP_F_EVP_MD_CTX_COPY,ERR_R_ENGINE_LIB);
+                EVPerr(EVP_F_EVP_MD_CTX_COPY_EX,ERR_R_ENGINE_LIB);
                 return 0;
                 }
 #endif
@@ -330,7 +285,7 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
         return 1;
         }
 
-int EVP_Digest(void *data, unsigned int count,
+int EVP_Digest(const void *data, size_t count,
                 unsigned char *md, unsigned int *size, const EVP_MD *type, ENGINE *impl)
         {
         EVP_MD_CTX ctx;
diff --git a/src/lib/libssl/src/crypto/evp/e_aes.c b/src/lib/libssl/src/crypto/evp/e_aes.c
index 7b67984fa1..bd6c0a3a62 100644
--- a/src/lib/libssl/src/crypto/evp/e_aes.c
+++ b/src/lib/libssl/src/crypto/evp/e_aes.c
@@ -48,10 +48,12 @@
  *
  */
 
+#include <openssl/opensslconf.h>
 #ifndef OPENSSL_NO_AES
 #include <openssl/evp.h>
 #include <openssl/err.h>
 #include <string.h>
+#include <assert.h>
 #include <openssl/aes.h>
 #include "evp_locl.h"
 
@@ -67,32 +69,32 @@ typedef struct
 
 IMPLEMENT_BLOCK_CIPHER(aes_128, ks, AES, EVP_AES_KEY,
                        NID_aes_128, 16, 16, 16, 128,
-                       EVP_CIPH_FLAG_FIPS, aes_init_key, NULL, 
+                       0, aes_init_key, NULL, 
                        EVP_CIPHER_set_asn1_iv,
                        EVP_CIPHER_get_asn1_iv,
                        NULL)
 IMPLEMENT_BLOCK_CIPHER(aes_192, ks, AES, EVP_AES_KEY,
                        NID_aes_192, 16, 24, 16, 128,
-                       EVP_CIPH_FLAG_FIPS, aes_init_key, NULL, 
+                       0, aes_init_key, NULL, 
                        EVP_CIPHER_set_asn1_iv,
                        EVP_CIPHER_get_asn1_iv,
                        NULL)
 IMPLEMENT_BLOCK_CIPHER(aes_256, ks, AES, EVP_AES_KEY,
                        NID_aes_256, 16, 32, 16, 128,
-                       EVP_CIPH_FLAG_FIPS, aes_init_key, NULL, 
+                       0, aes_init_key, NULL, 
                        EVP_CIPHER_set_asn1_iv,
                        EVP_CIPHER_get_asn1_iv,
                        NULL)
 
-#define IMPLEMENT_AES_CFBR(ksize,cbits,flags)   IMPLEMENT_CFBR(aes,AES,EVP_AES_KEY,ks,ksize,cbits,16,flags)
+#define IMPLEMENT_AES_CFBR(ksize,cbits) IMPLEMENT_CFBR(aes,AES,EVP_AES_KEY,ks,ksize,cbits,16)
 
-IMPLEMENT_AES_CFBR(128,1,EVP_CIPH_FLAG_FIPS)
-IMPLEMENT_AES_CFBR(192,1,EVP_CIPH_FLAG_FIPS)
-IMPLEMENT_AES_CFBR(256,1,EVP_CIPH_FLAG_FIPS)
+IMPLEMENT_AES_CFBR(128,1)
+IMPLEMENT_AES_CFBR(192,1)
+IMPLEMENT_AES_CFBR(256,1)
 
-IMPLEMENT_AES_CFBR(128,8,EVP_CIPH_FLAG_FIPS)
-IMPLEMENT_AES_CFBR(192,8,EVP_CIPH_FLAG_FIPS)
-IMPLEMENT_AES_CFBR(256,8,EVP_CIPH_FLAG_FIPS)
+IMPLEMENT_AES_CFBR(128,8)
+IMPLEMENT_AES_CFBR(192,8)
+IMPLEMENT_AES_CFBR(256,8)
 
 static int aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
                    const unsigned char *iv, int enc)
diff --git a/src/lib/libssl/src/crypto/evp/e_bf.c b/src/lib/libssl/src/crypto/evp/e_bf.c
index e74337567b..cc224e5363 100644
--- a/src/lib/libssl/src/crypto/evp/e_bf.c
+++ b/src/lib/libssl/src/crypto/evp/e_bf.c
@@ -56,9 +56,9 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_BF
 #include <stdio.h>
 #include "cryptlib.h"
+#ifndef OPENSSL_NO_BF
 #include <openssl/evp.h>
 #include "evp_locl.h"
 #include <openssl/objects.h>
diff --git a/src/lib/libssl/src/crypto/evp/e_cast.c b/src/lib/libssl/src/crypto/evp/e_cast.c
index 3400fef187..d77bcd9298 100644
--- a/src/lib/libssl/src/crypto/evp/e_cast.c
+++ b/src/lib/libssl/src/crypto/evp/e_cast.c
@@ -56,10 +56,10 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_CAST
-
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_CAST
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include "evp_locl.h"
diff --git a/src/lib/libssl/src/crypto/evp/e_des.c b/src/lib/libssl/src/crypto/evp/e_des.c
index 46e2899825..856323648c 100644
--- a/src/lib/libssl/src/crypto/evp/e_des.c
+++ b/src/lib/libssl/src/crypto/evp/e_des.c
@@ -63,9 +63,11 @@
 #include <openssl/objects.h>
 #include "evp_locl.h"
 #include <openssl/des.h>
+#include <openssl/rand.h>
 
 static int des_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
                         const unsigned char *iv, int enc);
+static int des_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr);
 
 /* Because of various casts and different names can't use IMPLEMENT_BLOCK_CIPHER */
 
@@ -127,28 +129,48 @@ static int des_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
     }
 
 BLOCK_CIPHER_defs(des, DES_key_schedule, NID_des, 8, 8, 8, 64,
-                        EVP_CIPH_FLAG_FIPS, des_init_key, NULL,
+                        EVP_CIPH_RAND_KEY, des_init_key, NULL,
                         EVP_CIPHER_set_asn1_iv,
                         EVP_CIPHER_get_asn1_iv,
-                        NULL)
+                        des_ctrl)
 
 BLOCK_CIPHER_def_cfb(des,DES_key_schedule,NID_des,8,8,1,
-                     EVP_CIPH_FLAG_FIPS,des_init_key,NULL,
+                     EVP_CIPH_RAND_KEY, des_init_key,NULL,
                      EVP_CIPHER_set_asn1_iv,
-                     EVP_CIPHER_get_asn1_iv,NULL)
+                     EVP_CIPHER_get_asn1_iv,des_ctrl)
 
 BLOCK_CIPHER_def_cfb(des,DES_key_schedule,NID_des,8,8,8,
-                     EVP_CIPH_FLAG_FIPS,des_init_key,NULL,
+                     EVP_CIPH_RAND_KEY,des_init_key,NULL,
                      EVP_CIPHER_set_asn1_iv,
-                     EVP_CIPHER_get_asn1_iv,NULL)
+                     EVP_CIPHER_get_asn1_iv,des_ctrl)
 
 static int des_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
                         const unsigned char *iv, int enc)
         {
         DES_cblock *deskey = (DES_cblock *)key;
-
+#ifdef EVP_CHECK_DES_KEY
+        if(DES_set_key_checked(deskey,ctx->cipher_data) != 0)
+                return 0;
+#else
         DES_set_key_unchecked(deskey,ctx->cipher_data);
+#endif
         return 1;
         }
 
+static int des_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
+        {
+        
+        switch(type)
+                {
+        case EVP_CTRL_RAND_KEY:
+                if (RAND_bytes(ptr, 8) <= 0)
+                        return 0;
+                DES_set_odd_parity((DES_cblock *)ptr);
+                return 1;
+
+        default:
+                return -1;
+                }
+        }
+
 #endif
diff --git a/src/lib/libssl/src/crypto/evp/e_des3.c b/src/lib/libssl/src/crypto/evp/e_des3.c
index 677322bf02..ac148efab2 100644
--- a/src/lib/libssl/src/crypto/evp/e_des3.c
+++ b/src/lib/libssl/src/crypto/evp/e_des3.c
@@ -63,6 +63,7 @@
 #include <openssl/objects.h>
 #include "evp_locl.h"
 #include <openssl/des.h>
+#include <openssl/rand.h>
 
 static int des_ede_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
                             const unsigned char *iv,int enc);
@@ -70,6 +71,8 @@ static int des_ede_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
 static int des_ede3_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
                              const unsigned char *iv,int enc);
 
+static int des3_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr);
+
 typedef struct
     {
     DES_key_schedule ks1;/* key schedule */
@@ -85,7 +88,8 @@ static int des_ede_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                               const unsigned char *in, unsigned int inl)
 {
         BLOCK_CIPHER_ecb_loop()
-                DES_ecb3_encrypt(in + i,out + i, 
+                DES_ecb3_encrypt((const_DES_cblock *)(in + i),
+                                 (DES_cblock *)(out + i),
                                  &data(ctx)->ks1, &data(ctx)->ks2,
                                  &data(ctx)->ks3,
                                  ctx->encrypt);
@@ -160,10 +164,10 @@ static int des_ede3_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
     }
 
 BLOCK_CIPHER_defs(des_ede, DES_EDE_KEY, NID_des_ede, 8, 16, 8, 64,
-                        EVP_CIPH_FLAG_FIPS, des_ede_init_key, NULL, 
+                        EVP_CIPH_RAND_KEY, des_ede_init_key, NULL, 
                         EVP_CIPHER_set_asn1_iv,
                         EVP_CIPHER_get_asn1_iv,
-                        NULL)
+                        des3_ctrl)
 
 #define des_ede3_cfb64_cipher des_ede_cfb64_cipher
 #define des_ede3_ofb_cipher des_ede_ofb_cipher
@@ -171,28 +175,35 @@ BLOCK_CIPHER_defs(des_ede, DES_EDE_KEY, NID_des_ede, 8, 16, 8, 64,
 #define des_ede3_ecb_cipher des_ede_ecb_cipher
 
 BLOCK_CIPHER_defs(des_ede3, DES_EDE_KEY, NID_des_ede3, 8, 24, 8, 64,
-                        EVP_CIPH_FLAG_FIPS, des_ede3_init_key, NULL, 
+                        EVP_CIPH_RAND_KEY, des_ede3_init_key, NULL, 
                         EVP_CIPHER_set_asn1_iv,
                         EVP_CIPHER_get_asn1_iv,
-                        NULL)
+                        des3_ctrl)
 
 BLOCK_CIPHER_def_cfb(des_ede3,DES_EDE_KEY,NID_des_ede3,24,8,1,
-                     EVP_CIPH_FLAG_FIPS, des_ede3_init_key,NULL,
+                     EVP_CIPH_RAND_KEY, des_ede3_init_key,NULL,
                      EVP_CIPHER_set_asn1_iv,
-                     EVP_CIPHER_get_asn1_iv,NULL)
+                     EVP_CIPHER_get_asn1_iv,
+                     des3_ctrl)
 
 BLOCK_CIPHER_def_cfb(des_ede3,DES_EDE_KEY,NID_des_ede3,24,8,8,
-                     EVP_CIPH_FLAG_FIPS, des_ede3_init_key,NULL,
+                     EVP_CIPH_RAND_KEY, des_ede3_init_key,NULL,
                      EVP_CIPHER_set_asn1_iv,
-                     EVP_CIPHER_get_asn1_iv,NULL)
+                     EVP_CIPHER_get_asn1_iv,
+                     des3_ctrl)
 
 static int des_ede_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
                             const unsigned char *iv, int enc)
         {
         DES_cblock *deskey = (DES_cblock *)key;
-
+#ifdef EVP_CHECK_DES_KEY
+        if (DES_set_key_checked(&deskey[0],&data(ctx)->ks1)
+                !! DES_set_key_checked(&deskey[1],&data(ctx)->ks2))
+                return 0;
+#else
         DES_set_key_unchecked(&deskey[0],&data(ctx)->ks1);
         DES_set_key_unchecked(&deskey[1],&data(ctx)->ks2);
+#endif
         memcpy(&data(ctx)->ks3,&data(ctx)->ks1,
                sizeof(data(ctx)->ks1));
         return 1;
@@ -213,13 +224,41 @@ static int des_ede3_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
         }
 #endif  /* KSSL_DEBUG */
 
+#ifdef EVP_CHECK_DES_KEY
+        if (DES_set_key_checked(&deskey[0],&data(ctx)->ks1)
+                || DES_set_key_checked(&deskey[1],&data(ctx)->ks2)
+                || DES_set_key_checked(&deskey[2],&data(ctx)->ks3))
+                return 0;
+#else
         DES_set_key_unchecked(&deskey[0],&data(ctx)->ks1);
         DES_set_key_unchecked(&deskey[1],&data(ctx)->ks2);
         DES_set_key_unchecked(&deskey[2],&data(ctx)->ks3);
-
+#endif
         return 1;
         }
 
+static int des3_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
+        {
+
+        DES_cblock *deskey = ptr;
+
+        switch(type)
+                {
+        case EVP_CTRL_RAND_KEY:
+                if (RAND_bytes(ptr, c->key_len) <= 0)
+                        return 0;
+                DES_set_odd_parity(deskey);
+                if (c->key_len >= 16)
+                        DES_set_odd_parity(deskey + 1);
+                if (c->key_len >= 24)
+                        DES_set_odd_parity(deskey + 2);
+                return 1;
+
+        default:
+                return -1;
+                }
+        }
+
 const EVP_CIPHER *EVP_des_ede(void)
 {
         return &des_ede_ecb;
diff --git a/src/lib/libssl/src/crypto/evp/e_idea.c b/src/lib/libssl/src/crypto/evp/e_idea.c
index b9efa75ae7..48c33a774a 100644
--- a/src/lib/libssl/src/crypto/evp/e_idea.c
+++ b/src/lib/libssl/src/crypto/evp/e_idea.c
@@ -56,10 +56,10 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_IDEA
-
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_IDEA
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include "evp_locl.h"
diff --git a/src/lib/libssl/src/crypto/evp/e_null.c b/src/lib/libssl/src/crypto/evp/e_null.c
index a84b0f14b1..5205259f18 100644
--- a/src/lib/libssl/src/crypto/evp/e_null.c
+++ b/src/lib/libssl/src/crypto/evp/e_null.c
@@ -69,13 +69,14 @@ static const EVP_CIPHER n_cipher=
         {
         NID_undef,
         1,0,0,
-        EVP_CIPH_FLAG_FIPS,
+        0,
         null_init_key,
         null_cipher,
         NULL,
         0,
         NULL,
         NULL,
+        NULL,
         NULL
         };
 
@@ -95,7 +96,7 @@ static int null_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
              const unsigned char *in, unsigned int inl)
         {
         if (in != out)
-                memcpy((char *)out,(char *)in,(int)inl);
+                memcpy((char *)out,(const char *)in,(size_t)inl);
         return 1;
         }
 
diff --git a/src/lib/libssl/src/crypto/evp/e_rc2.c b/src/lib/libssl/src/crypto/evp/e_rc2.c
index d42cbfd17e..d37726ffae 100644
--- a/src/lib/libssl/src/crypto/evp/e_rc2.c
+++ b/src/lib/libssl/src/crypto/evp/e_rc2.c
@@ -56,10 +56,11 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_RC2
-
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_RC2
+
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include "evp_locl.h"
@@ -167,16 +168,17 @@ static int rc2_magic_to_meth(int i)
 static int rc2_get_asn1_type_and_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
         {
         long num=0;
-        int i=0,l;
+        int i=0;
         int key_bits;
+        unsigned int l;
         unsigned char iv[EVP_MAX_IV_LENGTH];
 
         if (type != NULL)
                 {
                 l=EVP_CIPHER_CTX_iv_length(c);
-                OPENSSL_assert(l <= sizeof iv);
+                OPENSSL_assert(l <= sizeof(iv));
                 i=ASN1_TYPE_get_int_octetstring(type,&num,iv,l);
-                if (i != l)
+                if (i != (int)l)
                         return(-1);
                 key_bits =rc2_magic_to_meth((int)num);
                 if (!key_bits)
diff --git a/src/lib/libssl/src/crypto/evp/e_rc4.c b/src/lib/libssl/src/crypto/evp/e_rc4.c
index 8aa70585b9..67af850bea 100644
--- a/src/lib/libssl/src/crypto/evp/e_rc4.c
+++ b/src/lib/libssl/src/crypto/evp/e_rc4.c
@@ -56,13 +56,13 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_RC4
-
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_RC4
+
 #include <openssl/evp.h>
 #include <openssl/objects.h>
-#include "evp_locl.h"
 #include <openssl/rc4.h>
 
 /* FIXME: surely this is available elsewhere? */
@@ -90,6 +90,7 @@ static const EVP_CIPHER r4_cipher=
         sizeof(EVP_RC4_KEY),
         NULL,
         NULL,
+        NULL,
         NULL
         };
 
@@ -104,6 +105,7 @@ static const EVP_CIPHER r4_40_cipher=
         sizeof(EVP_RC4_KEY),
         NULL, 
         NULL,
+        NULL,
         NULL
         };
 
diff --git a/src/lib/libssl/src/crypto/evp/e_rc5.c b/src/lib/libssl/src/crypto/evp/e_rc5.c
index 3c7713b181..19a10c6402 100644
--- a/src/lib/libssl/src/crypto/evp/e_rc5.c
+++ b/src/lib/libssl/src/crypto/evp/e_rc5.c
@@ -56,10 +56,11 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_RC5
-
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_RC5
+
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include "evp_locl.h"
diff --git a/src/lib/libssl/src/crypto/evp/e_xcbc_d.c b/src/lib/libssl/src/crypto/evp/e_xcbc_d.c
index a6f849e93d..8832da2433 100644
--- a/src/lib/libssl/src/crypto/evp/e_xcbc_d.c
+++ b/src/lib/libssl/src/crypto/evp/e_xcbc_d.c
@@ -56,9 +56,11 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_DES
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_DES
+
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/des.h>
@@ -89,6 +91,7 @@ static const EVP_CIPHER d_xcbc_cipher=
         sizeof(DESX_CBC_KEY),
         EVP_CIPHER_set_asn1_iv,
         EVP_CIPHER_get_asn1_iv,
+        NULL,
         NULL
         };
 
diff --git a/src/lib/libssl/src/crypto/evp/encode.c b/src/lib/libssl/src/crypto/evp/encode.c
index 33e540087d..5921f0d710 100644
--- a/src/lib/libssl/src/crypto/evp/encode.c
+++ b/src/lib/libssl/src/crypto/evp/encode.c
@@ -129,14 +129,14 @@ void EVP_EncodeInit(EVP_ENCODE_CTX *ctx)
         }
 
 void EVP_EncodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
-             unsigned char *in, int inl)
+             const unsigned char *in, int inl)
         {
         int i,j;
         unsigned int total=0;
 
         *outl=0;
         if (inl == 0) return;
-        OPENSSL_assert(ctx->length <= sizeof ctx->enc_data);
+        OPENSSL_assert(ctx->length <= (int)sizeof(ctx->enc_data));
         if ((ctx->num+inl) < ctx->length)
                 {
                 memcpy(&(ctx->enc_data[ctx->num]),in,inl);
@@ -233,7 +233,7 @@ void EVP_DecodeInit(EVP_ENCODE_CTX *ctx)
  *  1 for full line
  */
 int EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
-             unsigned char *in, int inl)
+             const unsigned char *in, int inl)
         {
         int seof= -1,eof=0,rv= -1,ret=0,i,v,tmp,n,ln,tmp2,exp_nl;
         unsigned char *d;
@@ -259,7 +259,7 @@ int EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
                 /* only save the good data :-) */
                 if (!B64_NOT_BASE64(v))
                         {
-                        OPENSSL_assert(n < sizeof ctx->enc_data);
+                        OPENSSL_assert(n < (int)sizeof(ctx->enc_data));
                         d[n++]=tmp;
                         ln++;
                         }
@@ -323,8 +323,8 @@ int EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
                         if (n > 0)
                                 {
                                 v=EVP_DecodeBlock(out,d,n);
-                                if (v < 0) { rv=0; goto end; }
                                 n=0;
+                                if (v < 0) { rv=0; goto end; }
                                 ret+=(v-eof);
                                 }
                         else
diff --git a/src/lib/libssl/src/crypto/evp/evp.h b/src/lib/libssl/src/crypto/evp/evp.h
index f29e0ba8f0..c19d764c15 100644
--- a/src/lib/libssl/src/crypto/evp/evp.h
+++ b/src/lib/libssl/src/crypto/evp/evp.h
@@ -75,10 +75,6 @@
 #include <openssl/bio.h>
 #endif
 
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
-
 /*
 #define EVP_RC2_KEY_SIZE                16
 #define EVP_RC4_KEY_SIZE                16
@@ -86,7 +82,7 @@
 #define EVP_CAST5_KEY_SIZE              16
 #define EVP_RC5_32_12_16_KEY_SIZE       16
 */
-#define EVP_MAX_MD_SIZE                 64      /* longest known SHA512 */
+#define EVP_MAX_MD_SIZE                 64      /* longest known is SHA512 */
 #define EVP_MAX_KEY_LENGTH              32
 #define EVP_MAX_IV_LENGTH               16
 #define EVP_MAX_BLOCK_LENGTH            32
@@ -100,11 +96,13 @@
 #define EVP_PK_RSA      0x0001
 #define EVP_PK_DSA      0x0002
 #define EVP_PK_DH       0x0004
+#define EVP_PK_EC       0x0008
 #define EVP_PKT_SIGN    0x0010
 #define EVP_PKT_ENC     0x0020
 #define EVP_PKT_EXCH    0x0040
 #define EVP_PKS_RSA     0x0100
 #define EVP_PKS_DSA     0x0200
+#define EVP_PKS_EC      0x0400
 #define EVP_PKT_EXP     0x1000 /* <= 512 bit key */
 
 #define EVP_PKEY_NONE   NID_undef
@@ -116,6 +114,7 @@
 #define EVP_PKEY_DSA3   NID_dsaWithSHA1
 #define EVP_PKEY_DSA4   NID_dsaWithSHA1_2
 #define EVP_PKEY_DH     NID_dhKeyAgreement
+#define EVP_PKEY_EC     NID_X9_62_id_ecPublicKey
 
 #ifdef  __cplusplus
 extern "C" {
@@ -140,6 +139,9 @@ struct evp_pkey_st
 #ifndef OPENSSL_NO_DH
                 struct dh_st *dh;       /* DH */
 #endif
+#ifndef OPENSSL_NO_EC
+                struct ec_key_st *ec;   /* ECC */
+#endif
                 } pkey;
         int save_parameters;
         STACK_OF(X509_ATTRIBUTE) *attributes; /* [ 0 ] */
@@ -225,39 +227,58 @@ struct env_md_st
         int md_size;
         unsigned long flags;
         int (*init)(EVP_MD_CTX *ctx);
-        int (*update)(EVP_MD_CTX *ctx,const void *data,unsigned long count);
+        int (*update)(EVP_MD_CTX *ctx,const void *data,size_t count);
         int (*final)(EVP_MD_CTX *ctx,unsigned char *md);
         int (*copy)(EVP_MD_CTX *to,const EVP_MD_CTX *from);
         int (*cleanup)(EVP_MD_CTX *ctx);
 
         /* FIXME: prototype these some day */
-        int (*sign)();
-        int (*verify)();
+        int (*sign)(int type, const unsigned char *m, unsigned int m_length,
+                    unsigned char *sigret, unsigned int *siglen, void *key);
+        int (*verify)(int type, const unsigned char *m, unsigned int m_length,
+                      const unsigned char *sigbuf, unsigned int siglen,
+                      void *key);
         int required_pkey_type[5]; /*EVP_PKEY_xxx */
         int block_size;
         int ctx_size; /* how big does the ctx->md_data need to be */
         } /* EVP_MD */;
 
+typedef int evp_sign_method(int type,const unsigned char *m,
+                            unsigned int m_length,unsigned char *sigret,
+                            unsigned int *siglen, void *key);
+typedef int evp_verify_method(int type,const unsigned char *m,
+                            unsigned int m_length,const unsigned char *sigbuf,
+                            unsigned int siglen, void *key);
+
 #define EVP_MD_FLAG_ONESHOT     0x0001 /* digest can only handle a single
                                         * block */
-#define EVP_MD_FLAG_FIPS        0x0400 /* Note if suitable for use in FIPS mode */
 
 #define EVP_PKEY_NULL_method    NULL,NULL,{0,0,0,0}
 
 #ifndef OPENSSL_NO_DSA
-#define EVP_PKEY_DSA_method     DSA_sign,DSA_verify, \
+#define EVP_PKEY_DSA_method     (evp_sign_method *)DSA_sign, \
+                                (evp_verify_method *)DSA_verify, \
                                 {EVP_PKEY_DSA,EVP_PKEY_DSA2,EVP_PKEY_DSA3, \
                                         EVP_PKEY_DSA4,0}
 #else
 #define EVP_PKEY_DSA_method     EVP_PKEY_NULL_method
 #endif
 
+#ifndef OPENSSL_NO_ECDSA
+#define EVP_PKEY_ECDSA_method   (evp_sign_method *)ECDSA_sign, \
+                                (evp_verify_method *)ECDSA_verify, \
+                                 {EVP_PKEY_EC,0,0,0}
+#else   
+#define EVP_PKEY_ECDSA_method   EVP_PKEY_NULL_method
+#endif
+
 #ifndef OPENSSL_NO_RSA
-#define EVP_PKEY_RSA_method     RSA_sign,RSA_verify, \
+#define EVP_PKEY_RSA_method     (evp_sign_method *)RSA_sign, \
+                                (evp_verify_method *)RSA_verify, \
                                 {EVP_PKEY_RSA,EVP_PKEY_RSA2,0,0}
 #define EVP_PKEY_RSA_ASN1_OCTET_STRING_method \
-                                RSA_sign_ASN1_OCTET_STRING, \
-                                RSA_verify_ASN1_OCTET_STRING, \
+                                (evp_sign_method *)RSA_sign_ASN1_OCTET_STRING, \
+                                (evp_verify_method *)RSA_verify_ASN1_OCTET_STRING, \
                                 {EVP_PKEY_RSA,EVP_PKEY_RSA2,0,0}
 #else
 #define EVP_PKEY_RSA_method     EVP_PKEY_NULL_method
@@ -283,9 +304,6 @@ struct env_md_ctx_st
 #define EVP_MD_CTX_FLAG_REUSE           0x0004 /* Don't free up ctx->md_data
                                                 * in EVP_MD_CTX_cleanup */
 
-#define EVP_MD_CTX_FLAG_NON_FIPS_ALLOW  0x0008  /* Allow use of non FIPS digest
-                                                 * in FIPS mode */
-
 struct evp_cipher_st
         {
         int nid;
@@ -327,10 +345,8 @@ struct evp_cipher_st
 #define         EVP_CIPH_CUSTOM_KEY_LENGTH      0x80
 /* Don't use standard block padding */
 #define         EVP_CIPH_NO_PADDING             0x100
-/* Note if suitable for use in FIPS mode */
-#define         EVP_CIPH_FLAG_FIPS              0x400
-/* Allow non FIPS cipher in FIPS mode */
-#define         EVP_CIPH_FLAG_NON_FIPS_ALLOW    0x800
+/* cipher handles random key generation */
+#define         EVP_CIPH_RAND_KEY               0x200
 
 /* ctrl() values */
 
@@ -341,6 +357,7 @@ struct evp_cipher_st
 #define         EVP_CTRL_GET_RC5_ROUNDS         0x4
 #define         EVP_CTRL_SET_RC5_ROUNDS         0x5
 #define         EVP_CTRL_SET_ACSS_MODE          0x6
+#define         EVP_CTRL_RAND_KEY               0x7
 
 typedef struct evp_cipher_info_st
         {
@@ -402,45 +419,47 @@ typedef int (EVP_PBE_KEYGEN)(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
                                         (char *)(dh))
 #endif
 
+#ifndef OPENSSL_NO_EC
+#define EVP_PKEY_assign_EC_KEY(pkey,eckey) EVP_PKEY_assign((pkey),EVP_PKEY_EC,\
+                                        (char *)(eckey))
+#endif
+
 /* Add some extra combinations */
 #define EVP_get_digestbynid(a) EVP_get_digestbyname(OBJ_nid2sn(a))
 #define EVP_get_digestbyobj(a) EVP_get_digestbynid(OBJ_obj2nid(a))
 #define EVP_get_cipherbynid(a) EVP_get_cipherbyname(OBJ_nid2sn(a))
 #define EVP_get_cipherbyobj(a) EVP_get_cipherbynid(OBJ_obj2nid(a))
 
-#define EVP_MD_type(e)                  ((e)->type)
+int EVP_MD_type(const EVP_MD *md);
 #define EVP_MD_nid(e)                   EVP_MD_type(e)
 #define EVP_MD_name(e)                  OBJ_nid2sn(EVP_MD_nid(e))
-#define EVP_MD_pkey_type(e)             ((e)->pkey_type)
-#define EVP_MD_size(e)                  ((e)->md_size)
-#define EVP_MD_block_size(e)            ((e)->block_size)
+int EVP_MD_pkey_type(const EVP_MD *md); 
+int EVP_MD_size(const EVP_MD *md);
+int EVP_MD_block_size(const EVP_MD *md);
 
-#define EVP_MD_CTX_md(e)                ((e)->digest)
-#define EVP_MD_CTX_size(e)              EVP_MD_size((e)->digest)
-#define EVP_MD_CTX_block_size(e)        EVP_MD_block_size((e)->digest)
-#define EVP_MD_CTX_type(e)              EVP_MD_type((e)->digest)
+const EVP_MD * EVP_MD_CTX_md(const EVP_MD_CTX *ctx);
+#define EVP_MD_CTX_size(e)              EVP_MD_size(EVP_MD_CTX_md(e))
+#define EVP_MD_CTX_block_size(e)        EVP_MD_block_size(EVP_MD_CTX_md(e))
+#define EVP_MD_CTX_type(e)              EVP_MD_type(EVP_MD_CTX_md(e))
 
-#define EVP_CIPHER_nid(e)               ((e)->nid)
+int EVP_CIPHER_nid(const EVP_CIPHER *cipher);
 #define EVP_CIPHER_name(e)              OBJ_nid2sn(EVP_CIPHER_nid(e))
-#define EVP_CIPHER_block_size(e)        ((e)->block_size)
-#define EVP_CIPHER_key_length(e)        ((e)->key_len)
-#define EVP_CIPHER_iv_length(e)         ((e)->iv_len)
-#define EVP_CIPHER_flags(e)             ((e)->flags)
-#define EVP_CIPHER_mode(e)              (((e)->flags) & EVP_CIPH_MODE)
-
-#define EVP_CIPHER_CTX_cipher(e)        ((e)->cipher)
-#define EVP_CIPHER_CTX_nid(e)           ((e)->cipher->nid)
-#define EVP_CIPHER_CTX_block_size(e)    ((e)->cipher->block_size)
-#define EVP_CIPHER_CTX_key_length(e)    ((e)->key_len)
-#define EVP_CIPHER_CTX_iv_length(e)     ((e)->cipher->iv_len)
-#define EVP_CIPHER_CTX_get_app_data(e)  ((e)->app_data)
-#define EVP_CIPHER_CTX_set_app_data(e,d) ((e)->app_data=(char *)(d))
+int EVP_CIPHER_block_size(const EVP_CIPHER *cipher);
+int EVP_CIPHER_key_length(const EVP_CIPHER *cipher);
+int EVP_CIPHER_iv_length(const EVP_CIPHER *cipher);
+unsigned long EVP_CIPHER_flags(const EVP_CIPHER *cipher);
+#define EVP_CIPHER_mode(e)              (EVP_CIPHER_flags(e) & EVP_CIPH_MODE)
+
+const EVP_CIPHER * EVP_CIPHER_CTX_cipher(const EVP_CIPHER_CTX *ctx);
+int EVP_CIPHER_CTX_nid(const EVP_CIPHER_CTX *ctx);
+int EVP_CIPHER_CTX_block_size(const EVP_CIPHER_CTX *ctx);
+int EVP_CIPHER_CTX_key_length(const EVP_CIPHER_CTX *ctx);
+int EVP_CIPHER_CTX_iv_length(const EVP_CIPHER_CTX *ctx);
+void * EVP_CIPHER_CTX_get_app_data(const EVP_CIPHER_CTX *ctx);
+void EVP_CIPHER_CTX_set_app_data(EVP_CIPHER_CTX *ctx, void *data);
 #define EVP_CIPHER_CTX_type(c)         EVP_CIPHER_type(EVP_CIPHER_CTX_cipher(c))
-#define EVP_CIPHER_CTX_flags(e)         ((e)->cipher->flags)
-#define EVP_CIPHER_CTX_set_flags(ctx,flgs) ((ctx)->flags|=(flgs))
-#define EVP_CIPHER_CTX_clear_flags(ctx,flgs) ((ctx)->flags&=~(flgs))
-#define EVP_CIPHER_CTX_test_flags(ctx,flgs) ((ctx)->flags&(flgs))
-#define EVP_CIPHER_CTX_mode(e)          ((e)->cipher->flags & EVP_CIPH_MODE)
+unsigned long EVP_CIPHER_CTX_flags(const EVP_CIPHER_CTX *ctx);
+#define EVP_CIPHER_CTX_mode(e)          (EVP_CIPHER_CTX_flags(e) & EVP_CIPH_MODE)
 
 #define EVP_ENCODE_LENGTH(l)    (((l+2)/3*4)+(l/48+1)*2+80)
 #define EVP_DECODE_LENGTH(l)    ((l+3)/4*3+80)
@@ -465,7 +484,10 @@ void BIO_set_md(BIO *,const EVP_MD *md);
 #define BIO_get_cipher_status(b)        BIO_ctrl(b,BIO_C_GET_CIPHER_STATUS,0,NULL)
 #define BIO_get_cipher_ctx(b,c_pp)      BIO_ctrl(b,BIO_C_GET_CIPHER_CTX,0,(char *)c_pp)
 
-#define EVP_Cipher(c,o,i,l)     (c)->cipher->do_cipher((c),(o),(i),(l))
+int EVP_Cipher(EVP_CIPHER_CTX *c,
+                unsigned char *out,
+                const unsigned char *in,
+                unsigned int inl);
 
 #define EVP_add_cipher_alias(n,alias) \
         OBJ_NAME_add((alias),OBJ_NAME_TYPE_CIPHER_METH|OBJ_NAME_ALIAS,(n))
@@ -481,14 +503,14 @@ int	EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx);
 EVP_MD_CTX *EVP_MD_CTX_create(void);
 void    EVP_MD_CTX_destroy(EVP_MD_CTX *ctx);
 int     EVP_MD_CTX_copy_ex(EVP_MD_CTX *out,const EVP_MD_CTX *in);  
-#define EVP_MD_CTX_set_flags(ctx,flgs) ((ctx)->flags|=(flgs))
-#define EVP_MD_CTX_clear_flags(ctx,flgs) ((ctx)->flags&=~(flgs))
-#define EVP_MD_CTX_test_flags(ctx,flgs) ((ctx)->flags&(flgs))
+void    EVP_MD_CTX_set_flags(EVP_MD_CTX *ctx, int flags);
+void    EVP_MD_CTX_clear_flags(EVP_MD_CTX *ctx, int flags);
+int     EVP_MD_CTX_test_flags(const EVP_MD_CTX *ctx,int flags);
 int     EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl);
 int     EVP_DigestUpdate(EVP_MD_CTX *ctx,const void *d,
-                         unsigned int cnt);
+                         size_t cnt);
 int     EVP_DigestFinal_ex(EVP_MD_CTX *ctx,unsigned char *md,unsigned int *s);
-int     EVP_Digest(void *data, unsigned int count,
+int     EVP_Digest(const void *data, size_t count,
                 unsigned char *md, unsigned int *size, const EVP_MD *type, ENGINE *impl);
 
 int     EVP_MD_CTX_copy(EVP_MD_CTX *out,const EVP_MD_CTX *in);  
@@ -496,7 +518,7 @@ int	EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type);
 int     EVP_DigestFinal(EVP_MD_CTX *ctx,unsigned char *md,unsigned int *s);
 
 int     EVP_read_pw_string(char *buf,int length,const char *prompt,int verify);
-void    EVP_set_pw_prompt(char *prompt);
+void    EVP_set_pw_prompt(const char *prompt);
 char *  EVP_get_pw_prompt(void);
 
 int     EVP_BytesToKey(const EVP_CIPHER *type,const EVP_MD *md,
@@ -535,43 +557,48 @@ int	EVP_CipherFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
 int     EVP_SignFinal(EVP_MD_CTX *ctx,unsigned char *md,unsigned int *s,
                 EVP_PKEY *pkey);
 
-int     EVP_VerifyFinal(EVP_MD_CTX *ctx,unsigned char *sigbuf,
+int     EVP_VerifyFinal(EVP_MD_CTX *ctx,const unsigned char *sigbuf,
                 unsigned int siglen,EVP_PKEY *pkey);
 
-int     EVP_OpenInit(EVP_CIPHER_CTX *ctx,const EVP_CIPHER *type,unsigned char *ek,
-                int ekl,unsigned char *iv,EVP_PKEY *priv);
+int     EVP_OpenInit(EVP_CIPHER_CTX *ctx,const EVP_CIPHER *type,
+                const unsigned char *ek, int ekl, const unsigned char *iv,
+                EVP_PKEY *priv);
 int     EVP_OpenFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl);
 
-int     EVP_SealInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, unsigned char **ek,
-                int *ekl, unsigned char *iv,EVP_PKEY **pubk, int npubk);
+int     EVP_SealInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+                 unsigned char **ek, int *ekl, unsigned char *iv,
+                EVP_PKEY **pubk, int npubk);
 int     EVP_SealFinal(EVP_CIPHER_CTX *ctx,unsigned char *out,int *outl);
 
 void    EVP_EncodeInit(EVP_ENCODE_CTX *ctx);
-void    EVP_EncodeUpdate(EVP_ENCODE_CTX *ctx,unsigned char *out,
-                int *outl,unsigned char *in,int inl);
+void    EVP_EncodeUpdate(EVP_ENCODE_CTX *ctx,unsigned char *out,int *outl,
+                const unsigned char *in,int inl);
 void    EVP_EncodeFinal(EVP_ENCODE_CTX *ctx,unsigned char *out,int *outl);
 int     EVP_EncodeBlock(unsigned char *t, const unsigned char *f, int n);
 
 void    EVP_DecodeInit(EVP_ENCODE_CTX *ctx);
 int     EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx,unsigned char *out,int *outl,
-                unsigned char *in, int inl);
+                const unsigned char *in, int inl);
 int     EVP_DecodeFinal(EVP_ENCODE_CTX *ctx, unsigned
                 char *out, int *outl);
 int     EVP_DecodeBlock(unsigned char *t, const unsigned char *f, int n);
 
 void EVP_CIPHER_CTX_init(EVP_CIPHER_CTX *a);
 int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *a);
+EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void);
+void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *a);
 int EVP_CIPHER_CTX_set_key_length(EVP_CIPHER_CTX *x, int keylen);
 int EVP_CIPHER_CTX_set_padding(EVP_CIPHER_CTX *c, int pad);
 int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr);
+int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key);
 
 #ifndef OPENSSL_NO_BIO
 BIO_METHOD *BIO_f_md(void);
 BIO_METHOD *BIO_f_base64(void);
 BIO_METHOD *BIO_f_cipher(void);
 BIO_METHOD *BIO_f_reliable(void);
-void BIO_set_cipher(BIO *b,const EVP_CIPHER *c,unsigned char *k,
-        unsigned char *i, int enc);
+void BIO_set_cipher(BIO *b,const EVP_CIPHER *c,const unsigned char *k,
+                const unsigned char *i, int enc);
 #endif
 
 const EVP_MD *EVP_md_null(void);
@@ -589,7 +616,8 @@ const EVP_MD *EVP_sha(void);
 const EVP_MD *EVP_sha1(void);
 const EVP_MD *EVP_dss(void);
 const EVP_MD *EVP_dss1(void);
-#ifdef OPENSSL_FIPS
+const EVP_MD *EVP_ecdsa(void);
+#endif
 #ifndef OPENSSL_NO_SHA256
 const EVP_MD *EVP_sha224(void);
 const EVP_MD *EVP_sha256(void);
@@ -598,8 +626,6 @@ const EVP_MD *EVP_sha256(void);
 const EVP_MD *EVP_sha384(void);
 const EVP_MD *EVP_sha512(void);
 #endif
-#endif
-#endif
 #ifndef OPENSSL_NO_MDC2
 const EVP_MD *EVP_mdc2(void);
 #endif
@@ -720,6 +746,37 @@ const EVP_CIPHER *EVP_aes_256_ctr(void);
 #ifndef OPENSSL_NO_ACSS
 const EVP_CIPHER *EVP_acss(void);
 #endif
+#ifndef OPENSSL_NO_CAMELLIA
+const EVP_CIPHER *EVP_camellia_128_ecb(void);
+const EVP_CIPHER *EVP_camellia_128_cbc(void);
+const EVP_CIPHER *EVP_camellia_128_cfb1(void);
+const EVP_CIPHER *EVP_camellia_128_cfb8(void);
+const EVP_CIPHER *EVP_camellia_128_cfb128(void);
+# define EVP_camellia_128_cfb EVP_camellia_128_cfb128
+const EVP_CIPHER *EVP_camellia_128_ofb(void);
+const EVP_CIPHER *EVP_camellia_192_ecb(void);
+const EVP_CIPHER *EVP_camellia_192_cbc(void);
+const EVP_CIPHER *EVP_camellia_192_cfb1(void);
+const EVP_CIPHER *EVP_camellia_192_cfb8(void);
+const EVP_CIPHER *EVP_camellia_192_cfb128(void);
+# define EVP_camellia_192_cfb EVP_camellia_192_cfb128
+const EVP_CIPHER *EVP_camellia_192_ofb(void);
+const EVP_CIPHER *EVP_camellia_256_ecb(void);
+const EVP_CIPHER *EVP_camellia_256_cbc(void);
+const EVP_CIPHER *EVP_camellia_256_cfb1(void);
+const EVP_CIPHER *EVP_camellia_256_cfb8(void);
+const EVP_CIPHER *EVP_camellia_256_cfb128(void);
+# define EVP_camellia_256_cfb EVP_camellia_256_cfb128
+const EVP_CIPHER *EVP_camellia_256_ofb(void);
+#endif
+
+#ifndef OPENSSL_NO_SEED
+const EVP_CIPHER *EVP_seed_ecb(void);
+const EVP_CIPHER *EVP_seed_cbc(void);
+const EVP_CIPHER *EVP_seed_cfb128(void);
+# define EVP_seed_cfb EVP_seed_cfb128
+const EVP_CIPHER *EVP_seed_ofb(void);
+#endif
 
 void OPENSSL_add_all_algorithms_noconf(void);
 void OPENSSL_add_all_algorithms_conf(void);
@@ -745,10 +802,12 @@ const EVP_CIPHER *EVP_get_cipherbyname(const char *name);
 const EVP_MD *EVP_get_digestbyname(const char *name);
 void EVP_cleanup(void);
 
-int             EVP_PKEY_decrypt(unsigned char *dec_key,unsigned char *enc_key,
-                        int enc_key_len,EVP_PKEY *private_key);
+int             EVP_PKEY_decrypt(unsigned char *dec_key,
+                        const unsigned char *enc_key,int enc_key_len,
+                        EVP_PKEY *private_key);
 int             EVP_PKEY_encrypt(unsigned char *enc_key,
-                        unsigned char *key,int key_len,EVP_PKEY *pub_key);
+                        const unsigned char *key,int key_len,
+                        EVP_PKEY *pub_key);
 int             EVP_PKEY_type(int type);
 int             EVP_PKEY_bits(EVP_PKEY *pkey);
 int             EVP_PKEY_size(EVP_PKEY *pkey);
@@ -769,24 +828,31 @@ struct dh_st;
 int EVP_PKEY_set1_DH(EVP_PKEY *pkey,struct dh_st *key);
 struct dh_st *EVP_PKEY_get1_DH(EVP_PKEY *pkey);
 #endif
-
+#ifndef OPENSSL_NO_EC
+struct ec_key_st;
+int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey,struct ec_key_st *key);
+struct ec_key_st *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey);
+#endif
 
 EVP_PKEY *      EVP_PKEY_new(void);
 void            EVP_PKEY_free(EVP_PKEY *pkey);
-EVP_PKEY *      d2i_PublicKey(int type,EVP_PKEY **a, unsigned char **pp,
+
+EVP_PKEY *      d2i_PublicKey(int type,EVP_PKEY **a, const unsigned char **pp,
                         long length);
 int             i2d_PublicKey(EVP_PKEY *a, unsigned char **pp);
 
-EVP_PKEY *      d2i_PrivateKey(int type,EVP_PKEY **a, unsigned char **pp,
+EVP_PKEY *      d2i_PrivateKey(int type,EVP_PKEY **a, const unsigned char **pp,
                         long length);
-EVP_PKEY *      d2i_AutoPrivateKey(EVP_PKEY **a, unsigned char **pp,
+EVP_PKEY *      d2i_AutoPrivateKey(EVP_PKEY **a, const unsigned char **pp,
                         long length);
 int             i2d_PrivateKey(EVP_PKEY *a, unsigned char **pp);
 
-int EVP_PKEY_copy_parameters(EVP_PKEY *to,EVP_PKEY *from);
-int EVP_PKEY_missing_parameters(EVP_PKEY *pkey);
+int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from);
+int EVP_PKEY_missing_parameters(const EVP_PKEY *pkey);
 int EVP_PKEY_save_parameters(EVP_PKEY *pkey,int mode);
-int EVP_PKEY_cmp_parameters(EVP_PKEY *a,EVP_PKEY *b);
+int EVP_PKEY_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b);
+
+int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b);
 
 int EVP_CIPHER_type(const EVP_CIPHER *ctx);
 
@@ -803,7 +869,7 @@ int PKCS5_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
                          ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md,
                          int en_de);
 int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen,
-                           unsigned char *salt, int saltlen, int iter,
+                           const unsigned char *salt, int saltlen, int iter,
                            int keylen, unsigned char *out);
 int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
                          ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md,
@@ -826,30 +892,32 @@ void ERR_load_EVP_strings(void);
 /* Error codes for the EVP functions. */
 
 /* Function codes. */
-#define EVP_F_AES_INIT_KEY                               129
+#define EVP_F_AES_INIT_KEY                               133
+#define EVP_F_CAMELLIA_INIT_KEY                          159
 #define EVP_F_D2I_PKEY                                   100
-#define EVP_F_EVP_ADD_CIPHER                             130
-#define EVP_F_EVP_ADD_DIGEST                             131
-#define EVP_F_EVP_CIPHERINIT                             123
+#define EVP_F_DSAPKEY2PKCS8                              134
+#define EVP_F_DSA_PKEY2PKCS8                             135
+#define EVP_F_ECDSA_PKEY2PKCS8                           129
+#define EVP_F_ECKEY_PKEY2PKCS8                           132
+#define EVP_F_EVP_CIPHERINIT_EX                          123
 #define EVP_F_EVP_CIPHER_CTX_CTRL                        124
 #define EVP_F_EVP_CIPHER_CTX_SET_KEY_LENGTH              122
-#define EVP_F_EVP_DECRYPTFINAL                           101
-#define EVP_F_EVP_DIGESTINIT                             128
-#define EVP_F_EVP_ENCRYPTFINAL                           127
-#define EVP_F_EVP_GET_CIPHERBYNAME                       132
-#define EVP_F_EVP_GET_DIGESTBYNAME                       133
-#define EVP_F_EVP_MD_CTX_COPY                            110
+#define EVP_F_EVP_DECRYPTFINAL_EX                        101
+#define EVP_F_EVP_DIGESTINIT_EX                          128
+#define EVP_F_EVP_ENCRYPTFINAL_EX                        127
+#define EVP_F_EVP_MD_CTX_COPY_EX                         110
 #define EVP_F_EVP_OPENINIT                               102
 #define EVP_F_EVP_PBE_ALG_ADD                            115
 #define EVP_F_EVP_PBE_CIPHERINIT                         116
 #define EVP_F_EVP_PKCS82PKEY                             111
-#define EVP_F_EVP_PKCS8_SET_BROKEN                       112
-#define EVP_F_EVP_PKEY2PKCS8                             113
+#define EVP_F_EVP_PKEY2PKCS8_BROKEN                      113
 #define EVP_F_EVP_PKEY_COPY_PARAMETERS                   103
 #define EVP_F_EVP_PKEY_DECRYPT                           104
 #define EVP_F_EVP_PKEY_ENCRYPT                           105
 #define EVP_F_EVP_PKEY_GET1_DH                           119
 #define EVP_F_EVP_PKEY_GET1_DSA                          120
+#define EVP_F_EVP_PKEY_GET1_ECDSA                        130
+#define EVP_F_EVP_PKEY_GET1_EC_KEY                       131
 #define EVP_F_EVP_PKEY_GET1_RSA                          121
 #define EVP_F_EVP_PKEY_NEW                               106
 #define EVP_F_EVP_RIJNDAEL                               126
@@ -857,28 +925,32 @@ void ERR_load_EVP_strings(void);
 #define EVP_F_EVP_VERIFYFINAL                            108
 #define EVP_F_PKCS5_PBE_KEYIVGEN                         117
 #define EVP_F_PKCS5_V2_PBE_KEYIVGEN                      118
+#define EVP_F_PKCS8_SET_BROKEN                           112
 #define EVP_F_RC2_MAGIC_TO_METH                          109
 #define EVP_F_RC5_CTRL                                   125
 
 /* Reason codes. */
-#define EVP_R_AES_KEY_SETUP_FAILED                       140
+#define EVP_R_AES_KEY_SETUP_FAILED                       143
+#define EVP_R_ASN1_LIB                                   140
 #define EVP_R_BAD_BLOCK_LENGTH                           136
 #define EVP_R_BAD_DECRYPT                                100
 #define EVP_R_BAD_KEY_LENGTH                             137
 #define EVP_R_BN_DECODE_ERROR                            112
 #define EVP_R_BN_PUBKEY_ERROR                            113
+#define EVP_R_CAMELLIA_KEY_SETUP_FAILED                  157
 #define EVP_R_CIPHER_PARAMETER_ERROR                     122
 #define EVP_R_CTRL_NOT_IMPLEMENTED                       132
 #define EVP_R_CTRL_OPERATION_NOT_IMPLEMENTED             133
 #define EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH          138
 #define EVP_R_DECODE_ERROR                               114
 #define EVP_R_DIFFERENT_KEY_TYPES                        101
-#define EVP_R_DISABLED_FOR_FIPS                          141
 #define EVP_R_ENCODE_ERROR                               115
 #define EVP_R_EVP_PBE_CIPHERINIT_ERROR                   119
 #define EVP_R_EXPECTING_AN_RSA_KEY                       127
 #define EVP_R_EXPECTING_A_DH_KEY                         128
 #define EVP_R_EXPECTING_A_DSA_KEY                        129
+#define EVP_R_EXPECTING_A_ECDSA_KEY                      141
+#define EVP_R_EXPECTING_A_EC_KEY                         142
 #define EVP_R_INITIALIZATION_ERROR                       134
 #define EVP_R_INPUT_NOT_INITIALIZED                      111
 #define EVP_R_INVALID_KEY_LENGTH                         130
@@ -903,6 +975,7 @@ void ERR_load_EVP_strings(void);
 #define EVP_R_UNSUPPORTED_SALT_TYPE                      126
 #define EVP_R_WRONG_FINAL_BLOCK_LENGTH                   109
 #define EVP_R_WRONG_PUBLIC_KEY_TYPE                      110
+#define EVP_R_SEED_KEY_SETUP_FAILED                      162
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/evp/evp_enc.c b/src/lib/libssl/src/crypto/evp/evp_enc.c
index f549eeb437..a1904993bf 100644
--- a/src/lib/libssl/src/crypto/evp/evp_enc.c
+++ b/src/lib/libssl/src/crypto/evp/evp_enc.c
@@ -60,12 +60,13 @@
 #include "cryptlib.h"
 #include <openssl/evp.h>
 #include <openssl/err.h>
+#include <openssl/rand.h>
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
 #include "evp_locl.h"
 
-const char *EVP_version="EVP" OPENSSL_VERSION_PTEXT;
+const char EVP_version[]="EVP" OPENSSL_VERSION_PTEXT;
 
 void EVP_CIPHER_CTX_init(EVP_CIPHER_CTX *ctx)
         {
@@ -73,6 +74,13 @@ void EVP_CIPHER_CTX_init(EVP_CIPHER_CTX *ctx)
         /* ctx->cipher=NULL; */
         }
 
+EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void)
+        {
+        EVP_CIPHER_CTX *ctx=OPENSSL_malloc(sizeof *ctx);
+        if (ctx)
+                EVP_CIPHER_CTX_init(ctx);
+        return ctx;
+        }
 
 int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
              const unsigned char *key, const unsigned char *iv, int enc)
@@ -82,48 +90,6 @@ int EVP_CipherInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
         return EVP_CipherInit_ex(ctx,cipher,NULL,key,iv,enc);
         }
 
-#ifdef OPENSSL_FIPS
-
-/* The purpose of these is to trap programs that attempt to use non FIPS
- * algorithms in FIPS mode and ignore the errors.
- */
-
-int bad_init(EVP_CIPHER_CTX *ctx, const unsigned char *key,
-            const unsigned char *iv, int enc)
-        { FIPS_ERROR_IGNORED("Cipher init"); return 0;}
-
-int bad_do_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
-                 const unsigned char *in, unsigned int inl)
-        { FIPS_ERROR_IGNORED("Cipher update"); return 0;}
-
-/* NB: no cleanup because it is allowed after failed init */
-
-int bad_set_asn1(EVP_CIPHER_CTX *ctx, ASN1_TYPE *typ)
-        { FIPS_ERROR_IGNORED("Cipher set_asn1"); return 0;}
-int bad_get_asn1(EVP_CIPHER_CTX *ctx, ASN1_TYPE *typ)
-        { FIPS_ERROR_IGNORED("Cipher get_asn1"); return 0;}
-int bad_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
-        { FIPS_ERROR_IGNORED("Cipher ctrl"); return 0;}
-
-static const EVP_CIPHER bad_cipher =
-        {
-        0,
-        0,
-        0,
-        0,
-        0,
-        bad_init,
-        bad_do_cipher,
-        NULL,
-        0,
-        bad_set_asn1,
-        bad_get_asn1,
-        bad_ctrl,
-        NULL
-        };
-
-#endif
-
 int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *impl,
              const unsigned char *key, const unsigned char *iv, int enc)
         {
@@ -158,7 +124,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
                         {
                         if (!ENGINE_init(impl))
                                 {
-                                EVPerr(EVP_F_EVP_CIPHERINIT, EVP_R_INITIALIZATION_ERROR);
+                                EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);
                                 return 0;
                                 }
                         }
@@ -175,7 +141,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
                                  * control history, is that we should at least
                                  * be able to avoid using US mispellings of
                                  * "initialisation"? */
-                                EVPerr(EVP_F_EVP_CIPHERINIT, EVP_R_INITIALIZATION_ERROR);
+                                EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);
                                 return 0;
                                 }
                         /* We'll use the ENGINE's private cipher definition */
@@ -188,13 +154,14 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
                 else
                         ctx->engine = NULL;
 #endif
+
                 ctx->cipher=cipher;
                 if (ctx->cipher->ctx_size)
                         {
                         ctx->cipher_data=OPENSSL_malloc(ctx->cipher->ctx_size);
                         if (!ctx->cipher_data)
                                 {
-                                EVPerr(EVP_F_EVP_CIPHERINIT, ERR_R_MALLOC_FAILURE);
+                                EVPerr(EVP_F_EVP_CIPHERINIT_EX, ERR_R_MALLOC_FAILURE);
                                 return 0;
                                 }
                         }
@@ -208,14 +175,14 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher, ENGINE *imp
                         {
                         if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL))
                                 {
-                                EVPerr(EVP_F_EVP_CIPHERINIT, EVP_R_INITIALIZATION_ERROR);
+                                EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_INITIALIZATION_ERROR);
                                 return 0;
                                 }
                         }
                 }
         else if(!ctx->cipher)
                 {
-                EVPerr(EVP_F_EVP_CIPHERINIT, EVP_R_NO_CIPHER_SET);
+                EVPerr(EVP_F_EVP_CIPHERINIT_EX, EVP_R_NO_CIPHER_SET);
                 return 0;
                 }
 #ifndef OPENSSL_NO_ENGINE
@@ -240,7 +207,8 @@ skip_to_init:
 
                         case EVP_CIPH_CBC_MODE:
 
-                        OPENSSL_assert(EVP_CIPHER_CTX_iv_length(ctx) <= sizeof ctx->iv);
+                        OPENSSL_assert(EVP_CIPHER_CTX_iv_length(ctx) <=
+                                        (int)sizeof(ctx->iv));
                         if(iv) memcpy(ctx->oiv, iv, EVP_CIPHER_CTX_iv_length(ctx));
                         memcpy(ctx->iv, ctx->oiv, EVP_CIPHER_CTX_iv_length(ctx));
                         break;
@@ -251,24 +219,6 @@ skip_to_init:
                 }
         }
 
-#ifdef OPENSSL_FIPS
-        /* After 'key' is set no further parameters changes are permissible.
-         * So only check for non FIPS enabling at this point.
-         */
-        if (key && FIPS_mode())
-                {
-                if (!(ctx->cipher->flags & EVP_CIPH_FLAG_FIPS)
-                        & !(ctx->flags & EVP_CIPH_FLAG_NON_FIPS_ALLOW))
-                        {
-                        EVPerr(EVP_F_EVP_CIPHERINIT, EVP_R_DISABLED_FOR_FIPS);
-                        ERR_add_error_data(2, "cipher=",
-                                                EVP_CIPHER_name(ctx->cipher));
-                        ctx->cipher = &bad_cipher;
-                        return 0;
-                        }
-                }
-#endif
-
         if(key || (ctx->cipher->flags & EVP_CIPH_ALWAYS_CALL_INIT)) {
                 if(!ctx->cipher->init(ctx,key,iv,enc)) return 0;
         }
@@ -345,7 +295,7 @@ int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
                 }
         i=ctx->buf_len;
         bl=ctx->cipher->block_size;
-        OPENSSL_assert(bl <= sizeof ctx->buf);
+        OPENSSL_assert(bl <= (int)sizeof(ctx->buf));
         if (i != 0)
                 {
                 if (i+inl < bl)
@@ -391,7 +341,8 @@ int EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
 
 int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
         {
-        int i,n,b,bl,ret;
+        int n,ret;
+        unsigned int i, b, bl;
 
         b=ctx->cipher->block_size;
         OPENSSL_assert(b <= sizeof ctx->buf);
@@ -405,7 +356,7 @@ int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
                 {
                 if(bl)
                         {
-                        EVPerr(EVP_F_EVP_ENCRYPTFINAL,EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH);
+                        EVPerr(EVP_F_EVP_ENCRYPTFINAL_EX,EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH);
                         return 0;
                         }
                 *outl = 0;
@@ -427,7 +378,8 @@ int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
 int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
              const unsigned char *in, int inl)
         {
-        int b, fix_len;
+        int fix_len;
+        unsigned int b;
 
         if (inl == 0)
                 {
@@ -480,8 +432,8 @@ int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
 
 int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
         {
-        int i,b;
-        int n;
+        int i,n;
+        unsigned int b;
 
         *outl=0;
         b=ctx->cipher->block_size;
@@ -489,7 +441,7 @@ int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
                 {
                 if(ctx->buf_len)
                         {
-                        EVPerr(EVP_F_EVP_DECRYPTFINAL,EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH);
+                        EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH);
                         return 0;
                         }
                 *outl = 0;
@@ -499,21 +451,21 @@ int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
                 {
                 if (ctx->buf_len || !ctx->final_used)
                         {
-                        EVPerr(EVP_F_EVP_DECRYPTFINAL,EVP_R_WRONG_FINAL_BLOCK_LENGTH);
+                        EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_WRONG_FINAL_BLOCK_LENGTH);
                         return(0);
                         }
                 OPENSSL_assert(b <= sizeof ctx->final);
                 n=ctx->final[b-1];
-                if (n > b)
+                if (n == 0 || n > (int)b)
                         {
-                        EVPerr(EVP_F_EVP_DECRYPTFINAL,EVP_R_BAD_DECRYPT);
+                        EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_BAD_DECRYPT);
                         return(0);
                         }
                 for (i=0; i<n; i++)
                         {
                         if (ctx->final[--b] != n)
                                 {
-                                EVPerr(EVP_F_EVP_DECRYPTFINAL,EVP_R_BAD_DECRYPT);
+                                EVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_BAD_DECRYPT);
                                 return(0);
                                 }
                         }
@@ -527,6 +479,15 @@ int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
         return(1);
         }
 
+void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *ctx)
+        {
+        if (ctx)
+                {
+                EVP_CIPHER_CTX_cleanup(ctx);
+                OPENSSL_free(ctx);
+                }
+        }
+
 int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *c)
         {
         if (c->cipher != NULL)
@@ -590,3 +551,13 @@ int EVP_CIPHER_CTX_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
         }
         return ret;
 }
+
+int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key)
+        {
+        if (ctx->cipher->flags & EVP_CIPH_RAND_KEY)
+                return EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_RAND_KEY, 0, key);
+        if (RAND_bytes(key, ctx->key_len) <= 0)
+                return 0;
+        return 1;
+        }
+
diff --git a/src/lib/libssl/src/crypto/evp/evp_err.c b/src/lib/libssl/src/crypto/evp/evp_err.c
index 77eee070d3..e8c9e8de9c 100644
--- a/src/lib/libssl/src/crypto/evp/evp_err.c
+++ b/src/lib/libssl/src/crypto/evp/evp_err.c
@@ -71,29 +71,31 @@
 static ERR_STRING_DATA EVP_str_functs[]=
         {
 {ERR_FUNC(EVP_F_AES_INIT_KEY),  "AES_INIT_KEY"},
+{ERR_FUNC(EVP_F_CAMELLIA_INIT_KEY),     "CAMELLIA_INIT_KEY"},
 {ERR_FUNC(EVP_F_D2I_PKEY),      "D2I_PKEY"},
-{ERR_FUNC(EVP_F_EVP_ADD_CIPHER),        "EVP_add_cipher"},
-{ERR_FUNC(EVP_F_EVP_ADD_DIGEST),        "EVP_add_digest"},
-{ERR_FUNC(EVP_F_EVP_CIPHERINIT),        "EVP_CipherInit"},
+{ERR_FUNC(EVP_F_DSAPKEY2PKCS8), "DSAPKEY2PKCS8"},
+{ERR_FUNC(EVP_F_DSA_PKEY2PKCS8),        "DSA_PKEY2PKCS8"},
+{ERR_FUNC(EVP_F_ECDSA_PKEY2PKCS8),      "ECDSA_PKEY2PKCS8"},
+{ERR_FUNC(EVP_F_ECKEY_PKEY2PKCS8),      "ECKEY_PKEY2PKCS8"},
+{ERR_FUNC(EVP_F_EVP_CIPHERINIT_EX),     "EVP_CipherInit_ex"},
 {ERR_FUNC(EVP_F_EVP_CIPHER_CTX_CTRL),   "EVP_CIPHER_CTX_ctrl"},
 {ERR_FUNC(EVP_F_EVP_CIPHER_CTX_SET_KEY_LENGTH), "EVP_CIPHER_CTX_set_key_length"},
-{ERR_FUNC(EVP_F_EVP_DECRYPTFINAL),      "EVP_DecryptFinal"},
-{ERR_FUNC(EVP_F_EVP_DIGESTINIT),        "EVP_DigestInit"},
-{ERR_FUNC(EVP_F_EVP_ENCRYPTFINAL),      "EVP_EncryptFinal"},
-{ERR_FUNC(EVP_F_EVP_GET_CIPHERBYNAME),  "EVP_get_cipherbyname"},
-{ERR_FUNC(EVP_F_EVP_GET_DIGESTBYNAME),  "EVP_get_digestbyname"},
-{ERR_FUNC(EVP_F_EVP_MD_CTX_COPY),       "EVP_MD_CTX_copy"},
+{ERR_FUNC(EVP_F_EVP_DECRYPTFINAL_EX),   "EVP_DecryptFinal_ex"},
+{ERR_FUNC(EVP_F_EVP_DIGESTINIT_EX),     "EVP_DigestInit_ex"},
+{ERR_FUNC(EVP_F_EVP_ENCRYPTFINAL_EX),   "EVP_EncryptFinal_ex"},
+{ERR_FUNC(EVP_F_EVP_MD_CTX_COPY_EX),    "EVP_MD_CTX_copy_ex"},
 {ERR_FUNC(EVP_F_EVP_OPENINIT),  "EVP_OpenInit"},
 {ERR_FUNC(EVP_F_EVP_PBE_ALG_ADD),       "EVP_PBE_alg_add"},
 {ERR_FUNC(EVP_F_EVP_PBE_CIPHERINIT),    "EVP_PBE_CipherInit"},
 {ERR_FUNC(EVP_F_EVP_PKCS82PKEY),        "EVP_PKCS82PKEY"},
-{ERR_FUNC(EVP_F_EVP_PKCS8_SET_BROKEN),  "EVP_PKCS8_SET_BROKEN"},
-{ERR_FUNC(EVP_F_EVP_PKEY2PKCS8),        "EVP_PKEY2PKCS8"},
+{ERR_FUNC(EVP_F_EVP_PKEY2PKCS8_BROKEN), "EVP_PKEY2PKCS8_broken"},
 {ERR_FUNC(EVP_F_EVP_PKEY_COPY_PARAMETERS),      "EVP_PKEY_copy_parameters"},
 {ERR_FUNC(EVP_F_EVP_PKEY_DECRYPT),      "EVP_PKEY_decrypt"},
 {ERR_FUNC(EVP_F_EVP_PKEY_ENCRYPT),      "EVP_PKEY_encrypt"},
 {ERR_FUNC(EVP_F_EVP_PKEY_GET1_DH),      "EVP_PKEY_get1_DH"},
 {ERR_FUNC(EVP_F_EVP_PKEY_GET1_DSA),     "EVP_PKEY_get1_DSA"},
+{ERR_FUNC(EVP_F_EVP_PKEY_GET1_ECDSA),   "EVP_PKEY_GET1_ECDSA"},
+{ERR_FUNC(EVP_F_EVP_PKEY_GET1_EC_KEY),  "EVP_PKEY_get1_EC_KEY"},
 {ERR_FUNC(EVP_F_EVP_PKEY_GET1_RSA),     "EVP_PKEY_get1_RSA"},
 {ERR_FUNC(EVP_F_EVP_PKEY_NEW),  "EVP_PKEY_new"},
 {ERR_FUNC(EVP_F_EVP_RIJNDAEL),  "EVP_RIJNDAEL"},
@@ -101,6 +103,7 @@ static ERR_STRING_DATA EVP_str_functs[]=
 {ERR_FUNC(EVP_F_EVP_VERIFYFINAL),       "EVP_VerifyFinal"},
 {ERR_FUNC(EVP_F_PKCS5_PBE_KEYIVGEN),    "PKCS5_PBE_keyivgen"},
 {ERR_FUNC(EVP_F_PKCS5_V2_PBE_KEYIVGEN), "PKCS5_v2_PBE_keyivgen"},
+{ERR_FUNC(EVP_F_PKCS8_SET_BROKEN),      "PKCS8_set_broken"},
 {ERR_FUNC(EVP_F_RC2_MAGIC_TO_METH),     "RC2_MAGIC_TO_METH"},
 {ERR_FUNC(EVP_F_RC5_CTRL),      "RC5_CTRL"},
 {0,NULL}
@@ -109,23 +112,26 @@ static ERR_STRING_DATA EVP_str_functs[]=
 static ERR_STRING_DATA EVP_str_reasons[]=
         {
 {ERR_REASON(EVP_R_AES_KEY_SETUP_FAILED)  ,"aes key setup failed"},
+{ERR_REASON(EVP_R_ASN1_LIB)              ,"asn1 lib"},
 {ERR_REASON(EVP_R_BAD_BLOCK_LENGTH)      ,"bad block length"},
 {ERR_REASON(EVP_R_BAD_DECRYPT)           ,"bad decrypt"},
 {ERR_REASON(EVP_R_BAD_KEY_LENGTH)        ,"bad key length"},
 {ERR_REASON(EVP_R_BN_DECODE_ERROR)       ,"bn decode error"},
 {ERR_REASON(EVP_R_BN_PUBKEY_ERROR)       ,"bn pubkey error"},
+{ERR_REASON(EVP_R_CAMELLIA_KEY_SETUP_FAILED),"camellia key setup failed"},
 {ERR_REASON(EVP_R_CIPHER_PARAMETER_ERROR),"cipher parameter error"},
 {ERR_REASON(EVP_R_CTRL_NOT_IMPLEMENTED)  ,"ctrl not implemented"},
 {ERR_REASON(EVP_R_CTRL_OPERATION_NOT_IMPLEMENTED),"ctrl operation not implemented"},
 {ERR_REASON(EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH),"data not multiple of block length"},
 {ERR_REASON(EVP_R_DECODE_ERROR)          ,"decode error"},
 {ERR_REASON(EVP_R_DIFFERENT_KEY_TYPES)   ,"different key types"},
-{ERR_REASON(EVP_R_DISABLED_FOR_FIPS)     ,"disabled for fips"},
 {ERR_REASON(EVP_R_ENCODE_ERROR)          ,"encode error"},
 {ERR_REASON(EVP_R_EVP_PBE_CIPHERINIT_ERROR),"evp pbe cipherinit error"},
 {ERR_REASON(EVP_R_EXPECTING_AN_RSA_KEY)  ,"expecting an rsa key"},
 {ERR_REASON(EVP_R_EXPECTING_A_DH_KEY)    ,"expecting a dh key"},
 {ERR_REASON(EVP_R_EXPECTING_A_DSA_KEY)   ,"expecting a dsa key"},
+{ERR_REASON(EVP_R_EXPECTING_A_ECDSA_KEY) ,"expecting a ecdsa key"},
+{ERR_REASON(EVP_R_EXPECTING_A_EC_KEY)    ,"expecting a ec key"},
 {ERR_REASON(EVP_R_INITIALIZATION_ERROR)  ,"initialization error"},
 {ERR_REASON(EVP_R_INPUT_NOT_INITIALIZED) ,"input not initialized"},
 {ERR_REASON(EVP_R_INVALID_KEY_LENGTH)    ,"invalid key length"},
@@ -157,15 +163,12 @@ static ERR_STRING_DATA EVP_str_reasons[]=
 
 void ERR_load_EVP_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(EVP_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,EVP_str_functs);
                 ERR_load_strings(0,EVP_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/evp/evp_key.c b/src/lib/libssl/src/crypto/evp/evp_key.c
index f8650d5df6..361ea69ab6 100644
--- a/src/lib/libssl/src/crypto/evp/evp_key.c
+++ b/src/lib/libssl/src/crypto/evp/evp_key.c
@@ -66,7 +66,7 @@
 /* should be init to zeros. */
 static char prompt_string[80];
 
-void EVP_set_pw_prompt(char *prompt)
+void EVP_set_pw_prompt(const char *prompt)
         {
         if (prompt == NULL)
                 prompt_string[0]='\0';
diff --git a/src/lib/libssl/src/crypto/evp/evp_lib.c b/src/lib/libssl/src/crypto/evp/evp_lib.c
index a63ba19317..edb28ef38e 100644
--- a/src/lib/libssl/src/crypto/evp/evp_lib.c
+++ b/src/lib/libssl/src/crypto/evp/evp_lib.c
@@ -68,7 +68,7 @@ int EVP_CIPHER_param_to_asn1(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
         if (c->cipher->set_asn1_parameters != NULL)
                 ret=c->cipher->set_asn1_parameters(c,type);
         else
-                return -1;
+                ret=-1;
         return(ret);
         }
 
@@ -79,20 +79,21 @@ int EVP_CIPHER_asn1_to_param(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
         if (c->cipher->get_asn1_parameters != NULL)
                 ret=c->cipher->get_asn1_parameters(c,type);
         else
-                return -1;
+                ret=-1;
         return(ret);
         }
 
 int EVP_CIPHER_get_asn1_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
         {
-        int i=0,l;
+        int i=0;
+        unsigned int l;
 
         if (type != NULL) 
                 {
                 l=EVP_CIPHER_CTX_iv_length(c);
-                OPENSSL_assert(l <= sizeof c->iv);
+                OPENSSL_assert(l <= sizeof(c->iv));
                 i=ASN1_TYPE_get_octetstring(type,c->oiv,l);
-                if (i != l)
+                if (i != (int)l)
                         return(-1);
                 else if (i > 0)
                         memcpy(c->iv,c->oiv,l);
@@ -102,12 +103,13 @@ int EVP_CIPHER_get_asn1_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
 
 int EVP_CIPHER_set_asn1_iv(EVP_CIPHER_CTX *c, ASN1_TYPE *type)
         {
-        int i=0,j;
+        int i=0;
+        unsigned int j;
 
         if (type != NULL)
                 {
                 j=EVP_CIPHER_CTX_iv_length(c);
-                OPENSSL_assert(j <= sizeof c->iv);
+                OPENSSL_assert(j <= sizeof(c->iv));
                 i=ASN1_TYPE_set_octetstring(type,c->oiv,j);
                 }
         return(i);
@@ -166,3 +168,112 @@ int EVP_CIPHER_type(const EVP_CIPHER *ctx)
         }
 }
 
+int EVP_CIPHER_block_size(const EVP_CIPHER *e)
+        {
+        return e->block_size;
+        }
+
+int EVP_CIPHER_CTX_block_size(const EVP_CIPHER_CTX *ctx)
+        {
+        return ctx->cipher->block_size;
+        }
+
+int EVP_Cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, unsigned int inl)
+        {
+        return ctx->cipher->do_cipher(ctx,out,in,inl);
+        }
+
+const EVP_CIPHER *EVP_CIPHER_CTX_cipher(const EVP_CIPHER_CTX *ctx)
+        {
+        return ctx->cipher;
+        }
+
+unsigned long EVP_CIPHER_flags(const EVP_CIPHER *cipher)
+        {
+        return cipher->flags;
+        }
+
+unsigned long EVP_CIPHER_CTX_flags(const EVP_CIPHER_CTX *ctx)
+        {
+        return ctx->cipher->flags;
+        }
+
+void *EVP_CIPHER_CTX_get_app_data(const EVP_CIPHER_CTX *ctx)
+        {
+        return ctx->app_data;
+        }
+
+void EVP_CIPHER_CTX_set_app_data(EVP_CIPHER_CTX *ctx, void *data)
+        {
+        ctx->app_data = data;
+        }
+
+int EVP_CIPHER_iv_length(const EVP_CIPHER *cipher)
+        {
+        return cipher->iv_len;
+        }
+
+int EVP_CIPHER_CTX_iv_length(const EVP_CIPHER_CTX *ctx)
+        {
+        return ctx->cipher->iv_len;
+        }
+
+int EVP_CIPHER_key_length(const EVP_CIPHER *cipher)
+        {
+        return cipher->key_len;
+        }
+
+int EVP_CIPHER_CTX_key_length(const EVP_CIPHER_CTX *ctx)
+        {
+        return ctx->key_len;
+        }
+
+int EVP_CIPHER_nid(const EVP_CIPHER *cipher)
+        {
+        return cipher->nid;
+        }
+
+int EVP_CIPHER_CTX_nid(const EVP_CIPHER_CTX *ctx)
+        {
+        return ctx->cipher->nid;
+        }
+
+int EVP_MD_block_size(const EVP_MD *md) 
+        {
+        return md->block_size;
+        }
+
+int EVP_MD_type(const EVP_MD *md)
+        {
+        return md->type;
+        }
+
+int EVP_MD_pkey_type(const EVP_MD *md)
+        {
+        return md->pkey_type;
+        }
+
+int EVP_MD_size(const EVP_MD *md)
+        {
+        return md->md_size;
+        }
+
+const EVP_MD * EVP_MD_CTX_md(const EVP_MD_CTX *ctx)
+        {
+        return ctx->digest;
+        }
+
+void EVP_MD_CTX_set_flags(EVP_MD_CTX *ctx, int flags)
+        {
+        ctx->flags |= flags;
+        }
+
+void EVP_MD_CTX_clear_flags(EVP_MD_CTX *ctx, int flags)
+        {
+        ctx->flags &= ~flags;
+        }
+
+int EVP_MD_CTX_test_flags(const EVP_MD_CTX *ctx, int flags)
+        {
+        return (ctx->flags & flags);
+        }
diff --git a/src/lib/libssl/src/crypto/evp/evp_locl.h b/src/lib/libssl/src/crypto/evp/evp_locl.h
index f8c5343620..073b0adcff 100644
--- a/src/lib/libssl/src/crypto/evp/evp_locl.h
+++ b/src/lib/libssl/src/crypto/evp/evp_locl.h
@@ -65,7 +65,7 @@
         bl = ctx->cipher->block_size;\
         if(inl < bl) return 1;\
         inl -= bl; \
-        for(i=0; i <= inl; i+=bl) \
+        for(i=0; i <= inl; i+=bl) 
 
 #define BLOCK_CIPHER_func_ecb(cname, cprefix, kstruct, ksched) \
 static int cname##_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, unsigned int inl) \
@@ -92,7 +92,7 @@ static int cname##_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const uns
 #define BLOCK_CIPHER_func_cfb(cname, cprefix, cbits, kstruct, ksched) \
 static int cname##_cfb##cbits##_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, unsigned int inl) \
 {\
-        cprefix##_cfb##cbits##_encrypt(in, out, (long)inl, &((kstruct *)ctx->cipher_data)->ksched, ctx->iv, &ctx->num, ctx->encrypt);\
+        cprefix##_cfb##cbits##_encrypt(in, out, (long)(cbits==1?inl*8:inl), &((kstruct *)ctx->cipher_data)->ksched, ctx->iv, &ctx->num, ctx->encrypt);\
         return 1;\
 }
 
@@ -226,27 +226,11 @@ const EVP_CIPHER *EVP_##cname##_ecb(void) { return &cname##_ecb; }
 
 #define EVP_C_DATA(kstruct, ctx)        ((kstruct *)(ctx)->cipher_data)
 
-#define IMPLEMENT_CFBR(cipher,cprefix,kstruct,ksched,keysize,cbits,iv_len,flags) \
+#define IMPLEMENT_CFBR(cipher,cprefix,kstruct,ksched,keysize,cbits,iv_len) \
         BLOCK_CIPHER_func_cfb(cipher##_##keysize,cprefix,cbits,kstruct,ksched) \
         BLOCK_CIPHER_def_cfb(cipher##_##keysize,kstruct, \
                              NID_##cipher##_##keysize, keysize/8, iv_len, cbits, \
-                             flags, cipher##_init_key, NULL, \
+                             0, cipher##_init_key, NULL, \
                              EVP_CIPHER_set_asn1_iv, \
                              EVP_CIPHER_get_asn1_iv, \
                              NULL)
-
-#ifdef OPENSSL_FIPS
-#define RC2_set_key     private_RC2_set_key
-#define RC4_set_key     private_RC4_set_key
-#define CAST_set_key    private_CAST_set_key
-#define RC5_32_set_key  private_RC5_32_set_key
-#define BF_set_key      private_BF_set_key
-#define idea_set_encrypt_key private_idea_set_encrypt_key
-
-#define MD5_Init        private_MD5_Init
-#define MD4_Init        private_MD4_Init
-#define MD2_Init        private_MD2_Init
-#define MDC2_Init       private_MDC2_Init
-#define SHA_Init        private_SHA_Init
-
-#endif
diff --git a/src/lib/libssl/src/crypto/evp/evp_pbe.c b/src/lib/libssl/src/crypto/evp/evp_pbe.c
index 91e545a141..c26d2de0f3 100644
--- a/src/lib/libssl/src/crypto/evp/evp_pbe.c
+++ b/src/lib/libssl/src/crypto/evp/evp_pbe.c
@@ -74,7 +74,7 @@ const EVP_MD *md;
 EVP_PBE_KEYGEN *keygen;
 } EVP_PBE_CTL;
 
-int EVP_PBE_CipherInit (ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
+int EVP_PBE_CipherInit(ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
              ASN1_TYPE *param, EVP_CIPHER_CTX *ctx, int en_de)
 {
 
@@ -106,7 +106,8 @@ int EVP_PBE_CipherInit (ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
 
 static int pbe_cmp(const char * const *a, const char * const *b)
 {
-        EVP_PBE_CTL **pbe1 = (EVP_PBE_CTL **) a,  **pbe2 = (EVP_PBE_CTL **)b;
+        const EVP_PBE_CTL * const *pbe1 = (const EVP_PBE_CTL * const *) a,
+                        * const *pbe2 = (const EVP_PBE_CTL * const *)b;
         return ((*pbe1)->pbe_nid - (*pbe2)->pbe_nid);
 }
 
diff --git a/src/lib/libssl/src/crypto/evp/evp_pkey.c b/src/lib/libssl/src/crypto/evp/evp_pkey.c
index 47a69932a5..0147f3e02a 100644
--- a/src/lib/libssl/src/crypto/evp/evp_pkey.c
+++ b/src/lib/libssl/src/crypto/evp/evp_pkey.c
@@ -3,7 +3,7 @@
  * project 1999.
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2002 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -61,14 +61,24 @@
 #include "cryptlib.h"
 #include <openssl/x509.h>
 #include <openssl/rand.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#include <openssl/bn.h>
 
 #ifndef OPENSSL_NO_DSA
 static int dsa_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8inf, EVP_PKEY *pkey);
 #endif
+#ifndef OPENSSL_NO_EC
+static int eckey_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8inf, EVP_PKEY *pkey);
+#endif
 
 /* Extract a private key from a PKCS8 structure */
 
-EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
+EVP_PKEY *EVP_PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8)
 {
         EVP_PKEY *pkey = NULL;
 #ifndef OPENSSL_NO_RSA
@@ -76,16 +86,24 @@ EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
 #endif
 #ifndef OPENSSL_NO_DSA
         DSA *dsa = NULL;
+        ASN1_TYPE *t1, *t2;
         ASN1_INTEGER *privkey;
-        ASN1_TYPE *t1, *t2, *param = NULL;
         STACK_OF(ASN1_TYPE) *ndsa = NULL;
+#endif
+#ifndef OPENSSL_NO_EC
+        EC_KEY *eckey = NULL;
+        const unsigned char *p_tmp;
+#endif
+#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_EC)
+        ASN1_TYPE    *param = NULL;     
         BN_CTX *ctx = NULL;
         int plen;
 #endif
         X509_ALGOR *a;
-        unsigned char *p;
+        const unsigned char *p;
         const unsigned char *cp;
         int pkeylen;
+        int  nid;
         char obj_tmp[80];
 
         if(p8->pkey->type == V_ASN1_OCTET_STRING) {
@@ -102,7 +120,8 @@ EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
                 return NULL;
         }
         a = p8->pkeyalg;
-        switch (OBJ_obj2nid(a->algorithm))
+        nid = OBJ_obj2nid(a->algorithm);
+        switch(nid)
         {
 #ifndef OPENSSL_NO_RSA
                 case NID_rsaEncryption:
@@ -208,6 +227,112 @@ EVP_PKEY *EVP_PKCS82PKEY (PKCS8_PRIV_KEY_INFO *p8)
                 return NULL;
                 break;
 #endif
+#ifndef OPENSSL_NO_EC
+                case NID_X9_62_id_ecPublicKey:
+                p_tmp = p;
+                /* extract the ec parameters */
+                param = p8->pkeyalg->parameter;
+
+                if (!param || ((param->type != V_ASN1_SEQUENCE) &&
+                    (param->type != V_ASN1_OBJECT)))
+                {
+                        EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
+                        goto ecerr;
+                }
+
+                if (param->type == V_ASN1_SEQUENCE)
+                {
+                        cp = p = param->value.sequence->data;
+                        plen = param->value.sequence->length;
+
+                        if (!(eckey = d2i_ECParameters(NULL, &cp, plen)))
+                        {
+                                EVPerr(EVP_F_EVP_PKCS82PKEY,
+                                        EVP_R_DECODE_ERROR);
+                                goto ecerr;
+                        }
+                }
+                else
+                {
+                        EC_GROUP *group;
+                        cp = p = param->value.object->data;
+                        plen = param->value.object->length;
+
+                        /* type == V_ASN1_OBJECT => the parameters are given
+                         * by an asn1 OID
+                         */
+                        if ((eckey = EC_KEY_new()) == NULL)
+                        {
+                                EVPerr(EVP_F_EVP_PKCS82PKEY,
+                                        ERR_R_MALLOC_FAILURE);
+                                goto ecerr;
+                        }
+                        group = EC_GROUP_new_by_curve_name(OBJ_obj2nid(a->parameter->value.object));
+                        if (group == NULL)
+                                goto ecerr;
+                        EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE);
+                        if (EC_KEY_set_group(eckey, group) == 0)
+                                goto ecerr;
+                        EC_GROUP_free(group);
+                }
+
+                /* We have parameters now set private key */
+                if (!d2i_ECPrivateKey(&eckey, &p_tmp, pkeylen))
+                {
+                        EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_DECODE_ERROR);
+                        goto ecerr;
+                }
+
+                /* calculate public key (if necessary) */
+                if (EC_KEY_get0_public_key(eckey) == NULL)
+                {
+                        const BIGNUM *priv_key;
+                        const EC_GROUP *group;
+                        EC_POINT *pub_key;
+                        /* the public key was not included in the SEC1 private
+                         * key => calculate the public key */
+                        group   = EC_KEY_get0_group(eckey);
+                        pub_key = EC_POINT_new(group);
+                        if (pub_key == NULL)
+                        {
+                                EVPerr(EVP_F_EVP_PKCS82PKEY, ERR_R_EC_LIB);
+                                goto ecerr;
+                        }
+                        if (!EC_POINT_copy(pub_key, EC_GROUP_get0_generator(group)))
+                        {
+                                EC_POINT_free(pub_key);
+                                EVPerr(EVP_F_EVP_PKCS82PKEY, ERR_R_EC_LIB);
+                                goto ecerr;
+                        }
+                        priv_key = EC_KEY_get0_private_key(eckey);
+                        if (!EC_POINT_mul(group, pub_key, priv_key, NULL, NULL, ctx))
+                        {
+                                EC_POINT_free(pub_key);
+                                EVPerr(EVP_F_EVP_PKCS82PKEY, ERR_R_EC_LIB);
+                                goto ecerr;
+                        }
+                        if (EC_KEY_set_public_key(eckey, pub_key) == 0)
+                        {
+                                EC_POINT_free(pub_key);
+                                EVPerr(EVP_F_EVP_PKCS82PKEY, ERR_R_EC_LIB);
+                                goto ecerr;
+                        }
+                        EC_POINT_free(pub_key);
+                }
+
+                EVP_PKEY_assign_EC_KEY(pkey, eckey);
+                if (ctx)
+                        BN_CTX_free(ctx);
+                break;
+ecerr:
+                if (ctx)
+                        BN_CTX_free(ctx);
+                if (eckey)
+                        EC_KEY_free(eckey);
+                if (pkey)
+                        EVP_PKEY_free(pkey);
+                return NULL;
+#endif
                 default:
                 EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM);
                 if (!a->algorithm) BUF_strlcpy (obj_tmp, "NULL", sizeof obj_tmp);
@@ -231,17 +356,17 @@ PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8_broken(EVP_PKEY *pkey, int broken)
         PKCS8_PRIV_KEY_INFO *p8;
 
         if (!(p8 = PKCS8_PRIV_KEY_INFO_new())) {        
-                EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                EVPerr(EVP_F_EVP_PKEY2PKCS8_BROKEN,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         p8->broken = broken;
         if (!ASN1_INTEGER_set(p8->version, 0)) {
-                EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                EVPerr(EVP_F_EVP_PKEY2PKCS8_BROKEN,ERR_R_MALLOC_FAILURE);
                 PKCS8_PRIV_KEY_INFO_free (p8);
                 return NULL;
         }
         if (!(p8->pkeyalg->parameter = ASN1_TYPE_new ())) {
-                EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                EVPerr(EVP_F_EVP_PKEY2PKCS8_BROKEN,ERR_R_MALLOC_FAILURE);
                 PKCS8_PRIV_KEY_INFO_free (p8);
                 return NULL;
         }
@@ -254,9 +379,9 @@ PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8_broken(EVP_PKEY *pkey, int broken)
 
                 p8->pkeyalg->algorithm = OBJ_nid2obj(NID_rsaEncryption);
                 p8->pkeyalg->parameter->type = V_ASN1_NULL;
-                if (!ASN1_pack_string ((char *)pkey, i2d_PrivateKey,
+                if (!ASN1_pack_string_of (EVP_PKEY,pkey, i2d_PrivateKey,
                                          &p8->pkey->value.octet_string)) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_EVP_PKEY2PKCS8_BROKEN,ERR_R_MALLOC_FAILURE);
                         PKCS8_PRIV_KEY_INFO_free (p8);
                         return NULL;
                 }
@@ -271,13 +396,22 @@ PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8_broken(EVP_PKEY *pkey, int broken)
 
                 break;
 #endif
+#ifndef OPENSSL_NO_EC
+                case EVP_PKEY_EC:
+                if (!eckey_pkey2pkcs8(p8, pkey))
+                {
+                        PKCS8_PRIV_KEY_INFO_free(p8);
+                        return(NULL);
+                }
+                break;
+#endif
                 default:
-                EVPerr(EVP_F_EVP_PKEY2PKCS8, EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM);
+                EVPerr(EVP_F_EVP_PKEY2PKCS8_BROKEN, EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM);
                 PKCS8_PRIV_KEY_INFO_free (p8);
                 return NULL;
         }
         RAND_add(p8->pkey->value.octet_string->data,
-                 p8->pkey->value.octet_string->length, 0);
+                 p8->pkey->value.octet_string->length, 0.0);
         return p8;
 }
 
@@ -297,10 +431,8 @@ PKCS8_PRIV_KEY_INFO *PKCS8_set_broken(PKCS8_PRIV_KEY_INFO *p8, int broken)
                 break;
 
                 default:
-                EVPerr(EVP_F_EVP_PKCS8_SET_BROKEN,EVP_R_PKCS8_UNKNOWN_BROKEN_TYPE);
+                EVPerr(EVP_F_PKCS8_SET_BROKEN,EVP_R_PKCS8_UNKNOWN_BROKEN_TYPE);
                 return NULL;
-                break;
-                
         }
 }
 
@@ -317,24 +449,24 @@ static int dsa_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8, EVP_PKEY *pkey)
         p8->pkeyalg->algorithm = OBJ_nid2obj(NID_dsa);
         len = i2d_DSAparams (pkey->pkey.dsa, NULL);
         if (!(p = OPENSSL_malloc(len))) {
-                EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                 goto err;
         }
         q = p;
         i2d_DSAparams (pkey->pkey.dsa, &q);
         if (!(params = ASN1_STRING_new())) {
-                EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                 goto err;
         }
         if (!ASN1_STRING_set(params, p, len)) {
-                EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                 goto err;
         }
         OPENSSL_free(p);
         p = NULL;
         /* Get private key into integer */
         if (!(prkey = BN_to_ASN1_INTEGER (pkey->pkey.dsa->priv_key, NULL))) {
-                EVPerr(EVP_F_EVP_PKEY2PKCS8,EVP_R_ENCODE_ERROR);
+                EVPerr(EVP_F_DSA_PKEY2PKCS8,EVP_R_ENCODE_ERROR);
                 goto err;
         }
 
@@ -343,9 +475,9 @@ static int dsa_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8, EVP_PKEY *pkey)
                 case PKCS8_OK:
                 case PKCS8_NO_OCTET:
 
-                if (!ASN1_pack_string((char *)prkey, i2d_ASN1_INTEGER,
+                if (!ASN1_pack_string_of(ASN1_INTEGER,prkey, i2d_ASN1_INTEGER,
                                          &p8->pkey->value.octet_string)) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
 
@@ -363,39 +495,39 @@ static int dsa_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8, EVP_PKEY *pkey)
                 params = NULL;
                 p8->pkeyalg->parameter->type = V_ASN1_SEQUENCE;
                 if (!(ndsa = sk_ASN1_TYPE_new_null())) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
                 if (!(ttmp = ASN1_TYPE_new())) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
                 if (!(ttmp->value.integer =
                         BN_to_ASN1_INTEGER(pkey->pkey.dsa->pub_key, NULL))) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,EVP_R_ENCODE_ERROR);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,EVP_R_ENCODE_ERROR);
                         goto err;
                 }
                 ttmp->type = V_ASN1_INTEGER;
                 if (!sk_ASN1_TYPE_push(ndsa, ttmp)) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
 
                 if (!(ttmp = ASN1_TYPE_new())) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
                 ttmp->value.integer = prkey;
                 prkey = NULL;
                 ttmp->type = V_ASN1_INTEGER;
                 if (!sk_ASN1_TYPE_push(ndsa, ttmp)) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
                 ttmp = NULL;
 
                 if (!(p8->pkey->value.octet_string = ASN1_OCTET_STRING_new())) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
 
@@ -403,7 +535,7 @@ static int dsa_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8, EVP_PKEY *pkey)
                                          &p8->pkey->value.octet_string->data,
                                          &p8->pkey->value.octet_string->length)) {
 
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
                 sk_ASN1_TYPE_pop_free(ndsa, ASN1_TYPE_free);
@@ -413,36 +545,36 @@ static int dsa_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8, EVP_PKEY *pkey)
 
                 p8->pkeyalg->parameter->type = V_ASN1_NULL;
                 if (!(ndsa = sk_ASN1_TYPE_new_null())) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
                 if (!(ttmp = ASN1_TYPE_new())) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
                 ttmp->value.sequence = params;
                 params = NULL;
                 ttmp->type = V_ASN1_SEQUENCE;
                 if (!sk_ASN1_TYPE_push(ndsa, ttmp)) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
 
                 if (!(ttmp = ASN1_TYPE_new())) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
                 ttmp->value.integer = prkey;
                 prkey = NULL;
                 ttmp->type = V_ASN1_INTEGER;
                 if (!sk_ASN1_TYPE_push(ndsa, ttmp)) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
                 ttmp = NULL;
 
                 if (!(p8->pkey->value.octet_string = ASN1_OCTET_STRING_new())) {
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
 
@@ -450,7 +582,7 @@ static int dsa_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8, EVP_PKEY *pkey)
                                          &p8->pkey->value.octet_string->data,
                                          &p8->pkey->value.octet_string->length)) {
 
-                        EVPerr(EVP_F_EVP_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
+                        EVPerr(EVP_F_DSA_PKEY2PKCS8,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
                 sk_ASN1_TYPE_pop_free(ndsa, ASN1_TYPE_free);
@@ -466,3 +598,197 @@ err:
         return 0;
 }
 #endif
+
+#ifndef OPENSSL_NO_EC
+static int eckey_pkey2pkcs8(PKCS8_PRIV_KEY_INFO *p8, EVP_PKEY *pkey)
+{
+        EC_KEY          *ec_key;
+        const EC_GROUP  *group;
+        unsigned char   *p, *pp;
+        int             nid, i, ret = 0;
+        unsigned int    tmp_flags, old_flags;
+
+        ec_key = pkey->pkey.ec;
+        if (ec_key == NULL || (group = EC_KEY_get0_group(ec_key)) == NULL) 
+        {
+                EVPerr(EVP_F_ECKEY_PKEY2PKCS8, EVP_R_MISSING_PARAMETERS);
+                return 0;
+        }
+
+        /* set the ec parameters OID */
+        if (p8->pkeyalg->algorithm)
+                ASN1_OBJECT_free(p8->pkeyalg->algorithm);
+
+        p8->pkeyalg->algorithm = OBJ_nid2obj(NID_X9_62_id_ecPublicKey);
+
+        /* set the ec parameters */
+
+        if (p8->pkeyalg->parameter)
+        {
+                ASN1_TYPE_free(p8->pkeyalg->parameter);
+                p8->pkeyalg->parameter = NULL;
+        }
+
+        if ((p8->pkeyalg->parameter = ASN1_TYPE_new()) == NULL)
+        {
+                EVPerr(EVP_F_ECKEY_PKEY2PKCS8, ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        
+        if (EC_GROUP_get_asn1_flag(group)
+                     && (nid = EC_GROUP_get_curve_name(group)))
+        {
+                /* we have a 'named curve' => just set the OID */
+                p8->pkeyalg->parameter->type = V_ASN1_OBJECT;
+                p8->pkeyalg->parameter->value.object = OBJ_nid2obj(nid);
+        }
+        else    /* explicit parameters */
+        {
+                if ((i = i2d_ECParameters(ec_key, NULL)) == 0)
+                {
+                        EVPerr(EVP_F_ECKEY_PKEY2PKCS8, ERR_R_EC_LIB);
+                        return 0;
+                }
+                if ((p = (unsigned char *) OPENSSL_malloc(i)) == NULL)
+                {
+                        EVPerr(EVP_F_ECKEY_PKEY2PKCS8, ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }       
+                pp = p;
+                if (!i2d_ECParameters(ec_key, &pp))
+                {
+                        EVPerr(EVP_F_ECKEY_PKEY2PKCS8, ERR_R_EC_LIB);
+                        OPENSSL_free(p);
+                        return 0;
+                }
+                p8->pkeyalg->parameter->type = V_ASN1_SEQUENCE;
+                if ((p8->pkeyalg->parameter->value.sequence 
+                        = ASN1_STRING_new()) == NULL)
+                {
+                        EVPerr(EVP_F_ECKEY_PKEY2PKCS8, ERR_R_ASN1_LIB);
+                        OPENSSL_free(p);
+                        return 0;
+                }
+                ASN1_STRING_set(p8->pkeyalg->parameter->value.sequence, p, i);
+                OPENSSL_free(p);
+        }
+
+        /* set the private key */
+
+        /* do not include the parameters in the SEC1 private key
+         * see PKCS#11 12.11 */
+        old_flags = EC_KEY_get_enc_flags(pkey->pkey.ec);
+        tmp_flags = old_flags | EC_PKEY_NO_PARAMETERS;
+        EC_KEY_set_enc_flags(pkey->pkey.ec, tmp_flags);
+        i = i2d_ECPrivateKey(pkey->pkey.ec, NULL);
+        if (!i)
+        {
+                EC_KEY_set_enc_flags(pkey->pkey.ec, old_flags);
+                EVPerr(EVP_F_ECKEY_PKEY2PKCS8, ERR_R_EC_LIB);
+                return 0;
+        }
+        p = (unsigned char *) OPENSSL_malloc(i);
+        if (!p)
+        {
+                EC_KEY_set_enc_flags(pkey->pkey.ec, old_flags);
+                EVPerr(EVP_F_ECKEY_PKEY2PKCS8, ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        pp = p;
+        if (!i2d_ECPrivateKey(pkey->pkey.ec, &pp))
+        {
+                EC_KEY_set_enc_flags(pkey->pkey.ec, old_flags);
+                EVPerr(EVP_F_ECKEY_PKEY2PKCS8, ERR_R_EC_LIB);
+                OPENSSL_free(p);
+                return 0;
+        }
+        /* restore old encoding flags */
+        EC_KEY_set_enc_flags(pkey->pkey.ec, old_flags);
+
+        switch(p8->broken) {
+
+                case PKCS8_OK:
+                p8->pkey->value.octet_string = ASN1_OCTET_STRING_new();
+                if (!p8->pkey->value.octet_string ||
+                    !M_ASN1_OCTET_STRING_set(p8->pkey->value.octet_string,
+                    (const void *)p, i))
+
+                {
+                        EVPerr(EVP_F_ECKEY_PKEY2PKCS8, ERR_R_MALLOC_FAILURE);
+                }
+                else
+                        ret = 1;
+                break;
+                case PKCS8_NO_OCTET:            /* RSA specific */
+                case PKCS8_NS_DB:               /* DSA specific */
+                case PKCS8_EMBEDDED_PARAM:      /* DSA specific */
+                default:
+                        EVPerr(EVP_F_ECKEY_PKEY2PKCS8,EVP_R_ENCODE_ERROR);
+        }
+        OPENSSL_cleanse(p, (size_t)i);
+        OPENSSL_free(p);
+        return ret;
+}
+#endif
+
+/* EVP_PKEY attribute functions */
+
+int EVP_PKEY_get_attr_count(const EVP_PKEY *key)
+{
+        return X509at_get_attr_count(key->attributes);
+}
+
+int EVP_PKEY_get_attr_by_NID(const EVP_PKEY *key, int nid,
+                          int lastpos)
+{
+        return X509at_get_attr_by_NID(key->attributes, nid, lastpos);
+}
+
+int EVP_PKEY_get_attr_by_OBJ(const EVP_PKEY *key, ASN1_OBJECT *obj,
+                          int lastpos)
+{
+        return X509at_get_attr_by_OBJ(key->attributes, obj, lastpos);
+}
+
+X509_ATTRIBUTE *EVP_PKEY_get_attr(const EVP_PKEY *key, int loc)
+{
+        return X509at_get_attr(key->attributes, loc);
+}
+
+X509_ATTRIBUTE *EVP_PKEY_delete_attr(EVP_PKEY *key, int loc)
+{
+        return X509at_delete_attr(key->attributes, loc);
+}
+
+int EVP_PKEY_add1_attr(EVP_PKEY *key, X509_ATTRIBUTE *attr)
+{
+        if(X509at_add1_attr(&key->attributes, attr)) return 1;
+        return 0;
+}
+
+int EVP_PKEY_add1_attr_by_OBJ(EVP_PKEY *key,
+                        const ASN1_OBJECT *obj, int type,
+                        const unsigned char *bytes, int len)
+{
+        if(X509at_add1_attr_by_OBJ(&key->attributes, obj,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+int EVP_PKEY_add1_attr_by_NID(EVP_PKEY *key,
+                        int nid, int type,
+                        const unsigned char *bytes, int len)
+{
+        if(X509at_add1_attr_by_NID(&key->attributes, nid,
+                                type, bytes, len)) return 1;
+        return 0;
+}
+
+int EVP_PKEY_add1_attr_by_txt(EVP_PKEY *key,
+                        const char *attrname, int type,
+                        const unsigned char *bytes, int len)
+{
+        if(X509at_add1_attr_by_txt(&key->attributes, attrname,
+                                type, bytes, len)) return 1;
+        return 0;
+}
diff --git a/src/lib/libssl/src/crypto/evp/evp_test.c b/src/lib/libssl/src/crypto/evp/evp_test.c
index a624cfd248..bb6f02c2e9 100644
--- a/src/lib/libssl/src/crypto/evp/evp_test.c
+++ b/src/lib/libssl/src/crypto/evp/evp_test.c
@@ -52,6 +52,7 @@
 
 #include "../e_os.h"
 
+#include <openssl/opensslconf.h>
 #include <openssl/evp.h>
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
@@ -136,7 +137,7 @@ static void test1(const EVP_CIPHER *c,const unsigned char *key,int kn,
                   const unsigned char *iv,int in,
                   const unsigned char *plaintext,int pn,
                   const unsigned char *ciphertext,int cn,
-                  int encdec,int multiplier)
+                  int encdec)
     {
     EVP_CIPHER_CTX ctx;
     unsigned char out[4096];
@@ -167,7 +168,7 @@ static void test1(const EVP_CIPHER *c,const unsigned char *key,int kn,
             }
         EVP_CIPHER_CTX_set_padding(&ctx,0);
 
-        if(!EVP_EncryptUpdate(&ctx,out,&outl,plaintext,pn*multiplier))
+        if(!EVP_EncryptUpdate(&ctx,out,&outl,plaintext,pn))
             {
             fprintf(stderr,"Encrypt failed\n");
             ERR_print_errors_fp(stderr);
@@ -180,7 +181,7 @@ static void test1(const EVP_CIPHER *c,const unsigned char *key,int kn,
             test1_exit(7);
             }
 
-        if(outl+outl2 != cn*multiplier)
+        if(outl+outl2 != cn)
             {
             fprintf(stderr,"Ciphertext length mismatch got %d expected %d\n",
                     outl+outl2,cn);
@@ -206,7 +207,7 @@ static void test1(const EVP_CIPHER *c,const unsigned char *key,int kn,
             }
         EVP_CIPHER_CTX_set_padding(&ctx,0);
 
-        if(!EVP_DecryptUpdate(&ctx,out,&outl,ciphertext,cn*multiplier))
+        if(!EVP_DecryptUpdate(&ctx,out,&outl,ciphertext,cn))
             {
             fprintf(stderr,"Decrypt failed\n");
             ERR_print_errors_fp(stderr);
@@ -219,7 +220,7 @@ static void test1(const EVP_CIPHER *c,const unsigned char *key,int kn,
             test1_exit(7);
             }
 
-        if(outl+outl2 != cn*multiplier)
+        if(outl+outl2 != cn)
             {
             fprintf(stderr,"Plaintext length mismatch got %d expected %d\n",
                     outl+outl2,cn);
@@ -244,7 +245,7 @@ static int test_cipher(const char *cipher,const unsigned char *key,int kn,
                        const unsigned char *iv,int in,
                        const unsigned char *plaintext,int pn,
                        const unsigned char *ciphertext,int cn,
-                       int encdec,int multiplier)
+                       int encdec)
     {
     const EVP_CIPHER *c;
 
@@ -252,7 +253,7 @@ static int test_cipher(const char *cipher,const unsigned char *key,int kn,
     if(!c)
         return 0;
 
-    test1(c,key,kn,iv,in,plaintext,pn,ciphertext,cn,encdec,multiplier);
+    test1(c,key,kn,iv,in,plaintext,pn,ciphertext,cn,encdec);
 
     return 1;
     }
@@ -368,7 +369,6 @@ int main(int argc,char **argv)
         unsigned char *iv,*key,*plaintext,*ciphertext;
         int encdec;
         int kn,in,pn,cn;
-        int multiplier=1;
 
         if(!fgets((char *)line,sizeof line,f))
             break;
@@ -393,17 +393,44 @@ int main(int argc,char **argv)
         pn=convert(plaintext);
         cn=convert(ciphertext);
 
-        if(strchr(cipher,'*'))
-            {
-            p=cipher;
-            sstrsep(&p,"*");
-            multiplier=atoi(sstrsep(&p,"*"));
-            }
-
-        if(!test_cipher(cipher,key,kn,iv,in,plaintext,pn,ciphertext,cn,encdec,
-                        multiplier)
+        if(!test_cipher(cipher,key,kn,iv,in,plaintext,pn,ciphertext,cn,encdec)
            && !test_digest(cipher,plaintext,pn,ciphertext,cn))
             {
+#ifdef OPENSSL_NO_AES
+            if (strstr(cipher, "AES") == cipher)
+                {
+                fprintf(stdout, "Cipher disabled, skipping %s\n", cipher); 
+                continue;
+                }
+#endif
+#ifdef OPENSSL_NO_DES
+            if (strstr(cipher, "DES") == cipher)
+                {
+                fprintf(stdout, "Cipher disabled, skipping %s\n", cipher); 
+                continue;
+                }
+#endif
+#ifdef OPENSSL_NO_RC4
+            if (strstr(cipher, "RC4") == cipher)
+                {
+                fprintf(stdout, "Cipher disabled, skipping %s\n", cipher); 
+                continue;
+                }
+#endif
+#ifdef OPENSSL_NO_CAMELLIA
+            if (strstr(cipher, "CAMELLIA") == cipher)
+                {
+                fprintf(stdout, "Cipher disabled, skipping %s\n", cipher); 
+                continue;
+                }
+#endif
+#ifdef OPENSSL_NO_SEED
+            if (strstr(cipher, "SEED") == cipher)
+                {
+                fprintf(stdout, "Cipher disabled, skipping %s\n", cipher); 
+                continue;
+                }
+#endif
             fprintf(stderr,"Can't find %s\n",cipher);
             EXIT(3);
             }
diff --git a/src/lib/libssl/src/crypto/evp/evptests.txt b/src/lib/libssl/src/crypto/evp/evptests.txt
index dfe91a5bc0..beb12144b6 100644
--- a/src/lib/libssl/src/crypto/evp/evptests.txt
+++ b/src/lib/libssl/src/crypto/evp/evptests.txt
@@ -92,102 +92,7 @@ AES-256-CBC:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:000
 AES-256-CBC:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:F58C4C04D6E5F1BA779EABFB5F7BFBD6:AE2D8A571E03AC9C9EB76FAC45AF8E51:9CFC4E967EDB808D679F777BC6702C7D
 AES-256-CBC:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:9CFC4E967EDB808D679F777BC6702C7D:30C81C46A35CE411E5FBC1191A0A52EF:39F23369A9D9BACFA530E26304231461
 AES-256-CBC:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:39F23369A9D9BACFA530E26304231461:F69F2445DF4F9B17AD2B417BE66C3710:B2EB05E2C39BE9FCDA6C19078C6A9D1B
-
-# CFB1-AES128.Encrypt
-
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:000102030405060708090a0b0c0d0e0f:00:00:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:00020406080a0c0e10121416181a1c1e:80:80:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:0004080c1014181c2024282c3034383d:80:80:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:0008101820283038404850586068707b:00:00:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:00102030405060708090a0b0c0d0e0f6:80:80:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:0020406080a0c0e10121416181a1c1ed:00:00:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:004080c1014181c2024282c3034383da:80:00:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:008101820283038404850586068707b4:80:00:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:0102030405060708090a0b0c0d0e0f68:80:80:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:020406080a0c0e10121416181a1c1ed1:80:00:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:04080c1014181c2024282c3034383da2:00:80:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:08101820283038404850586068707b45:00:80:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:102030405060708090a0b0c0d0e0f68b:00:00:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:20406080a0c0e10121416181a1c1ed16:00:00:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:4080c1014181c2024282c3034383da2c:00:80:1
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:8101820283038404850586068707b459:80:80:1
-# all of the above packed into one...
-# in: 0110 1011 1100 0001 = 6bc1
-# out: 0110 1000 1011 0011 = 68b3
-AES-128-CFB1*8:2b7e151628aed2a6abf7158809cf4f3c:000102030405060708090a0b0c0d0e0f:6bc1:68b3:1
-
-# CFB1-AES128.Decrypt
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:000102030405060708090a0b0c0d0e0f:00:00:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:00020406080a0c0e10121416181a1c1e:80:80:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:0004080c1014181c2024282c3034383d:80:80:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:0008101820283038404850586068707b:00:00:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:00102030405060708090a0b0c0d0e0f6:80:80:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:0020406080a0c0e10121416181a1c1ed:00:00:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:004080c1014181c2024282c3034383da:80:00:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:008101820283038404850586068707b4:80:00:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:0102030405060708090a0b0c0d0e0f68:80:80:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:020406080a0c0e10121416181a1c1ed1:80:00:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:04080c1014181c2024282c3034383da2:00:80:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:08101820283038404850586068707b45:00:80:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:102030405060708090a0b0c0d0e0f68b:00:00:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:20406080a0c0e10121416181a1c1ed16:00:00:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:4080c1014181c2024282c3034383da2c:00:80:0
-AES-128-CFB1:2b7e151628aed2a6abf7158809cf4f3c:8101820283038404850586068707b459:80:80:0
-# all of the above packed into one...
-# in: 0110 1000 1011 0011 = 68b3
-# out: 0110 1011 1100 0001 = 6bc1
-AES-128-CFB1*8:2b7e151628aed2a6abf7158809cf4f3c:000102030405060708090a0b0c0d0e0f:6bc1:68b3:0
-
-# TODO: CFB1-AES192 and 256
-
-# CFB8-AES128.Encrypt
-
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:000102030405060708090a0b0c0d0e0f:6b:3b:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0102030405060708090a0b0c0d0e0f3b:c1:79:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:02030405060708090a0b0c0d0e0f3b79:be:42:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:030405060708090a0b0c0d0e0f3b7942:e2:4c:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0405060708090a0b0c0d0e0f3b79424c:2e:9c:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:05060708090a0b0c0d0e0f3b79424c9c:40:0d:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:060708090a0b0c0d0e0f3b79424c9c0d:9f:d4:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0708090a0b0c0d0e0f3b79424c9c0dd4:96:36:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:08090a0b0c0d0e0f3b79424c9c0dd436:e9:ba:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:090a0b0c0d0e0f3b79424c9c0dd436ba:3d:ce:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0a0b0c0d0e0f3b79424c9c0dd436bace:7e:9e:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0b0c0d0e0f3b79424c9c0dd436bace9e:11:0e:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0c0d0e0f3b79424c9c0dd436bace9e0e:73:d4:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0d0e0f3b79424c9c0dd436bace9e0ed4:93:58:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0e0f3b79424c9c0dd436bace9e0ed458:17:6a:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0f3b79424c9c0dd436bace9e0ed4586a:2a:4f:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:3b79424c9c0dd436bace9e0ed4586a4f:ae:32:1
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:79424c9c0dd436bace9e0ed4586a4f32:2d:b9:1
-# all of the above packed into one
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:000102030405060708090a0b0c0d0e0f:6bc1bee22e409f96e93d7e117393172aae2d:3b79424c9c0dd436bace9e0ed4586a4f32b9:1
-
-# CFB8-AES128.Decrypt
-
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:000102030405060708090a0b0c0d0e0f:6b:3b:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0102030405060708090a0b0c0d0e0f3b:c1:79:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:02030405060708090a0b0c0d0e0f3b79:be:42:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:030405060708090a0b0c0d0e0f3b7942:e2:4c:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0405060708090a0b0c0d0e0f3b79424c:2e:9c:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:05060708090a0b0c0d0e0f3b79424c9c:40:0d:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:060708090a0b0c0d0e0f3b79424c9c0d:9f:d4:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0708090a0b0c0d0e0f3b79424c9c0dd4:96:36:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:08090a0b0c0d0e0f3b79424c9c0dd436:e9:ba:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:090a0b0c0d0e0f3b79424c9c0dd436ba:3d:ce:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0a0b0c0d0e0f3b79424c9c0dd436bace:7e:9e:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0b0c0d0e0f3b79424c9c0dd436bace9e:11:0e:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0c0d0e0f3b79424c9c0dd436bace9e0e:73:d4:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0d0e0f3b79424c9c0dd436bace9e0ed4:93:58:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0e0f3b79424c9c0dd436bace9e0ed458:17:6a:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:0f3b79424c9c0dd436bace9e0ed4586a:2a:4f:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:3b79424c9c0dd436bace9e0ed4586a4f:ae:32:0
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:79424c9c0dd436bace9e0ed4586a4f32:2d:b9:0
-# all of the above packed into one
-AES-128-CFB8:2b7e151628aed2a6abf7158809cf4f3c:000102030405060708090a0b0c0d0e0f:6bc1bee22e409f96e93d7e117393172aae2d:3b79424c9c0dd436bace9e0ed4586a4f32b9:0
-
-# TODO: 192 and 256 bit keys
-
+# We don't support CFB{1,8}-AESxxx.{En,De}crypt
 # For all CFB128 encrypts and decrypts, the transformed sequence is
 #   AES-bits-CFB:key:IV/ciphertext':plaintext:ciphertext:encdec
 # CFB128-AES128.Encrypt 
@@ -269,16 +174,6 @@ DESX-CBC:0123456789abcdeff1e0d3c2b5a49786fedcba9876543210:fedcba9876543210:37363
 # DES EDE3 CBC tests (from destest)
 DES-EDE3-CBC:0123456789abcdeff1e0d3c2b5a49786fedcba9876543210:fedcba9876543210:37363534333231204E6F77206973207468652074696D6520666F722000000000:3FE301C962AC01D02213763C1CBD4CDC799657C064ECF5D41C673812CFDE9675
 
-# DES CFB1 from FIPS 81
-# plaintext: 0100 1110 0110 1111 0111 0111 = 4e6f77
-# ciphertext: 1100 1101 0001 1110 1100 1001 = cd1ec9
-
-DES-CFB1*8:0123456789abcdef:1234567890abcdef:4e6f77:cd1ec9
-
-# DES CFB8 from FIPS 81
-
-DES-CFB8:0123456789abcdef:1234567890abcdef:4e6f7720697320746865:f31fda07011462ee187f
-
 # RC4 tests (from rc4test)
 RC4:0123456789abcdef0123456789abcdef::0123456789abcdef:75b7878099e0c596
 RC4:0123456789abcdef0123456789abcdef::0000000000000000:7494c2e7104b0879
@@ -286,3 +181,141 @@ RC4:00000000000000000000000000000000::0000000000000000:de188941a3375d3a
 RC4:ef012345ef012345ef012345ef012345::0000000000000000000000000000000000000000:d6a141a7ec3c38dfbd615a1162e1c7ba36b67858
 RC4:0123456789abcdef0123456789abcdef::123456789ABCDEF0123456789ABCDEF0123456789ABCDEF012345678:66a0949f8af7d6891f7f832ba833c00c892ebe30143ce28740011ecf
 RC4:ef012345ef012345ef012345ef012345::00000000000000000000:d6a141a7ec3c38dfbd61
+
+
+# Camellia tests from RFC3713
+# For all ECB encrypts and decrypts, the transformed sequence is
+#   CAMELLIA-bits-ECB:key::plaintext:ciphertext:encdec
+CAMELLIA-128-ECB:0123456789abcdeffedcba9876543210::0123456789abcdeffedcba9876543210:67673138549669730857065648eabe43
+CAMELLIA-192-ECB:0123456789abcdeffedcba98765432100011223344556677::0123456789abcdeffedcba9876543210:b4993401b3e996f84ee5cee7d79b09b9
+CAMELLIA-256-ECB:0123456789abcdeffedcba987654321000112233445566778899aabbccddeeff::0123456789abcdeffedcba9876543210:9acc237dff16d76c20ef7c919e3a7509
+
+# ECB-CAMELLIA128.Encrypt
+CAMELLIA-128-ECB:000102030405060708090A0B0C0D0E0F::00112233445566778899AABBCCDDEEFF:77CF412067AF8270613529149919546F:1
+CAMELLIA-192-ECB:000102030405060708090A0B0C0D0E0F1011121314151617::00112233445566778899AABBCCDDEEFF:B22F3C36B72D31329EEE8ADDC2906C68:1
+CAMELLIA-256-ECB:000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F::00112233445566778899AABBCCDDEEFF:2EDF1F3418D53B88841FC8985FB1ECF2:1
+
+# ECB-CAMELLIA128.Encrypt and ECB-CAMELLIA128.Decrypt 
+CAMELLIA-128-ECB:2B7E151628AED2A6ABF7158809CF4F3C::6BC1BEE22E409F96E93D7E117393172A:432FC5DCD628115B7C388D770B270C96
+CAMELLIA-128-ECB:2B7E151628AED2A6ABF7158809CF4F3C::AE2D8A571E03AC9C9EB76FAC45AF8E51:0BE1F14023782A22E8384C5ABB7FAB2B
+CAMELLIA-128-ECB:2B7E151628AED2A6ABF7158809CF4F3C::30C81C46A35CE411E5FBC1191A0A52EF:A0A1ABCD1893AB6FE0FE5B65DF5F8636
+CAMELLIA-128-ECB:2B7E151628AED2A6ABF7158809CF4F3C::F69F2445DF4F9B17AD2B417BE66C3710:E61925E0D5DFAA9BB29F815B3076E51A
+
+# ECB-CAMELLIA192.Encrypt and ECB-CAMELLIA192.Decrypt 
+CAMELLIA-192-ECB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B::6BC1BEE22E409F96E93D7E117393172A:CCCC6C4E138B45848514D48D0D3439D3
+CAMELLIA-192-ECB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B::AE2D8A571E03AC9C9EB76FAC45AF8E51:5713C62C14B2EC0F8393B6AFD6F5785A
+CAMELLIA-192-ECB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B::30C81C46A35CE411E5FBC1191A0A52EF:B40ED2B60EB54D09D030CF511FEEF366
+CAMELLIA-192-ECB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B::F69F2445DF4F9B17AD2B417BE66C3710:909DBD95799096748CB27357E73E1D26
+
+# ECB-CAMELLIA256.Encrypt and ECB-CAMELLIA256.Decrypt 
+CAMELLIA-256-ECB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4::6BC1BEE22E409F96E93D7E117393172A:BEFD219B112FA00098919CD101C9CCFA
+CAMELLIA-256-ECB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4::AE2D8A571E03AC9C9EB76FAC45AF8E51:C91D3A8F1AEA08A9386CF4B66C0169EA
+CAMELLIA-256-ECB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4::30C81C46A35CE411E5FBC1191A0A52EF:A623D711DC5F25A51BB8A80D56397D28
+CAMELLIA-256-ECB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4::F69F2445DF4F9B17AD2B417BE66C3710:7960109FB6DC42947FCFE59EA3C5EB6B
+
+# For all CBC encrypts and decrypts, the transformed sequence is
+#   CAMELLIA-bits-CBC:key:IV/ciphertext':plaintext:ciphertext:encdec
+# CBC-CAMELLIA128.Encrypt and CBC-CAMELLIA128.Decrypt 
+CAMELLIA-128-CBC:2B7E151628AED2A6ABF7158809CF4F3C:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:1607CF494B36BBF00DAEB0B503C831AB
+CAMELLIA-128-CBC:2B7E151628AED2A6ABF7158809CF4F3C:1607CF494B36BBF00DAEB0B503C831AB:AE2D8A571E03AC9C9EB76FAC45AF8E51:A2F2CF671629EF7840C5A5DFB5074887
+CAMELLIA-128-CBC:2B7E151628AED2A6ABF7158809CF4F3C:A2F2CF671629EF7840C5A5DFB5074887:30C81C46A35CE411E5FBC1191A0A52EF:0F06165008CF8B8B5A63586362543E54
+CAMELLIA-128-CBC:2B7E151628AED2A6ABF7158809CF4F3C:36A84CDAFD5F9A85ADA0F0A993D6D577:F69F2445DF4F9B17AD2B417BE66C3710:74C64268CDB8B8FAF5B34E8AF3732980
+
+# CBC-CAMELLIA192.Encrypt and CBC-CAMELLIA192.Decrypt 
+CAMELLIA-192-CBC:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:2A4830AB5AC4A1A2405955FD2195CF93
+CAMELLIA-192-CBC:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:2A4830AB5AC4A1A2405955FD2195CF93:AE2D8A571E03AC9C9EB76FAC45AF8E51:5D5A869BD14CE54264F892A6DD2EC3D5
+CAMELLIA-192-CBC:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:5D5A869BD14CE54264F892A6DD2EC3D5:30C81C46A35CE411E5FBC1191A0A52EF:37D359C3349836D884E310ADDF68C449
+CAMELLIA-192-CBC:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:37D359C3349836D884E310ADDF68C449:F69F2445DF4F9B17AD2B417BE66C3710:01FAAA930B4AB9916E9668E1428C6B08
+
+# CBC-CAMELLIA256.Encrypt and CBC-CAMELLIA256.Decrypt 
+CAMELLIA-256-CBC:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:E6CFA35FC02B134A4D2C0B6737AC3EDA
+CAMELLIA-256-CBC:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:E6CFA35FC02B134A4D2C0B6737AC3EDA:AE2D8A571E03AC9C9EB76FAC45AF8E51:36CBEB73BD504B4070B1B7DE2B21EB50
+CAMELLIA-256-CBC:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:36CBEB73BD504B4070B1B7DE2B21EB50:30C81C46A35CE411E5FBC1191A0A52EF:E31A6055297D96CA3330CDF1B1860A83
+CAMELLIA-256-CBC:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:E31A6055297D96CA3330CDF1B1860A83:F69F2445DF4F9B17AD2B417BE66C3710:5D563F6D1CCCF236051C0C5C1C58F28F
+
+# We don't support CFB{1,8}-CAMELLIAxxx.{En,De}crypt
+# For all CFB128 encrypts and decrypts, the transformed sequence is
+#   CAMELLIA-bits-CFB:key:IV/ciphertext':plaintext:ciphertext:encdec
+# CFB128-CAMELLIA128.Encrypt 
+CAMELLIA-128-CFB:2B7E151628AED2A6ABF7158809CF4F3C:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:14F7646187817EB586599146B82BD719:1
+CAMELLIA-128-CFB:2B7E151628AED2A6ABF7158809CF4F3C:14F7646187817EB586599146B82BD719:AE2D8A571E03AC9C9EB76FAC45AF8E51:A53D28BB82DF741103EA4F921A44880B:1
+CAMELLIA-128-CFB:2B7E151628AED2A6ABF7158809CF4F3C:A53D28BB82DF741103EA4F921A44880B:30C81C46A35CE411E5FBC1191A0A52EF:9C2157A664626D1DEF9EA420FDE69B96:1
+CAMELLIA-128-CFB:2B7E151628AED2A6ABF7158809CF4F3C:9C2157A664626D1DEF9EA420FDE69B96:F69F2445DF4F9B17AD2B417BE66C3710:742A25F0542340C7BAEF24CA8482BB09:1
+
+# CFB128-CAMELLIA128.Decrypt 
+CAMELLIA-128-CFB:2B7E151628AED2A6ABF7158809CF4F3C:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:14F7646187817EB586599146B82BD719:0
+CAMELLIA-128-CFB:2B7E151628AED2A6ABF7158809CF4F3C:14F7646187817EB586599146B82BD719:AE2D8A571E03AC9C9EB76FAC45AF8E51:A53D28BB82DF741103EA4F921A44880B:0
+CAMELLIA-128-CFB:2B7E151628AED2A6ABF7158809CF4F3C:A53D28BB82DF741103EA4F921A44880B:30C81C46A35CE411E5FBC1191A0A52EF:9C2157A664626D1DEF9EA420FDE69B96:0
+CAMELLIA-128-CFB:2B7E151628AED2A6ABF7158809CF4F3C:9C2157A664626D1DEF9EA420FDE69B96:F69F2445DF4F9B17AD2B417BE66C3710:742A25F0542340C7BAEF24CA8482BB09:0
+
+# CFB128-CAMELLIA192.Encrypt
+CAMELLIA-192-CFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:C832BB9780677DAA82D9B6860DCD565E:1
+CAMELLIA-192-CFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:C832BB9780677DAA82D9B6860DCD565E:AE2D8A571E03AC9C9EB76FAC45AF8E51:86F8491627906D780C7A6D46EA331F98:1
+CAMELLIA-192-CFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:86F8491627906D780C7A6D46EA331F98:30C81C46A35CE411E5FBC1191A0A52EF:69511CCE594CF710CB98BB63D7221F01:1
+CAMELLIA-192-CFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:69511CCE594CF710CB98BB63D7221F01:F69F2445DF4F9B17AD2B417BE66C3710:D5B5378A3ABED55803F25565D8907B84:1
+
+# CFB128-CAMELLIA192.Decrypt
+CAMELLIA-192-CFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:C832BB9780677DAA82D9B6860DCD565E:0
+CAMELLIA-192-CFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:C832BB9780677DAA82D9B6860DCD565E:AE2D8A571E03AC9C9EB76FAC45AF8E51:86F8491627906D780C7A6D46EA331F98:0
+CAMELLIA-192-CFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:86F8491627906D780C7A6D46EA331F98:30C81C46A35CE411E5FBC1191A0A52EF:69511CCE594CF710CB98BB63D7221F01:0
+CAMELLIA-192-CFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:69511CCE594CF710CB98BB63D7221F01:F69F2445DF4F9B17AD2B417BE66C3710:D5B5378A3ABED55803F25565D8907B84:0
+
+# CFB128-CAMELLIA256.Encrypt 
+CAMELLIA-256-CFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:CF6107BB0CEA7D7FB1BD31F5E7B06C93:1
+CAMELLIA-256-CFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:CF6107BB0CEA7D7FB1BD31F5E7B06C93:AE2D8A571E03AC9C9EB76FAC45AF8E51:89BEDB4CCDD864EA11BA4CBE849B5E2B:1
+CAMELLIA-256-CFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:89BEDB4CCDD864EA11BA4CBE849B5E2B:30C81C46A35CE411E5FBC1191A0A52EF:555FC3F34BDD2D54C62D9E3BF338C1C4:1
+CAMELLIA-256-CFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:555FC3F34BDD2D54C62D9E3BF338C1C4:F69F2445DF4F9B17AD2B417BE66C3710:5953ADCE14DB8C7F39F1BD39F359BFFA:1
+
+# CFB128-CAMELLIA256.Decrypt 
+CAMELLIA-256-CFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:CF6107BB0CEA7D7FB1BD31F5E7B06C93:0
+CAMELLIA-256-CFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:CF6107BB0CEA7D7FB1BD31F5E7B06C93:AE2D8A571E03AC9C9EB76FAC45AF8E51:89BEDB4CCDD864EA11BA4CBE849B5E2B:0
+CAMELLIA-256-CFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:89BEDB4CCDD864EA11BA4CBE849B5E2B:30C81C46A35CE411E5FBC1191A0A52EF:555FC3F34BDD2D54C62D9E3BF338C1C4:0
+CAMELLIA-256-CFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:555FC3F34BDD2D54C62D9E3BF338C1C4:F69F2445DF4F9B17AD2B417BE66C3710:5953ADCE14DB8C7F39F1BD39F359BFFA:0
+
+# For all OFB encrypts and decrypts, the transformed sequence is
+#   CAMELLIA-bits-OFB:key:IV/output':plaintext:ciphertext:encdec
+# OFB-CAMELLIA128.Encrypt 
+CAMELLIA-128-OFB:2B7E151628AED2A6ABF7158809CF4F3C:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:14F7646187817EB586599146B82BD719:1
+CAMELLIA-128-OFB:2B7E151628AED2A6ABF7158809CF4F3C:50FE67CC996D32B6DA0937E99BAFEC60:AE2D8A571E03AC9C9EB76FAC45AF8E51:25623DB569CA51E01482649977E28D84:1
+CAMELLIA-128-OFB:2B7E151628AED2A6ABF7158809CF4F3C:D9A4DADA0892239F6B8B3D7680E15674:30C81C46A35CE411E5FBC1191A0A52EF:C776634A60729DC657D12B9FCA801E98:1
+CAMELLIA-128-OFB:2B7E151628AED2A6ABF7158809CF4F3C:A78819583F0308E7A6BF36B1386ABF23:F69F2445DF4F9B17AD2B417BE66C3710:D776379BE0E50825E681DA1A4C980E8E:1
+
+# OFB-CAMELLIA128.Decrypt 
+CAMELLIA-128-OFB:2B7E151628AED2A6ABF7158809CF4F3C:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:14F7646187817EB586599146B82BD719:0
+CAMELLIA-128-OFB:2B7E151628AED2A6ABF7158809CF4F3C:50FE67CC996D32B6DA0937E99BAFEC60:AE2D8A571E03AC9C9EB76FAC45AF8E51:25623DB569CA51E01482649977E28D84:0
+CAMELLIA-128-OFB:2B7E151628AED2A6ABF7158809CF4F3C:D9A4DADA0892239F6B8B3D7680E15674:30C81C46A35CE411E5FBC1191A0A52EF:C776634A60729DC657D12B9FCA801E98:0
+CAMELLIA-128-OFB:2B7E151628AED2A6ABF7158809CF4F3C:A78819583F0308E7A6BF36B1386ABF23:F69F2445DF4F9B17AD2B417BE66C3710:D776379BE0E50825E681DA1A4C980E8E:0
+
+# OFB-CAMELLIA192.Encrypt 
+CAMELLIA-192-OFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:C832BB9780677DAA82D9B6860DCD565E:1
+CAMELLIA-192-OFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:A609B38DF3B1133DDDFF2718BA09565E:AE2D8A571E03AC9C9EB76FAC45AF8E51:8ECEB7D0350D72C7F78562AEBDF99339:1
+CAMELLIA-192-OFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:52EF01DA52602FE0975F78AC84BF8A50:30C81C46A35CE411E5FBC1191A0A52EF:BDD62DBBB9700846C53B507F544696F0:1
+CAMELLIA-192-OFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:BD5286AC63AABD7EB067AC54B553F71D:F69F2445DF4F9B17AD2B417BE66C3710:E28014E046B802F385C4C2E13EAD4A72:1
+
+# OFB-CAMELLIA192.Decrypt 
+CAMELLIA-192-OFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:C832BB9780677DAA82D9B6860DCD565E:0
+CAMELLIA-192-OFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:A609B38DF3B1133DDDFF2718BA09565E:AE2D8A571E03AC9C9EB76FAC45AF8E51:8ECEB7D0350D72C7F78562AEBDF99339:0
+CAMELLIA-192-OFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:52EF01DA52602FE0975F78AC84BF8A50:30C81C46A35CE411E5FBC1191A0A52EF:BDD62DBBB9700846C53B507F544696F0:0
+CAMELLIA-192-OFB:8E73B0F7DA0E6452C810F32B809079E562F8EAD2522C6B7B:BD5286AC63AABD7EB067AC54B553F71D:F69F2445DF4F9B17AD2B417BE66C3710:E28014E046B802F385C4C2E13EAD4A72:0
+
+# OFB-CAMELLIA256.Encrypt 
+CAMELLIA-256-OFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:CF6107BB0CEA7D7FB1BD31F5E7B06C93:1
+CAMELLIA-256-OFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:B7BF3A5DF43989DD97F0FA97EBCE2F4A:AE2D8A571E03AC9C9EB76FAC45AF8E51:127AD97E8E3994E4820027D7BA109368:1
+CAMELLIA-256-OFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:E1C656305ED1A7A6563805746FE03EDC:30C81C46A35CE411E5FBC1191A0A52EF:6BFF6265A6A6B7A535BC65A80B17214E:1
+CAMELLIA-256-OFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:41635BE625B48AFC1666DD42A09D96E7:F69F2445DF4F9B17AD2B417BE66C3710:0A4A0404E26AA78A27CB271E8BF3CF20:1
+
+# OFB-CAMELLIA256.Decrypt 
+CAMELLIA-256-OFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:000102030405060708090A0B0C0D0E0F:6BC1BEE22E409F96E93D7E117393172A:CF6107BB0CEA7D7FB1BD31F5E7B06C93:0
+CAMELLIA-256-OFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:B7BF3A5DF43989DD97F0FA97EBCE2F4A:AE2D8A571E03AC9C9EB76FAC45AF8E51:127AD97E8E3994E4820027D7BA109368:0
+CAMELLIA-256-OFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:E1C656305ED1A7A6563805746FE03EDC:30C81C46A35CE411E5FBC1191A0A52EF:6BFF6265A6A6B7A535BC65A80B17214E:0
+CAMELLIA-256-OFB:603DEB1015CA71BE2B73AEF0857D77811F352C073B6108D72D9810A30914DFF4:41635BE625B48AFC1666DD42A09D96E7:F69F2445DF4F9B17AD2B417BE66C3710:0A4A0404E26AA78A27CB271E8BF3CF20:0
+
+# SEED test vectors from RFC4269
+SEED-ECB:00000000000000000000000000000000::000102030405060708090A0B0C0D0E0F:5EBAC6E0054E166819AFF1CC6D346CDB:0
+SEED-ECB:000102030405060708090A0B0C0D0E0F::00000000000000000000000000000000:C11F22F20140505084483597E4370F43:0
+SEED-ECB:4706480851E61BE85D74BFB3FD956185::83A2F8A288641FB9A4E9A5CC2F131C7D:EE54D13EBCAE706D226BC3142CD40D4A:0
+SEED-ECB:28DBC3BC49FFD87DCFA509B11D422BE7::B41E6BE2EBA84A148E2EED84593C5EC7:9B9B7BFCD1813CB95D0B3618F40F5122:0
+SEED-ECB:00000000000000000000000000000000::000102030405060708090A0B0C0D0E0F:5EBAC6E0054E166819AFF1CC6D346CDB:1
+SEED-ECB:000102030405060708090A0B0C0D0E0F::00000000000000000000000000000000:C11F22F20140505084483597E4370F43:1
+SEED-ECB:4706480851E61BE85D74BFB3FD956185::83A2F8A288641FB9A4E9A5CC2F131C7D:EE54D13EBCAE706D226BC3142CD40D4A:1
+SEED-ECB:28DBC3BC49FFD87DCFA509B11D422BE7::B41E6BE2EBA84A148E2EED84593C5EC7:9B9B7BFCD1813CB95D0B3618F40F5122:1
diff --git a/src/lib/libssl/src/crypto/evp/m_dss.c b/src/lib/libssl/src/crypto/evp/m_dss.c
index d393eb3400..a948c77fa4 100644
--- a/src/lib/libssl/src/crypto/evp/m_dss.c
+++ b/src/lib/libssl/src/crypto/evp/m_dss.c
@@ -61,12 +61,16 @@
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
 
 #ifndef OPENSSL_NO_SHA
+
 static int init(EVP_MD_CTX *ctx)
         { return SHA1_Init(ctx->md_data); }
 
-static int update(EVP_MD_CTX *ctx,const void *data,unsigned long count)
+static int update(EVP_MD_CTX *ctx,const void *data,size_t count)
         { return SHA1_Update(ctx->md_data,data,count); }
 
 static int final(EVP_MD_CTX *ctx,unsigned char *md)
@@ -77,7 +81,7 @@ static const EVP_MD dsa_md=
         NID_dsaWithSHA,
         NID_dsaWithSHA,
         SHA_DIGEST_LENGTH,
-        EVP_MD_FLAG_FIPS,
+        0,
         init,
         update,
         final,
diff --git a/src/lib/libssl/src/crypto/evp/m_dss1.c b/src/lib/libssl/src/crypto/evp/m_dss1.c
index 23b90d0538..c12e13972b 100644
--- a/src/lib/libssl/src/crypto/evp/m_dss1.c
+++ b/src/lib/libssl/src/crypto/evp/m_dss1.c
@@ -56,25 +56,23 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_SHA
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_SHA
+
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
 
 static int init(EVP_MD_CTX *ctx)
         { return SHA1_Init(ctx->md_data); }
 
-static int update(EVP_MD_CTX *ctx,const void *data,unsigned long count)
-#ifndef OPENSSL_FIPS
+static int update(EVP_MD_CTX *ctx,const void *data,size_t count)
         { return SHA1_Update(ctx->md_data,data,count); }
-#else
-        {
-        OPENSSL_assert(sizeof(count)<=sizeof(size_t));
-        return SHA1_Update(ctx->md_data,data,count);
-        }
-#endif
 
 static int final(EVP_MD_CTX *ctx,unsigned char *md)
         { return SHA1_Final(md,ctx->md_data); }
@@ -84,7 +82,7 @@ static const EVP_MD dss1_md=
         NID_dsa,
         NID_dsaWithSHA1,
         SHA_DIGEST_LENGTH,
-        EVP_MD_FLAG_FIPS,
+        0,
         init,
         update,
         final,
diff --git a/src/lib/libssl/src/crypto/evp/m_md2.c b/src/lib/libssl/src/crypto/evp/m_md2.c
index 0df48e5199..5ce849f161 100644
--- a/src/lib/libssl/src/crypto/evp/m_md2.c
+++ b/src/lib/libssl/src/crypto/evp/m_md2.c
@@ -56,19 +56,23 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_MD2
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_MD2
+
 #include <openssl/evp.h>
-#include "evp_locl.h"
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 #include <openssl/md2.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
 
 static int init(EVP_MD_CTX *ctx)
         { return MD2_Init(ctx->md_data); }
 
-static int update(EVP_MD_CTX *ctx,const void *data,unsigned long count)
+static int update(EVP_MD_CTX *ctx,const void *data,size_t count)
         { return MD2_Update(ctx->md_data,data,count); }
 
 static int final(EVP_MD_CTX *ctx,unsigned char *md)
diff --git a/src/lib/libssl/src/crypto/evp/m_md4.c b/src/lib/libssl/src/crypto/evp/m_md4.c
index 0605e4b707..1e0b7c5b42 100644
--- a/src/lib/libssl/src/crypto/evp/m_md4.c
+++ b/src/lib/libssl/src/crypto/evp/m_md4.c
@@ -56,19 +56,23 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_MD4
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_MD4
+
 #include <openssl/evp.h>
-#include "evp_locl.h"
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 #include <openssl/md4.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
 
 static int init(EVP_MD_CTX *ctx)
         { return MD4_Init(ctx->md_data); }
 
-static int update(EVP_MD_CTX *ctx,const void *data,unsigned long count)
+static int update(EVP_MD_CTX *ctx,const void *data,size_t count)
         { return MD4_Update(ctx->md_data,data,count); }
 
 static int final(EVP_MD_CTX *ctx,unsigned char *md)
diff --git a/src/lib/libssl/src/crypto/evp/m_md5.c b/src/lib/libssl/src/crypto/evp/m_md5.c
index 752615d473..63c142119e 100644
--- a/src/lib/libssl/src/crypto/evp/m_md5.c
+++ b/src/lib/libssl/src/crypto/evp/m_md5.c
@@ -56,19 +56,23 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_MD5
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_MD5
+
 #include <openssl/evp.h>
-#include "evp_locl.h"
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 #include <openssl/md5.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
 
 static int init(EVP_MD_CTX *ctx)
         { return MD5_Init(ctx->md_data); }
 
-static int update(EVP_MD_CTX *ctx,const void *data,unsigned long count)
+static int update(EVP_MD_CTX *ctx,const void *data,size_t count)
         { return MD5_Update(ctx->md_data,data,count); }
 
 static int final(EVP_MD_CTX *ctx,unsigned char *md)
diff --git a/src/lib/libssl/src/crypto/evp/m_mdc2.c b/src/lib/libssl/src/crypto/evp/m_mdc2.c
index 62de1336b8..36c4e9b134 100644
--- a/src/lib/libssl/src/crypto/evp/m_mdc2.c
+++ b/src/lib/libssl/src/crypto/evp/m_mdc2.c
@@ -56,19 +56,21 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_MDC2
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_MDC2
+
 #include <openssl/evp.h>
-#include "evp_locl.h"
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 #include <openssl/mdc2.h>
+#include <openssl/rsa.h>
 
 static int init(EVP_MD_CTX *ctx)
         { return MDC2_Init(ctx->md_data); }
 
-static int update(EVP_MD_CTX *ctx,const void *data,unsigned long count)
+static int update(EVP_MD_CTX *ctx,const void *data,size_t count)
         { return MDC2_Update(ctx->md_data,data,count); }
 
 static int final(EVP_MD_CTX *ctx,unsigned char *md)
diff --git a/src/lib/libssl/src/crypto/evp/m_null.c b/src/lib/libssl/src/crypto/evp/m_null.c
index f6f0a1d2c0..cb0721699d 100644
--- a/src/lib/libssl/src/crypto/evp/m_null.c
+++ b/src/lib/libssl/src/crypto/evp/m_null.c
@@ -65,7 +65,7 @@
 static int init(EVP_MD_CTX *ctx)
         { return 1; }
 
-static int update(EVP_MD_CTX *ctx,const void *data,unsigned long count)
+static int update(EVP_MD_CTX *ctx,const void *data,size_t count)
         { return 1; }
 
 static int final(EVP_MD_CTX *ctx,unsigned char *md)
diff --git a/src/lib/libssl/src/crypto/evp/m_ripemd.c b/src/lib/libssl/src/crypto/evp/m_ripemd.c
index 64725528dc..a1d60ee78d 100644
--- a/src/lib/libssl/src/crypto/evp/m_ripemd.c
+++ b/src/lib/libssl/src/crypto/evp/m_ripemd.c
@@ -56,18 +56,23 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_RIPEMD
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_RIPEMD
+
 #include <openssl/ripemd.h>
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
 
 static int init(EVP_MD_CTX *ctx)
         { return RIPEMD160_Init(ctx->md_data); }
 
-static int update(EVP_MD_CTX *ctx,const void *data,unsigned long count)
+static int update(EVP_MD_CTX *ctx,const void *data,size_t count)
         { return RIPEMD160_Update(ctx->md_data,data,count); }
 
 static int final(EVP_MD_CTX *ctx,unsigned char *md)
diff --git a/src/lib/libssl/src/crypto/evp/m_sha.c b/src/lib/libssl/src/crypto/evp/m_sha.c
index ed54909b16..acccc8f92d 100644
--- a/src/lib/libssl/src/crypto/evp/m_sha.c
+++ b/src/lib/libssl/src/crypto/evp/m_sha.c
@@ -56,21 +56,22 @@
  * [including the GNU Public Licence.]
  */
 
-#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA0)
 #include <stdio.h>
 #include "cryptlib.h"
-/* Including sha.h prior evp.h masks FIPS SHA declarations, but that's
- * exactly what we want to achieve here... */
-#include <openssl/sha.h>
+
+#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA0)
+
 #include <openssl/evp.h>
-#include "evp_locl.h"
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
 
 static int init(EVP_MD_CTX *ctx)
         { return SHA_Init(ctx->md_data); }
 
-static int update(EVP_MD_CTX *ctx,const void *data,unsigned long count)
+static int update(EVP_MD_CTX *ctx,const void *data,size_t count)
         { return SHA_Update(ctx->md_data,data,count); }
 
 static int final(EVP_MD_CTX *ctx,unsigned char *md)
diff --git a/src/lib/libssl/src/crypto/evp/m_sha1.c b/src/lib/libssl/src/crypto/evp/m_sha1.c
index 60da93873c..4679b1c463 100644
--- a/src/lib/libssl/src/crypto/evp/m_sha1.c
+++ b/src/lib/libssl/src/crypto/evp/m_sha1.c
@@ -56,25 +56,23 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_SHA
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_SHA
+
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
 
 static int init(EVP_MD_CTX *ctx)
         { return SHA1_Init(ctx->md_data); }
 
-static int update(EVP_MD_CTX *ctx,const void *data,unsigned long count)
-#ifndef OPENSSL_FIPS
+static int update(EVP_MD_CTX *ctx,const void *data,size_t count)
         { return SHA1_Update(ctx->md_data,data,count); }
-#else
-        {
-        OPENSSL_assert(sizeof(count)<=sizeof(size_t));
-        return SHA1_Update(ctx->md_data,data,count);
-        }
-#endif
 
 static int final(EVP_MD_CTX *ctx,unsigned char *md)
         { return SHA1_Final(md,ctx->md_data); }
@@ -84,7 +82,7 @@ static const EVP_MD sha1_md=
         NID_sha1,
         NID_sha1WithRSAEncryption,
         SHA_DIGEST_LENGTH,
-        EVP_MD_FLAG_FIPS,
+        0,
         init,
         update,
         final,
@@ -101,7 +99,6 @@ const EVP_MD *EVP_sha1(void)
         }
 #endif
 
-#ifdef OPENSSL_FIPS
 #ifndef OPENSSL_NO_SHA256
 static int init224(EVP_MD_CTX *ctx)
         { return SHA224_Init(ctx->md_data); }
@@ -112,11 +109,8 @@ static int init256(EVP_MD_CTX *ctx)
  * SHA256 functions even in SHA224 context. This is what happens
  * there anyway, so we can spare few CPU cycles:-)
  */
-static int update256(EVP_MD_CTX *ctx,const void *data,unsigned long count)
-        {
-        OPENSSL_assert(sizeof(count)<=sizeof(size_t));
-        return SHA256_Update(ctx->md_data,data,count);
-        }
+static int update256(EVP_MD_CTX *ctx,const void *data,size_t count)
+        { return SHA256_Update(ctx->md_data,data,count); }
 static int final256(EVP_MD_CTX *ctx,unsigned char *md)
         { return SHA256_Final(md,ctx->md_data); }
 
@@ -125,7 +119,7 @@ static const EVP_MD sha224_md=
         NID_sha224,
         NID_sha224WithRSAEncryption,
         SHA224_DIGEST_LENGTH,
-        EVP_MD_FLAG_FIPS,
+        0,
         init224,
         update256,
         final256,
@@ -144,7 +138,7 @@ static const EVP_MD sha256_md=
         NID_sha256,
         NID_sha256WithRSAEncryption,
         SHA256_DIGEST_LENGTH,
-        EVP_MD_FLAG_FIPS,
+        0,
         init256,
         update256,
         final256,
@@ -157,7 +151,7 @@ static const EVP_MD sha256_md=
 
 const EVP_MD *EVP_sha256(void)
         { return(&sha256_md); }
-#endif /* ifndef OPENSSL_NO_SHA256 */
+#endif  /* ifndef OPENSSL_NO_SHA256 */
 
 #ifndef OPENSSL_NO_SHA512
 static int init384(EVP_MD_CTX *ctx)
@@ -165,11 +159,8 @@ static int init384(EVP_MD_CTX *ctx)
 static int init512(EVP_MD_CTX *ctx)
         { return SHA512_Init(ctx->md_data); }
 /* See comment in SHA224/256 section */
-static int update512(EVP_MD_CTX *ctx,const void *data,unsigned long count)
-        {
-        OPENSSL_assert(sizeof(count)<=sizeof(size_t));
-        return SHA512_Update(ctx->md_data,data,count);
-        }
+static int update512(EVP_MD_CTX *ctx,const void *data,size_t count)
+        { return SHA512_Update(ctx->md_data,data,count); }
 static int final512(EVP_MD_CTX *ctx,unsigned char *md)
         { return SHA512_Final(md,ctx->md_data); }
 
@@ -178,7 +169,7 @@ static const EVP_MD sha384_md=
         NID_sha384,
         NID_sha384WithRSAEncryption,
         SHA384_DIGEST_LENGTH,
-        EVP_MD_FLAG_FIPS,
+        0,
         init384,
         update512,
         final512,
@@ -197,7 +188,7 @@ static const EVP_MD sha512_md=
         NID_sha512,
         NID_sha512WithRSAEncryption,
         SHA512_DIGEST_LENGTH,
-        EVP_MD_FLAG_FIPS,
+        0,
         init512,
         update512,
         final512,
@@ -210,5 +201,4 @@ static const EVP_MD sha512_md=
 
 const EVP_MD *EVP_sha512(void)
         { return(&sha512_md); }
-#endif /* ifndef OPENSSL_NO_SHA512 */
-#endif /* ifdef OPENSSL_FIPS */
+#endif  /* ifndef OPENSSL_NO_SHA512 */
diff --git a/src/lib/libssl/src/crypto/evp/names.c b/src/lib/libssl/src/crypto/evp/names.c
index 7712453046..88c1e780dd 100644
--- a/src/lib/libssl/src/crypto/evp/names.c
+++ b/src/lib/libssl/src/crypto/evp/names.c
@@ -61,17 +61,14 @@
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
-#ifdef OPENSSL_FIPS
-#include <openssl/fips.h>
-#endif
 
 int EVP_add_cipher(const EVP_CIPHER *c)
         {
         int r;
 
-        r=OBJ_NAME_add(OBJ_nid2sn(c->nid),OBJ_NAME_TYPE_CIPHER_METH,(char *)c);
+        r=OBJ_NAME_add(OBJ_nid2sn(c->nid),OBJ_NAME_TYPE_CIPHER_METH,(const char *)c);
         if (r == 0) return(0);
-        r=OBJ_NAME_add(OBJ_nid2ln(c->nid),OBJ_NAME_TYPE_CIPHER_METH,(char *)c);
+        r=OBJ_NAME_add(OBJ_nid2ln(c->nid),OBJ_NAME_TYPE_CIPHER_METH,(const char *)c);
         return(r);
         }
 
@@ -81,9 +78,9 @@ int EVP_add_digest(const EVP_MD *md)
         const char *name;
 
         name=OBJ_nid2sn(md->type);
-        r=OBJ_NAME_add(name,OBJ_NAME_TYPE_MD_METH,(char *)md);
+        r=OBJ_NAME_add(name,OBJ_NAME_TYPE_MD_METH,(const char *)md);
         if (r == 0) return(0);
-        r=OBJ_NAME_add(OBJ_nid2ln(md->type),OBJ_NAME_TYPE_MD_METH,(char *)md);
+        r=OBJ_NAME_add(OBJ_nid2ln(md->type),OBJ_NAME_TYPE_MD_METH,(const char *)md);
         if (r == 0) return(0);
 
         if (md->type != md->pkey_type)
diff --git a/src/lib/libssl/src/crypto/evp/p5_crpt.c b/src/lib/libssl/src/crypto/evp/p5_crpt.c
index a1874e83b2..48d50014a0 100644
--- a/src/lib/libssl/src/crypto/evp/p5_crpt.c
+++ b/src/lib/libssl/src/crypto/evp/p5_crpt.c
@@ -110,12 +110,18 @@ int PKCS5_PBE_keyivgen(EVP_CIPHER_CTX *cctx, const char *pass, int passlen,
         int i;
         PBEPARAM *pbe;
         int saltlen, iter;
-        unsigned char *salt, *pbuf;
+        unsigned char *salt;
+        const unsigned char *pbuf;
 
         /* Extract useful info from parameter */
+        if (param == NULL || param->type != V_ASN1_SEQUENCE ||
+            param->value.sequence == NULL) {
+                EVPerr(EVP_F_PKCS5_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
+                return 0;
+        }
+
         pbuf = param->value.sequence->data;
-        if (!param || (param->type != V_ASN1_SEQUENCE) ||
-           !(pbe = d2i_PBEPARAM (NULL, &pbuf, param->value.sequence->length))) {
+        if (!(pbe = d2i_PBEPARAM(NULL, &pbuf, param->value.sequence->length))) {
                 EVPerr(EVP_F_PKCS5_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
                 return 0;
         }
@@ -140,7 +146,7 @@ int PKCS5_PBE_keyivgen(EVP_CIPHER_CTX *cctx, const char *pass, int passlen,
                 EVP_DigestFinal_ex (&ctx, md_tmp, NULL);
         }
         EVP_MD_CTX_cleanup(&ctx);
-        OPENSSL_assert(EVP_CIPHER_key_length(cipher) <= sizeof md_tmp);
+        OPENSSL_assert(EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp));
         memcpy(key, md_tmp, EVP_CIPHER_key_length(cipher));
         OPENSSL_assert(EVP_CIPHER_iv_length(cipher) <= 16);
         memcpy(iv, md_tmp + (16 - EVP_CIPHER_iv_length(cipher)),
diff --git a/src/lib/libssl/src/crypto/evp/p5_crpt2.c b/src/lib/libssl/src/crypto/evp/p5_crpt2.c
index 1d5fabc4b2..c969d5a206 100644
--- a/src/lib/libssl/src/crypto/evp/p5_crpt2.c
+++ b/src/lib/libssl/src/crypto/evp/p5_crpt2.c
@@ -55,10 +55,10 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
-#if !defined(OPENSSL_NO_HMAC) && !defined(OPENSSL_NO_SHA)
 #include <stdio.h>
 #include <stdlib.h>
 #include "cryptlib.h"
+#if !defined(OPENSSL_NO_HMAC) && !defined(OPENSSL_NO_SHA)
 #include <openssl/x509.h>
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
@@ -77,7 +77,7 @@
  */
 
 int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen,
-                           unsigned char *salt, int saltlen, int iter,
+                           const unsigned char *salt, int saltlen, int iter,
                            int keylen, unsigned char *out)
 {
         unsigned char digtmp[SHA_DIGEST_LENGTH], *p, itmp[4];
@@ -148,16 +148,23 @@ int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
                          ASN1_TYPE *param, const EVP_CIPHER *c, const EVP_MD *md,
                          int en_de)
 {
-        unsigned char *pbuf, *salt, key[EVP_MAX_KEY_LENGTH];
-        int saltlen, keylen, iter, plen;
+        unsigned char *salt, key[EVP_MAX_KEY_LENGTH];
+        const unsigned char *pbuf;
+        int saltlen, iter, plen;
+        unsigned int keylen;
         PBE2PARAM *pbe2 = NULL;
         const EVP_CIPHER *cipher;
         PBKDF2PARAM *kdf = NULL;
 
+        if (param == NULL || param->type != V_ASN1_SEQUENCE ||
+            param->value.sequence == NULL) {
+                EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
+                return 0;
+        }
+
         pbuf = param->value.sequence->data;
         plen = param->value.sequence->length;
-        if(!param || (param->type != V_ASN1_SEQUENCE) ||
-                                   !(pbe2 = d2i_PBE2PARAM(NULL, &pbuf, plen))) {
+        if(!(pbe2 = d2i_PBE2PARAM(NULL, &pbuf, plen))) {
                 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
                 return 0;
         }
@@ -213,7 +220,7 @@ int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
 
         /* Now check the parameters of the kdf */
 
-        if(kdf->keylength && (ASN1_INTEGER_get(kdf->keylength) != keylen)){
+        if(kdf->keylength && (ASN1_INTEGER_get(kdf->keylength) != (int)keylen)){
                 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,
                                                 EVP_R_UNSUPPORTED_KEYLENGTH);
                 goto err;
diff --git a/src/lib/libssl/src/crypto/evp/p_dec.c b/src/lib/libssl/src/crypto/evp/p_dec.c
index 8af620400e..f64901f653 100644
--- a/src/lib/libssl/src/crypto/evp/p_dec.c
+++ b/src/lib/libssl/src/crypto/evp/p_dec.c
@@ -66,7 +66,7 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 
-int EVP_PKEY_decrypt(unsigned char *key, unsigned char *ek, int ekl,
+int EVP_PKEY_decrypt(unsigned char *key, const unsigned char *ek, int ekl,
              EVP_PKEY *priv)
         {
         int ret= -1;
diff --git a/src/lib/libssl/src/crypto/evp/p_enc.c b/src/lib/libssl/src/crypto/evp/p_enc.c
index 656883b996..c2dfdc52ad 100644
--- a/src/lib/libssl/src/crypto/evp/p_enc.c
+++ b/src/lib/libssl/src/crypto/evp/p_enc.c
@@ -66,7 +66,7 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 
-int EVP_PKEY_encrypt(unsigned char *ek, unsigned char *key, int key_len,
+int EVP_PKEY_encrypt(unsigned char *ek, const unsigned char *key, int key_len,
              EVP_PKEY *pubk)
         {
         int ret=0;
diff --git a/src/lib/libssl/src/crypto/evp/p_lib.c b/src/lib/libssl/src/crypto/evp/p_lib.c
index 215b94292a..22155ecf62 100644
--- a/src/lib/libssl/src/crypto/evp/p_lib.c
+++ b/src/lib/libssl/src/crypto/evp/p_lib.c
@@ -58,24 +58,60 @@
 
 #include <stdio.h>
 #include "cryptlib.h"
+#include <openssl/bn.h>
+#include <openssl/err.h>
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include <openssl/asn1_mac.h>
 #include <openssl/x509.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
 
 static void EVP_PKEY_free_it(EVP_PKEY *x);
 
 int EVP_PKEY_bits(EVP_PKEY *pkey)
         {
+        if (0)
+                return 0;
 #ifndef OPENSSL_NO_RSA
-        if (pkey->type == EVP_PKEY_RSA)
+        else if (pkey->type == EVP_PKEY_RSA)
                 return(BN_num_bits(pkey->pkey.rsa->n));
-        else
 #endif
 #ifndef OPENSSL_NO_DSA
-                if (pkey->type == EVP_PKEY_DSA)
+        else if (pkey->type == EVP_PKEY_DSA)
                 return(BN_num_bits(pkey->pkey.dsa->p));
 #endif
+#ifndef OPENSSL_NO_EC
+        else if (pkey->type == EVP_PKEY_EC)
+                {
+                BIGNUM *order = BN_new();
+                const EC_GROUP *group;
+                int ret;
+
+                if (!order)
+                        {
+                        ERR_clear_error();
+                        return 0;
+                        }
+                group = EC_KEY_get0_group(pkey->pkey.ec);
+                if (!EC_GROUP_get_order(group, order, NULL))
+                        {
+                        ERR_clear_error();
+                        return 0;
+                        }
+
+                ret = BN_num_bits(order);
+                BN_free(order);
+                return ret;
+                }
+#endif
         return(0);
         }
 
@@ -92,6 +128,11 @@ int EVP_PKEY_size(EVP_PKEY *pkey)
                 if (pkey->type == EVP_PKEY_DSA)
                 return(DSA_size(pkey->pkey.dsa));
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                if (pkey->type == EVP_PKEY_EC)
+                return(ECDSA_size(pkey->pkey.ec));
+#endif
+
         return(0);
         }
 
@@ -107,10 +148,20 @@ int EVP_PKEY_save_parameters(EVP_PKEY *pkey, int mode)
                 return(ret);
                 }
 #endif
+#ifndef OPENSSL_NO_EC
+        if (pkey->type == EVP_PKEY_EC)
+                {
+                int ret = pkey->save_parameters;
+
+                if (mode >= 0)
+                        pkey->save_parameters = mode;
+                return(ret);
+                }
+#endif
         return(0);
         }
 
-int EVP_PKEY_copy_parameters(EVP_PKEY *to, EVP_PKEY *from)
+int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
         {
         if (to->type != from->type)
                 {
@@ -141,12 +192,23 @@ int EVP_PKEY_copy_parameters(EVP_PKEY *to, EVP_PKEY *from)
                 to->pkey.dsa->g=a;
                 }
 #endif
+#ifndef OPENSSL_NO_EC
+        if (to->type == EVP_PKEY_EC)
+                {
+                EC_GROUP *group = EC_GROUP_dup(EC_KEY_get0_group(from->pkey.ec));
+                if (group == NULL)
+                        goto err;
+                if (EC_KEY_set_group(to->pkey.ec, group) == 0)
+                        goto err;
+                EC_GROUP_free(group);
+                }
+#endif
         return(1);
 err:
         return(0);
         }
 
-int EVP_PKEY_missing_parameters(EVP_PKEY *pkey)
+int EVP_PKEY_missing_parameters(const EVP_PKEY *pkey)
         {
 #ifndef OPENSSL_NO_DSA
         if (pkey->type == EVP_PKEY_DSA)
@@ -158,10 +220,18 @@ int EVP_PKEY_missing_parameters(EVP_PKEY *pkey)
                         return(1);
                 }
 #endif
+#ifndef OPENSSL_NO_EC
+        if (pkey->type == EVP_PKEY_EC)
+                {
+                if (EC_KEY_get0_group(pkey->pkey.ec) == NULL)
+                        return(1);
+                }
+#endif
+
         return(0);
         }
 
-int EVP_PKEY_cmp_parameters(EVP_PKEY *a, EVP_PKEY *b)
+int EVP_PKEY_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
         {
 #ifndef OPENSSL_NO_DSA
         if ((a->type == EVP_PKEY_DSA) && (b->type == EVP_PKEY_DSA))
@@ -174,9 +244,72 @@ int EVP_PKEY_cmp_parameters(EVP_PKEY *a, EVP_PKEY *b)
                         return(1);
                 }
 #endif
+#ifndef OPENSSL_NO_EC
+        if (a->type == EVP_PKEY_EC && b->type == EVP_PKEY_EC)
+                {
+                const EC_GROUP *group_a = EC_KEY_get0_group(a->pkey.ec),
+                               *group_b = EC_KEY_get0_group(b->pkey.ec);
+                if (EC_GROUP_cmp(group_a, group_b, NULL))
+                        return 0;
+                else
+                        return 1;
+                }
+#endif
         return(-1);
         }
 
+int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
+        {
+        if (a->type != b->type)
+                return -1;
+
+        if (EVP_PKEY_cmp_parameters(a, b) == 0)
+                return 0;
+
+        switch (a->type)
+                {
+#ifndef OPENSSL_NO_RSA
+        case EVP_PKEY_RSA:
+                if (BN_cmp(b->pkey.rsa->n,a->pkey.rsa->n) != 0
+                        || BN_cmp(b->pkey.rsa->e,a->pkey.rsa->e) != 0)
+                        return 0;
+                break;
+#endif
+#ifndef OPENSSL_NO_DSA
+        case EVP_PKEY_DSA:
+                if (BN_cmp(b->pkey.dsa->pub_key,a->pkey.dsa->pub_key) != 0)
+                        return 0;
+                break;
+#endif
+#ifndef OPENSSL_NO_EC
+        case EVP_PKEY_EC:
+                {
+                int  r;
+                const EC_GROUP *group = EC_KEY_get0_group(b->pkey.ec);
+                const EC_POINT *pa = EC_KEY_get0_public_key(a->pkey.ec),
+                               *pb = EC_KEY_get0_public_key(b->pkey.ec);
+                r = EC_POINT_cmp(group, pa, pb, NULL);
+                if (r != 0)
+                        {
+                        if (r == 1)
+                                return 0;
+                        else
+                                return -2;
+                        }
+                }
+                break;
+#endif
+#ifndef OPENSSL_NO_DH
+        case EVP_PKEY_DH:
+                return -2;
+#endif
+        default:
+                return -2;
+                }
+
+        return 1;
+        }
+
 EVP_PKEY *EVP_PKEY_new(void)
         {
         EVP_PKEY *ret;
@@ -246,6 +379,29 @@ DSA *EVP_PKEY_get1_DSA(EVP_PKEY *pkey)
 }
 #endif
 
+#ifndef OPENSSL_NO_EC
+
+int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key)
+{
+        int ret = EVP_PKEY_assign_EC_KEY(pkey,key);
+        if (ret)
+                EC_KEY_up_ref(key);
+        return ret;
+}
+
+EC_KEY *EVP_PKEY_get1_EC_KEY(EVP_PKEY *pkey)
+{
+        if (pkey->type != EVP_PKEY_EC)
+        {
+                EVPerr(EVP_F_EVP_PKEY_GET1_EC_KEY, EVP_R_EXPECTING_A_EC_KEY);
+                return NULL;
+        }
+        EC_KEY_up_ref(pkey->pkey.ec);
+        return pkey->pkey.ec;
+}
+#endif
+
+
 #ifndef OPENSSL_NO_DH
 
 int EVP_PKEY_set1_DH(EVP_PKEY *pkey, DH *key)
@@ -282,6 +438,8 @@ int EVP_PKEY_type(int type)
                 return(EVP_PKEY_DSA);
         case EVP_PKEY_DH:
                 return(EVP_PKEY_DH);
+        case EVP_PKEY_EC:
+                return(EVP_PKEY_EC);
         default:
                 return(NID_undef);
                 }
@@ -306,6 +464,8 @@ void EVP_PKEY_free(EVP_PKEY *x)
                 }
 #endif
         EVP_PKEY_free_it(x);
+        if (x->attributes)
+                sk_X509_ATTRIBUTE_pop_free(x->attributes, X509_ATTRIBUTE_free);
         OPENSSL_free(x);
         }
 
@@ -327,6 +487,11 @@ static void EVP_PKEY_free_it(EVP_PKEY *x)
                 DSA_free(x->pkey.dsa);
                 break;
 #endif
+#ifndef OPENSSL_NO_EC
+        case EVP_PKEY_EC:
+                EC_KEY_free(x->pkey.ec);
+                break;
+#endif
 #ifndef OPENSSL_NO_DH
         case EVP_PKEY_DH:
                 DH_free(x->pkey.dh);
diff --git a/src/lib/libssl/src/crypto/evp/p_open.c b/src/lib/libssl/src/crypto/evp/p_open.c
index 5a933d1cda..9935206d0f 100644
--- a/src/lib/libssl/src/crypto/evp/p_open.c
+++ b/src/lib/libssl/src/crypto/evp/p_open.c
@@ -56,15 +56,19 @@
  * [including the GNU Public Licence.]
  */
 
-#ifndef OPENSSL_NO_RSA
 #include <stdio.h>
 #include "cryptlib.h"
+
+#ifndef OPENSSL_NO_RSA
+
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#include <openssl/rsa.h>
 
-int EVP_OpenInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, unsigned char *ek,
-             int ekl, unsigned char *iv, EVP_PKEY *priv)
+int EVP_OpenInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+        const unsigned char *ek, int ekl, const unsigned char *iv,
+        EVP_PKEY *priv)
         {
         unsigned char *key=NULL;
         int i,size=0,ret=0;
diff --git a/src/lib/libssl/src/crypto/evp/p_seal.c b/src/lib/libssl/src/crypto/evp/p_seal.c
index 37e547fe72..8cc8fcb0bd 100644
--- a/src/lib/libssl/src/crypto/evp/p_seal.c
+++ b/src/lib/libssl/src/crypto/evp/p_seal.c
@@ -78,7 +78,7 @@ int EVP_SealInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, unsigned char **ek
         }
         if ((npubk <= 0) || !pubk)
                 return 1;
-        if (RAND_bytes(key,EVP_MAX_KEY_LENGTH) <= 0)
+        if (EVP_CIPHER_CTX_rand_key(ctx, key) <= 0)
                 return 0;
         if (EVP_CIPHER_CTX_iv_length(ctx))
                 RAND_pseudo_bytes(iv,EVP_CIPHER_CTX_iv_length(ctx));
diff --git a/src/lib/libssl/src/crypto/evp/p_verify.c b/src/lib/libssl/src/crypto/evp/p_verify.c
index d854d743a5..21a40a375e 100644
--- a/src/lib/libssl/src/crypto/evp/p_verify.c
+++ b/src/lib/libssl/src/crypto/evp/p_verify.c
@@ -62,7 +62,7 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 
-int EVP_VerifyFinal(EVP_MD_CTX *ctx, unsigned char *sigbuf,
+int EVP_VerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sigbuf,
              unsigned int siglen, EVP_PKEY *pkey)
         {
         unsigned char m[EVP_MAX_MD_SIZE];
diff --git a/src/lib/libssl/src/crypto/ex_data.c b/src/lib/libssl/src/crypto/ex_data.c
index 5b2e345c27..3b11e7a556 100644
--- a/src/lib/libssl/src/crypto/ex_data.c
+++ b/src/lib/libssl/src/crypto/ex_data.c
@@ -138,12 +138,8 @@
  *
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <openssl/buffer.h>
-#include <openssl/bio.h>
-#include <openssl/lhash.h>
 #include "cryptlib.h"
+#include <openssl/lhash.h>
 
 /* What an "implementation of ex_data functionality" looks like */
 struct st_CRYPTO_EX_DATA_IMPL
@@ -287,7 +283,7 @@ static void def_cleanup_util_cb(CRYPTO_EX_DATA_FUNCS *funcs)
 /* This callback is used in lh_doall to destroy all EX_CLASS_ITEM values from
  * "ex_data" prior to the ex_data hash table being itself destroyed. Doesn't do
  * any locking. */
-static void def_cleanup_cb(const void *a_void)
+static void def_cleanup_cb(void *a_void)
         {
         EX_CLASS_ITEM *item = (EX_CLASS_ITEM *)a_void;
         sk_CRYPTO_EX_DATA_FUNCS_pop_free(item->meth, def_cleanup_util_cb);
@@ -358,7 +354,7 @@ static int def_add_index(EX_CLASS_ITEM *item, long argl, void *argp,
                         }
                 }
         toret = item->meth_num++;
-        sk_CRYPTO_EX_DATA_FUNCS_set(item->meth, toret, a);
+        (void)sk_CRYPTO_EX_DATA_FUNCS_set(item->meth, toret, a);
 err:
         CRYPTO_w_unlock(CRYPTO_LOCK_EX_DATA);
         return toret;
diff --git a/src/lib/libssl/src/crypto/hmac/hmac.c b/src/lib/libssl/src/crypto/hmac/hmac.c
index 6c110bd52b..c45e001492 100644
--- a/src/lib/libssl/src/crypto/hmac/hmac.c
+++ b/src/lib/libssl/src/crypto/hmac/hmac.c
@@ -58,10 +58,8 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <openssl/hmac.h>
 #include "cryptlib.h"
-
-#ifndef OPENSSL_FIPS
+#include <openssl/hmac.h>
 
 void HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
                   const EVP_MD *md, ENGINE *impl)
@@ -81,7 +79,7 @@ void HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
                 {
                 reset=1;
                 j=EVP_MD_block_size(md);
-                OPENSSL_assert(j <= sizeof ctx->key);
+                OPENSSL_assert(j <= (int)sizeof(ctx->key));
                 if (j < len)
                         {
                         EVP_DigestInit_ex(&ctx->md_ctx,md, impl);
@@ -91,7 +89,7 @@ void HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
                         }
                 else
                         {
-                        OPENSSL_assert(len <= sizeof ctx->key);
+                        OPENSSL_assert(len>=0 && len<=(int)sizeof(ctx->key));
                         memcpy(ctx->key,key,len);
                         ctx->key_length=len;
                         }
@@ -123,7 +121,7 @@ void HMAC_Init(HMAC_CTX *ctx, const void *key, int len,
         HMAC_Init_ex(ctx,key,len,md, NULL);
         }
 
-void HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, int len)
+void HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len)
         {
         EVP_DigestUpdate(&ctx->md_ctx,data,len);
         }
@@ -158,7 +156,7 @@ void HMAC_CTX_cleanup(HMAC_CTX *ctx)
         }
 
 unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
-                    const unsigned char *d, int n, unsigned char *md,
+                    const unsigned char *d, size_t n, unsigned char *md,
                     unsigned int *md_len)
         {
         HMAC_CTX c;
@@ -173,11 +171,3 @@ unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
         return(md);
         }
 
-void HMAC_CTX_set_flags(HMAC_CTX *ctx, unsigned long flags)
-        {
-        EVP_MD_CTX_set_flags(&ctx->i_ctx, flags);
-        EVP_MD_CTX_set_flags(&ctx->o_ctx, flags);
-        EVP_MD_CTX_set_flags(&ctx->md_ctx, flags);
-        }
-
-#endif
diff --git a/src/lib/libssl/src/crypto/hmac/hmac.h b/src/lib/libssl/src/crypto/hmac/hmac.h
index c6489c04c8..719fc408ac 100644
--- a/src/lib/libssl/src/crypto/hmac/hmac.h
+++ b/src/lib/libssl/src/crypto/hmac/hmac.h
@@ -58,17 +58,15 @@
 #ifndef HEADER_HMAC_H
 #define HEADER_HMAC_H
 
+#include <openssl/opensslconf.h>
+
 #ifdef OPENSSL_NO_HMAC
 #error HMAC is disabled.
 #endif
 
 #include <openssl/evp.h>
 
-#ifdef OPENSSL_FIPS
-#define HMAC_MAX_MD_CBLOCK      128
-#else
-#define HMAC_MAX_MD_CBLOCK      64
-#endif
+#define HMAC_MAX_MD_CBLOCK      128     /* largest known is SHA512 */
 
 #ifdef  __cplusplus
 extern "C" {
@@ -96,13 +94,12 @@ void HMAC_Init(HMAC_CTX *ctx, const void *key, int len,
                const EVP_MD *md); /* deprecated */
 void HMAC_Init_ex(HMAC_CTX *ctx, const void *key, int len,
                   const EVP_MD *md, ENGINE *impl);
-void HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, int len);
+void HMAC_Update(HMAC_CTX *ctx, const unsigned char *data, size_t len);
 void HMAC_Final(HMAC_CTX *ctx, unsigned char *md, unsigned int *len);
 unsigned char *HMAC(const EVP_MD *evp_md, const void *key, int key_len,
-                    const unsigned char *d, int n, unsigned char *md,
+                    const unsigned char *d, size_t n, unsigned char *md,
                     unsigned int *md_len);
 
-void HMAC_CTX_set_flags(HMAC_CTX *ctx, unsigned long flags);
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/idea/idea.h b/src/lib/libssl/src/crypto/idea/idea.h
index bf41844fd7..bf97a37e39 100644
--- a/src/lib/libssl/src/crypto/idea/idea.h
+++ b/src/lib/libssl/src/crypto/idea/idea.h
@@ -59,6 +59,8 @@
 #ifndef HEADER_IDEA_H
 #define HEADER_IDEA_H
 
+#include <openssl/opensslconf.h> /* IDEA_INT, OPENSSL_NO_IDEA */
+
 #ifdef OPENSSL_NO_IDEA
 #error IDEA is disabled.
 #endif
@@ -66,7 +68,6 @@
 #define IDEA_ENCRYPT    1
 #define IDEA_DECRYPT    0
 
-#include <openssl/opensslconf.h> /* IDEA_INT */
 #define IDEA_BLOCK      8
 #define IDEA_KEY_LENGTH 16
 
@@ -82,12 +83,8 @@ typedef struct idea_key_st
 const char *idea_options(void);
 void idea_ecb_encrypt(const unsigned char *in, unsigned char *out,
         IDEA_KEY_SCHEDULE *ks);
-#ifdef OPENSSL_FIPS
-void private_idea_set_encrypt_key(const unsigned char *key,
-                                                IDEA_KEY_SCHEDULE *ks);
-#endif
 void idea_set_encrypt_key(const unsigned char *key, IDEA_KEY_SCHEDULE *ks);
-void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk);
+void idea_set_decrypt_key(const IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk);
 void idea_cbc_encrypt(const unsigned char *in, unsigned char *out,
         long length, IDEA_KEY_SCHEDULE *ks, unsigned char *iv,int enc);
 void idea_cfb64_encrypt(const unsigned char *in, unsigned char *out,
diff --git a/src/lib/libssl/src/crypto/install.com b/src/lib/libssl/src/crypto/install.com
index b3d155e964..58a4fecdaa 100644
--- a/src/lib/libssl/src/crypto/install.com
+++ b/src/lib/libssl/src/crypto/install.com
@@ -32,14 +32,18 @@ $	IF F$PARSE("WRK_SSLALIB:") .EQS. "" THEN -
 $       IF F$PARSE("WRK_SSLINCLUDE:") .EQS. "" THEN -
            CREATE/DIR/LOG WRK_SSLINCLUDE:
 $
-$       SDIRS := ,MD2,MD4,MD5,SHA,MDC2,HMAC,RIPEMD,-
-                 DES,RC2,RC4,RC5,IDEA,BF,CAST,-
-                 BN,EC,RSA,DSA,DH,DSO,ENGINE,AES,-
-                 BUFFER,BIO,STACK,LHASH,RAND,ERR,OBJECTS,-
+$       SDIRS := ,-
+                 OBJECTS,-
+                 MD2,MD4,MD5,SHA,MDC2,HMAC,RIPEMD,-
+                 DES,RC2,RC4,RC5,IDEA,BF,CAST,CAMELLIA,SEED,-
+                 BN,EC,RSA,DSA,ECDSA,DH,ECDH,DSO,ENGINE,AES,-
+                 BUFFER,BIO,STACK,LHASH,RAND,ERR,-
                  EVP,ASN1,PEM,X509,X509V3,CONF,TXT_DB,PKCS7,PKCS12,COMP,OCSP,-
-                 UI,KRB5
+                 UI,KRB5,-
+                 STORE,CMS,PQUEUE
 $       EXHEADER_ := crypto.h,tmdiff.h,opensslv.h,opensslconf.h,ebcdic.h,-
                 symhacks.h,ossl_typ.h
+$       EXHEADER_OBJECTS := objects.h,obj_mac.h
 $       EXHEADER_MD2 := md2.h
 $       EXHEADER_MD4 := md4.h
 $       EXHEADER_MD5 := md5.h
@@ -54,11 +58,15 @@ $	EXHEADER_RC5 := rc5.h
 $       EXHEADER_IDEA := idea.h
 $       EXHEADER_BF := blowfish.h
 $       EXHEADER_CAST := cast.h
+$       EXHEADER_CAMELLIA := camellia.h
+$       EXHEADER_SEED := seed.h
 $       EXHEADER_BN := bn.h
 $       EXHEADER_EC := ec.h
 $       EXHEADER_RSA := rsa.h
 $       EXHEADER_DSA := dsa.h
+$       EXHEADER_ECDSA := ecdsa.h
 $       EXHEADER_DH := dh.h
+$       EXHEADER_ECDH := ecdh.h
 $       EXHEADER_DSO := dso.h
 $       EXHEADER_ENGINE := engine.h
 $       EXHEADER_AES := aes.h
@@ -68,7 +76,6 @@ $	EXHEADER_STACK := stack.h,safestack.h
 $       EXHEADER_LHASH := lhash.h
 $       EXHEADER_RAND := rand.h
 $       EXHEADER_ERR := err.h
-$       EXHEADER_OBJECTS := objects.h,obj_mac.h
 $       EXHEADER_EVP := evp.h
 $       EXHEADER_ASN1 := asn1.h,asn1_mac.h,asn1t.h
 $       EXHEADER_PEM := pem.h,pem2.h
@@ -82,6 +89,10 @@ $	EXHEADER_COMP := comp.h
 $       EXHEADER_OCSP := ocsp.h
 $       EXHEADER_UI := ui.h,ui_compat.h
 $       EXHEADER_KRB5 := krb5_asn.h
+$!      EXHEADER_STORE := store.h,str_compat.h
+$       EXHEADER_STORE := store.h
+$       EXHEADER_PQUEUE := pqueue.h,pq_compat.h
+$       EXHEADER_CMS := cms.h
 $       LIBS := LIBCRYPTO
 $
 $       VEXE_DIR := [-.VAX.EXE.CRYPTO]
diff --git a/src/lib/libssl/src/crypto/krb5/krb5_asn.h b/src/lib/libssl/src/crypto/krb5/krb5_asn.h
index 3329477b07..41725d0dc4 100644
--- a/src/lib/libssl/src/crypto/krb5/krb5_asn.h
+++ b/src/lib/libssl/src/crypto/krb5/krb5_asn.h
@@ -225,7 +225,7 @@ DECLARE_STACK_OF(KRB5_AUTHENTBODY)
 **      void name##_free(type *a);
 **      DECLARE_ASN1_ENCODE_FUNCTIONS(type, name, name) =
 **       DECLARE_ASN1_ENCODE_FUNCTIONS(type, itname, name) =
-**        type *d2i_##name(type **a, unsigned char **in, long len);
+**        type *d2i_##name(type **a, const unsigned char **in, long len);
 **        int i2d_##name(type *a, unsigned char **out);
 **        DECLARE_ASN1_ITEM(itname) = OPENSSL_EXTERN const ASN1_ITEM itname##_it
 */
diff --git a/src/lib/libssl/src/crypto/lhash/lhash.c b/src/lib/libssl/src/crypto/lhash/lhash.c
index 0a16fcf27d..04ea80203c 100644
--- a/src/lib/libssl/src/crypto/lhash/lhash.c
+++ b/src/lib/libssl/src/crypto/lhash/lhash.c
@@ -100,7 +100,7 @@
 #include <openssl/crypto.h>
 #include <openssl/lhash.h>
 
-const char *lh_version="lhash" OPENSSL_VERSION_PTEXT;
+const char lh_version[]="lhash" OPENSSL_VERSION_PTEXT;
 
 #undef MIN_NODES 
 #define MIN_NODES       16
@@ -176,11 +176,11 @@ void lh_free(LHASH *lh)
         OPENSSL_free(lh);
         }
 
-void *lh_insert(LHASH *lh, const void *data)
+void *lh_insert(LHASH *lh, void *data)
         {
         unsigned long hash;
         LHASH_NODE *nn,**rn;
-        const void *ret;
+        void *ret;
 
         lh->error=0;
         if (lh->up_load <= (lh->num_items*LH_LOAD_MULT/lh->num_nodes))
@@ -211,14 +211,14 @@ void *lh_insert(LHASH *lh, const void *data)
                 (*rn)->data=data;
                 lh->num_replace++;
                 }
-        return((void *)ret);
+        return(ret);
         }
 
 void *lh_delete(LHASH *lh, const void *data)
         {
         unsigned long hash;
         LHASH_NODE *nn,**rn;
-        const void *ret;
+        void *ret;
 
         lh->error=0;
         rn=getrn(lh,data,&hash);
@@ -242,14 +242,14 @@ void *lh_delete(LHASH *lh, const void *data)
                 (lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
                 contract(lh);
 
-        return((void *)ret);
+        return(ret);
         }
 
 void *lh_retrieve(LHASH *lh, const void *data)
         {
         unsigned long hash;
         LHASH_NODE **rn;
-        const void *ret;
+        void *ret;
 
         lh->error=0;
         rn=getrn(lh,data,&hash);
@@ -264,7 +264,7 @@ void *lh_retrieve(LHASH *lh, const void *data)
                 ret= (*rn)->data;
                 lh->num_retrieve++;
                 }
-        return((void *)ret);
+        return(ret);
         }
 
 static void doall_util_fn(LHASH *lh, int use_arg, LHASH_DOALL_FN_TYPE func,
@@ -339,7 +339,7 @@ static void expand(LHASH *lh)
                 {
                 j=(int)lh->num_alloc_nodes*2;
                 n=(LHASH_NODE **)OPENSSL_realloc(lh->b,
-                        (unsigned int)sizeof(LHASH_NODE *)*j);
+                        (int)(sizeof(LHASH_NODE *)*j));
                 if (n == NULL)
                         {
 /*                      fputs("realloc error in lhash",stderr); */
@@ -401,7 +401,7 @@ static LHASH_NODE **getrn(LHASH *lh, const void *data, unsigned long *rhash)
         {
         LHASH_NODE **ret,*n1;
         unsigned long hash,nn;
-        int (*cf)();
+        LHASH_COMP_FN_TYPE cf;
 
         hash=(*(lh->hash))(data);
         lh->num_hash_calls++;
diff --git a/src/lib/libssl/src/crypto/lhash/lhash.h b/src/lib/libssl/src/crypto/lhash/lhash.h
index dee8207333..d392d0cd80 100644
--- a/src/lib/libssl/src/crypto/lhash/lhash.h
+++ b/src/lib/libssl/src/crypto/lhash/lhash.h
@@ -63,6 +63,7 @@
 #ifndef HEADER_LHASH_H
 #define HEADER_LHASH_H
 
+#include <openssl/e_os2.h>
 #ifndef OPENSSL_NO_FP_API
 #include <stdio.h>
 #endif
@@ -77,7 +78,7 @@ extern "C" {
 
 typedef struct lhash_node_st
         {
-        const void *data;
+        void *data;
         struct lhash_node_st *next;
 #ifndef OPENSSL_NO_HASH_COMP
         unsigned long hash;
@@ -86,8 +87,8 @@ typedef struct lhash_node_st
 
 typedef int (*LHASH_COMP_FN_TYPE)(const void *, const void *);
 typedef unsigned long (*LHASH_HASH_FN_TYPE)(const void *);
-typedef void (*LHASH_DOALL_FN_TYPE)(const void *);
-typedef void (*LHASH_DOALL_ARG_FN_TYPE)(const void *, void *);
+typedef void (*LHASH_DOALL_FN_TYPE)(void *);
+typedef void (*LHASH_DOALL_ARG_FN_TYPE)(void *, void *);
 
 /* Macros for declaring and implementing type-safe wrappers for LHASH callbacks.
  * This way, callbacks can be provided to LHASH structures without function
@@ -117,18 +118,18 @@ typedef void (*LHASH_DOALL_ARG_FN_TYPE)(const void *, void *);
 
 /* Third: "doall" functions */
 #define DECLARE_LHASH_DOALL_FN(f_name,o_type) \
-        void f_name##_LHASH_DOALL(const void *);
+        void f_name##_LHASH_DOALL(void *);
 #define IMPLEMENT_LHASH_DOALL_FN(f_name,o_type) \
-        void f_name##_LHASH_DOALL(const void *arg) { \
+        void f_name##_LHASH_DOALL(void *arg) { \
                 o_type a = (o_type)arg; \
                 f_name(a); }
 #define LHASH_DOALL_FN(f_name) f_name##_LHASH_DOALL
 
 /* Fourth: "doall_arg" functions */
 #define DECLARE_LHASH_DOALL_ARG_FN(f_name,o_type,a_type) \
-        void f_name##_LHASH_DOALL_ARG(const void *, void *);
+        void f_name##_LHASH_DOALL_ARG(void *, void *);
 #define IMPLEMENT_LHASH_DOALL_ARG_FN(f_name,o_type,a_type) \
-        void f_name##_LHASH_DOALL_ARG(const void *arg1, void *arg2) { \
+        void f_name##_LHASH_DOALL_ARG(void *arg1, void *arg2) { \
                 o_type a = (o_type)arg1; \
                 a_type b = (a_type)arg2; \
                 f_name(a,b); }
@@ -172,7 +173,7 @@ typedef struct lhash_st
 
 LHASH *lh_new(LHASH_HASH_FN_TYPE h, LHASH_COMP_FN_TYPE c);
 void lh_free(LHASH *lh);
-void *lh_insert(LHASH *lh, const void *data);
+void *lh_insert(LHASH *lh, void *data);
 void *lh_delete(LHASH *lh, const void *data);
 void *lh_retrieve(LHASH *lh, const void *data);
 void lh_doall(LHASH *lh, LHASH_DOALL_FN_TYPE func);
diff --git a/src/lib/libssl/src/crypto/md2/md2.h b/src/lib/libssl/src/crypto/md2/md2.h
index d0ef9da08e..a46120e7d4 100644
--- a/src/lib/libssl/src/crypto/md2/md2.h
+++ b/src/lib/libssl/src/crypto/md2/md2.h
@@ -59,13 +59,14 @@
 #ifndef HEADER_MD2_H
 #define HEADER_MD2_H
 
+#include <openssl/opensslconf.h> /* OPENSSL_NO_MD2, MD2_INT */
 #ifdef OPENSSL_NO_MD2
 #error MD2 is disabled.
 #endif
+#include <stddef.h>
 
 #define MD2_DIGEST_LENGTH       16
 #define MD2_BLOCK               16
-#include <openssl/opensslconf.h> /* MD2_INT */
 
 #ifdef  __cplusplus
 extern "C" {
@@ -73,20 +74,17 @@ extern "C" {
 
 typedef struct MD2state_st
         {
-        int num;
+        unsigned int num;
         unsigned char data[MD2_BLOCK];
         MD2_INT cksm[MD2_BLOCK];
         MD2_INT state[MD2_BLOCK];
         } MD2_CTX;
 
 const char *MD2_options(void);
-#ifdef OPENSSL_FIPS
-int private_MD2_Init(MD2_CTX *c);
-#endif
 int MD2_Init(MD2_CTX *c);
-int MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len);
+int MD2_Update(MD2_CTX *c, const unsigned char *data, size_t len);
 int MD2_Final(unsigned char *md, MD2_CTX *c);
-unsigned char *MD2(const unsigned char *d, unsigned long n,unsigned char *md);
+unsigned char *MD2(const unsigned char *d, size_t n,unsigned char *md);
 #ifdef  __cplusplus
 }
 #endif
diff --git a/src/lib/libssl/src/crypto/md2/md2_dgst.c b/src/lib/libssl/src/crypto/md2/md2_dgst.c
index 8124acd687..6f68b25c6a 100644
--- a/src/lib/libssl/src/crypto/md2/md2_dgst.c
+++ b/src/lib/libssl/src/crypto/md2/md2_dgst.c
@@ -62,10 +62,8 @@
 #include <openssl/md2.h>
 #include <openssl/opensslv.h>
 #include <openssl/crypto.h>
-#include <openssl/fips.h>
-#include <openssl/err.h>
 
-const char *MD2_version="MD2" OPENSSL_VERSION_PTEXT;
+const char MD2_version[]="MD2" OPENSSL_VERSION_PTEXT;
 
 /* Implemented from RFC1319 The MD2 Message-Digest Algorithm
  */
@@ -118,7 +116,7 @@ const char *MD2_options(void)
                 return("md2(int)");
         }
 
-FIPS_NON_FIPS_MD_Init(MD2)
+int MD2_Init(MD2_CTX *c)
         {
         c->num=0;
         memset(c->state,0,sizeof c->state);
@@ -127,7 +125,7 @@ FIPS_NON_FIPS_MD_Init(MD2)
         return 1;
         }
 
-int MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len)
+int MD2_Update(MD2_CTX *c, const unsigned char *data, size_t len)
         {
         register UCHAR *p;
 
@@ -147,7 +145,7 @@ int MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len)
                         }
                 else
                         {
-                        memcpy(&(p[c->num]),data,(int)len);
+                        memcpy(&(p[c->num]),data,len);
                         /* data+=len; */
                         c->num+=(int)len;
                         return 1;
@@ -161,7 +159,7 @@ int MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len)
                 data+=MD2_BLOCK;
                 len-=MD2_BLOCK;
                 }
-        memcpy(p,data,(int)len);
+        memcpy(p,data,len);
         c->num=(int)len;
         return 1;
         }
diff --git a/src/lib/libssl/src/crypto/md2/md2_one.c b/src/lib/libssl/src/crypto/md2/md2_one.c
index 8c36ba5779..f7fef5cc0a 100644
--- a/src/lib/libssl/src/crypto/md2/md2_one.c
+++ b/src/lib/libssl/src/crypto/md2/md2_one.c
@@ -63,7 +63,7 @@
 /* This is a separate file so that #defines in cryptlib.h can
  * map my MD functions to different names */
 
-unsigned char *MD2(const unsigned char *d, unsigned long n, unsigned char *md)
+unsigned char *MD2(const unsigned char *d, size_t n, unsigned char *md)
         {
         MD2_CTX c;
         static unsigned char m[MD2_DIGEST_LENGTH];
diff --git a/src/lib/libssl/src/crypto/md2/md2test.c b/src/lib/libssl/src/crypto/md2/md2test.c
index 9c1e28b6ce..db5f5bc6d2 100644
--- a/src/lib/libssl/src/crypto/md2/md2test.c
+++ b/src/lib/libssl/src/crypto/md2/md2test.c
@@ -110,7 +110,7 @@ int main(int argc, char *argv[])
         i=1;
         while (*P != NULL)
                 {
-                EVP_Digest((unsigned char *)*P,(unsigned long)strlen(*P),md,NULL,EVP_md2(), NULL);
+                EVP_Digest((unsigned char *)*P,strlen(*P),md,NULL,EVP_md2(), NULL);
                 p=pt(md);
                 if (strcmp(p,*R) != 0)
                         {
@@ -124,7 +124,11 @@ int main(int argc, char *argv[])
                 R++;
                 P++;
                 }
+#ifdef OPENSSL_SYS_NETWARE
+    if (err) printf("ERROR: %d\n", err);
+#endif
         EXIT(err);
+        return err;
         }
 
 static char *pt(unsigned char *md)
diff --git a/src/lib/libssl/src/crypto/md32_common.h b/src/lib/libssl/src/crypto/md32_common.h
index 733da6acaf..089c450290 100644
--- a/src/lib/libssl/src/crypto/md32_common.h
+++ b/src/lib/libssl/src/crypto/md32_common.h
@@ -1,6 +1,6 @@
 /* crypto/md32_common.h */
 /* ====================================================================
- * Copyright (c) 1999-2002 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,10 +47,6 @@
  * OF THE POSSIBILITY OF SUCH DAMAGE.
  * ====================================================================
  *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
  */
 
 /*
@@ -76,40 +72,27 @@
  *              typedef struct {
  *                      ...
  *                      HASH_LONG       Nl,Nh;
+ *                      either {
  *                      HASH_LONG       data[HASH_LBLOCK];
- *                      int             num;
+ *                      unsigned char   data[HASH_CBLOCK];
+ *                      };
+ *                      unsigned int    num;
  *                      ...
  *                      } HASH_CTX;
+ *      data[] vector is expected to be zeroed upon first call to
+ *      HASH_UPDATE.
  * HASH_UPDATE
  *      name of "Update" function, implemented here.
  * HASH_TRANSFORM
  *      name of "Transform" function, implemented here.
  * HASH_FINAL
  *      name of "Final" function, implemented here.
- * HASH_BLOCK_HOST_ORDER
- *      name of "block" function treating *aligned* input message
- *      in host byte order, implemented externally.
  * HASH_BLOCK_DATA_ORDER
- *      name of "block" function treating *unaligned* input message
- *      in original (data) byte order, implemented externally (it
- *      actually is optional if data and host are of the same
- *      "endianess").
+ *      name of "block" function capable of treating *unaligned* input
+ *      message in original (data) byte order, implemented externally.
  * HASH_MAKE_STRING
  *      macro convering context variables to an ASCII hash string.
  *
- * Optional macros:
- *
- * B_ENDIAN or L_ENDIAN
- *      defines host byte-order.
- * HASH_LONG_LOG2
- *      defaults to 2 if not states otherwise.
- * HASH_LBLOCK
- *      assumed to be HASH_CBLOCK/4 if not stated otherwise.
- * HASH_BLOCK_DATA_ORDER_ALIGNED
- *      alternative "block" function capable of treating
- *      aligned input message in original (data) order,
- *      implemented externally.
- *
  * MD5 example:
  *
  *      #define DATA_ORDER_IS_LITTLE_ENDIAN
@@ -118,20 +101,14 @@
  *      #define HASH_LONG_LOG2          MD5_LONG_LOG2
  *      #define HASH_CTX                MD5_CTX
  *      #define HASH_CBLOCK             MD5_CBLOCK
- *      #define HASH_LBLOCK             MD5_LBLOCK
  *      #define HASH_UPDATE             MD5_Update
  *      #define HASH_TRANSFORM          MD5_Transform
  *      #define HASH_FINAL              MD5_Final
- *      #define HASH_BLOCK_HOST_ORDER   md5_block_host_order
  *      #define HASH_BLOCK_DATA_ORDER   md5_block_data_order
  *
  *                                      <appro@fy.chalmers.se>
  */
 
-#include <openssl/crypto.h>
-#include <openssl/fips.h>
-#include <openssl/err.h>
-
 #if !defined(DATA_ORDER_IS_BIG_ENDIAN) && !defined(DATA_ORDER_IS_LITTLE_ENDIAN)
 #error "DATA_ORDER must be defined!"
 #endif
@@ -156,34 +133,16 @@
 #error "HASH_FINAL must be defined!"
 #endif
 
-#ifndef HASH_BLOCK_HOST_ORDER
-#error "HASH_BLOCK_HOST_ORDER must be defined!"
-#endif
-
-#if 0
-/*
- * Moved below as it's required only if HASH_BLOCK_DATA_ORDER_ALIGNED
- * isn't defined.
- */
 #ifndef HASH_BLOCK_DATA_ORDER
 #error "HASH_BLOCK_DATA_ORDER must be defined!"
 #endif
-#endif
-
-#ifndef HASH_LBLOCK
-#define HASH_LBLOCK     (HASH_CBLOCK/4)
-#endif
-
-#ifndef HASH_LONG_LOG2
-#define HASH_LONG_LOG2  2
-#endif
 
 /*
  * Engage compiler specific rotate intrinsic function if available.
  */
 #undef ROTATE
 #ifndef PEDANTIC
-# if 0 /* defined(_MSC_VER) */
+# if defined(_MSC_VER) || defined(__ICC)
 #  define ROTATE(a,n)   _lrotl(a,n)
 # elif defined(__MWERKS__)
 #  if defined(__POWERPC__)
@@ -199,7 +158,6 @@
    * Some GNU C inline assembler templates. Note that these are
    * rotates by *constant* number of bits! But that's exactly
    * what we need here...
-   *
    *                                    <appro@fy.chalmers.se>
    */
 #  if defined(__i386) || defined(__i386__) || defined(__x86_64) || defined(__x86_64__)
@@ -211,7 +169,8 @@
                                 : "cc");                \
                            ret;                         \
                         })
-#  elif defined(__powerpc) || defined(__ppc__) || defined(__powerpc64__)
+#  elif defined(_ARCH_PPC) || defined(_ARCH_PPC64) || \
+        defined(__powerpc) || defined(__ppc__) || defined(__powerpc64__)
 #   define ROTATE(a,n)  ({ register unsigned int ret;   \
                                 asm (                   \
                                 "rlwinm %0,%1,%2,0,31"  \
@@ -219,194 +178,100 @@
                                 : "r"(a), "I"(n));      \
                            ret;                         \
                         })
-#  endif
-# endif
-
-/*
- * Engage compiler specific "fetch in reverse byte order"
- * intrinsic function if available.
- */
-# if defined(__GNUC__) && __GNUC__>=2 && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM)
-  /* some GNU C inline assembler templates by <appro@fy.chalmers.se> */
-#  if (defined(__i386) || defined(__i386__) || defined(__x86_64) || defined(__x86_64__)) && !defined(I386_ONLY)
-#   define BE_FETCH32(a)        ({ register unsigned int l=(a);\
-                                asm (                   \
-                                "bswapl %0"             \
-                                : "=r"(l) : "0"(l));    \
-                          l;                            \
-                        })
-#  elif defined(__powerpc)
-#   define LE_FETCH32(a)        ({ register unsigned int l;     \
-                                asm (                   \
-                                "lwbrx %0,0,%1"         \
-                                : "=r"(l)               \
-                                : "r"(a));              \
-                           l;                           \
-                        })
-
-#  elif defined(__sparc) && defined(OPENSSL_SYS_ULTRASPARC)
-#  define LE_FETCH32(a) ({ register unsigned int l;             \
-                                asm (                           \
-                                "lda [%1]#ASI_PRIMARY_LITTLE,%0"\
-                                : "=r"(l)                       \
-                                : "r"(a));                      \
-                           l;                                   \
+#  elif defined(__s390x__)
+#   define ROTATE(a,n) ({ register unsigned int ret;    \
+                                asm ("rll %0,%1,%2"     \
+                                : "=r"(ret)             \
+                                : "r"(a), "I"(n));      \
+                          ret;                          \
                         })
 #  endif
 # endif
 #endif /* PEDANTIC */
 
-#if HASH_LONG_LOG2==2   /* Engage only if sizeof(HASH_LONG)== 4 */
-/* A nice byte order reversal from Wei Dai <weidai@eskimo.com> */
-#ifdef ROTATE
-/* 5 instructions with rotate instruction, else 9 */
-#define REVERSE_FETCH32(a,l)    (                                       \
-                l=*(const HASH_LONG *)(a),                              \
-                ((ROTATE(l,8)&0x00FF00FF)|(ROTATE((l&0x00FF00FF),24)))  \
-                                )
-#else
-/* 6 instructions with rotate instruction, else 8 */
-#define REVERSE_FETCH32(a,l)    (                               \
-                l=*(const HASH_LONG *)(a),                      \
-                l=(((l>>8)&0x00FF00FF)|((l&0x00FF00FF)<<8)),    \
-                ROTATE(l,16)                                    \
-                                )
-/*
- * Originally the middle line started with l=(((l&0xFF00FF00)>>8)|...
- * It's rewritten as above for two reasons:
- *      - RISCs aren't good at long constants and have to explicitely
- *        compose 'em with several (well, usually 2) instructions in a
- *        register before performing the actual operation and (as you
- *        already realized:-) having same constant should inspire the
- *        compiler to permanently allocate the only register for it;
- *      - most modern CPUs have two ALUs, but usually only one has
- *        circuitry for shifts:-( this minor tweak inspires compiler
- *        to schedule shift instructions in a better way...
- *
- *                              <appro@fy.chalmers.se>
- */
-#endif
-#endif
-
 #ifndef ROTATE
 #define ROTATE(a,n)     (((a)<<(n))|(((a)&0xffffffff)>>(32-(n))))
 #endif
 
-/*
- * Make some obvious choices. E.g., HASH_BLOCK_DATA_ORDER_ALIGNED
- * and HASH_BLOCK_HOST_ORDER ought to be the same if input data
- * and host are of the same "endianess". It's possible to mask
- * this with blank #define HASH_BLOCK_DATA_ORDER though...
- *
- *                              <appro@fy.chalmers.se>
- */
-#if defined(B_ENDIAN)
-#  if defined(DATA_ORDER_IS_BIG_ENDIAN)
-#    if !defined(HASH_BLOCK_DATA_ORDER_ALIGNED) && HASH_LONG_LOG2==2
-#      define HASH_BLOCK_DATA_ORDER_ALIGNED     HASH_BLOCK_HOST_ORDER
-#    endif
-#  elif defined(DATA_ORDER_IS_LITTLE_ENDIAN)
-#    ifndef HOST_FETCH32
-#      ifdef LE_FETCH32
-#        define HOST_FETCH32(p,l)       LE_FETCH32(p)
-#      elif defined(REVERSE_FETCH32)
-#        define HOST_FETCH32(p,l)       REVERSE_FETCH32(p,l)
-#      endif
-#    endif
-#  endif
-#elif defined(L_ENDIAN)
-#  if defined(DATA_ORDER_IS_LITTLE_ENDIAN)
-#    if !defined(HASH_BLOCK_DATA_ORDER_ALIGNED) && HASH_LONG_LOG2==2
-#      define HASH_BLOCK_DATA_ORDER_ALIGNED     HASH_BLOCK_HOST_ORDER
-#    endif
-#  elif defined(DATA_ORDER_IS_BIG_ENDIAN)
-#    ifndef HOST_FETCH32
-#      ifdef BE_FETCH32
-#        define HOST_FETCH32(p,l)       BE_FETCH32(p)
-#      elif defined(REVERSE_FETCH32)
-#        define HOST_FETCH32(p,l)       REVERSE_FETCH32(p,l)
-#      endif
-#    endif
-#  endif
-#endif
+#if defined(DATA_ORDER_IS_BIG_ENDIAN)
 
-#if !defined(HASH_BLOCK_DATA_ORDER_ALIGNED)
-#ifndef HASH_BLOCK_DATA_ORDER
-#error "HASH_BLOCK_DATA_ORDER must be defined!"
+#ifndef PEDANTIC
+# if defined(__GNUC__) && __GNUC__>=2 && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM)
+#  if ((defined(__i386) || defined(__i386__)) && !defined(I386_ONLY)) || \
+      (defined(__x86_64) || defined(__x86_64__))
+#   if !defined(B_ENDIAN)
+    /*
+     * This gives ~30-40% performance improvement in SHA-256 compiled
+     * with gcc [on P4]. Well, first macro to be frank. We can pull
+     * this trick on x86* platforms only, because these CPUs can fetch
+     * unaligned data without raising an exception.
+     */
+#   define HOST_c2l(c,l)        ({ unsigned int r=*((const unsigned int *)(c)); \
+                                   asm ("bswapl %0":"=r"(r):"0"(r));    \
+                                   (c)+=4; (l)=r;                       })
+#   define HOST_l2c(l,c)        ({ unsigned int r=(l);                  \
+                                   asm ("bswapl %0":"=r"(r):"0"(r));    \
+                                   *((unsigned int *)(c))=r; (c)+=4; r; })
+#   endif
+#  endif
+# endif
 #endif
+#if defined(__s390__) || defined(__s390x__)
+# define HOST_c2l(c,l) ((l)=*((const unsigned int *)(c)), (c)+=4, (l))
+# define HOST_l2c(l,c) (*((unsigned int *)(c))=(l), (c)+=4, (l))
 #endif
 
-#if defined(DATA_ORDER_IS_BIG_ENDIAN)
-
+#ifndef HOST_c2l
 #define HOST_c2l(c,l)   (l =(((unsigned long)(*((c)++)))<<24),          \
                          l|=(((unsigned long)(*((c)++)))<<16),          \
                          l|=(((unsigned long)(*((c)++)))<< 8),          \
                          l|=(((unsigned long)(*((c)++)))    ),          \
                          l)
-#define HOST_p_c2l(c,l,n)       {                                       \
-                        switch (n) {                                    \
-                        case 0: l =((unsigned long)(*((c)++)))<<24;     \
-                        case 1: l|=((unsigned long)(*((c)++)))<<16;     \
-                        case 2: l|=((unsigned long)(*((c)++)))<< 8;     \
-                        case 3: l|=((unsigned long)(*((c)++)));         \
-                                } }
-#define HOST_p_c2l_p(c,l,sc,len) {                                      \
-                        switch (sc) {                                   \
-                        case 0: l =((unsigned long)(*((c)++)))<<24;     \
-                                if (--len == 0) break;                  \
-                        case 1: l|=((unsigned long)(*((c)++)))<<16;     \
-                                if (--len == 0) break;                  \
-                        case 2: l|=((unsigned long)(*((c)++)))<< 8;     \
-                                } }
-/* NOTE the pointer is not incremented at the end of this */
-#define HOST_c2l_p(c,l,n)       {                                       \
-                        l=0; (c)+=n;                                    \
-                        switch (n) {                                    \
-                        case 3: l =((unsigned long)(*(--(c))))<< 8;     \
-                        case 2: l|=((unsigned long)(*(--(c))))<<16;     \
-                        case 1: l|=((unsigned long)(*(--(c))))<<24;     \
-                                } }
+#endif
+#ifndef HOST_l2c
 #define HOST_l2c(l,c)   (*((c)++)=(unsigned char)(((l)>>24)&0xff),      \
                          *((c)++)=(unsigned char)(((l)>>16)&0xff),      \
                          *((c)++)=(unsigned char)(((l)>> 8)&0xff),      \
                          *((c)++)=(unsigned char)(((l)    )&0xff),      \
                          l)
+#endif
 
 #elif defined(DATA_ORDER_IS_LITTLE_ENDIAN)
 
+#ifndef PEDANTIC
+# if defined(__GNUC__) && __GNUC__>=2 && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM)
+#  if defined(__s390x__)
+#   define HOST_c2l(c,l)        ({ asm ("lrv    %0,0(%1)"               \
+                                        :"=r"(l) : "r"(c));             \
+                                   (c)+=4; (l);                         })
+#   define HOST_l2c(l,c)        ({ asm ("strv   %0,0(%1)"               \
+                                        : : "r"(l),"r"(c) : "memory");  \
+                                   (c)+=4; (l);                         })
+#  endif
+# endif
+#endif
+#if defined(__i386) || defined(__i386__) || defined(__x86_64) || defined(__x86_64__)
+# ifndef B_ENDIAN
+   /* See comment in DATA_ORDER_IS_BIG_ENDIAN section. */
+#  define HOST_c2l(c,l) ((l)=*((const unsigned int *)(c)), (c)+=4, l)
+#  define HOST_l2c(l,c) (*((unsigned int *)(c))=(l), (c)+=4, l)
+# endif
+#endif
+
+#ifndef HOST_c2l
 #define HOST_c2l(c,l)   (l =(((unsigned long)(*((c)++)))    ),          \
                          l|=(((unsigned long)(*((c)++)))<< 8),          \
                          l|=(((unsigned long)(*((c)++)))<<16),          \
                          l|=(((unsigned long)(*((c)++)))<<24),          \
                          l)
-#define HOST_p_c2l(c,l,n)       {                                       \
-                        switch (n) {                                    \
-                        case 0: l =((unsigned long)(*((c)++)));         \
-                        case 1: l|=((unsigned long)(*((c)++)))<< 8;     \
-                        case 2: l|=((unsigned long)(*((c)++)))<<16;     \
-                        case 3: l|=((unsigned long)(*((c)++)))<<24;     \
-                                } }
-#define HOST_p_c2l_p(c,l,sc,len) {                                      \
-                        switch (sc) {                                   \
-                        case 0: l =((unsigned long)(*((c)++)));         \
-                                if (--len == 0) break;                  \
-                        case 1: l|=((unsigned long)(*((c)++)))<< 8;     \
-                                if (--len == 0) break;                  \
-                        case 2: l|=((unsigned long)(*((c)++)))<<16;     \
-                                } }
-/* NOTE the pointer is not incremented at the end of this */
-#define HOST_c2l_p(c,l,n)       {                                       \
-                        l=0; (c)+=n;                                    \
-                        switch (n) {                                    \
-                        case 3: l =((unsigned long)(*(--(c))))<<16;     \
-                        case 2: l|=((unsigned long)(*(--(c))))<< 8;     \
-                        case 1: l|=((unsigned long)(*(--(c))));         \
-                                } }
+#endif
+#ifndef HOST_l2c
 #define HOST_l2c(l,c)   (*((c)++)=(unsigned char)(((l)    )&0xff),      \
                          *((c)++)=(unsigned char)(((l)>> 8)&0xff),      \
                          *((c)++)=(unsigned char)(((l)>>16)&0xff),      \
                          *((c)++)=(unsigned char)(((l)>>24)&0xff),      \
                          l)
+#endif
 
 #endif
 
@@ -414,118 +279,60 @@
  * Time for some action:-)
  */
 
-int HASH_UPDATE (HASH_CTX *c, const void *data_, unsigned long len)
+int HASH_UPDATE (HASH_CTX *c, const void *data_, size_t len)
         {
         const unsigned char *data=data_;
-        register HASH_LONG * p;
-        register unsigned long l;
-        int sw,sc,ew,ec;
+        unsigned char *p;
+        HASH_LONG l;
+        size_t n;
 
         if (len==0) return 1;
 
-        l=(c->Nl+(len<<3))&0xffffffffL;
+        l=(c->Nl+(((HASH_LONG)len)<<3))&0xffffffffUL;
         /* 95-05-24 eay Fixed a bug with the overflow handling, thanks to
          * Wei Dai <weidai@eskimo.com> for pointing it out. */
         if (l < c->Nl) /* overflow */
                 c->Nh++;
-        c->Nh+=(len>>29);
+        c->Nh+=(len>>29);       /* might cause compiler warning on 16-bit */
         c->Nl=l;
 
-        if (c->num != 0)
+        n = c->num;
+        if (n != 0)
                 {
-                p=c->data;
-                sw=c->num>>2;
-                sc=c->num&0x03;
+                p=(unsigned char *)c->data;
 
-                if ((c->num+len) >= HASH_CBLOCK)
+                if ((n+len) >= HASH_CBLOCK)
                         {
-                        l=p[sw]; HOST_p_c2l(data,l,sc); p[sw++]=l;
-                        for (; sw<HASH_LBLOCK; sw++)
-                                {
-                                HOST_c2l(data,l); p[sw]=l;
-                                }
-                        HASH_BLOCK_HOST_ORDER (c,p,1);
-                        len-=(HASH_CBLOCK-c->num);
-                        c->num=0;
-                        /* drop through and do the rest */
+                        memcpy (p+n,data,HASH_CBLOCK-n);
+                        HASH_BLOCK_DATA_ORDER (c,p,1);
+                        n      = HASH_CBLOCK-n;
+                        data  += n;
+                        len   -= n;
+                        c->num = 0;
+                        memset (p,0,HASH_CBLOCK);       /* keep it zeroed */
                         }
                 else
                         {
-                        c->num+=len;
-                        if ((sc+len) < 4) /* ugly, add char's to a word */
-                                {
-                                l=p[sw]; HOST_p_c2l_p(data,l,sc,len); p[sw]=l;
-                                }
-                        else
-                                {
-                                ew=(c->num>>2);
-                                ec=(c->num&0x03);
-                                if (sc)
-                                        l=p[sw];
-                                HOST_p_c2l(data,l,sc);
-                                p[sw++]=l;
-                                for (; sw < ew; sw++)
-                                        {
-                                        HOST_c2l(data,l); p[sw]=l;
-                                        }
-                                if (ec)
-                                        {
-                                        HOST_c2l_p(data,l,ec); p[sw]=l;
-                                        }
-                                }
+                        memcpy (p+n,data,len);
+                        c->num += (unsigned int)len;
                         return 1;
                         }
                 }
 
-        sw=len/HASH_CBLOCK;
-        if (sw > 0)
+        n = len/HASH_CBLOCK;
+        if (n > 0)
                 {
-#if defined(HASH_BLOCK_DATA_ORDER_ALIGNED)
-                /*
-                 * Note that HASH_BLOCK_DATA_ORDER_ALIGNED gets defined
-                 * only if sizeof(HASH_LONG)==4.
-                 */
-                if ((((unsigned long)data)%4) == 0)
-                        {
-                        /* data is properly aligned so that we can cast it: */
-                        HASH_BLOCK_DATA_ORDER_ALIGNED (c,(HASH_LONG *)data,sw);
-                        sw*=HASH_CBLOCK;
-                        data+=sw;
-                        len-=sw;
-                        }
-                else
-#if !defined(HASH_BLOCK_DATA_ORDER)
-                        while (sw--)
-                                {
-                                memcpy (p=c->data,data,HASH_CBLOCK);
-                                HASH_BLOCK_DATA_ORDER_ALIGNED(c,p,1);
-                                data+=HASH_CBLOCK;
-                                len-=HASH_CBLOCK;
-                                }
-#endif
-#endif
-#if defined(HASH_BLOCK_DATA_ORDER)
-                        {
-                        HASH_BLOCK_DATA_ORDER(c,data,sw);
-                        sw*=HASH_CBLOCK;
-                        data+=sw;
-                        len-=sw;
-                        }
-#endif
+                HASH_BLOCK_DATA_ORDER (c,data,n);
+                n    *= HASH_CBLOCK;
+                data += n;
+                len  -= n;
                 }
 
-        if (len!=0)
+        if (len != 0)
                 {
-                p = c->data;
+                p = (unsigned char *)c->data;
                 c->num = len;
-                ew=len>>2;      /* words to copy */
-                ec=len&0x03;
-                for (; ew; ew--,p++)
-                        {
-                        HOST_c2l(data,l); *p=l;
-                        }
-                HOST_c2l_p(data,l,ec);
-                *p=l;
+                memcpy (p,data,len);
                 }
         return 1;
         }
@@ -533,81 +340,38 @@ int HASH_UPDATE (HASH_CTX *c, const void *data_, unsigned long len)
 
 void HASH_TRANSFORM (HASH_CTX *c, const unsigned char *data)
         {
-#if defined(HASH_BLOCK_DATA_ORDER_ALIGNED)
-        if ((((unsigned long)data)%4) == 0)
-                /* data is properly aligned so that we can cast it: */
-                HASH_BLOCK_DATA_ORDER_ALIGNED (c,(HASH_LONG *)data,1);
-        else
-#if !defined(HASH_BLOCK_DATA_ORDER)
-                {
-                memcpy (c->data,data,HASH_CBLOCK);
-                HASH_BLOCK_DATA_ORDER_ALIGNED (c,c->data,1);
-                }
-#endif
-#endif
-#if defined(HASH_BLOCK_DATA_ORDER)
         HASH_BLOCK_DATA_ORDER (c,data,1);
-#endif
         }
 
 
 int HASH_FINAL (unsigned char *md, HASH_CTX *c)
         {
-        register HASH_LONG *p;
-        register unsigned long l;
-        register int i,j;
-        static const unsigned char end[4]={0x80,0x00,0x00,0x00};
-        const unsigned char *cp=end;
-
-#if 0
-        if(FIPS_mode() && !FIPS_md5_allowed())
-            {
-            FIPSerr(FIPS_F_HASH_FINAL,FIPS_R_NON_FIPS_METHOD);
-            return 0;
-            }
-#endif
+        unsigned char *p = (unsigned char *)c->data;
+        size_t n = c->num;
 
-        /* c->num should definitly have room for at least one more byte. */
-        p=c->data;
-        i=c->num>>2;
-        j=c->num&0x03;
-
-#if 0
-        /* purify often complains about the following line as an
-         * Uninitialized Memory Read.  While this can be true, the
-         * following p_c2l macro will reset l when that case is true.
-         * This is because j&0x03 contains the number of 'valid' bytes
-         * already in p[i].  If and only if j&0x03 == 0, the UMR will
-         * occur but this is also the only time p_c2l will do
-         * l= *(cp++) instead of l|= *(cp++)
-         * Many thanks to Alex Tang <altitude@cic.net> for pickup this
-         * 'potential bug' */
-#ifdef PURIFY
-        if (j==0) p[i]=0; /* Yeah, but that's not the way to fix it:-) */
-#endif
-        l=p[i];
-#else
-        l = (j==0) ? 0 : p[i];
-#endif
-        HOST_p_c2l(cp,l,j); p[i++]=l; /* i is the next 'undefined word' */
+        p[n] = 0x80; /* there is always room for one */
+        n++;
 
-        if (i>(HASH_LBLOCK-2)) /* save room for Nl and Nh */
+        if (n > (HASH_CBLOCK-8))
                 {
-                if (i<HASH_LBLOCK) p[i]=0;
-                HASH_BLOCK_HOST_ORDER (c,p,1);
-                i=0;
+                memset (p+n,0,HASH_CBLOCK-n);
+                n=0;
+                HASH_BLOCK_DATA_ORDER (c,p,1);
                 }
-        for (; i<(HASH_LBLOCK-2); i++)
-                p[i]=0;
+        memset (p+n,0,HASH_CBLOCK-8-n);
 
+        p += HASH_CBLOCK-8;
 #if   defined(DATA_ORDER_IS_BIG_ENDIAN)
-        p[HASH_LBLOCK-2]=c->Nh;
-        p[HASH_LBLOCK-1]=c->Nl;
+        (void)HOST_l2c(c->Nh,p);
+        (void)HOST_l2c(c->Nl,p);
 #elif defined(DATA_ORDER_IS_LITTLE_ENDIAN)
-        p[HASH_LBLOCK-2]=c->Nl;
-        p[HASH_LBLOCK-1]=c->Nh;
+        (void)HOST_l2c(c->Nl,p);
+        (void)HOST_l2c(c->Nh,p);
 #endif
-        HASH_BLOCK_HOST_ORDER (c,p,1);
+        p -= HASH_CBLOCK;
+        HASH_BLOCK_DATA_ORDER (c,p,1);
+        c->num=0;
+        memset (p,0,HASH_CBLOCK);
 
 #ifndef HASH_MAKE_STRING
 #error "HASH_MAKE_STRING must be defined!"
@@ -615,11 +379,6 @@ int HASH_FINAL (unsigned char *md, HASH_CTX *c)
         HASH_MAKE_STRING(c,md);
 #endif
 
-        c->num=0;
-        /* clear stuff, HASH_BLOCK may be leaving some stuff on the stack
-         * but I'm not worried :-)
-        OPENSSL_cleanse((void *)c,sizeof(HASH_CTX));
-         */
         return 1;
         }
 
diff --git a/src/lib/libssl/src/crypto/md4/md4.h b/src/lib/libssl/src/crypto/md4/md4.h
index 7e761efb62..5598c93a4f 100644
--- a/src/lib/libssl/src/crypto/md4/md4.h
+++ b/src/lib/libssl/src/crypto/md4/md4.h
@@ -60,6 +60,7 @@
 #define HEADER_MD4_H
 
 #include <openssl/e_os2.h>
+#include <stddef.h>
 
 #ifdef  __cplusplus
 extern "C" {
@@ -101,16 +102,13 @@ typedef struct MD4state_st
         MD4_LONG A,B,C,D;
         MD4_LONG Nl,Nh;
         MD4_LONG data[MD4_LBLOCK];
-        int num;
+        unsigned int num;
         } MD4_CTX;
 
-#ifdef OPENSSL_FIPS
-int private_MD4_Init(MD4_CTX *c);
-#endif
 int MD4_Init(MD4_CTX *c);
-int MD4_Update(MD4_CTX *c, const void *data, unsigned long len);
+int MD4_Update(MD4_CTX *c, const void *data, size_t len);
 int MD4_Final(unsigned char *md, MD4_CTX *c);
-unsigned char *MD4(const unsigned char *d, unsigned long n, unsigned char *md);
+unsigned char *MD4(const unsigned char *d, size_t n, unsigned char *md);
 void MD4_Transform(MD4_CTX *c, const unsigned char *b);
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/md4/md4_dgst.c b/src/lib/libssl/src/crypto/md4/md4_dgst.c
index ee7cc72262..cfef94af39 100644
--- a/src/lib/libssl/src/crypto/md4/md4_dgst.c
+++ b/src/lib/libssl/src/crypto/md4/md4_dgst.c
@@ -60,7 +60,7 @@
 #include "md4_locl.h"
 #include <openssl/opensslv.h>
 
-const char *MD4_version="MD4" OPENSSL_VERSION_PTEXT;
+const char MD4_version[]="MD4" OPENSSL_VERSION_PTEXT;
 
 /* Implemented from RFC1186 The MD4 Message-Digest Algorithm
  */
@@ -70,7 +70,7 @@ const char *MD4_version="MD4" OPENSSL_VERSION_PTEXT;
 #define INIT_DATA_C (unsigned long)0x98badcfeL
 #define INIT_DATA_D (unsigned long)0x10325476L
 
-FIPS_NON_FIPS_MD_Init(MD4)
+int MD4_Init(MD4_CTX *c)
         {
         c->A=INIT_DATA_A;
         c->B=INIT_DATA_B;
@@ -82,84 +82,11 @@ FIPS_NON_FIPS_MD_Init(MD4)
         return 1;
         }
 
-#ifndef md4_block_host_order
-void md4_block_host_order (MD4_CTX *c, const void *data, int num)
-        {
-        const MD4_LONG *X=data;
-        register unsigned MD32_REG_T A,B,C,D;
-
-        A=c->A;
-        B=c->B;
-        C=c->C;
-        D=c->D;
-
-        for (;num--;X+=HASH_LBLOCK)
-                {
-        /* Round 0 */
-        R0(A,B,C,D,X[ 0], 3,0);
-        R0(D,A,B,C,X[ 1], 7,0);
-        R0(C,D,A,B,X[ 2],11,0);
-        R0(B,C,D,A,X[ 3],19,0);
-        R0(A,B,C,D,X[ 4], 3,0);
-        R0(D,A,B,C,X[ 5], 7,0);
-        R0(C,D,A,B,X[ 6],11,0);
-        R0(B,C,D,A,X[ 7],19,0);
-        R0(A,B,C,D,X[ 8], 3,0);
-        R0(D,A,B,C,X[ 9], 7,0);
-        R0(C,D,A,B,X[10],11,0);
-        R0(B,C,D,A,X[11],19,0);
-        R0(A,B,C,D,X[12], 3,0);
-        R0(D,A,B,C,X[13], 7,0);
-        R0(C,D,A,B,X[14],11,0);
-        R0(B,C,D,A,X[15],19,0);
-        /* Round 1 */
-        R1(A,B,C,D,X[ 0], 3,0x5A827999L);
-        R1(D,A,B,C,X[ 4], 5,0x5A827999L);
-        R1(C,D,A,B,X[ 8], 9,0x5A827999L);
-        R1(B,C,D,A,X[12],13,0x5A827999L);
-        R1(A,B,C,D,X[ 1], 3,0x5A827999L);
-        R1(D,A,B,C,X[ 5], 5,0x5A827999L);
-        R1(C,D,A,B,X[ 9], 9,0x5A827999L);
-        R1(B,C,D,A,X[13],13,0x5A827999L);
-        R1(A,B,C,D,X[ 2], 3,0x5A827999L);
-        R1(D,A,B,C,X[ 6], 5,0x5A827999L);
-        R1(C,D,A,B,X[10], 9,0x5A827999L);
-        R1(B,C,D,A,X[14],13,0x5A827999L);
-        R1(A,B,C,D,X[ 3], 3,0x5A827999L);
-        R1(D,A,B,C,X[ 7], 5,0x5A827999L);
-        R1(C,D,A,B,X[11], 9,0x5A827999L);
-        R1(B,C,D,A,X[15],13,0x5A827999L);
-        /* Round 2 */
-        R2(A,B,C,D,X[ 0], 3,0x6ED9EBA1);
-        R2(D,A,B,C,X[ 8], 9,0x6ED9EBA1);
-        R2(C,D,A,B,X[ 4],11,0x6ED9EBA1);
-        R2(B,C,D,A,X[12],15,0x6ED9EBA1);
-        R2(A,B,C,D,X[ 2], 3,0x6ED9EBA1);
-        R2(D,A,B,C,X[10], 9,0x6ED9EBA1);
-        R2(C,D,A,B,X[ 6],11,0x6ED9EBA1);
-        R2(B,C,D,A,X[14],15,0x6ED9EBA1);
-        R2(A,B,C,D,X[ 1], 3,0x6ED9EBA1);
-        R2(D,A,B,C,X[ 9], 9,0x6ED9EBA1);
-        R2(C,D,A,B,X[ 5],11,0x6ED9EBA1);
-        R2(B,C,D,A,X[13],15,0x6ED9EBA1);
-        R2(A,B,C,D,X[ 3], 3,0x6ED9EBA1);
-        R2(D,A,B,C,X[11], 9,0x6ED9EBA1);
-        R2(C,D,A,B,X[ 7],11,0x6ED9EBA1);
-        R2(B,C,D,A,X[15],15,0x6ED9EBA1);
-
-        A = c->A += A;
-        B = c->B += B;
-        C = c->C += C;
-        D = c->D += D;
-                }
-        }
-#endif
-
 #ifndef md4_block_data_order
 #ifdef X
 #undef X
 #endif
-void md4_block_data_order (MD4_CTX *c, const void *data_, int num)
+void md4_block_data_order (MD4_CTX *c, const void *data_, size_t num)
         {
         const unsigned char *data=data_;
         register unsigned MD32_REG_T A,B,C,D,l;
@@ -240,19 +167,3 @@ void md4_block_data_order (MD4_CTX *c, const void *data_, int num)
                 }
         }
 #endif
-
-#ifdef undef
-int printit(unsigned long *l)
-        {
-        int i,ii;
-
-        for (i=0; i<2; i++)
-                {
-                for (ii=0; ii<8; ii++)
-                        {
-                        fprintf(stderr,"%08lx ",l[i*8+ii]);
-                        }
-                fprintf(stderr,"\n");
-                }
-        }
-#endif
diff --git a/src/lib/libssl/src/crypto/md4/md4_locl.h b/src/lib/libssl/src/crypto/md4/md4_locl.h
index a8d31d7a73..c8085b0ead 100644
--- a/src/lib/libssl/src/crypto/md4/md4_locl.h
+++ b/src/lib/libssl/src/crypto/md4/md4_locl.h
@@ -65,41 +65,13 @@
 #define MD4_LONG_LOG2 2 /* default to 32 bits */
 #endif
 
-void md4_block_host_order (MD4_CTX *c, const void *p,int num);
-void md4_block_data_order (MD4_CTX *c, const void *p,int num);
-
-#if defined(__i386) || defined(__i386__) || defined(_M_IX86) || defined(__INTEL__)
-/*
- * *_block_host_order is expected to handle aligned data while
- * *_block_data_order - unaligned. As algorithm and host (x86)
- * are in this case of the same "endianness" these two are
- * otherwise indistinguishable. But normally you don't want to
- * call the same function because unaligned access in places
- * where alignment is expected is usually a "Bad Thing". Indeed,
- * on RISCs you get punished with BUS ERROR signal or *severe*
- * performance degradation. Intel CPUs are in turn perfectly
- * capable of loading unaligned data without such drastic side
- * effect. Yes, they say it's slower than aligned load, but no
- * exception is generated and therefore performance degradation
- * is *incomparable* with RISCs. What we should weight here is
- * costs of unaligned access against costs of aligning data.
- * According to my measurements allowing unaligned access results
- * in ~9% performance improvement on Pentium II operating at
- * 266MHz. I won't be surprised if the difference will be higher
- * on faster systems:-)
- *
- *                              <appro@fy.chalmers.se>
- */
-#define md4_block_data_order md4_block_host_order
-#endif
+void md4_block_data_order (MD4_CTX *c, const void *p,size_t num);
 
 #define DATA_ORDER_IS_LITTLE_ENDIAN
 
 #define HASH_LONG               MD4_LONG
-#define HASH_LONG_LOG2          MD4_LONG_LOG2
 #define HASH_CTX                MD4_CTX
 #define HASH_CBLOCK             MD4_CBLOCK
-#define HASH_LBLOCK             MD4_LBLOCK
 #define HASH_UPDATE             MD4_Update
 #define HASH_TRANSFORM          MD4_Transform
 #define HASH_FINAL              MD4_Final
@@ -110,21 +82,7 @@ void md4_block_data_order (MD4_CTX *c, const void *p,int num);
         ll=(c)->C; HOST_l2c(ll,(s));    \
         ll=(c)->D; HOST_l2c(ll,(s));    \
         } while (0)
-#define HASH_BLOCK_HOST_ORDER   md4_block_host_order
-#if !defined(L_ENDIAN) || defined(md4_block_data_order)
 #define HASH_BLOCK_DATA_ORDER   md4_block_data_order
-/*
- * Little-endians (Intel and Alpha) feel better without this.
- * It looks like memcpy does better job than generic
- * md4_block_data_order on copying-n-aligning input data.
- * But frankly speaking I didn't expect such result on Alpha.
- * On the other hand I've got this with egcs-1.0.2 and if
- * program is compiled with another (better?) compiler it
- * might turn out other way around.
- *
- *                              <appro@fy.chalmers.se>
- */
-#endif
 
 #include "md32_common.h"
 
diff --git a/src/lib/libssl/src/crypto/md4/md4_one.c b/src/lib/libssl/src/crypto/md4/md4_one.c
index 50f79352f6..bb64362638 100644
--- a/src/lib/libssl/src/crypto/md4/md4_one.c
+++ b/src/lib/libssl/src/crypto/md4/md4_one.c
@@ -65,7 +65,7 @@
 #include <openssl/ebcdic.h>
 #endif
 
-unsigned char *MD4(const unsigned char *d, unsigned long n, unsigned char *md)
+unsigned char *MD4(const unsigned char *d, size_t n, unsigned char *md)
         {
         MD4_CTX c;
         static unsigned char m[MD4_DIGEST_LENGTH];
diff --git a/src/lib/libssl/src/crypto/md4/md4test.c b/src/lib/libssl/src/crypto/md4/md4test.c
index 21a77d96f7..56591728a1 100644
--- a/src/lib/libssl/src/crypto/md4/md4test.c
+++ b/src/lib/libssl/src/crypto/md4/md4test.c
@@ -97,16 +97,16 @@ static char *pt(unsigned char *md);
 int main(int argc, char *argv[])
         {
         int i,err=0;
-        unsigned char **P,**R;
+        char **P,**R;
         char *p;
         unsigned char md[MD4_DIGEST_LENGTH];
 
-        P=(unsigned char **)test;
-        R=(unsigned char **)ret;
+        P=test;
+        R=ret;
         i=1;
         while (*P != NULL)
                 {
-                EVP_Digest(&(P[0][0]),(unsigned long)strlen((char *)*P),md,NULL,EVP_md4(), NULL);
+                EVP_Digest(&(P[0][0]),strlen((char *)*P),md,NULL,EVP_md4(), NULL);
                 p=pt(md);
                 if (strcmp(p,(char *)*R) != 0)
                         {
diff --git a/src/lib/libssl/src/crypto/md5/asm/md5-586.pl b/src/lib/libssl/src/crypto/md5/asm/md5-586.pl
index fa3fa3bed5..76ac235f7d 100644
--- a/src/lib/libssl/src/crypto/md5/asm/md5-586.pl
+++ b/src/lib/libssl/src/crypto/md5/asm/md5-586.pl
@@ -29,7 +29,7 @@ $X="esi";
  0, 7, 14, 5, 12, 3, 10, 1, 8, 15, 6, 13, 4, 11, 2, 9,  # R3
  );
 
-&md5_block("md5_block_asm_host_order");
+&md5_block("md5_block_asm_data_order");
 &asm_finish();
 
 sub Np
diff --git a/src/lib/libssl/src/crypto/md5/md5.h b/src/lib/libssl/src/crypto/md5/md5.h
index c663dd1816..dbdc0e1abc 100644
--- a/src/lib/libssl/src/crypto/md5/md5.h
+++ b/src/lib/libssl/src/crypto/md5/md5.h
@@ -60,6 +60,7 @@
 #define HEADER_MD5_H
 
 #include <openssl/e_os2.h>
+#include <stddef.h>
 
 #ifdef  __cplusplus
 extern "C" {
@@ -101,16 +102,13 @@ typedef struct MD5state_st
         MD5_LONG A,B,C,D;
         MD5_LONG Nl,Nh;
         MD5_LONG data[MD5_LBLOCK];
-        int num;
+        unsigned int num;
         } MD5_CTX;
 
-#ifdef OPENSSL_FIPS
-int private_MD5_Init(MD5_CTX *c);
-#endif
 int MD5_Init(MD5_CTX *c);
-int MD5_Update(MD5_CTX *c, const void *data, unsigned long len);
+int MD5_Update(MD5_CTX *c, const void *data, size_t len);
 int MD5_Final(unsigned char *md, MD5_CTX *c);
-unsigned char *MD5(const unsigned char *d, unsigned long n, unsigned char *md);
+unsigned char *MD5(const unsigned char *d, size_t n, unsigned char *md);
 void MD5_Transform(MD5_CTX *c, const unsigned char *b);
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/md5/md5_dgst.c b/src/lib/libssl/src/crypto/md5/md5_dgst.c
index 54b33c6509..b96e332ba4 100644
--- a/src/lib/libssl/src/crypto/md5/md5_dgst.c
+++ b/src/lib/libssl/src/crypto/md5/md5_dgst.c
@@ -60,7 +60,7 @@
 #include "md5_locl.h"
 #include <openssl/opensslv.h>
 
-const char *MD5_version="MD5" OPENSSL_VERSION_PTEXT;
+const char MD5_version[]="MD5" OPENSSL_VERSION_PTEXT;
 
 /* Implemented from RFC1321 The MD5 Message-Digest Algorithm
  */
@@ -70,7 +70,7 @@ const char *MD5_version="MD5" OPENSSL_VERSION_PTEXT;
 #define INIT_DATA_C (unsigned long)0x98badcfeL
 #define INIT_DATA_D (unsigned long)0x10325476L
 
-FIPS_NON_FIPS_MD_Init(MD5)
+int MD5_Init(MD5_CTX *c)
         {
         c->A=INIT_DATA_A;
         c->B=INIT_DATA_B;
@@ -82,101 +82,11 @@ FIPS_NON_FIPS_MD_Init(MD5)
         return 1;
         }
 
-#ifndef md5_block_host_order
-void md5_block_host_order (MD5_CTX *c, const void *data, int num)
-        {
-        const MD5_LONG *X=data;
-        register unsigned MD32_REG_T A,B,C,D;
-
-        A=c->A;
-        B=c->B;
-        C=c->C;
-        D=c->D;
-
-        for (;num--;X+=HASH_LBLOCK)
-                {
-        /* Round 0 */
-        R0(A,B,C,D,X[ 0], 7,0xd76aa478L);
-        R0(D,A,B,C,X[ 1],12,0xe8c7b756L);
-        R0(C,D,A,B,X[ 2],17,0x242070dbL);
-        R0(B,C,D,A,X[ 3],22,0xc1bdceeeL);
-        R0(A,B,C,D,X[ 4], 7,0xf57c0fafL);
-        R0(D,A,B,C,X[ 5],12,0x4787c62aL);
-        R0(C,D,A,B,X[ 6],17,0xa8304613L);
-        R0(B,C,D,A,X[ 7],22,0xfd469501L);
-        R0(A,B,C,D,X[ 8], 7,0x698098d8L);
-        R0(D,A,B,C,X[ 9],12,0x8b44f7afL);
-        R0(C,D,A,B,X[10],17,0xffff5bb1L);
-        R0(B,C,D,A,X[11],22,0x895cd7beL);
-        R0(A,B,C,D,X[12], 7,0x6b901122L);
-        R0(D,A,B,C,X[13],12,0xfd987193L);
-        R0(C,D,A,B,X[14],17,0xa679438eL);
-        R0(B,C,D,A,X[15],22,0x49b40821L);
-        /* Round 1 */
-        R1(A,B,C,D,X[ 1], 5,0xf61e2562L);
-        R1(D,A,B,C,X[ 6], 9,0xc040b340L);
-        R1(C,D,A,B,X[11],14,0x265e5a51L);
-        R1(B,C,D,A,X[ 0],20,0xe9b6c7aaL);
-        R1(A,B,C,D,X[ 5], 5,0xd62f105dL);
-        R1(D,A,B,C,X[10], 9,0x02441453L);
-        R1(C,D,A,B,X[15],14,0xd8a1e681L);
-        R1(B,C,D,A,X[ 4],20,0xe7d3fbc8L);
-        R1(A,B,C,D,X[ 9], 5,0x21e1cde6L);
-        R1(D,A,B,C,X[14], 9,0xc33707d6L);
-        R1(C,D,A,B,X[ 3],14,0xf4d50d87L);
-        R1(B,C,D,A,X[ 8],20,0x455a14edL);
-        R1(A,B,C,D,X[13], 5,0xa9e3e905L);
-        R1(D,A,B,C,X[ 2], 9,0xfcefa3f8L);
-        R1(C,D,A,B,X[ 7],14,0x676f02d9L);
-        R1(B,C,D,A,X[12],20,0x8d2a4c8aL);
-        /* Round 2 */
-        R2(A,B,C,D,X[ 5], 4,0xfffa3942L);
-        R2(D,A,B,C,X[ 8],11,0x8771f681L);
-        R2(C,D,A,B,X[11],16,0x6d9d6122L);
-        R2(B,C,D,A,X[14],23,0xfde5380cL);
-        R2(A,B,C,D,X[ 1], 4,0xa4beea44L);
-        R2(D,A,B,C,X[ 4],11,0x4bdecfa9L);
-        R2(C,D,A,B,X[ 7],16,0xf6bb4b60L);
-        R2(B,C,D,A,X[10],23,0xbebfbc70L);
-        R2(A,B,C,D,X[13], 4,0x289b7ec6L);
-        R2(D,A,B,C,X[ 0],11,0xeaa127faL);
-        R2(C,D,A,B,X[ 3],16,0xd4ef3085L);
-        R2(B,C,D,A,X[ 6],23,0x04881d05L);
-        R2(A,B,C,D,X[ 9], 4,0xd9d4d039L);
-        R2(D,A,B,C,X[12],11,0xe6db99e5L);
-        R2(C,D,A,B,X[15],16,0x1fa27cf8L);
-        R2(B,C,D,A,X[ 2],23,0xc4ac5665L);
-        /* Round 3 */
-        R3(A,B,C,D,X[ 0], 6,0xf4292244L);
-        R3(D,A,B,C,X[ 7],10,0x432aff97L);
-        R3(C,D,A,B,X[14],15,0xab9423a7L);
-        R3(B,C,D,A,X[ 5],21,0xfc93a039L);
-        R3(A,B,C,D,X[12], 6,0x655b59c3L);
-        R3(D,A,B,C,X[ 3],10,0x8f0ccc92L);
-        R3(C,D,A,B,X[10],15,0xffeff47dL);
-        R3(B,C,D,A,X[ 1],21,0x85845dd1L);
-        R3(A,B,C,D,X[ 8], 6,0x6fa87e4fL);
-        R3(D,A,B,C,X[15],10,0xfe2ce6e0L);
-        R3(C,D,A,B,X[ 6],15,0xa3014314L);
-        R3(B,C,D,A,X[13],21,0x4e0811a1L);
-        R3(A,B,C,D,X[ 4], 6,0xf7537e82L);
-        R3(D,A,B,C,X[11],10,0xbd3af235L);
-        R3(C,D,A,B,X[ 2],15,0x2ad7d2bbL);
-        R3(B,C,D,A,X[ 9],21,0xeb86d391L);
-
-        A = c->A += A;
-        B = c->B += B;
-        C = c->C += C;
-        D = c->D += D;
-                }
-        }
-#endif
-
 #ifndef md5_block_data_order
 #ifdef X
 #undef X
 #endif
-void md5_block_data_order (MD5_CTX *c, const void *data_, int num)
+void md5_block_data_order (MD5_CTX *c, const void *data_, size_t num)
         {
         const unsigned char *data=data_;
         register unsigned MD32_REG_T A,B,C,D,l;
@@ -274,19 +184,3 @@ void md5_block_data_order (MD5_CTX *c, const void *data_, int num)
                 }
         }
 #endif
-
-#ifdef undef
-int printit(unsigned long *l)
-        {
-        int i,ii;
-
-        for (i=0; i<2; i++)
-                {
-                for (ii=0; ii<8; ii++)
-                        {
-                        fprintf(stderr,"%08lx ",l[i*8+ii]);
-                        }
-                fprintf(stderr,"\n");
-                }
-        }
-#endif
diff --git a/src/lib/libssl/src/crypto/md5/md5_locl.h b/src/lib/libssl/src/crypto/md5/md5_locl.h
index 9e360da732..84e81b960d 100644
--- a/src/lib/libssl/src/crypto/md5/md5_locl.h
+++ b/src/lib/libssl/src/crypto/md5/md5_locl.h
@@ -66,49 +66,19 @@
 #endif
 
 #ifdef MD5_ASM
-# if defined(__i386) || defined(__i386__) || defined(_M_IX86) || defined(__INTEL__)
-#  define md5_block_host_order md5_block_asm_host_order
-# elif defined(__sparc) && defined(OPENSSL_SYS_ULTRASPARC)
-   void md5_block_asm_data_order_aligned (MD5_CTX *c, const MD5_LONG *p,int num);
-#  define HASH_BLOCK_DATA_ORDER_ALIGNED md5_block_asm_data_order_aligned
+# if defined(__i386) || defined(__i386__) || defined(_M_IX86) || defined(__INTEL__) || \
+     defined(__x86_64) || defined(__x86_64__) || defined(_M_AMD64) || defined(_M_X64)
+#  define md5_block_data_order md5_block_asm_data_order
 # endif
 #endif
 
-void md5_block_host_order (MD5_CTX *c, const void *p,int num);
-void md5_block_data_order (MD5_CTX *c, const void *p,int num);
-
-#if defined(__i386) || defined(__i386__) || defined(_M_IX86) || defined(__INTEL__)
-/*
- * *_block_host_order is expected to handle aligned data while
- * *_block_data_order - unaligned. As algorithm and host (x86)
- * are in this case of the same "endianness" these two are
- * otherwise indistinguishable. But normally you don't want to
- * call the same function because unaligned access in places
- * where alignment is expected is usually a "Bad Thing". Indeed,
- * on RISCs you get punished with BUS ERROR signal or *severe*
- * performance degradation. Intel CPUs are in turn perfectly
- * capable of loading unaligned data without such drastic side
- * effect. Yes, they say it's slower than aligned load, but no
- * exception is generated and therefore performance degradation
- * is *incomparable* with RISCs. What we should weight here is
- * costs of unaligned access against costs of aligning data.
- * According to my measurements allowing unaligned access results
- * in ~9% performance improvement on Pentium II operating at
- * 266MHz. I won't be surprised if the difference will be higher
- * on faster systems:-)
- *
- *                              <appro@fy.chalmers.se>
- */
-#define md5_block_data_order md5_block_host_order
-#endif
+void md5_block_data_order (MD5_CTX *c, const void *p,size_t num);
 
 #define DATA_ORDER_IS_LITTLE_ENDIAN
 
 #define HASH_LONG               MD5_LONG
-#define HASH_LONG_LOG2          MD5_LONG_LOG2
 #define HASH_CTX                MD5_CTX
 #define HASH_CBLOCK             MD5_CBLOCK
-#define HASH_LBLOCK             MD5_LBLOCK
 #define HASH_UPDATE             MD5_Update
 #define HASH_TRANSFORM          MD5_Transform
 #define HASH_FINAL              MD5_Final
@@ -119,21 +89,7 @@ void md5_block_data_order (MD5_CTX *c, const void *p,int num);
         ll=(c)->C; HOST_l2c(ll,(s));    \
         ll=(c)->D; HOST_l2c(ll,(s));    \
         } while (0)
-#define HASH_BLOCK_HOST_ORDER   md5_block_host_order
-#if !defined(L_ENDIAN) || defined(md5_block_data_order)
 #define HASH_BLOCK_DATA_ORDER   md5_block_data_order
-/*
- * Little-endians (Intel and Alpha) feel better without this.
- * It looks like memcpy does better job than generic
- * md5_block_data_order on copying-n-aligning input data.
- * But frankly speaking I didn't expect such result on Alpha.
- * On the other hand I've got this with egcs-1.0.2 and if
- * program is compiled with another (better?) compiler it
- * might turn out other way around.
- *
- *                              <appro@fy.chalmers.se>
- */
-#endif
 
 #include "md32_common.h"
 
diff --git a/src/lib/libssl/src/crypto/md5/md5_one.c b/src/lib/libssl/src/crypto/md5/md5_one.c
index 44c6c455d1..43fee89379 100644
--- a/src/lib/libssl/src/crypto/md5/md5_one.c
+++ b/src/lib/libssl/src/crypto/md5/md5_one.c
@@ -65,7 +65,7 @@
 #include <openssl/ebcdic.h>
 #endif
 
-unsigned char *MD5(const unsigned char *d, unsigned long n, unsigned char *md)
+unsigned char *MD5(const unsigned char *d, size_t n, unsigned char *md)
         {
         MD5_CTX c;
         static unsigned char m[MD5_DIGEST_LENGTH];
diff --git a/src/lib/libssl/src/crypto/md5/md5test.c b/src/lib/libssl/src/crypto/md5/md5test.c
index bfd62629ed..2b37190e32 100644
--- a/src/lib/libssl/src/crypto/md5/md5test.c
+++ b/src/lib/libssl/src/crypto/md5/md5test.c
@@ -97,16 +97,16 @@ static char *pt(unsigned char *md);
 int main(int argc, char *argv[])
         {
         int i,err=0;
-        unsigned char **P,**R;
+        char **P,**R;
         char *p;
         unsigned char md[MD5_DIGEST_LENGTH];
 
-        P=(unsigned char **)test;
-        R=(unsigned char **)ret;
+        P=test;
+        R=ret;
         i=1;
         while (*P != NULL)
                 {
-                EVP_Digest(&(P[0][0]),(unsigned long)strlen((char *)*P),md,NULL,EVP_md5(), NULL);
+                EVP_Digest(&(P[0][0]),strlen((char *)*P),md,NULL,EVP_md5(), NULL);
                 p=pt(md);
                 if (strcmp(p,(char *)*R) != 0)
                         {
@@ -120,6 +120,10 @@ int main(int argc, char *argv[])
                 R++;
                 P++;
                 }
+
+#ifdef OPENSSL_SYS_NETWARE
+    if (err) printf("ERROR: %d\n", err);
+#endif
         EXIT(err);
         return(0);
         }
diff --git a/src/lib/libssl/src/crypto/mdc2/Makefile b/src/lib/libssl/src/crypto/mdc2/Makefile
index b8e9a9a4fa..1d064f17a6 100644
--- a/src/lib/libssl/src/crypto/mdc2/Makefile
+++ b/src/lib/libssl/src/crypto/mdc2/Makefile
@@ -7,11 +7,6 @@ TOP=	../..
 CC=     cc
 INCLUDES=
 CFLAG=-g
-INSTALL_PREFIX=
-OPENSSLDIR=     /usr/local/ssl
-INSTALLTOP=/usr/local/ssl
-MAKEDEPPROG=    makedepend
-MAKEDEPEND=     $(TOP)/util/domd $(TOP) -MD $(MAKEDEPPROG)
 MAKEFILE=       Makefile
 AR=             ar r
 
@@ -51,6 +46,7 @@ links:
         @$(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
 
 install:
+        @[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
         @headerlist="$(EXHEADER)"; for i in $$headerlist ; \
         do  \
         (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
@@ -66,6 +62,7 @@ lint:
         lint -DLINT $(INCLUDES) $(SRC)>fluff
 
 depend:
+        @[ -n "$(MAKEDEPEND)" ] # should be set by upper Makefile...
         $(MAKEDEPEND) -- $(CFLAG) $(INCLUDES) $(DEPFLAG) -- $(PROGS) $(LIBSRC)
 
 dclean:
@@ -83,16 +80,14 @@ mdc2_one.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
 mdc2_one.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 mdc2_one.o: ../../include/openssl/lhash.h ../../include/openssl/mdc2.h
 mdc2_one.o: ../../include/openssl/opensslconf.h
-mdc2_one.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
-mdc2_one.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
-mdc2_one.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
-mdc2_one.o: ../cryptlib.h mdc2_one.c
-mdc2dgst.o: ../../include/openssl/bio.h ../../include/openssl/crypto.h
+mdc2_one.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+mdc2_one.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+mdc2_one.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
+mdc2_one.o: ../../include/openssl/ui_compat.h ../cryptlib.h mdc2_one.c
 mdc2dgst.o: ../../include/openssl/des.h ../../include/openssl/des_old.h
-mdc2dgst.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
-mdc2dgst.o: ../../include/openssl/fips.h ../../include/openssl/lhash.h
-mdc2dgst.o: ../../include/openssl/mdc2.h ../../include/openssl/opensslconf.h
-mdc2dgst.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+mdc2dgst.o: ../../include/openssl/e_os2.h ../../include/openssl/mdc2.h
+mdc2dgst.o: ../../include/openssl/opensslconf.h
+mdc2dgst.o: ../../include/openssl/ossl_typ.h ../../include/openssl/safestack.h
 mdc2dgst.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
 mdc2dgst.o: ../../include/openssl/ui.h ../../include/openssl/ui_compat.h
 mdc2dgst.o: mdc2dgst.c
diff --git a/src/lib/libssl/src/crypto/mdc2/mdc2.h b/src/lib/libssl/src/crypto/mdc2/mdc2.h
index 4cba101f37..72778a5212 100644
--- a/src/lib/libssl/src/crypto/mdc2/mdc2.h
+++ b/src/lib/libssl/src/crypto/mdc2/mdc2.h
@@ -74,19 +74,17 @@ extern "C" {
  
 typedef struct mdc2_ctx_st
         {
-        int num;
+        unsigned int num;
         unsigned char data[MDC2_BLOCK];
         DES_cblock h,hh;
         int pad_type; /* either 1 or 2, default 1 */
         } MDC2_CTX;
 
-#ifdef OPENSSL_FIPS
-int private_MDC2_Init(MDC2_CTX *c);
-#endif
+
 int MDC2_Init(MDC2_CTX *c);
-int MDC2_Update(MDC2_CTX *c, const unsigned char *data, unsigned long len);
+int MDC2_Update(MDC2_CTX *c, const unsigned char *data, size_t len);
 int MDC2_Final(unsigned char *md, MDC2_CTX *c);
-unsigned char *MDC2(const unsigned char *d, unsigned long n,
+unsigned char *MDC2(const unsigned char *d, size_t n,
         unsigned char *md);
 
 #ifdef  __cplusplus
diff --git a/src/lib/libssl/src/crypto/mem.c b/src/lib/libssl/src/crypto/mem.c
index dd86733b77..6635167228 100644
--- a/src/lib/libssl/src/crypto/mem.c
+++ b/src/lib/libssl/src/crypto/mem.c
@@ -324,8 +324,8 @@ void *CRYPTO_realloc(void *str, int num, const char *file, int line)
         if (str == NULL)
                 return CRYPTO_malloc(num, file, line);
 
-        if (num <= 0) return NULL;
- 
+        if (num <= 0) return NULL;
+
         if (realloc_debug_func != NULL)
                 realloc_debug_func(str, NULL, num, file, line, 0);
         ret = realloc_ex_func(str,num,file,line);
@@ -345,9 +345,9 @@ void *CRYPTO_realloc_clean(void *str, int old_len, int num, const char *file,
 
         if (str == NULL)
                 return CRYPTO_malloc(num, file, line);
- 
-        if (num <= 0) return NULL;
- 
+
+        if (num <= 0) return NULL;
+
         if (realloc_debug_func != NULL)
                 realloc_debug_func(str, NULL, num, file, line, 0);
         ret=malloc_ex_func(num,file,line);
diff --git a/src/lib/libssl/src/crypto/mem_dbg.c b/src/lib/libssl/src/crypto/mem_dbg.c
index e212de27e4..8316485217 100644
--- a/src/lib/libssl/src/crypto/mem_dbg.c
+++ b/src/lib/libssl/src/crypto/mem_dbg.c
@@ -59,11 +59,11 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <time.h>       
+#include "cryptlib.h"
 #include <openssl/crypto.h>
 #include <openssl/buffer.h>
 #include <openssl/bio.h>
 #include <openssl/lhash.h>
-#include "cryptlib.h"
 
 static int mh_mode=CRYPTO_MEM_CHECK_OFF;
 /* The state changes to CRYPTO_MEM_CHECK_ON | CRYPTO_MEM_CHECK_ENABLE
@@ -252,8 +252,16 @@ long CRYPTO_dbg_get_options(void)
 /* static int mem_cmp(MEM *a, MEM *b) */
 static int mem_cmp(const void *a_void, const void *b_void)
         {
+#ifdef _WIN64
+        const char *a=(const char *)((const MEM *)a_void)->addr,
+                   *b=(const char *)((const MEM *)b_void)->addr;
+        if (a==b)       return 0;
+        else if (a>b)   return 1;
+        else            return -1;
+#else
         return((const char *)((const MEM *)a_void)->addr
                 - (const char *)((const MEM *)b_void)->addr);
+#endif
         }
 
 /* static unsigned long mem_hash(MEM *a) */
diff --git a/src/lib/libssl/src/crypto/objects/o_names.c b/src/lib/libssl/src/crypto/objects/o_names.c
index 28c9370ca3..adb5731f76 100644
--- a/src/lib/libssl/src/crypto/objects/o_names.c
+++ b/src/lib/libssl/src/crypto/objects/o_names.c
@@ -111,8 +111,8 @@ int OBJ_NAME_new_index(unsigned long (*hash_func)(const char *),
 static int obj_name_cmp(const void *a_void, const void *b_void)
         {
         int ret;
-        OBJ_NAME *a = (OBJ_NAME *)a_void;
-        OBJ_NAME *b = (OBJ_NAME *)b_void;
+        const OBJ_NAME *a = (const OBJ_NAME *)a_void;
+        const OBJ_NAME *b = (const OBJ_NAME *)b_void;
 
         ret=a->type-b->type;
         if (ret == 0)
@@ -133,7 +133,7 @@ static int obj_name_cmp(const void *a_void, const void *b_void)
 static unsigned long obj_name_hash(const void *a_void)
         {
         unsigned long ret;
-        OBJ_NAME *a = (OBJ_NAME *)a_void;
+        const OBJ_NAME *a = (const OBJ_NAME *)a_void;
 
         if ((name_funcs_stack != NULL) && (sk_NAME_FUNCS_num(name_funcs_stack) > a->type))
                 {
diff --git a/src/lib/libssl/src/crypto/objects/obj_dat.c b/src/lib/libssl/src/crypto/objects/obj_dat.c
index f549d078ef..7fd7433241 100644
--- a/src/lib/libssl/src/crypto/objects/obj_dat.c
+++ b/src/lib/libssl/src/crypto/objects/obj_dat.c
@@ -58,10 +58,12 @@
 
 #include <stdio.h>
 #include <ctype.h>
+#include <limits.h>
 #include "cryptlib.h"
 #include <openssl/lhash.h>
 #include <openssl/asn1.h>
 #include <openssl/objects.h>
+#include <openssl/bn.h>
 
 /* obj_dat.h is generated from objects.h by obj_dat.pl */
 #ifndef OPENSSL_NO_OBJECT
@@ -115,7 +117,7 @@ static unsigned long add_hash(const void *ca_void)
         int i;
         unsigned long ret=0;
         unsigned char *p;
-        ADDED_OBJ *ca = (ADDED_OBJ *)ca_void;
+        const ADDED_OBJ *ca = (const ADDED_OBJ *)ca_void;
 
         a=ca->obj;
         switch (ca->type)
@@ -149,8 +151,8 @@ static int add_cmp(const void *ca_void, const void *cb_void)
         {
         ASN1_OBJECT *a,*b;
         int i;
-        ADDED_OBJ *ca = (ADDED_OBJ *)ca_void;
-        ADDED_OBJ *cb = (ADDED_OBJ *)cb_void;
+        const ADDED_OBJ *ca = (const ADDED_OBJ *)ca_void;
+        const ADDED_OBJ *cb = (const ADDED_OBJ *)cb_void;
 
         i=ca->type-cb->type;
         if (i) return(i);
@@ -161,7 +163,7 @@ static int add_cmp(const void *ca_void, const void *cb_void)
         case ADDED_DATA:
                 i=(a->length - b->length);
                 if (i) return(i);
-                return(memcmp(a->data,b->data,a->length));
+                return(memcmp(a->data,b->data,(size_t)a->length));
         case ADDED_SNAME:
                 if (a->sn == NULL) return(-1);
                 else if (b->sn == NULL) return(1);
@@ -382,8 +384,8 @@ int OBJ_obj2nid(const ASN1_OBJECT *a)
                 adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL) return (adp->obj->nid);
                 }
-        op=(ASN1_OBJECT **)OBJ_bsearch((char *)&a,(char *)obj_objs,NUM_OBJ,
-                sizeof(ASN1_OBJECT *),obj_cmp);
+        op=(ASN1_OBJECT **)OBJ_bsearch((const char *)&a,(const char *)obj_objs,
+                NUM_OBJ, sizeof(ASN1_OBJECT *),obj_cmp);
         if (op == NULL)
                 return(NID_undef);
         return((*op)->nid);
@@ -399,7 +401,9 @@ ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)
         {
         int nid = NID_undef;
         ASN1_OBJECT *op=NULL;
-        unsigned char *buf,*p;
+        unsigned char *buf;
+        unsigned char *p;
+        const unsigned char *cp;
         int i, j;
 
         if(!no_name) {
@@ -411,8 +415,8 @@ ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)
         /* Work out size of content octets */
         i=a2d_ASN1_OBJECT(NULL,0,s,-1);
         if (i <= 0) {
-                /* Clear the error */
-                ERR_get_error();
+                /* Don't clear the error */
+                /*ERR_clear_error();*/
                 return NULL;
         }
         /* Work out total size */
@@ -425,75 +429,170 @@ ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)
         ASN1_put_object(&p,0,i,V_ASN1_OBJECT,V_ASN1_UNIVERSAL);
         /* Write out contents */
         a2d_ASN1_OBJECT(p,i,s,-1);
-        
-        p=buf;
-        op=d2i_ASN1_OBJECT(NULL,&p,j);
+
+        cp=buf;
+        op=d2i_ASN1_OBJECT(NULL,&cp,j);
         OPENSSL_free(buf);
         return op;
         }
 
 int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
 {
-        int i,idx=0,n=0,len,nid;
+        int i,n=0,len,nid, first, use_bn;
+        BIGNUM *bl;
         unsigned long l;
         unsigned char *p;
-        const char *s;
         char tbuf[DECIMAL_SIZE(i)+DECIMAL_SIZE(l)+2];
 
-        if (buf_len <= 0) return(0);
-
         if ((a == NULL) || (a->data == NULL)) {
                 buf[0]='\0';
                 return(0);
         }
 
-        if (no_name || (nid=OBJ_obj2nid(a)) == NID_undef) {
-                len=a->length;
-                p=a->data;
 
-                idx=0;
-                l=0;
-                while (idx < a->length) {
-                        l|=(p[idx]&0x7f);
-                        if (!(p[idx] & 0x80)) break;
-                        l<<=7L;
-                        idx++;
+        if (!no_name && (nid=OBJ_obj2nid(a)) != NID_undef)
+                {
+                const char *s;
+                s=OBJ_nid2ln(nid);
+                if (s == NULL)
+                        s=OBJ_nid2sn(nid);
+                if (buf)
+                        BUF_strlcpy(buf,s,buf_len);
+                n=strlen(s);
+                return n;
                 }
-                idx++;
-                i=(int)(l/40);
-                if (i > 2) i=2;
-                l-=(long)(i*40);
-
-                BIO_snprintf(tbuf,sizeof tbuf,"%d.%lu",i,l);
-                i=strlen(tbuf);
-                BUF_strlcpy(buf,tbuf,buf_len);
-                buf_len-=i;
-                buf+=i;
-                n+=i;
 
+
+        len=a->length;
+        p=a->data;
+
+        first = 1;
+        bl = NULL;
+
+        while (len > 0)
+                {
                 l=0;
-                for (; idx<len; idx++) {
-                        l|=p[idx]&0x7f;
-                        if (!(p[idx] & 0x80)) {
-                                BIO_snprintf(tbuf,sizeof tbuf,".%lu",l);
-                                i=strlen(tbuf);
+                use_bn = 0;
+                for (;;)
+                        {
+                        unsigned char c = *p++;
+                        len--;
+                        if ((len == 0) && (c & 0x80))
+                                goto err;
+                        if (use_bn)
+                                {
+                                if (!BN_add_word(bl, c & 0x7f))
+                                        goto err;
+                                }
+                        else
+                                l |= c  & 0x7f;
+                        if (!(c & 0x80))
+                                break;
+                        if (!use_bn && (l > (ULONG_MAX >> 7L)))
+                                {
+                                if (!bl && !(bl = BN_new()))
+                                        goto err;
+                                if (!BN_set_word(bl, l))
+                                        goto err;
+                                use_bn = 1;
+                                }
+                        if (use_bn)
+                                {
+                                if (!BN_lshift(bl, bl, 7))
+                                        goto err;
+                                }
+                        else
+                                l<<=7L;
+                        }
+
+                if (first)
+                        {
+                        first = 0;
+                        if (l >= 80)
+                                {
+                                i = 2;
+                                if (use_bn)
+                                        {
+                                        if (!BN_sub_word(bl, 80))
+                                                goto err;
+                                        }
+                                else
+                                        l -= 80;
+                                }
+                        else
+                                {
+                                i=(int)(l/40);
+                                l-=(long)(i*40);
+                                }
+                        if (buf && (buf_len > 0))
+                                {
+                                *buf++ = i + '0';
+                                buf_len--;
+                                }
+                        n++;
+                        }
+
+                if (use_bn)
+                        {
+                        char *bndec;
+                        bndec = BN_bn2dec(bl);
+                        if (!bndec)
+                                goto err;
+                        i = strlen(bndec);
+                        if (buf)
+                                {
                                 if (buf_len > 0)
-                                        BUF_strlcpy(buf,tbuf,buf_len);
-                                buf_len-=i;
-                                buf+=i;
-                                n+=i;
-                                l=0;
+                                        {
+                                        *buf++ = '.';
+                                        buf_len--;
+                                        }
+                                BUF_strlcpy(buf,bndec,buf_len);
+                                if (i > buf_len)
+                                        {
+                                        buf += buf_len;
+                                        buf_len = 0;
+                                        }
+                                else
+                                        {
+                                        buf+=i;
+                                        buf_len-=i;
+                                        }
+                                }
+                        n++;
+                        n += i;
+                        OPENSSL_free(bndec);
+                        }
+                else
+                        {
+                        BIO_snprintf(tbuf,sizeof tbuf,".%lu",l);
+                        i=strlen(tbuf);
+                        if (buf && (buf_len > 0))
+                                {
+                                BUF_strlcpy(buf,tbuf,buf_len);
+                                if (i > buf_len)
+                                        {
+                                        buf += buf_len;
+                                        buf_len = 0;
+                                        }
+                                else
+                                        {
+                                        buf+=i;
+                                        buf_len-=i;
+                                        }
+                                }
+                        n+=i;
+                        l=0;
                         }
-                        l<<=7L;
                 }
-        } else {
-                s=OBJ_nid2ln(nid);
-                if (s == NULL)
-                        s=OBJ_nid2sn(nid);
-                BUF_strlcpy(buf,s,buf_len);
-                n=strlen(s);
-        }
-        return(n);
+
+        if (bl)
+                BN_free(bl);
+        return n;
+
+        err:
+        if (bl)
+                BN_free(bl);
+        return -1;
 }
 
 int OBJ_txt2nid(const char *s)
@@ -519,7 +618,7 @@ int OBJ_ln2nid(const char *s)
                 adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                 if (adp != NULL) return (adp->obj->nid);
                 }
-        op=(ASN1_OBJECT **)OBJ_bsearch((char *)&oo,(char *)ln_objs,NUM_LN,
+        op=(ASN1_OBJECT **)OBJ_bsearch((char *)&oo,(char *)ln_objs, NUM_LN,
                 sizeof(ASN1_OBJECT *),ln_cmp);
         if (op == NULL) return(NID_undef);
         return((*op)->nid);
@@ -547,8 +646,8 @@ int OBJ_sn2nid(const char *s)
 static int obj_cmp(const void *ap, const void *bp)
         {
         int j;
-        ASN1_OBJECT *a= *(ASN1_OBJECT **)ap;
-        ASN1_OBJECT *b= *(ASN1_OBJECT **)bp;
+        const ASN1_OBJECT *a= *(ASN1_OBJECT * const *)ap;
+        const ASN1_OBJECT *b= *(ASN1_OBJECT * const *)bp;
 
         j=(a->length - b->length);
         if (j) return(j);
@@ -558,8 +657,14 @@ static int obj_cmp(const void *ap, const void *bp)
 const char *OBJ_bsearch(const char *key, const char *base, int num, int size,
         int (*cmp)(const void *, const void *))
         {
-        int l,h,i,c;
-        const char *p;
+        return OBJ_bsearch_ex(key, base, num, size, cmp, 0);
+        }
+
+const char *OBJ_bsearch_ex(const char *key, const char *base, int num,
+        int size, int (*cmp)(const void *, const void *), int flags)
+        {
+        int l,h,i=0,c=0;
+        const char *p = NULL;
 
         if (num == 0) return(NULL);
         l=0;
@@ -574,20 +679,33 @@ const char *OBJ_bsearch(const char *key, const char *base, int num, int size,
                 else if (c > 0)
                         l=i+1;
                 else
-                        return(p);
+                        break;
                 }
 #ifdef CHARSET_EBCDIC
 /* THIS IS A KLUDGE - Because the *_obj is sorted in ASCII order, and
  * I don't have perl (yet), we revert to a *LINEAR* search
  * when the object wasn't found in the binary search.
  */
-        for (i=0; i<num; ++i) {
-                p= &(base[i*size]);
-                if ((*cmp)(key,p) == 0)
-                        return p;
-        }
+        if (c != 0)
+                {
+                for (i=0; i<num; ++i)
+                        {
+                        p= &(base[i*size]);
+                        c = (*cmp)(key,p);
+                        if (c == 0 || (c < 0 && (flags & OBJ_BSEARCH_VALUE_ON_NOMATCH)))
+                                return p;
+                        }
+                }
 #endif
-        return(NULL);
+        if (c != 0 && !(flags & OBJ_BSEARCH_VALUE_ON_NOMATCH))
+                p = NULL;
+        else if (c == 0 && (flags & OBJ_BSEARCH_FIRST_VALUE_ON_MATCH))
+                {
+                while(i > 0 && (*cmp)(key,&(base[(i-1)*size])) == 0)
+                        i--;
+                p = &(base[i*size]);
+                }
+        return(p);
         }
 
 int OBJ_create_objects(BIO *in)
diff --git a/src/lib/libssl/src/crypto/objects/obj_dat.pl b/src/lib/libssl/src/crypto/objects/obj_dat.pl
index d0371661f9..8a09a46ee6 100644
--- a/src/lib/libssl/src/crypto/objects/obj_dat.pl
+++ b/src/lib/libssl/src/crypto/objects/obj_dat.pl
@@ -94,7 +94,7 @@ for ($i=0; $i<$n; $i++)
         {
         if (!defined($nid{$i}))
                 {
-                push(@out,"{NULL,NULL,NID_undef,0,NULL},\n");
+                push(@out,"{NULL,NULL,NID_undef,0,NULL,0},\n");
                 }
         else
                 {
@@ -138,7 +138,7 @@ for ($i=0; $i<$n; $i++)
                         }
                 else
                         {
-                        $out.="0,NULL";
+                        $out.="0,NULL,0";
                         }
                 $out.="},\n";
                 push(@out,$out);
diff --git a/src/lib/libssl/src/crypto/objects/obj_err.c b/src/lib/libssl/src/crypto/objects/obj_err.c
index 0682979b38..12b48850c6 100644
--- a/src/lib/libssl/src/crypto/objects/obj_err.c
+++ b/src/lib/libssl/src/crypto/objects/obj_err.c
@@ -91,15 +91,12 @@ static ERR_STRING_DATA OBJ_str_reasons[]=
 
 void ERR_load_OBJ_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(OBJ_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,OBJ_str_functs);
                 ERR_load_strings(0,OBJ_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/objects/obj_lib.c b/src/lib/libssl/src/crypto/objects/obj_lib.c
index b0b0f2ff24..706fa0b0e7 100644
--- a/src/lib/libssl/src/crypto/objects/obj_lib.c
+++ b/src/lib/libssl/src/crypto/objects/obj_lib.c
@@ -82,7 +82,8 @@ ASN1_OBJECT *OBJ_dup(const ASN1_OBJECT *o)
         r->data=OPENSSL_malloc(o->length);
         if (r->data == NULL)
                 goto err;
-        memcpy(r->data,o->data,o->length);
+        if (o->data != NULL)
+                memcpy(r->data,o->data,o->length);
         r->length=o->length;
         r->nid=o->nid;
         r->ln=r->sn=NULL;
diff --git a/src/lib/libssl/src/crypto/objects/obj_mac.num b/src/lib/libssl/src/crypto/objects/obj_mac.num
index 84555d936e..47815b1e4e 100644
--- a/src/lib/libssl/src/crypto/objects/obj_mac.num
+++ b/src/lib/libssl/src/crypto/objects/obj_mac.num
@@ -673,3 +673,118 @@ sha256		672
 sha384          673
 sha512          674
 sha224          675
+identified_organization         676
+certicom_arc            677
+wap             678
+wap_wsg         679
+X9_62_id_characteristic_two_basis               680
+X9_62_onBasis           681
+X9_62_tpBasis           682
+X9_62_ppBasis           683
+X9_62_c2pnb163v1                684
+X9_62_c2pnb163v2                685
+X9_62_c2pnb163v3                686
+X9_62_c2pnb176v1                687
+X9_62_c2tnb191v1                688
+X9_62_c2tnb191v2                689
+X9_62_c2tnb191v3                690
+X9_62_c2onb191v4                691
+X9_62_c2onb191v5                692
+X9_62_c2pnb208w1                693
+X9_62_c2tnb239v1                694
+X9_62_c2tnb239v2                695
+X9_62_c2tnb239v3                696
+X9_62_c2onb239v4                697
+X9_62_c2onb239v5                698
+X9_62_c2pnb272w1                699
+X9_62_c2pnb304w1                700
+X9_62_c2tnb359v1                701
+X9_62_c2pnb368w1                702
+X9_62_c2tnb431r1                703
+secp112r1               704
+secp112r2               705
+secp128r1               706
+secp128r2               707
+secp160k1               708
+secp160r1               709
+secp160r2               710
+secp192k1               711
+secp224k1               712
+secp224r1               713
+secp256k1               714
+secp384r1               715
+secp521r1               716
+sect113r1               717
+sect113r2               718
+sect131r1               719
+sect131r2               720
+sect163k1               721
+sect163r1               722
+sect163r2               723
+sect193r1               724
+sect193r2               725
+sect233k1               726
+sect233r1               727
+sect239k1               728
+sect283k1               729
+sect283r1               730
+sect409k1               731
+sect409r1               732
+sect571k1               733
+sect571r1               734
+wap_wsg_idm_ecid_wtls1          735
+wap_wsg_idm_ecid_wtls3          736
+wap_wsg_idm_ecid_wtls4          737
+wap_wsg_idm_ecid_wtls5          738
+wap_wsg_idm_ecid_wtls6          739
+wap_wsg_idm_ecid_wtls7          740
+wap_wsg_idm_ecid_wtls8          741
+wap_wsg_idm_ecid_wtls9          742
+wap_wsg_idm_ecid_wtls10         743
+wap_wsg_idm_ecid_wtls11         744
+wap_wsg_idm_ecid_wtls12         745
+any_policy              746
+policy_mappings         747
+inhibit_any_policy              748
+ipsec3          749
+ipsec4          750
+camellia_128_cbc                751
+camellia_192_cbc                752
+camellia_256_cbc                753
+camellia_128_ecb                754
+camellia_192_ecb                755
+camellia_256_ecb                756
+camellia_128_cfb128             757
+camellia_192_cfb128             758
+camellia_256_cfb128             759
+camellia_128_cfb1               760
+camellia_192_cfb1               761
+camellia_256_cfb1               762
+camellia_128_cfb8               763
+camellia_192_cfb8               764
+camellia_256_cfb8               765
+camellia_128_ofb128             766
+camellia_192_ofb128             767
+camellia_256_ofb128             768
+subject_directory_attributes            769
+issuing_distribution_point              770
+certificate_issuer              771
+korea           772
+kisa            773
+kftc            774
+npki_alg                775
+seed_ecb                776
+seed_cbc                777
+seed_ofb128             778
+seed_cfb128             779
+hmac_md5                780
+hmac_sha1               781
+id_PasswordBasedMAC             782
+id_DHBasedMac           783
+id_it_suppLangTags              784
+caRepository            785
+id_smime_ct_compressedData              786
+id_ct_asciiTextWithCRLF         787
+id_aes128_wrap          788
+id_aes192_wrap          789
+id_aes256_wrap          790
diff --git a/src/lib/libssl/src/crypto/objects/objects.h b/src/lib/libssl/src/crypto/objects/objects.h
index f859d859b8..7242f76fb0 100644
--- a/src/lib/libssl/src/crypto/objects/objects.h
+++ b/src/lib/libssl/src/crypto/objects/objects.h
@@ -966,7 +966,10 @@
 #define OBJ_NAME_TYPE_COMP_METH         0x04
 #define OBJ_NAME_TYPE_NUM               0x05
 
-#define OBJ_NAME_ALIAS          0x8000
+#define OBJ_NAME_ALIAS                  0x8000
+
+#define OBJ_BSEARCH_VALUE_ON_NOMATCH            0x01
+#define OBJ_BSEARCH_FIRST_VALUE_ON_MATCH        0x02
 
 
 #ifdef  __cplusplus
@@ -1010,6 +1013,8 @@ int		OBJ_sn2nid(const char *s);
 int             OBJ_cmp(const ASN1_OBJECT *a,const ASN1_OBJECT *b);
 const char *    OBJ_bsearch(const char *key,const char *base,int num,int size,
         int (*cmp)(const void *, const void *));
+const char *    OBJ_bsearch_ex(const char *key,const char *base,int num,
+        int size, int (*cmp)(const void *, const void *), int flags);
 
 int             OBJ_new_nid(int num);
 int             OBJ_add_object(const ASN1_OBJECT *obj);
diff --git a/src/lib/libssl/src/crypto/objects/objects.txt b/src/lib/libssl/src/crypto/objects/objects.txt
index 2635c4e667..34c8d1d647 100644
--- a/src/lib/libssl/src/crypto/objects/objects.txt
+++ b/src/lib/libssl/src/crypto/objects/objects.txt
@@ -1,12 +1,28 @@
-0                       : CCITT                 : ccitt
+# CCITT was renamed to ITU-T quite some time ago
+0                       : ITU-T                 : itu-t
+!Alias ccitt itu-t
 
 1                       : ISO                   : iso
 
-2                       : JOINT-ISO-CCITT       : joint-iso-ccitt
+2                       : JOINT-ISO-ITU-T       : joint-iso-itu-t
+!Alias joint-iso-ccitt joint-iso-itu-t
 
 iso 2                   : member-body           : ISO Member Body
 
-joint-iso-ccitt 5 1 5   : selected-attribute-types      : Selected Attribute Types
+iso 3                   : identified-organization
+
+# HMAC OIDs
+identified-organization 6 1 5 5 8 1 1   : HMAC-MD5      : hmac-md5
+identified-organization 6 1 5 5 8 1 2   : HMAC-SHA1     : hmac-sha1
+
+identified-organization 132     : certicom-arc
+
+joint-iso-itu-t 23      : international-organizations   : International Organizations
+
+international-organizations 43  : wap
+wap 13                  : wap-wsg
+
+joint-iso-itu-t 5 1 5   : selected-attribute-types      : Selected Attribute Types
 
 selected-attribute-types 55     : clearance
 
@@ -24,12 +40,34 @@ ISO-US 10045		: ansi-X9-62		: ANSI X9.62
 !Alias id-fieldType ansi-X9-62 1
 X9-62_id-fieldType 1            : prime-field
 X9-62_id-fieldType 2            : characteristic-two-field
-# ... characteristic-two-field OID subtree
+X9-62_characteristic-two-field 3 : id-characteristic-two-basis
+X9-62_id-characteristic-two-basis 1 : onBasis
+X9-62_id-characteristic-two-basis 2 : tpBasis
+X9-62_id-characteristic-two-basis 3 : ppBasis
 !Alias id-publicKeyType ansi-X9-62 2
 X9-62_id-publicKeyType 1        : id-ecPublicKey
 !Alias ellipticCurve ansi-X9-62 3
 !Alias c-TwoCurve X9-62_ellipticCurve 0
-# ... characteristic 2 curve OIDs
+X9-62_c-TwoCurve 1              : c2pnb163v1
+X9-62_c-TwoCurve 2              : c2pnb163v2
+X9-62_c-TwoCurve 3              : c2pnb163v3
+X9-62_c-TwoCurve 4              : c2pnb176v1
+X9-62_c-TwoCurve 5              : c2tnb191v1
+X9-62_c-TwoCurve 6              : c2tnb191v2
+X9-62_c-TwoCurve 7              : c2tnb191v3
+X9-62_c-TwoCurve 8              : c2onb191v4
+X9-62_c-TwoCurve 9              : c2onb191v5
+X9-62_c-TwoCurve 10             : c2pnb208w1
+X9-62_c-TwoCurve 11             : c2tnb239v1
+X9-62_c-TwoCurve 12             : c2tnb239v2
+X9-62_c-TwoCurve 13             : c2tnb239v3
+X9-62_c-TwoCurve 14             : c2onb239v4
+X9-62_c-TwoCurve 15             : c2onb239v5
+X9-62_c-TwoCurve 16             : c2pnb272w1
+X9-62_c-TwoCurve 17             : c2pnb304w1
+X9-62_c-TwoCurve 18             : c2tnb359v1
+X9-62_c-TwoCurve 19             : c2pnb368w1
+X9-62_c-TwoCurve 20             : c2tnb431r1
 !Alias primeCurve X9-62_ellipticCurve 1
 X9-62_primeCurve 1              : prime192v1
 X9-62_primeCurve 2              : prime192v2
@@ -42,6 +80,60 @@ X9-62_primeCurve 7	 	: prime256v1
 !global
 X9-62_id-ecSigType 1            : ecdsa-with-SHA1
 
+# SECG curve OIDs from "SEC 2: Recommended Elliptic Curve Domain Parameters"
+# (http://www.secg.org/)
+!Alias secg_ellipticCurve certicom-arc 0
+# SECG prime curves OIDs
+secg-ellipticCurve 6            : secp112r1
+secg-ellipticCurve 7            : secp112r2
+secg-ellipticCurve 28           : secp128r1
+secg-ellipticCurve 29           : secp128r2
+secg-ellipticCurve 9            : secp160k1
+secg-ellipticCurve 8            : secp160r1
+secg-ellipticCurve 30           : secp160r2
+secg-ellipticCurve 31           : secp192k1
+# NOTE: the curve secp192r1 is the same as prime192v1 defined above
+#       and is therefore omitted
+secg-ellipticCurve 32           : secp224k1
+secg-ellipticCurve 33           : secp224r1
+secg-ellipticCurve 10           : secp256k1
+# NOTE: the curve secp256r1 is the same as prime256v1 defined above
+#       and is therefore omitted
+secg-ellipticCurve 34           : secp384r1
+secg-ellipticCurve 35           : secp521r1
+# SECG characteristic two curves OIDs
+secg-ellipticCurve 4            : sect113r1
+secg-ellipticCurve 5            : sect113r2
+secg-ellipticCurve 22           : sect131r1
+secg-ellipticCurve 23           : sect131r2
+secg-ellipticCurve 1            : sect163k1
+secg-ellipticCurve 2            : sect163r1
+secg-ellipticCurve 15           : sect163r2
+secg-ellipticCurve 24           : sect193r1
+secg-ellipticCurve 25           : sect193r2
+secg-ellipticCurve 26           : sect233k1
+secg-ellipticCurve 27           : sect233r1
+secg-ellipticCurve 3            : sect239k1
+secg-ellipticCurve 16           : sect283k1
+secg-ellipticCurve 17           : sect283r1
+secg-ellipticCurve 36           : sect409k1
+secg-ellipticCurve 37           : sect409r1
+secg-ellipticCurve 38           : sect571k1
+secg-ellipticCurve 39           : sect571r1
+
+# WAP/TLS curve OIDs (http://www.wapforum.org/)
+!Alias wap-wsg-idm-ecid wap-wsg 4
+wap-wsg-idm-ecid 1      : wap-wsg-idm-ecid-wtls1
+wap-wsg-idm-ecid 3      : wap-wsg-idm-ecid-wtls3
+wap-wsg-idm-ecid 4      : wap-wsg-idm-ecid-wtls4
+wap-wsg-idm-ecid 5      : wap-wsg-idm-ecid-wtls5
+wap-wsg-idm-ecid 6      : wap-wsg-idm-ecid-wtls6
+wap-wsg-idm-ecid 7      : wap-wsg-idm-ecid-wtls7
+wap-wsg-idm-ecid 8      : wap-wsg-idm-ecid-wtls8
+wap-wsg-idm-ecid 9      : wap-wsg-idm-ecid-wtls9
+wap-wsg-idm-ecid 10     : wap-wsg-idm-ecid-wtls10
+wap-wsg-idm-ecid 11     : wap-wsg-idm-ecid-wtls11
+wap-wsg-idm-ecid 12     : wap-wsg-idm-ecid-wtls12
 
 
 ISO-US 113533 7 66 10   : CAST5-CBC             : cast5-cbc
@@ -53,6 +145,10 @@ ISO-US 113533 7 66 10	: CAST5-CBC		: cast5-cbc
 !Cname pbeWithMD5AndCast5-CBC
 ISO-US 113533 7 66 12   :                       : pbeWithMD5AndCast5CBC
 
+# Macs for CMP and CRMF
+ISO-US 113533 7 66 13   : id-PasswordBasedMAC   : password based MAC
+ISO-US 113533 7 66 30   : id-DHBasedMac         : Diffie-Hellman based MAC
+
 ISO-US 113549           : rsadsi                : RSA Data Security, Inc.
 
 rsadsi 1                : pkcs                  : RSA Data Security, Inc. PKCS
@@ -149,6 +245,8 @@ id-smime-ct 5		: id-smime-ct-TDTInfo
 id-smime-ct 6           : id-smime-ct-contentInfo
 id-smime-ct 7           : id-smime-ct-DVCSRequestData
 id-smime-ct 8           : id-smime-ct-DVCSResponseData
+id-smime-ct 9           : id-smime-ct-compressedData
+id-smime-ct 27          : id-ct-asciiTextWithCRLF
 
 # S/MIME Attributes
 id-smime-aa 1           : id-smime-aa-receiptRequest
@@ -396,6 +494,7 @@ id-it 12		: id-it-revPassphrase
 id-it 13                : id-it-implicitConfirm
 id-it 14                : id-it-confirmWaitTime
 id-it 15                : id-it-origPKIMessage
+id-it 16                : id-it-suppLangTags
 
 # CRMF registration
 id-pkip 1               : id-regCtrl
@@ -482,6 +581,7 @@ id-ad 2			: caIssuers		: CA Issuers
 id-ad 3                 : ad_timestamping       : AD Time Stamping
 !Cname ad-dvcs
 id-ad 4                 : AD_DVCS               : ad dvcs
+id-ad 5                 : caRepository          : CA Repository
 
 
 !Alias id-pkix-OCSP ad-OCSP
@@ -569,6 +669,8 @@ X500algorithms 3 100	: RSA-MDC2		: mdc2WithRSA
 X500algorithms 3 101    : MDC2                  : mdc2
 
 X500 29                 : id-ce
+!Cname subject-directory-attributes
+id-ce 9                 : subjectDirectoryAttributes : X509v3 Subject Directory Attributes
 !Cname subject-key-identifier
 id-ce 14                : subjectKeyIdentifier  : X509v3 Subject Key Identifier
 !Cname key-usage
@@ -589,18 +691,28 @@ id-ce 21		: CRLReason		: X509v3 CRL Reason Code
 id-ce 24                : invalidityDate        : Invalidity Date
 !Cname delta-crl
 id-ce 27                : deltaCRL              : X509v3 Delta CRL Indicator
+!Cname issuing-distribution-point
+id-ce 28                : issuingDistributionPoint : X509v3 Issuing Distrubution Point
+!Cname certificate-issuer
+id-ce 29                : certificateIssuer     : X509v3 Certificate Issuer
 !Cname name-constraints
 id-ce 30                : nameConstraints       : X509v3 Name Constraints
 !Cname crl-distribution-points
 id-ce 31                : crlDistributionPoints : X509v3 CRL Distribution Points
 !Cname certificate-policies
 id-ce 32                : certificatePolicies   : X509v3 Certificate Policies
+!Cname any-policy
+certificate-policies 0  : anyPolicy             : X509v3 Any Policy
+!Cname policy-mappings
+id-ce 33                : policyMappings        : X509v3 Policy Mappings
 !Cname authority-key-identifier
 id-ce 35                : authorityKeyIdentifier : X509v3 Authority Key Identifier
 !Cname policy-constraints
 id-ce 36                : policyConstraints     : X509v3 Policy Constraints
 !Cname ext-key-usage
 id-ce 37                : extendedKeyUsage      : X509v3 Extended Key Usage
+!Cname inhibit-any-policy
+id-ce 54                : inhibitAnyPolicy      : X509v3 Inhibit Any Policy
 !Cname target-information
 id-ce 55                : targetInformation     : X509v3 AC Targeting
 !Cname no-rev-avail
@@ -668,7 +780,7 @@ mime-mhs-headings 2	: id-hex-multipart-message : id-hex-multipart-message
 !Cname rle-compression
 1 1 1 1 666 1           : RLE                   : run length compression
 !Cname zlib-compression
-1 1 1 1 666 2           : ZLIB                  : zlib compression
+id-smime-alg 8          : ZLIB                  : zlib compression
 
 # AES aka Rijndael
 
@@ -710,6 +822,10 @@ aes 44			: AES-256-CFB		: aes-256-cfb
                         : DES-EDE3-CFB1         : des-ede3-cfb1
                         : DES-EDE3-CFB8         : des-ede3-cfb8
 
+aes 5                   : id-aes128-wrap 
+aes 25                  : id-aes192-wrap 
+aes 45                  : id-aes256-wrap 
+
 # OIDs for SHA224, SHA256, SHA385 and SHA512, according to x9.84.
 !Alias nist_hashalgs nistAlgorithms 2
 nist_hashalgs 1         : SHA256                : sha256
@@ -728,9 +844,9 @@ holdInstruction 2	: holdInstructionCallIssuer : Hold Instruction Call Issuer
 !Cname hold-instruction-reject
 holdInstruction 3       : holdInstructionReject : Hold Instruction Reject
 
-# OID's from CCITT.  Most of this is defined in RFC 1274.  A couple of
+# OID's from ITU-T.  Most of this is defined in RFC 1274.  A couple of
 # them are also mentioned in RFC 2247
-ccitt 9                 : data
+itu-t 9                 : data
 data 2342               : pss
 pss 19200300            : ucl
 ucl 100                 : pilot
@@ -804,7 +920,7 @@ pilotAttributeType 54	:			: dITRedirect
 pilotAttributeType 55   : audio
 pilotAttributeType 56   :                       : documentPublisher
 
-2 23 42                 : id-set                : Secure Electronic Transactions
+international-organizations 42  : id-set        : Secure Electronic Transactions
 
 id-set 0                : set-ctype             : content types
 id-set 1                : set-msgExt            : message extensions
@@ -950,3 +1066,54 @@ set-brand 6011		: set-brand-Novus
 
 rsadsi 3 10             : DES-CDMF              : des-cdmf
 rsadsi 1 1 6            : rsaOAEPEncryptionSET
+
+                        : Oakley-EC2N-3         : ipsec3
+                        : Oakley-EC2N-4         : ipsec4
+
+
+# Definitions for Camellia cipher - CBC MODE
+1 2 392 200011 61 1 1 1 2 : CAMELLIA-128-CBC            : camellia-128-cbc
+1 2 392 200011 61 1 1 1 3 : CAMELLIA-192-CBC            : camellia-192-cbc
+1 2 392 200011 61 1 1 1 4 : CAMELLIA-256-CBC            : camellia-256-cbc
+
+# Definitions for Camellia cipher - ECB, CFB, OFB MODE
+!Alias ntt-ds 0 3 4401 5
+!Alias camellia ntt-ds 3 1 9 
+
+camellia 1              : CAMELLIA-128-ECB              : camellia-128-ecb
+!Cname camellia-128-ofb128
+camellia 3              : CAMELLIA-128-OFB              : camellia-128-ofb
+!Cname camellia-128-cfb128
+camellia 4              : CAMELLIA-128-CFB              : camellia-128-cfb
+
+camellia 21             : CAMELLIA-192-ECB              : camellia-192-ecb
+!Cname camellia-192-ofb128
+camellia 23             : CAMELLIA-192-OFB              : camellia-192-ofb
+!Cname camellia-192-cfb128
+camellia 24             : CAMELLIA-192-CFB              : camellia-192-cfb
+
+camellia 41             : CAMELLIA-256-ECB              : camellia-256-ecb
+!Cname camellia-256-ofb128
+camellia 43             : CAMELLIA-256-OFB              : camellia-256-ofb
+!Cname camellia-256-cfb128
+camellia 44             : CAMELLIA-256-CFB              : camellia-256-cfb
+
+# There are no OIDs for these modes...
+
+                        : CAMELLIA-128-CFB1             : camellia-128-cfb1
+                        : CAMELLIA-192-CFB1             : camellia-192-cfb1
+                        : CAMELLIA-256-CFB1             : camellia-256-cfb1
+                        : CAMELLIA-128-CFB8             : camellia-128-cfb8
+                        : CAMELLIA-192-CFB8             : camellia-192-cfb8
+                        : CAMELLIA-256-CFB8             : camellia-256-cfb8
+
+
+# Definitions for SEED cipher - ECB, CBC, OFB mode
+
+member-body 410 200004  : KISA          : kisa
+kisa 1 3                : SEED-ECB      : seed-ecb
+kisa 1 4                : SEED-CBC      : seed-cbc
+!Cname seed-cfb128
+kisa 1 5                : SEED-CFB      : seed-cfb
+!Cname seed-ofb128
+kisa 1 6                : SEED-OFB      : seed-ofb
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp.h b/src/lib/libssl/src/crypto/ocsp/ocsp.h
index fab3c03182..a0577a717e 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp.h
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp.h
@@ -186,11 +186,11 @@ typedef struct ocsp_resp_bytes_st
  *      responseStatus         OCSPResponseStatus,
  *      responseBytes          [0] EXPLICIT ResponseBytes OPTIONAL }
  */
-typedef struct ocsp_response_st
+struct ocsp_response_st
         {
         ASN1_ENUMERATED *responseStatus;
         OCSP_RESPBYTES  *responseBytes;
-        } OCSP_RESPONSE;
+        };
 
 /*   ResponderID ::= CHOICE {
  *      byName   [1] Name,
@@ -198,14 +198,18 @@ typedef struct ocsp_response_st
  */
 #define V_OCSP_RESPID_NAME 0
 #define V_OCSP_RESPID_KEY  1
-typedef struct ocsp_responder_id_st
+struct ocsp_responder_id_st
         {
         int type;
         union   {
                 X509_NAME* byName;
                 ASN1_OCTET_STRING *byKey;
                 } value;
-        } OCSP_RESPID;
+        };
+
+DECLARE_STACK_OF(OCSP_RESPID)
+DECLARE_ASN1_FUNCTIONS(OCSP_RESPID)
+
 /*   KeyHash ::= OCTET STRING --SHA-1 hash of responder's public key
  *                            --(excluding the tag and length fields)
  */
@@ -349,13 +353,9 @@ typedef struct ocsp_service_locator_st
 #define PEM_STRING_OCSP_REQUEST "OCSP REQUEST"
 #define PEM_STRING_OCSP_RESPONSE "OCSP RESPONSE"
 
-#define d2i_OCSP_REQUEST_bio(bp,p) (OCSP_REQUEST*)ASN1_d2i_bio((char*(*)()) \
-                OCSP_REQUEST_new,(char *(*)())d2i_OCSP_REQUEST, (bp),\
-                (unsigned char **)(p))
+#define d2i_OCSP_REQUEST_bio(bp,p) ASN1_d2i_bio_of(OCSP_REQUEST,OCSP_REQUEST_new,d2i_OCSP_REQUEST,bp,p)
 
-#define d2i_OCSP_RESPONSE_bio(bp,p) (OCSP_RESPONSE*)ASN1_d2i_bio((char*(*)())\
-                OCSP_REQUEST_new,(char *(*)())d2i_OCSP_RESPONSE, (bp),\
-                (unsigned char **)(p))
+#define d2i_OCSP_RESPONSE_bio(bp,p) ASN1_d2i_bio_of(OCSP_RESPONSE,OCSP_RESPONSE_new,d2i_OCSP_RESPONSE,bp,p)
 
 #define PEM_read_bio_OCSP_REQUEST(bp,x,cb) (OCSP_REQUEST *)PEM_ASN1_read_bio( \
      (char *(*)())d2i_OCSP_REQUEST,PEM_STRING_OCSP_REQUEST,bp,(char **)x,cb,NULL)
@@ -371,11 +371,9 @@ typedef struct ocsp_service_locator_st
     PEM_ASN1_write_bio((int (*)())i2d_OCSP_RESPONSE,PEM_STRING_OCSP_RESPONSE,\
                         bp,(char *)o, NULL,NULL,0,NULL,NULL)
 
-#define i2d_OCSP_RESPONSE_bio(bp,o) ASN1_i2d_bio(i2d_OCSP_RESPONSE,bp,\
-                (unsigned char *)o)
+#define i2d_OCSP_RESPONSE_bio(bp,o) ASN1_i2d_bio_of(OCSP_RESPONSE,i2d_OCSP_RESPONSE,bp,o)
 
-#define i2d_OCSP_REQUEST_bio(bp,o) ASN1_i2d_bio(i2d_OCSP_REQUEST,bp,\
-                (unsigned char *)o)
+#define i2d_OCSP_REQUEST_bio(bp,o) ASN1_i2d_bio_of(OCSP_REQUEST,i2d_OCSP_REQUEST,bp,o)
 
 #define OCSP_REQUEST_sign(o,pkey,md) \
         ASN1_item_sign(ASN1_ITEM_rptr(OCSP_REQINFO),\
@@ -396,14 +394,17 @@ typedef struct ocsp_service_locator_st
 #define ASN1_BIT_STRING_digest(data,type,md,len) \
         ASN1_item_digest(ASN1_ITEM_rptr(ASN1_BIT_STRING),type,data,md,len)
 
-#define OCSP_CERTID_dup(cid) (OCSP_CERTID*)ASN1_dup((int(*)())i2d_OCSP_CERTID,\
-                (char *(*)())d2i_OCSP_CERTID,(char *)(cid))
+#define OCSP_CERTID_dup(cid) ASN1_dup_of(OCSP_CERTID,i2d_OCSP_CERTID,d2i_OCSP_CERTID,cid)
 
 #define OCSP_CERTSTATUS_dup(cs)\
                 (OCSP_CERTSTATUS*)ASN1_dup((int(*)())i2d_OCSP_CERTSTATUS,\
                 (char *(*)())d2i_OCSP_CERTSTATUS,(char *)(cs))
 
 OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req);
+OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req,
+                                                                int maxline);
+int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx);
+void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx);
 
 OCSP_CERTID *OCSP_cert_to_id(const EVP_MD *dgst, X509 *subject, X509 *issuer);
 
@@ -473,8 +474,10 @@ int OCSP_basic_sign(OCSP_BASICRESP *brsp,
                         X509 *signer, EVP_PKEY *key, const EVP_MD *dgst,
                         STACK_OF(X509) *certs, unsigned long flags);
 
-ASN1_STRING *ASN1_STRING_encode(ASN1_STRING *s, int (*i2d)(), 
-                                char *data, STACK_OF(ASN1_OBJECT) *sk);
+ASN1_STRING *ASN1_STRING_encode(ASN1_STRING *s, i2d_of_void *i2d,
+                                void *data, STACK_OF(ASN1_OBJECT) *sk);
+#define ASN1_STRING_encode_of(type,s,i2d,data,sk) \
+        ASN1_STRING_encode(s, CHECKED_I2D_OF(type, i2d), data, sk)
 
 X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim);
 
@@ -564,11 +567,11 @@ void ERR_load_OCSP_strings(void);
 
 /* Function codes. */
 #define OCSP_F_ASN1_STRING_ENCODE                        100
-#define OCSP_F_CERT_ID_NEW                               101
 #define OCSP_F_D2I_OCSP_NONCE                            102
 #define OCSP_F_OCSP_BASIC_ADD1_STATUS                    103
 #define OCSP_F_OCSP_BASIC_SIGN                           104
 #define OCSP_F_OCSP_BASIC_VERIFY                         105
+#define OCSP_F_OCSP_CERT_ID_NEW                          101
 #define OCSP_F_OCSP_CHECK_DELEGATED                      106
 #define OCSP_F_OCSP_CHECK_IDS                            107
 #define OCSP_F_OCSP_CHECK_ISSUER                         108
@@ -579,6 +582,7 @@ void ERR_load_OCSP_strings(void);
 #define OCSP_F_OCSP_REQUEST_VERIFY                       116
 #define OCSP_F_OCSP_RESPONSE_GET1_BASIC                  111
 #define OCSP_F_OCSP_SENDREQ_BIO                          112
+#define OCSP_F_PARSE_HTTP_LINE1                          117
 #define OCSP_F_REQUEST_VERIFY                            113
 
 /* Reason codes. */
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_asn.c b/src/lib/libssl/src/crypto/ocsp/ocsp_asn.c
index 6a3a360d54..39b7a1c568 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_asn.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_asn.c
@@ -62,7 +62,7 @@
 ASN1_SEQUENCE(OCSP_SIGNATURE) = {
         ASN1_SIMPLE(OCSP_SIGNATURE, signatureAlgorithm, X509_ALGOR),
         ASN1_SIMPLE(OCSP_SIGNATURE, signature, ASN1_BIT_STRING),
-        ASN1_EXP_SEQUENCE_OF(OCSP_SIGNATURE, certs, X509, 0)
+        ASN1_EXP_SEQUENCE_OF_OPT(OCSP_SIGNATURE, certs, X509, 0)
 } ASN1_SEQUENCE_END(OCSP_SIGNATURE)
 
 IMPLEMENT_ASN1_FUNCTIONS(OCSP_SIGNATURE)
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_cl.c b/src/lib/libssl/src/crypto/ocsp/ocsp_cl.c
index 9b3e6dd8ca..17bab5fc59 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_cl.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_cl.c
@@ -101,6 +101,8 @@ int OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm)
         {
         GENERAL_NAME *gen;
         gen = GENERAL_NAME_new();
+        if (gen == NULL)
+                return 0;
         if (!X509_NAME_set(&gen->d.directoryName, nm))
                 {
                 GENERAL_NAME_free(gen);
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_err.c b/src/lib/libssl/src/crypto/ocsp/ocsp_err.c
index 65e6093fbc..d2f2e79f44 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_err.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_err.c
@@ -1,6 +1,6 @@
 /* crypto/ocsp/ocsp_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -71,11 +71,11 @@
 static ERR_STRING_DATA OCSP_str_functs[]=
         {
 {ERR_FUNC(OCSP_F_ASN1_STRING_ENCODE),   "ASN1_STRING_encode"},
-{ERR_FUNC(OCSP_F_CERT_ID_NEW),  "CERT_ID_NEW"},
 {ERR_FUNC(OCSP_F_D2I_OCSP_NONCE),       "D2I_OCSP_NONCE"},
 {ERR_FUNC(OCSP_F_OCSP_BASIC_ADD1_STATUS),       "OCSP_basic_add1_status"},
 {ERR_FUNC(OCSP_F_OCSP_BASIC_SIGN),      "OCSP_basic_sign"},
 {ERR_FUNC(OCSP_F_OCSP_BASIC_VERIFY),    "OCSP_basic_verify"},
+{ERR_FUNC(OCSP_F_OCSP_CERT_ID_NEW),     "OCSP_cert_id_new"},
 {ERR_FUNC(OCSP_F_OCSP_CHECK_DELEGATED), "OCSP_CHECK_DELEGATED"},
 {ERR_FUNC(OCSP_F_OCSP_CHECK_IDS),       "OCSP_CHECK_IDS"},
 {ERR_FUNC(OCSP_F_OCSP_CHECK_ISSUER),    "OCSP_CHECK_ISSUER"},
@@ -86,6 +86,7 @@ static ERR_STRING_DATA OCSP_str_functs[]=
 {ERR_FUNC(OCSP_F_OCSP_REQUEST_VERIFY),  "OCSP_request_verify"},
 {ERR_FUNC(OCSP_F_OCSP_RESPONSE_GET1_BASIC),     "OCSP_response_get1_basic"},
 {ERR_FUNC(OCSP_F_OCSP_SENDREQ_BIO),     "OCSP_sendreq_bio"},
+{ERR_FUNC(OCSP_F_PARSE_HTTP_LINE1),     "PARSE_HTTP_LINE1"},
 {ERR_FUNC(OCSP_F_REQUEST_VERIFY),       "REQUEST_VERIFY"},
 {0,NULL}
         };
@@ -129,15 +130,12 @@ static ERR_STRING_DATA OCSP_str_reasons[]=
 
 void ERR_load_OCSP_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(OCSP_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,OCSP_str_functs);
                 ERR_load_strings(0,OCSP_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_ext.c b/src/lib/libssl/src/crypto/ocsp/ocsp_ext.c
index 57399433fc..815cc29d58 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_ext.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_ext.c
@@ -265,8 +265,8 @@ int OCSP_SINGLERESP_add_ext(OCSP_SINGLERESP *x, X509_EXTENSION *ex, int loc)
 
 /* also CRL Entry Extensions */
 
-ASN1_STRING *ASN1_STRING_encode(ASN1_STRING *s, int (*i2d)(), 
-                                char *data, STACK_OF(ASN1_OBJECT) *sk)
+ASN1_STRING *ASN1_STRING_encode(ASN1_STRING *s, i2d_of_void *i2d,
+                                void *data, STACK_OF(ASN1_OBJECT) *sk)
         {
         int i;
         unsigned char *p, *b = NULL;
@@ -274,18 +274,23 @@ ASN1_STRING *ASN1_STRING_encode(ASN1_STRING *s, int (*i2d)(),
         if (data)
                 {
                 if ((i=i2d(data,NULL)) <= 0) goto err;
-                if (!(b=p=(unsigned char*)OPENSSL_malloc((unsigned int)i)))
+                if (!(b=p=OPENSSL_malloc((unsigned int)i)))
                         goto err;
                 if (i2d(data, &p) <= 0) goto err;
                 }
         else if (sk)
                 {
-                if ((i=i2d_ASN1_SET_OF_ASN1_OBJECT(sk,NULL,i2d,V_ASN1_SEQUENCE,
-                                   V_ASN1_UNIVERSAL,IS_SEQUENCE))<=0) goto err;
-                if (!(b=p=(unsigned char*)OPENSSL_malloc((unsigned int)i)))
+                if ((i=i2d_ASN1_SET_OF_ASN1_OBJECT(sk,NULL,
+                                                   (I2D_OF(ASN1_OBJECT))i2d,
+                                                   V_ASN1_SEQUENCE,
+                                                   V_ASN1_UNIVERSAL,
+                                                   IS_SEQUENCE))<=0) goto err;
+                if (!(b=p=OPENSSL_malloc((unsigned int)i)))
                         goto err;
-                if (i2d_ASN1_SET_OF_ASN1_OBJECT(sk,&p,i2d,V_ASN1_SEQUENCE,
-                                 V_ASN1_UNIVERSAL,IS_SEQUENCE)<=0) goto err;
+                if (i2d_ASN1_SET_OF_ASN1_OBJECT(sk,&p,(I2D_OF(ASN1_OBJECT))i2d,
+                                                V_ASN1_SEQUENCE,
+                                                V_ASN1_UNIVERSAL,
+                                                IS_SEQUENCE)<=0) goto err;
                 }
         else
                 {
@@ -439,7 +444,8 @@ X509_EXTENSION *OCSP_crlID_new(char *url, long *n, char *tim)
                 }
         if (!(x = X509_EXTENSION_new())) goto err;
         if (!(x->object = OBJ_nid2obj(NID_id_pkix_OCSP_CrlID))) goto err;
-        if (!(ASN1_STRING_encode(x->value,i2d_OCSP_CRLID,(char*)cid,NULL)))
+        if (!(ASN1_STRING_encode_of(OCSP_CRLID,x->value,i2d_OCSP_CRLID,cid,
+                                    NULL)))
                 goto err;
         OCSP_CRLID_free(cid);
         return x;
@@ -467,7 +473,8 @@ X509_EXTENSION *OCSP_accept_responses_new(char **oids)
         if (!(x = X509_EXTENSION_new())) goto err;
         if (!(x->object = OBJ_nid2obj(NID_id_pkix_OCSP_acceptableResponses)))
                 goto err;
-        if (!(ASN1_STRING_encode(x->value,i2d_ASN1_OBJECT,NULL,sk)))
+        if (!(ASN1_STRING_encode_of(ASN1_OBJECT,x->value,i2d_ASN1_OBJECT,NULL,
+                                    sk)))
                 goto err;
         sk_ASN1_OBJECT_pop_free(sk, ASN1_OBJECT_free);
         return x;
@@ -487,8 +494,8 @@ X509_EXTENSION *OCSP_archive_cutoff_new(char* tim)
         if (!(ASN1_GENERALIZEDTIME_set_string(gt, tim))) goto err;
         if (!(x = X509_EXTENSION_new())) goto err;
         if (!(x->object=OBJ_nid2obj(NID_id_pkix_OCSP_archiveCutoff)))goto err;
-        if (!(ASN1_STRING_encode(x->value,i2d_ASN1_GENERALIZEDTIME,
-                                 (char*)gt,NULL))) goto err;
+        if (!(ASN1_STRING_encode_of(ASN1_GENERALIZEDTIME,x->value,
+                                    i2d_ASN1_GENERALIZEDTIME,gt,NULL))) goto err;
         ASN1_GENERALIZEDTIME_free(gt);
         return x;
 err:
@@ -526,8 +533,8 @@ X509_EXTENSION *OCSP_url_svcloc_new(X509_NAME* issuer, char **urls)
         if (!(x = X509_EXTENSION_new())) goto err;
         if (!(x->object = OBJ_nid2obj(NID_id_pkix_OCSP_serviceLocator))) 
                 goto err;
-        if (!(ASN1_STRING_encode(x->value, i2d_OCSP_SERVICELOC,
-                                 (char*)sloc, NULL))) goto err;
+        if (!(ASN1_STRING_encode_of(OCSP_SERVICELOC,x->value,
+                                    i2d_OCSP_SERVICELOC,sloc,NULL))) goto err;
         OCSP_SERVICELOC_free(sloc);
         return x;
 err:
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_ht.c b/src/lib/libssl/src/crypto/ocsp/ocsp_ht.c
index 2c48171883..a8e569b74a 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_ht.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_ht.c
@@ -1,9 +1,9 @@
 /* ocsp_ht.c */
 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
- * project 2000.
+ * project 2006.
  */
 /* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -68,106 +68,404 @@
 #define strtoul (unsigned long)strtol
 #endif /* OPENSSL_SYS_SUNOS */
 
-/* Quick and dirty HTTP OCSP request handler.
- * Could make this a bit cleverer by adding
- * support for non blocking BIOs and a few
- * other refinements.
- */
+/* Stateful OCSP request code, supporting non-blocking I/O */
 
-OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req)
-{
-        BIO *mem = NULL;
-        char tmpbuf[1024];
-        OCSP_RESPONSE *resp = NULL;
-        char *p, *q, *r;
-        int len, retcode;
-        static char req_txt[] =
-"POST %s HTTP/1.0\r\n\
-Content-Type: application/ocsp-request\r\n\
-Content-Length: %d\r\n\r\n";
-
-        len = i2d_OCSP_REQUEST(req, NULL);
-        if(BIO_printf(b, req_txt, path, len) < 0) {
-                OCSPerr(OCSP_F_OCSP_SENDREQ_BIO,OCSP_R_SERVER_WRITE_ERROR);
-                goto err;
-        }
-        if(i2d_OCSP_REQUEST_bio(b, req) <= 0) {
-                OCSPerr(OCSP_F_OCSP_SENDREQ_BIO,OCSP_R_SERVER_WRITE_ERROR);
-                goto err;
+/* Opaque OCSP request status structure */
+
+struct ocsp_req_ctx_st {
+        int state;              /* Current I/O state */
+        unsigned char *iobuf;   /* Line buffer */
+        int iobuflen;           /* Line buffer length */
+        BIO *io;                /* BIO to perform I/O with */
+        BIO *mem;               /* Memory BIO response is built into */
+        unsigned long asn1_len; /* ASN1 length of response */
+        };
+
+#define OCSP_MAX_REQUEST_LENGTH (100 * 1024)
+#define OCSP_MAX_LINE_LEN       4096;
+
+/* OCSP states */
+
+/* If set no reading should be performed */
+#define OHS_NOREAD              0x1000
+/* Error condition */
+#define OHS_ERROR               (0 | OHS_NOREAD)
+/* First line being read */
+#define OHS_FIRSTLINE           1
+/* MIME headers being read */
+#define OHS_HEADERS             2
+/* OCSP initial header (tag + length) being read */
+#define OHS_ASN1_HEADER         3
+/* OCSP content octets being read */
+#define OHS_ASN1_CONTENT        4
+/* Request being sent */
+#define OHS_ASN1_WRITE          (6 | OHS_NOREAD)
+/* Request being flushed */
+#define OHS_ASN1_FLUSH          (7 | OHS_NOREAD)
+/* Completed */
+#define OHS_DONE                (8 | OHS_NOREAD)
+
+
+static int parse_http_line1(char *line);
+
+void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx)
+        {
+        if (rctx->mem)
+                BIO_free(rctx->mem);
+        if (rctx->iobuf)
+                OPENSSL_free(rctx->iobuf);
+        OPENSSL_free(rctx);
         }
-        if(!(mem = BIO_new(BIO_s_mem()))) goto err;
-        /* Copy response to a memory BIO: socket bios can't do gets! */
-        while ((len = BIO_read(b, tmpbuf, sizeof tmpbuf))) {
-                if(len < 0) {
-                        OCSPerr(OCSP_F_OCSP_SENDREQ_BIO,OCSP_R_SERVER_READ_ERROR);
-                        goto err;
+
+OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, char *path, OCSP_REQUEST *req,
+                                                                int maxline)
+        {
+        static char post_hdr[] = "POST %s HTTP/1.0\r\n"
+        "Content-Type: application/ocsp-request\r\n"
+        "Content-Length: %d\r\n\r\n";
+
+        OCSP_REQ_CTX *rctx;
+        rctx = OPENSSL_malloc(sizeof(OCSP_REQ_CTX));
+        rctx->state = OHS_FIRSTLINE;
+        rctx->mem = BIO_new(BIO_s_mem());
+        rctx->io = io;
+        if (maxline > 0)
+                rctx->iobuflen = maxline;
+        else
+                rctx->iobuflen = OCSP_MAX_LINE_LEN;
+        rctx->iobuf = OPENSSL_malloc(rctx->iobuflen);
+        if (!path)
+                path = "/";
+
+        if (BIO_printf(rctx->mem, post_hdr, path,
+                                i2d_OCSP_REQUEST(req, NULL)) <= 0)
+                {
+                rctx->state = OHS_ERROR;
+                return 0;
                 }
-                BIO_write(mem, tmpbuf, len);
-        }
-        if(BIO_gets(mem, tmpbuf, 512) <= 0) {
-                OCSPerr(OCSP_F_OCSP_SENDREQ_BIO,OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
-                goto err;
+        if (i2d_OCSP_REQUEST_bio(rctx->mem, req) <= 0)
+                {
+                rctx->state = OHS_ERROR;
+                return 0;
+                }
+        rctx->state = OHS_ASN1_WRITE;
+        rctx->asn1_len = BIO_get_mem_data(rctx->mem, NULL);
+
+        return rctx;
         }
-        /* Parse the HTTP response. This will look like this:
-         * "HTTP/1.0 200 OK". We need to obtain the numeric code and
-         * (optional) informational message.
-         */
 
+/* Parse the HTTP response. This will look like this:
+ * "HTTP/1.0 200 OK". We need to obtain the numeric code and
+ * (optional) informational message.
+ */
+
+static int parse_http_line1(char *line)
+        {
+        int retcode;
+        char *p, *q, *r;
         /* Skip to first white space (passed protocol info) */
-        for(p = tmpbuf; *p && !isspace((unsigned char)*p); p++) continue;
-        if(!*p) {
-                OCSPerr(OCSP_F_OCSP_SENDREQ_BIO,OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
-                goto err;
-        }
+
+        for(p = line; *p && !isspace((unsigned char)*p); p++)
+                continue;
+        if(!*p)
+                {
+                OCSPerr(OCSP_F_PARSE_HTTP_LINE1,
+                                        OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
+                return 0;
+                }
+
         /* Skip past white space to start of response code */
-        while(isspace((unsigned char)*p)) p++;
-        if(!*p) {
-                OCSPerr(OCSP_F_OCSP_SENDREQ_BIO,OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
-                goto err;
-        }
+        while(*p && isspace((unsigned char)*p))
+                p++;
+
+        if(!*p)
+                {
+                OCSPerr(OCSP_F_PARSE_HTTP_LINE1,
+                                        OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
+                return 0;
+                }
+
         /* Find end of response code: first whitespace after start of code */
-        for(q = p; *q && !isspace((unsigned char)*q); q++) continue;
-        if(!*q) {
-                OCSPerr(OCSP_F_OCSP_SENDREQ_BIO,OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
-                goto err;
-        }
+        for(q = p; *q && !isspace((unsigned char)*q); q++)
+                continue;
+
+        if(!*q)
+                {
+                OCSPerr(OCSP_F_PARSE_HTTP_LINE1,
+                                        OCSP_R_SERVER_RESPONSE_PARSE_ERROR);
+                return 0;
+                }
+
         /* Set end of response code and start of message */ 
         *q++ = 0;
+
         /* Attempt to parse numeric code */
         retcode = strtoul(p, &r, 10);
-        if(*r) goto err;
+
+        if(*r)
+                return 0;
+
         /* Skip over any leading white space in message */
-        while(isspace((unsigned char)*q))  q++;
-        if(*q) {
-        /* Finally zap any trailing white space in message (include CRLF) */
-        /* We know q has a non white space character so this is OK */
-                for(r = q + strlen(q) - 1; isspace((unsigned char)*r); r--) *r = 0;
-        }
-        if(retcode != 200) {
-                OCSPerr(OCSP_F_OCSP_SENDREQ_BIO,OCSP_R_SERVER_RESPONSE_ERROR);
-                if(!*q) { 
-                        ERR_add_error_data(2, "Code=", p);
+        while(*q && isspace((unsigned char)*q))
+                q++;
+
+        if(*q)
+                {
+                /* Finally zap any trailing white space in message (include
+                 * CRLF) */
+
+                /* We know q has a non white space character so this is OK */
+                for(r = q + strlen(q) - 1; isspace((unsigned char)*r); r--)
+                        *r = 0;
                 }
-                else {
+        if(retcode != 200)
+                {
+                OCSPerr(OCSP_F_PARSE_HTTP_LINE1, OCSP_R_SERVER_RESPONSE_ERROR);
+                if(!*q)
+                        ERR_add_error_data(2, "Code=", p);
+                else
                         ERR_add_error_data(4, "Code=", p, ",Reason=", q);
+                return 0;
                 }
-                goto err;
+
+
+        return 1;
+
         }
-        /* Find blank line marking beginning of content */      
-        while(BIO_gets(mem, tmpbuf, 512) > 0)
+
+int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx)
         {
-                for(p = tmpbuf; isspace((unsigned char)*p); p++) continue;
-                if(!*p) break;
-        }
-        if(*p) {
-                OCSPerr(OCSP_F_OCSP_SENDREQ_BIO,OCSP_R_NO_CONTENT);
-                goto err;
+        int i, n;
+        const unsigned char *p;
+        next_io:
+        if (!(rctx->state & OHS_NOREAD))
+                {
+                n = BIO_read(rctx->io, rctx->iobuf, rctx->iobuflen);
+
+                if (n <= 0)
+                        {
+                        if (BIO_should_retry(rctx->io))
+                                return -1;
+                        return 0;
+                        }
+
+                /* Write data to memory BIO */
+
+                if (BIO_write(rctx->mem, rctx->iobuf, n) != n)
+                        return 0;
+                }
+
+        switch(rctx->state)
+                {
+
+                case OHS_ASN1_WRITE:
+                n = BIO_get_mem_data(rctx->mem, &p);
+
+                i = BIO_write(rctx->io,
+                        p + (n - rctx->asn1_len), rctx->asn1_len);
+
+                if (i <= 0)
+                        {
+                        if (BIO_should_retry(rctx->io))
+                                return -1;
+                        rctx->state = OHS_ERROR;
+                        return 0;
+                        }
+
+                rctx->asn1_len -= i;
+
+                if (rctx->asn1_len > 0)
+                        goto next_io;
+
+                rctx->state = OHS_ASN1_FLUSH;
+
+                (void)BIO_reset(rctx->mem);
+
+                case OHS_ASN1_FLUSH:
+
+                i = BIO_flush(rctx->io);
+
+                if (i > 0)
+                        {
+                        rctx->state = OHS_FIRSTLINE;
+                        goto next_io;
+                        }
+
+                if (BIO_should_retry(rctx->io))
+                        return -1;
+
+                rctx->state = OHS_ERROR;
+                return 0;
+
+                case OHS_ERROR:
+                return 0;
+
+                case OHS_FIRSTLINE:
+                case OHS_HEADERS:
+
+                /* Attempt to read a line in */
+
+                next_line:
+                /* Due to &%^*$" memory BIO behaviour with BIO_gets we
+                 * have to check there's a complete line in there before
+                 * calling BIO_gets or we'll just get a partial read.
+                 */
+                n = BIO_get_mem_data(rctx->mem, &p);
+                if ((n <= 0) || !memchr(p, '\n', n))
+                        {
+                        if (n >= rctx->iobuflen)
+                                {
+                                rctx->state = OHS_ERROR;
+                                return 0;
+                                }
+                        goto next_io;
+                        }
+                n = BIO_gets(rctx->mem, (char *)rctx->iobuf, rctx->iobuflen);
+
+                if (n <= 0)
+                        {
+                        if (BIO_should_retry(rctx->mem))
+                                goto next_io;
+                        rctx->state = OHS_ERROR;
+                        return 0;
+                        }
+
+                /* Don't allow excessive lines */
+                if (n == rctx->iobuflen)
+                        {
+                        rctx->state = OHS_ERROR;
+                        return 0;
+                        }
+
+                /* First line */
+                if (rctx->state == OHS_FIRSTLINE)
+                        {
+                        if (parse_http_line1((char *)rctx->iobuf))
+                                {
+                                rctx->state = OHS_HEADERS;
+                                goto next_line;
+                                }
+                        else
+                                {
+                                rctx->state = OHS_ERROR;
+                                return 0;
+                                }
+                        }
+                else
+                        {
+                        /* Look for blank line: end of headers */
+                        for (p = rctx->iobuf; *p; p++)
+                                {
+                                if ((*p != '\r') && (*p != '\n'))
+                                        break;
+                                }
+                        if (*p)
+                                goto next_line;
+
+                        rctx->state = OHS_ASN1_HEADER;
+
+                        }
+ 
+                /* Fall thru */
+
+
+                case OHS_ASN1_HEADER:
+                /* Now reading ASN1 header: can read at least 6 bytes which
+                 * is more than enough for any valid ASN1 SEQUENCE header
+                 */
+                n = BIO_get_mem_data(rctx->mem, &p);
+                if (n < 6)
+                        goto next_io;
+
+                /* Check it is an ASN1 SEQUENCE */
+                if (*p++ != (V_ASN1_SEQUENCE|V_ASN1_CONSTRUCTED))
+                        {
+                        rctx->state = OHS_ERROR;
+                        return 0;
+                        }
+
+                /* Check out length field */
+                if (*p & 0x80)
+                        {
+                        n = *p & 0x7F;
+                        /* Not NDEF or excessive length */
+                        if (!n || (n > 4))
+                                {
+                                rctx->state = OHS_ERROR;
+                                return 0;
+                                }
+                        p++;
+                        rctx->asn1_len = 0;
+                        for (i = 0; i < n; i++)
+                                {
+                                rctx->asn1_len <<= 8;
+                                rctx->asn1_len |= *p++;
+                                }
+
+                        if (rctx->asn1_len > OCSP_MAX_REQUEST_LENGTH)
+                                {
+                                rctx->state = OHS_ERROR;
+                                return 0;
+                                }
+
+                        rctx->asn1_len += n + 2;
+                        }
+                else
+                        rctx->asn1_len = *p + 2;
+
+                rctx->state = OHS_ASN1_CONTENT;
+
+                /* Fall thru */
+                
+                case OHS_ASN1_CONTENT:
+                n = BIO_get_mem_data(rctx->mem, &p);
+                if (n < (int)rctx->asn1_len)
+                        goto next_io;
+
+
+                *presp = d2i_OCSP_RESPONSE(NULL, &p, rctx->asn1_len);
+                if (*presp)
+                        {
+                        rctx->state = OHS_DONE;
+                        return 1;
+                        }
+
+                rctx->state = OHS_ERROR;
+                return 0;
+
+                break;
+
+                case OHS_DONE:
+                return 1;
+
+                }
+
+
+
+        return 0;
+
+
         }
-        if(!(resp = d2i_OCSP_RESPONSE_bio(mem, NULL))) {
-                OCSPerr(OCSP_F_OCSP_SENDREQ_BIO,ERR_R_NESTED_ASN1_ERROR);
-                goto err;
+
+/* Blocking OCSP request handler: now a special case of non-blocking I/O */
+
+OCSP_RESPONSE *OCSP_sendreq_bio(BIO *b, char *path, OCSP_REQUEST *req)
+        {
+        OCSP_RESPONSE *resp = NULL;
+        OCSP_REQ_CTX *ctx;
+        int rv;
+
+        ctx = OCSP_sendreq_new(b, path, req, -1);
+
+        do
+                {
+                rv = OCSP_sendreq_nbio(&resp, ctx);
+                } while ((rv == -1) && BIO_should_retry(b));
+
+        OCSP_REQ_CTX_free(ctx);
+
+        if (rv)
+                return resp;
+
+        return NULL;
         }
-        err:
-        BIO_free(mem);
-        return resp;
-}
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_lib.c b/src/lib/libssl/src/crypto/ocsp/ocsp_lib.c
index 9e87fc7895..27450811d7 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_lib.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_lib.c
@@ -112,7 +112,7 @@ OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst,
         if (alg->algorithm != NULL) ASN1_OBJECT_free(alg->algorithm);
         if ((nid = EVP_MD_type(dgst)) == NID_undef)
                 {
-                OCSPerr(OCSP_F_CERT_ID_NEW,OCSP_R_UNKNOWN_NID);
+                OCSPerr(OCSP_F_OCSP_CERT_ID_NEW,OCSP_R_UNKNOWN_NID);
                 goto err;
                 }
         if (!(alg->algorithm=OBJ_nid2obj(nid))) goto err;
@@ -134,7 +134,7 @@ OCSP_CERTID *OCSP_cert_id_new(const EVP_MD *dgst,
                 }
         return cid;
 digerr:
-        OCSPerr(OCSP_F_CERT_ID_NEW,OCSP_R_DIGEST_ERR);
+        OCSPerr(OCSP_F_OCSP_CERT_ID_NEW,OCSP_R_DIGEST_ERR);
 err:
         if (cid) OCSP_CERTID_free(cid);
         return NULL;
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_prn.c b/src/lib/libssl/src/crypto/ocsp/ocsp_prn.c
index 4b7bc28769..3dfb51c1e4 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_prn.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_prn.c
@@ -194,7 +194,7 @@ int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags)
 
         if (BIO_puts(bp,"OCSP Response Data:\n") <= 0) goto err;
         l=ASN1_ENUMERATED_get(o->responseStatus);
-        if (BIO_printf(bp,"    OCSP Response Status: %s (0x%x)\n",
+        if (BIO_printf(bp,"    OCSP Response Status: %s (0x%lx)\n",
                        OCSP_response_status_str(l), l) <= 0) goto err;
         if (rb == NULL) return 1;
         if (BIO_puts(bp,"    Response Type: ") <= 0)
@@ -252,7 +252,7 @@ int OCSP_RESPONSE_print(BIO *bp, OCSP_RESPONSE* o, unsigned long flags)
                                 {
                                 l=ASN1_ENUMERATED_get(rev->revocationReason);
                                 if (BIO_printf(bp, 
-                                         "\n    Revocation Reason: %s (0x%x)",
+                                         "\n    Revocation Reason: %s (0x%lx)",
                                                OCSP_crl_reason_str(l), l) <= 0)
                                         goto err;
                                 }
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c b/src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c
index 3d58dfb06c..23ea41c847 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c
@@ -367,7 +367,7 @@ int OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *st
                 return 0;
                 }
         gen = req->tbsRequest->requestorName;
-        if (gen->type != GEN_DIRNAME)
+        if (!gen || gen->type != GEN_DIRNAME)
                 {
                 OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY, OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE);
                 return 0;
diff --git a/src/lib/libssl/src/crypto/opensslconf.h.in b/src/lib/libssl/src/crypto/opensslconf.h.in
index 685e83b7a3..cee83acf98 100644
--- a/src/lib/libssl/src/crypto/opensslconf.h.in
+++ b/src/lib/libssl/src/crypto/opensslconf.h.in
@@ -5,6 +5,7 @@
 
 #if !(defined(VMS) || defined(__VMS)) /* VMS uses logical names instead */
 #if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR)
+#define ENGINESDIR "/usr/local/lib/engines"
 #define OPENSSLDIR "/usr/local/ssl"
 #endif
 #endif
diff --git a/src/lib/libssl/src/crypto/opensslv.h b/src/lib/libssl/src/crypto/opensslv.h
index e50c1baf00..b308894f18 100644
--- a/src/lib/libssl/src/crypto/opensslv.h
+++ b/src/lib/libssl/src/crypto/opensslv.h
@@ -12,7 +12,7 @@
  * 0.9.3-beta2    0x00903002 (same as ...beta2-dev)
  * 0.9.3          0x0090300f
  * 0.9.3a         0x0090301f
- * 0.9.4          0x0090400f
+ * 0.9.4          0x0090400f
  * 1.2.3z         0x102031af
  *
  * For continuity reasons (because 0.9.5 is already out, and is coded
@@ -25,11 +25,11 @@
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-#define OPENSSL_VERSION_NUMBER  0x009070afL
+#define OPENSSL_VERSION_NUMBER  0x0090808fL
 #ifdef OPENSSL_FIPS
-#define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.7j-fips 04 May 2006"
+#define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.8h-fips 28 May 2008"
 #else
-#define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.7j 04 May 2006"
+#define OPENSSL_VERSION_TEXT    "OpenSSL 0.9.8h 28 May 2008"
 #endif
 #define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
 
@@ -83,7 +83,7 @@
  * should only keep the versions that are binary compatible with the current.
  */
 #define SHLIB_VERSION_HISTORY ""
-#define SHLIB_VERSION_NUMBER "0.9.7"
+#define SHLIB_VERSION_NUMBER "0.9.8"
 
 
 #endif /* HEADER_OPENSSLV_H */
diff --git a/src/lib/libssl/src/crypto/ossl_typ.h b/src/lib/libssl/src/crypto/ossl_typ.h
index 285fd0b1d9..345fb1dc4d 100644
--- a/src/lib/libssl/src/crypto/ossl_typ.h
+++ b/src/lib/libssl/src/crypto/ossl_typ.h
@@ -97,15 +97,43 @@ typedef int ASN1_NULL;
 
 #ifdef OPENSSL_SYS_WIN32
 #undef X509_NAME
+#undef X509_EXTENSIONS
+#undef X509_CERT_PAIR
 #undef PKCS7_ISSUER_AND_SERIAL
 #endif
 
+#ifdef BIGNUM
+#undef BIGNUM
+#endif
+typedef struct bignum_st BIGNUM;
+typedef struct bignum_ctx BN_CTX;
+typedef struct bn_blinding_st BN_BLINDING;
+typedef struct bn_mont_ctx_st BN_MONT_CTX;
+typedef struct bn_recp_ctx_st BN_RECP_CTX;
+typedef struct bn_gencb_st BN_GENCB;
+
+typedef struct buf_mem_st BUF_MEM;
+
 typedef struct evp_cipher_st EVP_CIPHER;
 typedef struct evp_cipher_ctx_st EVP_CIPHER_CTX;
 typedef struct env_md_st EVP_MD;
 typedef struct env_md_ctx_st EVP_MD_CTX;
 typedef struct evp_pkey_st EVP_PKEY;
 
+typedef struct dh_st DH;
+typedef struct dh_method DH_METHOD;
+
+typedef struct dsa_st DSA;
+typedef struct dsa_method DSA_METHOD;
+
+typedef struct rsa_st RSA;
+typedef struct rsa_meth_st RSA_METHOD;
+
+typedef struct rand_meth_st RAND_METHOD;
+
+typedef struct ecdh_method ECDH_METHOD;
+typedef struct ecdsa_method ECDSA_METHOD;
+
 typedef struct x509_st X509;
 typedef struct X509_algor_st X509_ALGOR;
 typedef struct X509_crl_st X509_CRL;
@@ -113,10 +141,39 @@ typedef struct X509_name_st X509_NAME;
 typedef struct x509_store_st X509_STORE;
 typedef struct x509_store_ctx_st X509_STORE_CTX;
 
+typedef struct v3_ext_ctx X509V3_CTX;
+typedef struct conf_st CONF;
+
+typedef struct store_st STORE;
+typedef struct store_method_st STORE_METHOD;
+
+typedef struct ui_st UI;
+typedef struct ui_method_st UI_METHOD;
+
+typedef struct st_ERR_FNS ERR_FNS;
+
 typedef struct engine_st ENGINE;
 
+typedef struct X509_POLICY_NODE_st X509_POLICY_NODE;
+typedef struct X509_POLICY_LEVEL_st X509_POLICY_LEVEL;
+typedef struct X509_POLICY_TREE_st X509_POLICY_TREE;
+typedef struct X509_POLICY_CACHE_st X509_POLICY_CACHE;
+
   /* If placed in pkcs12.h, we end up with a circular depency with pkcs7.h */
 #define DECLARE_PKCS12_STACK_OF(type) /* Nothing */
 #define IMPLEMENT_PKCS12_STACK_OF(type) /* Nothing */
 
+typedef struct crypto_ex_data_st CRYPTO_EX_DATA;
+/* Callback types for crypto.h */
+typedef int CRYPTO_EX_new(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                                        int idx, long argl, void *argp);
+typedef void CRYPTO_EX_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                                        int idx, long argl, void *argp);
+typedef int CRYPTO_EX_dup(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from, void *from_d, 
+                                        int idx, long argl, void *argp);
+
+typedef struct ocsp_req_ctx_st OCSP_REQ_CTX;
+typedef struct ocsp_response_st OCSP_RESPONSE;
+typedef struct ocsp_responder_id_st OCSP_RESPID;
+
 #endif /* def HEADER_OPENSSL_TYPES_H */
diff --git a/src/lib/libssl/src/crypto/pem/pem.h b/src/lib/libssl/src/crypto/pem/pem.h
index d330cbf9a3..670afa670b 100644
--- a/src/lib/libssl/src/crypto/pem/pem.h
+++ b/src/lib/libssl/src/crypto/pem/pem.h
@@ -59,6 +59,7 @@
 #ifndef HEADER_PEM_H
 #define HEADER_PEM_H
 
+#include <openssl/e_os2.h>
 #ifndef OPENSSL_NO_BIO
 #include <openssl/bio.h>
 #endif
@@ -68,7 +69,6 @@
 #include <openssl/evp.h>
 #include <openssl/x509.h>
 #include <openssl/pem2.h>
-#include <openssl/e_os2.h>
 
 #ifdef  __cplusplus
 extern "C" {
@@ -91,6 +91,9 @@ extern "C" {
 #define PEM_OBJ_DHPARAMS        17
 #define PEM_OBJ_DSAPARAMS       18
 #define PEM_OBJ_PRIV_RSA_PUBLIC 19
+#define PEM_OBJ_PRIV_ECDSA      20
+#define PEM_OBJ_PUB_ECDSA       21
+#define PEM_OBJ_ECPARAMETERS    22
 
 #define PEM_ERROR               30
 #define PEM_DEK_DES_CBC         40
@@ -110,6 +113,7 @@ extern "C" {
 
 #define PEM_STRING_X509_OLD     "X509 CERTIFICATE"
 #define PEM_STRING_X509         "CERTIFICATE"
+#define PEM_STRING_X509_PAIR    "CERTIFICATE PAIR"
 #define PEM_STRING_X509_TRUSTED "TRUSTED CERTIFICATE"
 #define PEM_STRING_X509_REQ_OLD "NEW CERTIFICATE REQUEST"
 #define PEM_STRING_X509_REQ     "CERTIFICATE REQUEST"
@@ -126,6 +130,10 @@ extern "C" {
 #define PEM_STRING_DHPARAMS     "DH PARAMETERS"
 #define PEM_STRING_SSL_SESSION  "SSL SESSION PARAMETERS"
 #define PEM_STRING_DSAPARAMS    "DSA PARAMETERS"
+#define PEM_STRING_ECDSA_PUBLIC "ECDSA PUBLIC KEY"
+#define PEM_STRING_ECPARAMETERS "EC PARAMETERS"
+#define PEM_STRING_ECPRIVATEKEY "EC PRIVATE KEY"
+#define PEM_STRING_CMS          "CMS"
 
   /* Note that this structure is initialised by PEM_SealInit and cleaned up
      by PEM_SealFinal (at least for now) */
@@ -213,24 +221,50 @@ typedef struct pem_ctx_st
 #define IMPLEMENT_PEM_read_fp(name, type, str, asn1) \
 type *PEM_read_##name(FILE *fp, type **x, pem_password_cb *cb, void *u)\
 { \
-return((type *)PEM_ASN1_read((char *(*)())d2i_##asn1, str,fp,(char **)x,\
-        cb,u)); \
-} \
+    return (type*)PEM_ASN1_read(CHECKED_D2I_OF(type, d2i_##asn1), \
+                                str, fp, \
+                                CHECKED_PPTR_OF(type, x), \
+                                cb, u); \
+} 
 
 #define IMPLEMENT_PEM_write_fp(name, type, str, asn1) \
 int PEM_write_##name(FILE *fp, type *x) \
 { \
-return(PEM_ASN1_write((int (*)())i2d_##asn1,str,fp, (char *)x, \
-                                                         NULL,NULL,0,NULL,NULL)); \
-} 
+    return PEM_ASN1_write(CHECKED_I2D_OF(type, i2d_##asn1), \
+                          str, fp, \
+                          CHECKED_PTR_OF(type, x), \
+                          NULL, NULL, 0, NULL, NULL); \
+}
+
+#define IMPLEMENT_PEM_write_fp_const(name, type, str, asn1) \
+int PEM_write_##name(FILE *fp, const type *x) \
+{ \
+    return PEM_ASN1_write(CHECKED_I2D_OF(const type, i2d_##asn1), \
+                          str, fp, \
+                          CHECKED_PTR_OF(const type, x), \
+                          NULL, NULL, 0, NULL, NULL); \
+}
 
 #define IMPLEMENT_PEM_write_cb_fp(name, type, str, asn1) \
 int PEM_write_##name(FILE *fp, type *x, const EVP_CIPHER *enc, \
              unsigned char *kstr, int klen, pem_password_cb *cb, \
                   void *u) \
         { \
-        return(PEM_ASN1_write((int (*)())i2d_##asn1,str,fp, \
-                (char *)x,enc,kstr,klen,cb,u)); \
+            return PEM_ASN1_write(CHECKED_I2D_OF(type, i2d_##asn1), \
+                                  str, fp, \
+                                  CHECKED_PTR_OF(type, x), \
+                                  enc, kstr, klen, cb, u); \
+        }
+
+#define IMPLEMENT_PEM_write_cb_fp_const(name, type, str, asn1) \
+int PEM_write_##name(FILE *fp, type *x, const EVP_CIPHER *enc, \
+             unsigned char *kstr, int klen, pem_password_cb *cb, \
+                  void *u) \
+        { \
+            return PEM_ASN1_write(CHECKED_I2D_OF(const type, i2d_##asn1), \
+                                  str, fp, \
+                                  CHECKED_PTR_OF(const type, x), \
+                                  enc, kstr, klen, cb, u); \
         }
 
 #endif
@@ -238,33 +272,66 @@ int PEM_write_##name(FILE *fp, type *x, const EVP_CIPHER *enc, \
 #define IMPLEMENT_PEM_read_bio(name, type, str, asn1) \
 type *PEM_read_bio_##name(BIO *bp, type **x, pem_password_cb *cb, void *u)\
 { \
-return((type *)PEM_ASN1_read_bio((char *(*)())d2i_##asn1, str,bp,\
-                                                        (char **)x,cb,u)); \
+    return (type*)PEM_ASN1_read_bio(CHECKED_D2I_OF(type, d2i_##asn1), \
+                                    str, bp, \
+                                    CHECKED_PPTR_OF(type, x), \
+                                    cb, u); \
 }
 
 #define IMPLEMENT_PEM_write_bio(name, type, str, asn1) \
 int PEM_write_bio_##name(BIO *bp, type *x) \
 { \
-return(PEM_ASN1_write_bio((int (*)())i2d_##asn1,str,bp, (char *)x, \
-                                                         NULL,NULL,0,NULL,NULL)); \
+    return PEM_ASN1_write_bio(CHECKED_I2D_OF(type, i2d_##asn1), \
+                              str, bp, \
+                              CHECKED_PTR_OF(type, x), \
+                              NULL, NULL, 0, NULL, NULL); \
+}
+
+#define IMPLEMENT_PEM_write_bio_const(name, type, str, asn1) \
+int PEM_write_bio_##name(BIO *bp, const type *x) \
+{ \
+    return PEM_ASN1_write_bio(CHECKED_I2D_OF(const type, i2d_##asn1), \
+                              str, bp, \
+                              CHECKED_PTR_OF(const type, x), \
+                              NULL, NULL, 0, NULL, NULL); \
 }
 
 #define IMPLEMENT_PEM_write_cb_bio(name, type, str, asn1) \
 int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \
              unsigned char *kstr, int klen, pem_password_cb *cb, void *u) \
         { \
-        return(PEM_ASN1_write_bio((int (*)())i2d_##asn1,str,bp, \
-                (char *)x,enc,kstr,klen,cb,u)); \
+            return PEM_ASN1_write_bio(CHECKED_I2D_OF(type, i2d_##asn1), \
+                                      str, bp, \
+                                      CHECKED_PTR_OF(type, x), \
+                                      enc, kstr, klen, cb, u); \
+        }
+
+#define IMPLEMENT_PEM_write_cb_bio_const(name, type, str, asn1) \
+int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \
+             unsigned char *kstr, int klen, pem_password_cb *cb, void *u) \
+        { \
+            return PEM_ASN1_write_bio(CHECKED_I2D_OF(const type, i2d_##asn1), \
+                                      str, bp, \
+                                      CHECKED_PTR_OF(const type, x), \
+                                      enc, kstr, klen, cb, u); \
         }
 
 #define IMPLEMENT_PEM_write(name, type, str, asn1) \
         IMPLEMENT_PEM_write_bio(name, type, str, asn1) \
         IMPLEMENT_PEM_write_fp(name, type, str, asn1) 
 
+#define IMPLEMENT_PEM_write_const(name, type, str, asn1) \
+        IMPLEMENT_PEM_write_bio_const(name, type, str, asn1) \
+        IMPLEMENT_PEM_write_fp_const(name, type, str, asn1) 
+
 #define IMPLEMENT_PEM_write_cb(name, type, str, asn1) \
         IMPLEMENT_PEM_write_cb_bio(name, type, str, asn1) \
         IMPLEMENT_PEM_write_cb_fp(name, type, str, asn1) 
 
+#define IMPLEMENT_PEM_write_cb_const(name, type, str, asn1) \
+        IMPLEMENT_PEM_write_cb_bio_const(name, type, str, asn1) \
+        IMPLEMENT_PEM_write_cb_fp_const(name, type, str, asn1) 
+
 #define IMPLEMENT_PEM_read(name, type, str, asn1) \
         IMPLEMENT_PEM_read_bio(name, type, str, asn1) \
         IMPLEMENT_PEM_read_fp(name, type, str, asn1) 
@@ -273,6 +340,10 @@ int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \
         IMPLEMENT_PEM_read(name, type, str, asn1) \
         IMPLEMENT_PEM_write(name, type, str, asn1)
 
+#define IMPLEMENT_PEM_rw_const(name, type, str, asn1) \
+        IMPLEMENT_PEM_read(name, type, str, asn1) \
+        IMPLEMENT_PEM_write_const(name, type, str, asn1)
+
 #define IMPLEMENT_PEM_rw_cb(name, type, str, asn1) \
         IMPLEMENT_PEM_read(name, type, str, asn1) \
         IMPLEMENT_PEM_write_cb(name, type, str, asn1)
@@ -293,6 +364,9 @@ int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \
 #define DECLARE_PEM_write_fp(name, type) \
         int PEM_write_##name(FILE *fp, type *x);
 
+#define DECLARE_PEM_write_fp_const(name, type) \
+        int PEM_write_##name(FILE *fp, const type *x);
+
 #define DECLARE_PEM_write_cb_fp(name, type) \
         int PEM_write_##name(FILE *fp, type *x, const EVP_CIPHER *enc, \
              unsigned char *kstr, int klen, pem_password_cb *cb, void *u);
@@ -306,6 +380,9 @@ int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \
 #define DECLARE_PEM_write_bio(name, type) \
         int PEM_write_bio_##name(BIO *bp, type *x);
 
+#define DECLARE_PEM_write_bio_const(name, type) \
+        int PEM_write_bio_##name(BIO *bp, const type *x);
+
 #define DECLARE_PEM_write_cb_bio(name, type) \
         int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \
              unsigned char *kstr, int klen, pem_password_cb *cb, void *u);
@@ -322,6 +399,10 @@ int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \
         DECLARE_PEM_write_bio(name, type) \
         DECLARE_PEM_write_fp(name, type) 
 
+#define DECLARE_PEM_write_const(name, type) \
+        DECLARE_PEM_write_bio_const(name, type) \
+        DECLARE_PEM_write_fp_const(name, type)
+
 #define DECLARE_PEM_write_cb(name, type) \
         DECLARE_PEM_write_cb_bio(name, type) \
         DECLARE_PEM_write_cb_fp(name, type) 
@@ -334,6 +415,10 @@ int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \
         DECLARE_PEM_read(name, type) \
         DECLARE_PEM_write(name, type)
 
+#define DECLARE_PEM_rw_const(name, type) \
+        DECLARE_PEM_read(name, type) \
+        DECLARE_PEM_write_const(name, type)
+
 #define DECLARE_PEM_rw_cb(name, type) \
         DECLARE_PEM_read(name, type) \
         DECLARE_PEM_write_cb(name, type)
@@ -403,9 +488,6 @@ int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \
         (char *(*)())d2i_NETSCAPE_CERT_SEQUENCE,PEM_STRING_X509,fp,\
                                                         (char **)x,cb,u)
 
-#define PEM_write_bio_SSL_SESSION(bp,x) \
-                PEM_ASN1_write_bio((int (*)())i2d_SSL_SESSION, \
-                        PEM_STRING_SSL_SESSION,bp, (char *)x, NULL,NULL,0,NULL,NULL)
 #define PEM_write_bio_X509(bp,x) \
                 PEM_ASN1_write_bio((int (*)())i2d_X509,PEM_STRING_X509,bp, \
                         (char *)x, NULL,NULL,0,NULL,NULL)
@@ -444,8 +526,6 @@ int PEM_write_bio_##name(BIO *bp, type *x, const EVP_CIPHER *enc, \
                         PEM_STRING_X509,bp, \
                         (char *)x, NULL,NULL,0,NULL,NULL)
 
-#define PEM_read_bio_SSL_SESSION(bp,x,cb,u) (SSL_SESSION *)PEM_ASN1_read_bio( \
-        (char *(*)())d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,bp,(char **)x,cb,u)
 #define PEM_read_bio_X509(bp,x,cb,u) (X509 *)PEM_ASN1_read_bio( \
         (char *(*)())d2i_X509,PEM_STRING_X509,bp,(char **)x,cb,u)
 #define PEM_read_bio_X509_REQ(bp,x,cb,u) (X509_REQ *)PEM_ASN1_read_bio( \
@@ -494,11 +574,25 @@ int	PEM_write_bio(BIO *bp,const char *name,char *hdr,unsigned char *data,
                 long len);
 int PEM_bytes_read_bio(unsigned char **pdata, long *plen, char **pnm, const char *name, BIO *bp,
              pem_password_cb *cb, void *u);
-char *  PEM_ASN1_read_bio(char *(*d2i)(),const char *name,BIO *bp,char **x,
-                pem_password_cb *cb, void *u);
-int     PEM_ASN1_write_bio(int (*i2d)(),const char *name,BIO *bp,char *x,
+void *  PEM_ASN1_read_bio(d2i_of_void *d2i, const char *name, BIO *bp,
+                          void **x, pem_password_cb *cb, void *u);
+
+#define PEM_ASN1_read_bio_of(type,d2i,name,bp,x,cb,u) \
+    ((type*)PEM_ASN1_read_bio(CHECKED_D2I_OF(type, d2i), \
+                              name, bp,                 \
+                              CHECKED_PPTR_OF(type, x), \
+                              cb, u))
+
+int     PEM_ASN1_write_bio(i2d_of_void *i2d,const char *name,BIO *bp,char *x,
                            const EVP_CIPHER *enc,unsigned char *kstr,int klen,
                            pem_password_cb *cb, void *u);
+
+#define PEM_ASN1_write_bio_of(type,i2d,name,bp,x,enc,kstr,klen,cb,u) \
+    (PEM_ASN1_write_bio(CHECKED_I2D_OF(type, i2d), \
+                        name, bp,                  \
+                        CHECKED_PTR_OF(type, x), \
+                        enc, kstr, klen, cb, u))
+
 STACK_OF(X509_INFO) *   PEM_X509_INFO_read_bio(BIO *bp, STACK_OF(X509_INFO) *sk, pem_password_cb *cb, void *u);
 int     PEM_X509_INFO_write_bio(BIO *bp,X509_INFO *xi, EVP_CIPHER *enc,
                 unsigned char *kstr, int klen, pem_password_cb *cd, void *u);
@@ -508,11 +602,11 @@ int	PEM_X509_INFO_write_bio(BIO *bp,X509_INFO *xi, EVP_CIPHER *enc,
 int     PEM_read(FILE *fp, char **name, char **header,
                 unsigned char **data,long *len);
 int     PEM_write(FILE *fp,char *name,char *hdr,unsigned char *data,long len);
-char *  PEM_ASN1_read(char *(*d2i)(),const char *name,FILE *fp,char **x,
-        pem_password_cb *cb, void *u);
-int     PEM_ASN1_write(int (*i2d)(),const char *name,FILE *fp,char *x,
-                       const EVP_CIPHER *enc,unsigned char *kstr,int klen,
-                       pem_password_cb *callback, void *u);
+void *  PEM_ASN1_read(d2i_of_void *d2i, const char *name, FILE *fp, void **x,
+                      pem_password_cb *cb, void *u);
+int     PEM_ASN1_write(i2d_of_void *i2d,const char *name,FILE *fp,
+                       char *x,const EVP_CIPHER *enc,unsigned char *kstr,
+                       int klen,pem_password_cb *callback, void *u);
 STACK_OF(X509_INFO) *   PEM_X509_INFO_read(FILE *fp, STACK_OF(X509_INFO) *sk,
         pem_password_cb *cb, void *u);
 #endif
@@ -542,6 +636,8 @@ DECLARE_PEM_rw(X509, X509)
 
 DECLARE_PEM_rw(X509_AUX, X509)
 
+DECLARE_PEM_rw(X509_CERT_PAIR, X509_CERT_PAIR)
+
 DECLARE_PEM_rw(X509_REQ, X509_REQ)
 DECLARE_PEM_write(X509_REQ_NEW, X509_REQ)
 
@@ -559,7 +655,7 @@ DECLARE_PEM_rw(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO)
 
 DECLARE_PEM_rw_cb(RSAPrivateKey, RSA)
 
-DECLARE_PEM_rw(RSAPublicKey, RSA)
+DECLARE_PEM_rw_const(RSAPublicKey, RSA)
 DECLARE_PEM_rw(RSA_PUBKEY, RSA)
 
 #endif
@@ -570,13 +666,19 @@ DECLARE_PEM_rw_cb(DSAPrivateKey, DSA)
 
 DECLARE_PEM_rw(DSA_PUBKEY, DSA)
 
-DECLARE_PEM_rw(DSAparams, DSA)
+DECLARE_PEM_rw_const(DSAparams, DSA)
+
+#endif
 
+#ifndef OPENSSL_NO_EC
+DECLARE_PEM_rw_const(ECPKParameters, EC_GROUP)
+DECLARE_PEM_rw_cb(ECPrivateKey, EC_KEY)
+DECLARE_PEM_rw(EC_PUBKEY, EC_KEY)
 #endif
 
 #ifndef OPENSSL_NO_DH
 
-DECLARE_PEM_rw(DHparams, DH)
+DECLARE_PEM_rw_const(DHparams, DH)
 
 #endif
 
@@ -626,24 +728,27 @@ void ERR_load_PEM_strings(void);
 /* Function codes. */
 #define PEM_F_D2I_PKCS8PRIVATEKEY_BIO                    120
 #define PEM_F_D2I_PKCS8PRIVATEKEY_FP                     121
-#define PEM_F_DEF_CALLBACK                               100
+#define PEM_F_DO_PK8PKEY                                 126
+#define PEM_F_DO_PK8PKEY_FP                              125
 #define PEM_F_LOAD_IV                                    101
 #define PEM_F_PEM_ASN1_READ                              102
 #define PEM_F_PEM_ASN1_READ_BIO                          103
 #define PEM_F_PEM_ASN1_WRITE                             104
 #define PEM_F_PEM_ASN1_WRITE_BIO                         105
+#define PEM_F_PEM_DEF_CALLBACK                           100
 #define PEM_F_PEM_DO_HEADER                              106
-#define PEM_F_PEM_F_DO_PK8KEY_FP                         122
 #define PEM_F_PEM_F_PEM_WRITE_PKCS8PRIVATEKEY            118
 #define PEM_F_PEM_GET_EVP_CIPHER_INFO                    107
+#define PEM_F_PEM_PK8PKEY                                119
 #define PEM_F_PEM_READ                                   108
 #define PEM_F_PEM_READ_BIO                               109
+#define PEM_F_PEM_READ_BIO_PRIVATEKEY                    123
+#define PEM_F_PEM_READ_PRIVATEKEY                        124
 #define PEM_F_PEM_SEALFINAL                              110
 #define PEM_F_PEM_SEALINIT                               111
 #define PEM_F_PEM_SIGNFINAL                              112
 #define PEM_F_PEM_WRITE                                  113
 #define PEM_F_PEM_WRITE_BIO                              114
-#define PEM_F_PEM_WRITE_BIO_PKCS8PRIVATEKEY              119
 #define PEM_F_PEM_X509_INFO_READ                         115
 #define PEM_F_PEM_X509_INFO_READ_BIO                     116
 #define PEM_F_PEM_X509_INFO_WRITE_BIO                    117
diff --git a/src/lib/libssl/src/crypto/pem/pem_all.c b/src/lib/libssl/src/crypto/pem/pem_all.c
index 07963314c9..66cbc7eb82 100644
--- a/src/lib/libssl/src/crypto/pem/pem_all.c
+++ b/src/lib/libssl/src/crypto/pem/pem_all.c
@@ -55,6 +55,59 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 
 #include <stdio.h>
 #undef SSLEAY_MACROS
@@ -64,7 +117,15 @@
 #include <openssl/x509.h>
 #include <openssl/pkcs7.h>
 #include <openssl/pem.h>
-#include <openssl/fips.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
 
 #ifndef OPENSSL_NO_RSA
 static RSA *pkey_get_rsa(EVP_PKEY *key, RSA **rsa);
@@ -73,6 +134,10 @@ static RSA *pkey_get_rsa(EVP_PKEY *key, RSA **rsa);
 static DSA *pkey_get_dsa(EVP_PKEY *key, DSA **dsa);
 #endif
 
+#ifndef OPENSSL_NO_EC
+static EC_KEY *pkey_get_eckey(EVP_PKEY *key, EC_KEY **eckey);
+#endif
+
 IMPLEMENT_PEM_rw(X509_REQ, X509_REQ, PEM_STRING_X509_REQ, X509_REQ)
 
 IMPLEMENT_PEM_write(X509_REQ_NEW, X509_REQ, PEM_STRING_X509_REQ_OLD, X509_REQ)
@@ -129,50 +194,8 @@ RSA *PEM_read_RSAPrivateKey(FILE *fp, RSA **rsa, pem_password_cb *cb,
 
 #endif
 
-#ifdef OPENSSL_FIPS
-
-int PEM_write_bio_RSAPrivateKey(BIO *bp, RSA *x, const EVP_CIPHER *enc,
-                                               unsigned char *kstr, int klen,
-                                               pem_password_cb *cb, void *u)
-{
-        EVP_PKEY *k;
-        int ret;
-        k = EVP_PKEY_new();
-        if (!k)
-                return 0;
-        EVP_PKEY_set1_RSA(k, x);
-
-        ret = PEM_write_bio_PrivateKey(bp, k, enc, kstr, klen, cb, u);
-        EVP_PKEY_free(k);
-        return ret;
-}
-
-#ifndef OPENSSL_NO_FP_API
-int PEM_write_RSAPrivateKey(FILE *fp, RSA *x, const EVP_CIPHER *enc,
-                                               unsigned char *kstr, int klen,
-                                               pem_password_cb *cb, void *u)
-{
-        EVP_PKEY *k;
-        int ret;
-        k = EVP_PKEY_new();
-        if (!k)
-                return 0;
-
-        EVP_PKEY_set1_RSA(k, x);
-
-        ret = PEM_write_PrivateKey(fp, k, enc, kstr, klen, cb, u);
-        EVP_PKEY_free(k);
-        return ret;
-}
-#endif
-
-#else
-
-IMPLEMENT_PEM_write_cb(RSAPrivateKey, RSA, PEM_STRING_RSA, RSAPrivateKey)
-
-#endif
-
-IMPLEMENT_PEM_rw(RSAPublicKey, RSA, PEM_STRING_RSA_PUBLIC, RSAPublicKey)
+IMPLEMENT_PEM_write_cb_const(RSAPrivateKey, RSA, PEM_STRING_RSA, RSAPrivateKey)
+IMPLEMENT_PEM_rw_const(RSAPublicKey, RSA, PEM_STRING_RSA_PUBLIC, RSAPublicKey)
 IMPLEMENT_PEM_rw(RSA_PUBKEY, RSA, PEM_STRING_PUBLIC, RSA_PUBKEY)
 
 #endif
@@ -201,69 +224,73 @@ DSA *PEM_read_bio_DSAPrivateKey(BIO *bp, DSA **dsa, pem_password_cb *cb,
         return pkey_get_dsa(pktmp, dsa);
 }
 
+IMPLEMENT_PEM_write_cb_const(DSAPrivateKey, DSA, PEM_STRING_DSA, DSAPrivateKey)
+IMPLEMENT_PEM_rw(DSA_PUBKEY, DSA, PEM_STRING_PUBLIC, DSA_PUBKEY)
 
-#ifdef OPENSSL_FIPS
+#ifndef OPENSSL_NO_FP_API
 
-int PEM_write_bio_DSAPrivateKey(BIO *bp, DSA *x, const EVP_CIPHER *enc,
-                                               unsigned char *kstr, int klen,
-                                               pem_password_cb *cb, void *u)
+DSA *PEM_read_DSAPrivateKey(FILE *fp, DSA **dsa, pem_password_cb *cb,
+                                                                void *u)
 {
-        EVP_PKEY *k;
-        int ret;
-        k = EVP_PKEY_new();
-        if (!k)
-                return 0;
-        EVP_PKEY_set1_DSA(k, x);
-
-        ret = PEM_write_bio_PrivateKey(bp, k, enc, kstr, klen, cb, u);
-        EVP_PKEY_free(k);
-        return ret;
+        EVP_PKEY *pktmp;
+        pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
+        return pkey_get_dsa(pktmp, dsa);
 }
 
-#ifndef OPENSSL_NO_FP_API
-int PEM_write_DSAPrivateKey(FILE *fp, DSA *x, const EVP_CIPHER *enc,
-                                               unsigned char *kstr, int klen,
-                                               pem_password_cb *cb, void *u)
+#endif
+
+IMPLEMENT_PEM_rw_const(DSAparams, DSA, PEM_STRING_DSAPARAMS, DSAparams)
+
+#endif
+
+
+#ifndef OPENSSL_NO_EC
+static EC_KEY *pkey_get_eckey(EVP_PKEY *key, EC_KEY **eckey)
 {
-        EVP_PKEY *k;
-        int ret;
-        k = EVP_PKEY_new();
-        if (!k)
-                return 0;
-        EVP_PKEY_set1_DSA(k, x);
-        ret = PEM_write_PrivateKey(fp, k, enc, kstr, klen, cb, u);
-        EVP_PKEY_free(k);
-        return ret;
+        EC_KEY *dtmp;
+        if(!key) return NULL;
+        dtmp = EVP_PKEY_get1_EC_KEY(key);
+        EVP_PKEY_free(key);
+        if(!dtmp) return NULL;
+        if(eckey) 
+        {
+                EC_KEY_free(*eckey);
+                *eckey = dtmp;
+        }
+        return dtmp;
 }
-#endif
 
-#else
+EC_KEY *PEM_read_bio_ECPrivateKey(BIO *bp, EC_KEY **key, pem_password_cb *cb,
+                                                        void *u)
+{
+        EVP_PKEY *pktmp;
+        pktmp = PEM_read_bio_PrivateKey(bp, NULL, cb, u);
+        return pkey_get_eckey(pktmp, key);
+}
 
-IMPLEMENT_PEM_write_cb(DSAPrivateKey, DSA, PEM_STRING_DSA, DSAPrivateKey)
+IMPLEMENT_PEM_rw_const(ECPKParameters, EC_GROUP, PEM_STRING_ECPARAMETERS, ECPKParameters)
 
-#endif
+IMPLEMENT_PEM_write_cb(ECPrivateKey, EC_KEY, PEM_STRING_ECPRIVATEKEY, ECPrivateKey)
 
-IMPLEMENT_PEM_rw(DSA_PUBKEY, DSA, PEM_STRING_PUBLIC, DSA_PUBKEY)
+IMPLEMENT_PEM_rw(EC_PUBKEY, EC_KEY, PEM_STRING_PUBLIC, EC_PUBKEY)
 
 #ifndef OPENSSL_NO_FP_API
-
-DSA *PEM_read_DSAPrivateKey(FILE *fp, DSA **dsa, pem_password_cb *cb,
-                                                                void *u)
+ 
+EC_KEY *PEM_read_ECPrivateKey(FILE *fp, EC_KEY **eckey, pem_password_cb *cb,
+                                                                void *u)
 {
         EVP_PKEY *pktmp;
         pktmp = PEM_read_PrivateKey(fp, NULL, cb, u);
-        return pkey_get_dsa(pktmp, dsa);
+        return pkey_get_eckey(pktmp, eckey);
 }
 
 #endif
 
-IMPLEMENT_PEM_rw(DSAparams, DSA, PEM_STRING_DSAPARAMS, DSAparams)
-
 #endif
 
 #ifndef OPENSSL_NO_DH
 
-IMPLEMENT_PEM_rw(DHparams, DH, PEM_STRING_DHPARAMS, DHparams)
+IMPLEMENT_PEM_rw_const(DHparams, DH, PEM_STRING_DHPARAMS, DHparams)
 
 #endif
 
@@ -274,42 +301,8 @@ IMPLEMENT_PEM_rw(DHparams, DH, PEM_STRING_DHPARAMS, DHparams)
  * (When reading, parameter PEM_STRING_EVP_PKEY is a wildcard for anything
  * appropriate.)
  */
-
-#ifdef OPENSSL_FIPS
-
-int PEM_write_bio_PrivateKey(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
-                                               unsigned char *kstr, int klen,
-                                               pem_password_cb *cb, void *u)
-        {
-                if (FIPS_mode())
-                        return PEM_write_bio_PKCS8PrivateKey(bp, x, enc,
-                                                (char *)kstr, klen, cb, u);
-                else
-                        return PEM_ASN1_write_bio((int (*)())i2d_PrivateKey,
-                (((x)->type == EVP_PKEY_DSA)?PEM_STRING_DSA:PEM_STRING_RSA),
-                        bp,(char *)x,enc,kstr,klen,cb,u);
-        }
-
-#ifndef OPENSSL_NO_FP_API
-int PEM_write_PrivateKey(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,
-                                               unsigned char *kstr, int klen,
-                                               pem_password_cb *cb, void *u)
-        {
-                if (FIPS_mode())
-                        return PEM_write_PKCS8PrivateKey(fp, x, enc,
-                                                (char *)kstr, klen, cb, u);
-                else
-                        return PEM_ASN1_write((int (*)())i2d_PrivateKey,
-                (((x)->type == EVP_PKEY_DSA)?PEM_STRING_DSA:PEM_STRING_RSA),
-                        fp,(char *)x,enc,kstr,klen,cb,u);
-        }
-#endif
-
-#else
-
-IMPLEMENT_PEM_write_cb(PrivateKey, EVP_PKEY, ((x->type == EVP_PKEY_DSA)?PEM_STRING_DSA:PEM_STRING_RSA), PrivateKey)
-
-#endif
+IMPLEMENT_PEM_write_cb(PrivateKey, EVP_PKEY, ((x->type == EVP_PKEY_DSA)?PEM_STRING_DSA:\
+                        (x->type == EVP_PKEY_RSA)?PEM_STRING_RSA:PEM_STRING_ECPRIVATEKEY), PrivateKey)
 
 IMPLEMENT_PEM_rw(PUBKEY, EVP_PKEY, PEM_STRING_PUBLIC, PUBKEY)
 
diff --git a/src/lib/libssl/src/crypto/pem/pem_err.c b/src/lib/libssl/src/crypto/pem/pem_err.c
index 8527028ebc..3133563d77 100644
--- a/src/lib/libssl/src/crypto/pem/pem_err.c
+++ b/src/lib/libssl/src/crypto/pem/pem_err.c
@@ -72,24 +72,27 @@ static ERR_STRING_DATA PEM_str_functs[]=
         {
 {ERR_FUNC(PEM_F_D2I_PKCS8PRIVATEKEY_BIO),       "d2i_PKCS8PrivateKey_bio"},
 {ERR_FUNC(PEM_F_D2I_PKCS8PRIVATEKEY_FP),        "d2i_PKCS8PrivateKey_fp"},
-{ERR_FUNC(PEM_F_DEF_CALLBACK),  "DEF_CALLBACK"},
+{ERR_FUNC(PEM_F_DO_PK8PKEY),    "DO_PK8PKEY"},
+{ERR_FUNC(PEM_F_DO_PK8PKEY_FP), "DO_PK8PKEY_FP"},
 {ERR_FUNC(PEM_F_LOAD_IV),       "LOAD_IV"},
 {ERR_FUNC(PEM_F_PEM_ASN1_READ), "PEM_ASN1_read"},
 {ERR_FUNC(PEM_F_PEM_ASN1_READ_BIO),     "PEM_ASN1_read_bio"},
 {ERR_FUNC(PEM_F_PEM_ASN1_WRITE),        "PEM_ASN1_write"},
 {ERR_FUNC(PEM_F_PEM_ASN1_WRITE_BIO),    "PEM_ASN1_write_bio"},
+{ERR_FUNC(PEM_F_PEM_DEF_CALLBACK),      "PEM_def_callback"},
 {ERR_FUNC(PEM_F_PEM_DO_HEADER), "PEM_do_header"},
-{ERR_FUNC(PEM_F_PEM_F_DO_PK8KEY_FP),    "PEM_F_DO_PK8KEY_FP"},
 {ERR_FUNC(PEM_F_PEM_F_PEM_WRITE_PKCS8PRIVATEKEY),       "PEM_F_PEM_WRITE_PKCS8PRIVATEKEY"},
 {ERR_FUNC(PEM_F_PEM_GET_EVP_CIPHER_INFO),       "PEM_get_EVP_CIPHER_INFO"},
+{ERR_FUNC(PEM_F_PEM_PK8PKEY),   "PEM_PK8PKEY"},
 {ERR_FUNC(PEM_F_PEM_READ),      "PEM_read"},
 {ERR_FUNC(PEM_F_PEM_READ_BIO),  "PEM_read_bio"},
+{ERR_FUNC(PEM_F_PEM_READ_BIO_PRIVATEKEY),       "PEM_READ_BIO_PRIVATEKEY"},
+{ERR_FUNC(PEM_F_PEM_READ_PRIVATEKEY),   "PEM_READ_PRIVATEKEY"},
 {ERR_FUNC(PEM_F_PEM_SEALFINAL), "PEM_SealFinal"},
 {ERR_FUNC(PEM_F_PEM_SEALINIT),  "PEM_SealInit"},
 {ERR_FUNC(PEM_F_PEM_SIGNFINAL), "PEM_SignFinal"},
 {ERR_FUNC(PEM_F_PEM_WRITE),     "PEM_write"},
 {ERR_FUNC(PEM_F_PEM_WRITE_BIO), "PEM_write_bio"},
-{ERR_FUNC(PEM_F_PEM_WRITE_BIO_PKCS8PRIVATEKEY), "PEM_write_bio_PKCS8PrivateKey"},
 {ERR_FUNC(PEM_F_PEM_X509_INFO_READ),    "PEM_X509_INFO_read"},
 {ERR_FUNC(PEM_F_PEM_X509_INFO_READ_BIO),        "PEM_X509_INFO_read_bio"},
 {ERR_FUNC(PEM_F_PEM_X509_INFO_WRITE_BIO),       "PEM_X509_INFO_write_bio"},
@@ -121,15 +124,12 @@ static ERR_STRING_DATA PEM_str_reasons[]=
 
 void ERR_load_PEM_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(PEM_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,PEM_str_functs);
                 ERR_load_strings(0,PEM_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/pem/pem_info.c b/src/lib/libssl/src/crypto/pem/pem_info.c
index 9e4af29c95..3a273f6f70 100644
--- a/src/lib/libssl/src/crypto/pem/pem_info.c
+++ b/src/lib/libssl/src/crypto/pem/pem_info.c
@@ -63,6 +63,12 @@
 #include <openssl/evp.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
 
 #ifndef OPENSSL_NO_FP_API
 STACK_OF(X509_INFO) *PEM_X509_INFO_read(FILE *fp, STACK_OF(X509_INFO) *sk, pem_password_cb *cb, void *u)
@@ -85,13 +91,15 @@ STACK_OF(X509_INFO) *PEM_X509_INFO_read(FILE *fp, STACK_OF(X509_INFO) *sk, pem_p
 STACK_OF(X509_INFO) *PEM_X509_INFO_read_bio(BIO *bp, STACK_OF(X509_INFO) *sk, pem_password_cb *cb, void *u)
         {
         X509_INFO *xi=NULL;
-        char *name=NULL,*header=NULL,**pp;
-        unsigned char *data=NULL,*p;
+        char *name=NULL,*header=NULL;
+        void *pp;
+        unsigned char *data=NULL;
+        const unsigned char *p;
         long len,error=0;
         int ok=0;
         STACK_OF(X509_INFO) *ret=NULL;
         unsigned int i,raw;
-        char *(*d2i)();
+        d2i_of_void *d2i;
 
         if (sk == NULL)
                 {
@@ -123,42 +131,42 @@ start:
                 if (    (strcmp(name,PEM_STRING_X509) == 0) ||
                         (strcmp(name,PEM_STRING_X509_OLD) == 0))
                         {
-                        d2i=(char *(*)())d2i_X509;
+                        d2i=(D2I_OF(void))d2i_X509;
                         if (xi->x509 != NULL)
                                 {
                                 if (!sk_X509_INFO_push(ret,xi)) goto err;
                                 if ((xi=X509_INFO_new()) == NULL) goto err;
                                 goto start;
                                 }
-                        pp=(char **)&(xi->x509);
+                        pp=&(xi->x509);
                         }
                 else if ((strcmp(name,PEM_STRING_X509_TRUSTED) == 0))
                         {
-                        d2i=(char *(*)())d2i_X509_AUX;
+                        d2i=(D2I_OF(void))d2i_X509_AUX;
                         if (xi->x509 != NULL)
                                 {
                                 if (!sk_X509_INFO_push(ret,xi)) goto err;
                                 if ((xi=X509_INFO_new()) == NULL) goto err;
                                 goto start;
                                 }
-                        pp=(char **)&(xi->x509);
+                        pp=&(xi->x509);
                         }
                 else if (strcmp(name,PEM_STRING_X509_CRL) == 0)
                         {
-                        d2i=(char *(*)())d2i_X509_CRL;
+                        d2i=(D2I_OF(void))d2i_X509_CRL;
                         if (xi->crl != NULL)
                                 {
                                 if (!sk_X509_INFO_push(ret,xi)) goto err;
                                 if ((xi=X509_INFO_new()) == NULL) goto err;
                                 goto start;
                                 }
-                        pp=(char **)&(xi->crl);
+                        pp=&(xi->crl);
                         }
                 else
 #ifndef OPENSSL_NO_RSA
                         if (strcmp(name,PEM_STRING_RSA) == 0)
                         {
-                        d2i=(char *(*)())d2i_RSAPrivateKey;
+                        d2i=(D2I_OF(void))d2i_RSAPrivateKey;
                         if (xi->x_pkey != NULL) 
                                 {
                                 if (!sk_X509_INFO_push(ret,xi)) goto err;
@@ -173,7 +181,7 @@ start:
                         if ((xi->x_pkey->dec_pkey=EVP_PKEY_new()) == NULL)
                                 goto err;
                         xi->x_pkey->dec_pkey->type=EVP_PKEY_RSA;
-                        pp=(char **)&(xi->x_pkey->dec_pkey->pkey.rsa);
+                        pp=&(xi->x_pkey->dec_pkey->pkey.rsa);
                         if ((int)strlen(header) > 10) /* assume encrypted */
                                 raw=1;
                         }
@@ -182,7 +190,7 @@ start:
 #ifndef OPENSSL_NO_DSA
                         if (strcmp(name,PEM_STRING_DSA) == 0)
                         {
-                        d2i=(char *(*)())d2i_DSAPrivateKey;
+                        d2i=(D2I_OF(void))d2i_DSAPrivateKey;
                         if (xi->x_pkey != NULL) 
                                 {
                                 if (!sk_X509_INFO_push(ret,xi)) goto err;
@@ -197,12 +205,36 @@ start:
                         if ((xi->x_pkey->dec_pkey=EVP_PKEY_new()) == NULL)
                                 goto err;
                         xi->x_pkey->dec_pkey->type=EVP_PKEY_DSA;
-                        pp=(char **)&(xi->x_pkey->dec_pkey->pkey.dsa);
+                        pp=&xi->x_pkey->dec_pkey->pkey.dsa;
                         if ((int)strlen(header) > 10) /* assume encrypted */
                                 raw=1;
                         }
                 else
 #endif
+#ifndef OPENSSL_NO_EC
+                        if (strcmp(name,PEM_STRING_ECPRIVATEKEY) == 0)
+                        {
+                                d2i=(D2I_OF(void))d2i_ECPrivateKey;
+                                if (xi->x_pkey != NULL) 
+                                {
+                                        if (!sk_X509_INFO_push(ret,xi)) goto err;
+                                        if ((xi=X509_INFO_new()) == NULL) goto err;
+                                                goto start;
+                                }
+ 
+                        xi->enc_data=NULL;
+                        xi->enc_len=0;
+ 
+                        xi->x_pkey=X509_PKEY_new();
+                        if ((xi->x_pkey->dec_pkey=EVP_PKEY_new()) == NULL)
+                                goto err;
+                        xi->x_pkey->dec_pkey->type=EVP_PKEY_EC;
+                        pp=&(xi->x_pkey->dec_pkey->pkey.ec);
+                        if ((int)strlen(header) > 10) /* assume encrypted */
+                                raw=1;
+                        }
+                else
+#endif
                         {
                         d2i=NULL;
                         pp=NULL;
diff --git a/src/lib/libssl/src/crypto/pem/pem_lib.c b/src/lib/libssl/src/crypto/pem/pem_lib.c
index 82815067b3..9bae4c8850 100644
--- a/src/lib/libssl/src/crypto/pem/pem_lib.c
+++ b/src/lib/libssl/src/crypto/pem/pem_lib.c
@@ -69,7 +69,7 @@
 #include <openssl/des.h>
 #endif
 
-const char *PEM_version="PEM" OPENSSL_VERSION_PTEXT;
+const char PEM_version[]="PEM" OPENSSL_VERSION_PTEXT;
 
 #define MIN_LENGTH      4
 
@@ -81,7 +81,7 @@ int PEM_def_callback(char *buf, int num, int w, void *key)
 #ifdef OPENSSL_NO_FP_API
         /* We should not ever call the default callback routine from
          * windows. */
-        PEMerr(PEM_F_DEF_CALLBACK,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+        PEMerr(PEM_F_PEM_DEF_CALLBACK,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
         return(-1);
 #else
         int i,j;
@@ -102,7 +102,7 @@ int PEM_def_callback(char *buf, int num, int w, void *key)
                 i=EVP_read_pw_string(buf,num,prompt,w);
                 if (i != 0)
                         {
-                        PEMerr(PEM_F_DEF_CALLBACK,PEM_R_PROBLEMS_GETTING_PASSWORD);
+                        PEMerr(PEM_F_PEM_DEF_CALLBACK,PEM_R_PROBLEMS_GETTING_PASSWORD);
                         memset(buf,0,(unsigned int)num);
                         return(-1);
                         }
@@ -158,11 +158,11 @@ void PEM_dek_info(char *buf, const char *type, int len, char *str)
         }
 
 #ifndef OPENSSL_NO_FP_API
-char *PEM_ASN1_read(char *(*d2i)(), const char *name, FILE *fp, char **x,
-             pem_password_cb *cb, void *u)
+void *PEM_ASN1_read(d2i_of_void *d2i, const char *name, FILE *fp, void **x,
+                    pem_password_cb *cb, void *u)
         {
         BIO *b;
-        char *ret;
+        void *ret;
 
         if ((b=BIO_new(BIO_s_file())) == NULL)
                 {
@@ -195,6 +195,8 @@ static int check_pem(const char *nm, const char *name)
         if(!strcmp(nm,PEM_STRING_DSA) &&
                  !strcmp(name,PEM_STRING_EVP_PKEY)) return 1;
 
+        if(!strcmp(nm,PEM_STRING_ECPRIVATEKEY) &&
+                 !strcmp(name,PEM_STRING_EVP_PKEY)) return 1;
         /* Permit older strings */
 
         if(!strcmp(nm,PEM_STRING_X509_OLD) &&
@@ -258,9 +260,9 @@ err:
         }
 
 #ifndef OPENSSL_NO_FP_API
-int PEM_ASN1_write(int (*i2d)(), const char *name, FILE *fp, char *x,
-             const EVP_CIPHER *enc, unsigned char *kstr, int klen,
-             pem_password_cb *callback, void *u)
+int PEM_ASN1_write(i2d_of_void *i2d, const char *name, FILE *fp,
+                   char *x, const EVP_CIPHER *enc, unsigned char *kstr,
+                   int klen, pem_password_cb *callback, void *u)
         {
         BIO *b;
         int ret;
@@ -277,9 +279,9 @@ int PEM_ASN1_write(int (*i2d)(), const char *name, FILE *fp, char *x,
         }
 #endif
 
-int PEM_ASN1_write_bio(int (*i2d)(), const char *name, BIO *bp, char *x,
-             const EVP_CIPHER *enc, unsigned char *kstr, int klen,
-             pem_password_cb *callback, void *u)
+int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp,
+                       char *x, const EVP_CIPHER *enc, unsigned char *kstr,
+                       int klen, pem_password_cb *callback, void *u)
         {
         EVP_CIPHER_CTX ctx;
         int dsize=0,i,j,ret=0;
@@ -336,7 +338,7 @@ int PEM_ASN1_write_bio(int (*i2d)(), const char *name, BIO *bp, char *x,
                         kstr=(unsigned char *)buf;
                         }
                 RAND_add(data,i,0);/* put in the RSA key. */
-                OPENSSL_assert(enc->iv_len <= sizeof iv);
+                OPENSSL_assert(enc->iv_len <= (int)sizeof(iv));
                 if (RAND_pseudo_bytes(iv,enc->iv_len) < 0) /* Generate a salt */
                         goto err;
                 /* The 'iv' is used as the iv and as a salt.  It is
@@ -577,6 +579,7 @@ int PEM_write_bio(BIO *bp, const char *name, char *header, unsigned char *data,
                 }
         EVP_EncodeFinal(&ctx,buf,&outl);
         if ((outl > 0) && (BIO_write(bp,(char *)buf,outl) != outl)) goto err;
+        OPENSSL_cleanse(buf, PEM_BUFSIZE*8);
         OPENSSL_free(buf);
         buf = NULL;
         if (    (BIO_write(bp,"-----END ",9) != 9) ||
@@ -585,8 +588,10 @@ int PEM_write_bio(BIO *bp, const char *name, char *header, unsigned char *data,
                 goto err;
         return(i+outl);
 err:
-        if (buf)
+        if (buf) {
+                OPENSSL_cleanse(buf, PEM_BUFSIZE*8);
                 OPENSSL_free(buf);
+        }
         PEMerr(PEM_F_PEM_WRITE_BIO,reason);
         return(0);
         }
diff --git a/src/lib/libssl/src/crypto/pem/pem_oth.c b/src/lib/libssl/src/crypto/pem/pem_oth.c
index 8d9064ea7c..b33868d25a 100644
--- a/src/lib/libssl/src/crypto/pem/pem_oth.c
+++ b/src/lib/libssl/src/crypto/pem/pem_oth.c
@@ -67,10 +67,11 @@
 
 /* Handle 'other' PEMs: not private keys */
 
-char *PEM_ASN1_read_bio(char *(*d2i)(), const char *name, BIO *bp, char **x,
-             pem_password_cb *cb, void *u)
+void *PEM_ASN1_read_bio(d2i_of_void *d2i, const char *name, BIO *bp, void **x,
+                        pem_password_cb *cb, void *u)
         {
-        unsigned char *p=NULL,*data=NULL;
+        const unsigned char *p=NULL;
+        unsigned char *data=NULL;
         long len;
         char *ret=NULL;
 
diff --git a/src/lib/libssl/src/crypto/pem/pem_pk8.c b/src/lib/libssl/src/crypto/pem/pem_pk8.c
index db38a2a79d..6deab8c338 100644
--- a/src/lib/libssl/src/crypto/pem/pem_pk8.c
+++ b/src/lib/libssl/src/crypto/pem/pem_pk8.c
@@ -118,7 +118,7 @@ static int do_pk8pkey(BIO *bp, EVP_PKEY *x, int isder, int nid, const EVP_CIPHER
         char buf[PEM_BUFSIZE];
         int ret;
         if(!(p8inf = EVP_PKEY2PKCS8(x))) {
-                PEMerr(PEM_F_PEM_WRITE_BIO_PKCS8PRIVATEKEY,
+                PEMerr(PEM_F_DO_PK8PKEY,
                                         PEM_R_ERROR_CONVERTING_PRIVATE_KEY);
                 return 0;
         }
@@ -127,8 +127,7 @@ static int do_pk8pkey(BIO *bp, EVP_PKEY *x, int isder, int nid, const EVP_CIPHER
                         if(!cb) klen = PEM_def_callback(buf, PEM_BUFSIZE, 1, u);
                         else klen = cb(buf, PEM_BUFSIZE, 1, u);
                         if(klen <= 0) {
-                                PEMerr(PEM_F_PEM_WRITE_BIO_PKCS8PRIVATEKEY,
-                                                                PEM_R_READ_KEY);
+                                PEMerr(PEM_F_DO_PK8PKEY,PEM_R_READ_KEY);
                                 PKCS8_PRIV_KEY_INFO_free(p8inf);
                                 return 0;
                         }
@@ -215,7 +214,7 @@ static int do_pk8pkey_fp(FILE *fp, EVP_PKEY *x, int isder, int nid, const EVP_CI
         BIO *bp;
         int ret;
         if(!(bp = BIO_new_fp(fp, BIO_NOCLOSE))) {
-                PEMerr(PEM_F_PEM_F_DO_PK8KEY_FP,ERR_R_BUF_LIB);
+                PEMerr(PEM_F_DO_PK8PKEY_FP,ERR_R_BUF_LIB);
                 return(0);
         }
         ret = do_pk8pkey(bp, x, isder, nid, enc, kstr, klen, cb, u);
diff --git a/src/lib/libssl/src/crypto/pem/pem_pkey.c b/src/lib/libssl/src/crypto/pem/pem_pkey.c
index 9ecdbd5419..4da4c31ce5 100644
--- a/src/lib/libssl/src/crypto/pem/pem_pkey.c
+++ b/src/lib/libssl/src/crypto/pem/pem_pkey.c
@@ -70,7 +70,8 @@
 EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, void *u)
         {
         char *nm=NULL;
-        unsigned char *p=NULL,*data=NULL;
+        const unsigned char *p=NULL;
+        unsigned char *data=NULL;
         long len;
         EVP_PKEY *ret=NULL;
 
@@ -82,6 +83,8 @@ EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, vo
                 ret=d2i_PrivateKey(EVP_PKEY_RSA,x,&p,len);
         else if (strcmp(nm,PEM_STRING_DSA) == 0)
                 ret=d2i_PrivateKey(EVP_PKEY_DSA,x,&p,len);
+        else if (strcmp(nm,PEM_STRING_ECPRIVATEKEY) == 0)
+                ret=d2i_PrivateKey(EVP_PKEY_EC,x,&p,len);
         else if (strcmp(nm,PEM_STRING_PKCS8INF) == 0) {
                 PKCS8_PRIV_KEY_INFO *p8inf;
                 p8inf=d2i_PKCS8_PRIV_KEY_INFO(NULL, &p, len);
@@ -102,7 +105,7 @@ EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, vo
                 if (cb) klen=cb(psbuf,PEM_BUFSIZE,0,u);
                 else klen=PEM_def_callback(psbuf,PEM_BUFSIZE,0,u);
                 if (klen <= 0) {
-                        PEMerr(PEM_F_PEM_ASN1_READ_BIO,
+                        PEMerr(PEM_F_PEM_READ_BIO_PRIVATEKEY,
                                         PEM_R_BAD_PASSWORD_READ);
                         X509_SIG_free(p8);
                         goto err;
@@ -119,9 +122,10 @@ EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb, vo
         }
 p8err:
         if (ret == NULL)
-                PEMerr(PEM_F_PEM_ASN1_READ_BIO,ERR_R_ASN1_LIB);
+                PEMerr(PEM_F_PEM_READ_BIO_PRIVATEKEY,ERR_R_ASN1_LIB);
 err:
         OPENSSL_free(nm);
+        OPENSSL_cleanse(data, len);
         OPENSSL_free(data);
         return(ret);
         }
@@ -134,7 +138,7 @@ EVP_PKEY *PEM_read_PrivateKey(FILE *fp, EVP_PKEY **x, pem_password_cb *cb, void
 
         if ((b=BIO_new(BIO_s_file())) == NULL)
                 {
-                PEMerr(PEM_F_PEM_ASN1_READ,ERR_R_BUF_LIB);
+                PEMerr(PEM_F_PEM_READ_PRIVATEKEY,ERR_R_BUF_LIB);
                 return(0);
                 }
         BIO_set_fp(b,fp,BIO_NOCLOSE);
diff --git a/src/lib/libssl/src/crypto/pem/pem_seal.c b/src/lib/libssl/src/crypto/pem/pem_seal.c
index 56e08abd70..4e554e5481 100644
--- a/src/lib/libssl/src/crypto/pem/pem_seal.c
+++ b/src/lib/libssl/src/crypto/pem/pem_seal.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/opensslconf.h>        /* for OPENSSL_NO_RSA */
 #ifndef OPENSSL_NO_RSA
 #include <stdio.h>
 #include "cryptlib.h"
@@ -64,6 +65,7 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
+#include <openssl/rsa.h>
 
 int PEM_SealInit(PEM_ENCODE_SEAL_CTX *ctx, EVP_CIPHER *type, EVP_MD *md_type,
              unsigned char **ek, int *ekl, unsigned char *iv, EVP_PKEY **pubk,
diff --git a/src/lib/libssl/src/crypto/pem/pem_xaux.c b/src/lib/libssl/src/crypto/pem/pem_xaux.c
index 2f579b5421..63ce660cf1 100644
--- a/src/lib/libssl/src/crypto/pem/pem_xaux.c
+++ b/src/lib/libssl/src/crypto/pem/pem_xaux.c
@@ -66,3 +66,4 @@
 #include <openssl/pem.h>
 
 IMPLEMENT_PEM_rw(X509_AUX, X509, PEM_STRING_X509_TRUSTED, X509_AUX)
+IMPLEMENT_PEM_rw(X509_CERT_PAIR, X509_CERT_PAIR, PEM_STRING_X509_PAIR, X509_CERT_PAIR)
diff --git a/src/lib/libssl/src/crypto/perlasm/cbc.pl b/src/lib/libssl/src/crypto/perlasm/cbc.pl
index 22149c680e..e43dc9ae15 100644
--- a/src/lib/libssl/src/crypto/perlasm/cbc.pl
+++ b/src/lib/libssl/src/crypto/perlasm/cbc.pl
@@ -322,7 +322,8 @@ sub cbc
 
         &function_end_A($name);
 
-        &set_label("cbc_enc_jmp_table",1);
+        &align(64);
+        &set_label("cbc_enc_jmp_table");
         &data_word("0");
         &data_word(&label("ej1")."-".&label("PIC_point"));
         &data_word(&label("ej2")."-".&label("PIC_point"));
@@ -341,6 +342,7 @@ sub cbc
         #&data_word(&label("dj5")."-".&label("PIC_point"));
         #&data_word(&label("dj6")."-".&label("PIC_point"));
         #&data_word(&label("dj7")."-".&label("PIC_point"));
+        &align(64);
 
         &function_end_B($name);
         
diff --git a/src/lib/libssl/src/crypto/perlasm/x86asm.pl b/src/lib/libssl/src/crypto/perlasm/x86asm.pl
index c3de90c65d..f535c9c7fa 100644
--- a/src/lib/libssl/src/crypto/perlasm/x86asm.pl
+++ b/src/lib/libssl/src/crypto/perlasm/x86asm.pl
@@ -18,7 +18,7 @@ sub main'asm_init
         ($type,$fn,$i386)=@_;
         $filename=$fn;
 
-        $elf=$cpp=$sol=$aout=$win32=$gaswin=$openbsd=0;
+        $elf=$cpp=$coff=$aout=$win32=$netware=$mwerks=$openbsd=0;
         if (    ($type eq "elf"))
                 { $elf=1; require "x86unix.pl"; }
         elsif ( ($type eq "openbsd-elf"))
@@ -27,28 +27,31 @@ sub main'asm_init
                 { $openbsd=1; require "x86unix.pl"; }
         elsif ( ($type eq "a.out"))
                 { $aout=1; require "x86unix.pl"; }
-        elsif ( ($type eq "gaswin"))
-                { $gaswin=1; $aout=1; require "x86unix.pl"; }
-        elsif ( ($type eq "sol"))
-                { $sol=1; require "x86unix.pl"; }
+        elsif ( ($type eq "coff" or $type eq "gaswin"))
+                { $coff=1; require "x86unix.pl"; }
         elsif ( ($type eq "cpp"))
                 { $cpp=1; require "x86unix.pl"; }
         elsif ( ($type eq "win32"))
                 { $win32=1; require "x86ms.pl"; }
         elsif ( ($type eq "win32n"))
                 { $win32=1; require "x86nasm.pl"; }
+        elsif ( ($type eq "nw-nasm"))
+                { $netware=1; require "x86nasm.pl"; }
+        elsif ( ($type eq "nw-mwasm"))
+                { $netware=1; $mwerks=1; require "x86nasm.pl"; }
         else
                 {
                 print STDERR <<"EOF";
 Pick one target type from
-        elf     - linux, FreeBSD etc
-        a.out   - old linux
-        sol     - x86 solaris
-        cpp     - format so x86unix.cpp can be used
+        elf     - Linux, FreeBSD, Solaris x86, etc.
+        a.out   - OpenBSD, DJGPP, etc.
+        coff    - GAS/COFF such as Win32 targets
         win32   - Windows 95/Windows NT
         win32n  - Windows 95/Windows NT NASM format
         openbsd-elf     - OpenBSD elf
         openbsd-a.out   - OpenBSD a.out
+        nw-nasm - NetWare NASM format
+        nw-mwasm- NetWare Metrowerks Assembler
 EOF
                 exit(1);
                 }
@@ -61,7 +64,7 @@ EOF
 &comment("Don't even think of reading this code");
 &comment("It was automatically generated by $filename");
 &comment("Which is a perl program used to generate the x86 assember for");
-&comment("any of elf, a.out, BSDI, Win32, gaswin (for GNU as on Win32) or Solaris");
+&comment("any of ELF, a.out, COFF, Win32, ...");
 &comment("eric <eay\@cryptsoft.com>");
 &comment("");
 
@@ -96,7 +99,7 @@ $tmp
 #ifdef OUT
 #define OK      1
 #define ALIGN   4
-#if defined(__CYGWIN__) || defined(__DJGPP__) || defined(__MINGW32__)
+#if defined(__CYGWIN__) || defined(__DJGPP__) || (__MINGW32__)
 #undef SIZE
 #undef TYPE
 #define SIZE(a,b)
@@ -130,6 +133,4 @@ BSDI - a.out with a very primative version of as.
 EOF
         }
 
-sub main'align() {} # swallow align statements in 0.9.7 context
-
 1;
diff --git a/src/lib/libssl/src/crypto/perlasm/x86ms.pl b/src/lib/libssl/src/crypto/perlasm/x86ms.pl
index b6bd744057..a0be2934c2 100644
--- a/src/lib/libssl/src/crypto/perlasm/x86ms.pl
+++ b/src/lib/libssl/src/crypto/perlasm/x86ms.pl
@@ -27,7 +27,13 @@ $label="L000";
 sub main'asm_init_output { @out=(); }
 sub main'asm_get_output { return(@out); }
 sub main'get_labels { return(@labels); }
-sub main'external_label { push(@labels,@_); }
+sub main'external_label
+{
+        push(@labels,@_);
+        foreach (@_) {
+                push(@out, "EXTRN\t_$_:DWORD\n");
+        }
+}
 
 sub main'LB
         {
@@ -51,6 +57,11 @@ sub main'DWP
         &get_mem("DWORD",@_);
         }
 
+sub main'QWP
+        {
+        &get_mem("QWORD",@_);
+        }
+
 sub main'BC
         {
         return @_;
@@ -87,7 +98,7 @@ sub get_mem
                 $reg2=&conv($1);
                 $addr="_$2";
                 }
-        elsif ($addr =~ /^[_a-zA-Z]/)
+        elsif ($addr =~ /^[_a-z][_a-z0-9]*$/i)
                 {
                 $addr="_$addr";
                 }
@@ -128,12 +139,14 @@ sub main'xorb	{ &out2("xor",@_); }
 sub main'add    { &out2("add",@_); }
 sub main'adc    { &out2("adc",@_); }
 sub main'sub    { &out2("sub",@_); }
+sub main'sbb    { &out2("sbb",@_); }
 sub main'rotl   { &out2("rol",@_); }
 sub main'rotr   { &out2("ror",@_); }
 sub main'exch   { &out2("xchg",@_); }
 sub main'cmp    { &out2("cmp",@_); }
 sub main'lea    { &out2("lea",@_); }
 sub main'mul    { &out1("mul",@_); }
+sub main'imul   { &out2("imul",@_); }
 sub main'div    { &out1("div",@_); }
 sub main'dec    { &out1("dec",@_); }
 sub main'inc    { &out1("inc",@_); }
@@ -155,26 +168,54 @@ sub main'jne	{ &out1("jne",@_); }
 sub main'jno    { &out1("jno",@_); }
 sub main'push   { &out1("push",@_); $stack+=4; }
 sub main'pop    { &out1("pop",@_); $stack-=4; }
+sub main'pushf  { &out0("pushfd"); $stack+=4; }
+sub main'popf   { &out0("popfd"); $stack-=4; }
 sub main'bswap  { &out1("bswap",@_); &using486(); }
 sub main'not    { &out1("not",@_); }
 sub main'call   { &out1("call",($_[0]=~/^\$L/?'':'_').$_[0]); }
+sub main'call_ptr { &out1p("call",@_); }
 sub main'ret    { &out0("ret"); }
 sub main'nop    { &out0("nop"); }
+sub main'test   { &out2("test",@_); }
+sub main'bt     { &out2("bt",@_); }
+sub main'leave  { &out0("leave"); }
+sub main'cpuid  { &out0("DW\t0A20Fh"); }
+sub main'rdtsc  { &out0("DW\t0310Fh"); }
+sub main'halt   { &out0("hlt"); }
 sub main'movz   { &out2("movzx",@_); }
+sub main'neg    { &out1("neg",@_); }
+sub main'cld    { &out0("cld"); }
+
+# SSE2
+sub main'emms   { &out0("emms"); }
+sub main'movd   { &out2("movd",@_); }
+sub main'movq   { &out2("movq",@_); }
+sub main'movdqu { &out2("movdqu",@_); }
+sub main'movdqa { &out2("movdqa",@_); }
+sub main'movdq2q{ &out2("movdq2q",@_); }
+sub main'movq2dq{ &out2("movq2dq",@_); }
+sub main'paddq  { &out2("paddq",@_); }
+sub main'pmuludq{ &out2("pmuludq",@_); }
+sub main'psrlq  { &out2("psrlq",@_); }
+sub main'psllq  { &out2("psllq",@_); }
+sub main'pxor   { &out2("pxor",@_); }
+sub main'por    { &out2("por",@_); }
+sub main'pand   { &out2("pand",@_); }
 
 sub out2
         {
         local($name,$p1,$p2)=@_;
-        local($l,$t);
+        local($l,$t,$line);
 
-        push(@out,"\t$name\t");
+        $line="\t$name\t";
         $t=&conv($p1).",";
         $l=length($t);
-        push(@out,$t);
+        $line.="$t";
         $l=4-($l+9)/8;
-        push(@out,"\t" x $l);
-        push(@out,&conv($p2));
-        push(@out,"\n");
+        $line.="\t" x $l;
+        $line.=&conv($p2);
+        if ($line=~/\bxmm[0-7]\b/i) { $line=~s/\b[A-Z]+WORD\s+PTR/XMMWORD PTR/i; }
+        push(@out,$line."\n");
         }
 
 sub out0
@@ -214,7 +255,9 @@ sub main'file
         local($tmp)=<<"EOF";
         TITLE   $file.asm
         .386
-.model FLAT
+.model  FLAT
+_TEXT\$ SEGMENT PAGE 'CODE'
+
 EOF
         push(@out,$tmp);
         }
@@ -226,7 +269,6 @@ sub main'function_begin
         push(@labels,$func);
 
         local($tmp)=<<"EOF";
-_TEXT   SEGMENT
 PUBLIC  _$func
 $extra
 _$func PROC NEAR
@@ -244,7 +286,6 @@ sub main'function_begin_B
         local($func,$extra)=@_;
 
         local($tmp)=<<"EOF";
-_TEXT   SEGMENT
 PUBLIC  _$func
 $extra
 _$func PROC NEAR
@@ -264,7 +305,6 @@ sub main'function_end
         pop     ebp
         ret
 _$func ENDP
-_TEXT   ENDS
 EOF
         push(@out,$tmp);
         $stack=0;
@@ -277,7 +317,6 @@ sub main'function_end_B
 
         local($tmp)=<<"EOF";
 _$func ENDP
-_TEXT   ENDS
 EOF
         push(@out,$tmp);
         $stack=0;
@@ -300,6 +339,20 @@ EOF
 
 sub main'file_end
         {
+        # try to detect if SSE2 or MMX extensions were used...
+        my $xmmheader=<<___;
+.686
+.XMM
+IF \@Version LT 800
+XMMWORD STRUCT 16
+        DQ  2 dup (?)
+XMMWORD ENDS
+ENDIF
+___
+        if (grep {/\b[x]?mm[0-7]\b/i} @out) {
+                grep {s/\.[3-7]86/$xmmheader/} @out;
+                }
+        push(@out,"_TEXT\$      ENDS\n");
         push(@out,"END\n");
         }
 
@@ -331,6 +384,12 @@ sub main'comment
                 }
         }
 
+sub main'public_label
+        {
+        $label{$_[0]}="_$_[0]"  if (!defined($label{$_[0]}));
+        push(@out,"PUBLIC\t$label{$_[0]}\n");
+        }
+
 sub main'label
         {
         if (!defined($label{$_[0]}))
@@ -348,19 +407,37 @@ sub main'set_label
                 $label{$_[0]}="\$${label}${_[0]}";
                 $label++;
                 }
+        if ($_[1]!=0 && $_[1]>1)
+                {
+                main'align($_[1]);
+                }
         if((defined $_[2]) && ($_[2] == 1))
                 {
                 push(@out,"$label{$_[0]}::\n");
                 }
+        elsif ($label{$_[0]} !~ /^\$/)
+                {
+                push(@out,"$label{$_[0]}\tLABEL PTR\n");
+                }
         else
                 {
                 push(@out,"$label{$_[0]}:\n");
                 }
         }
 
+sub main'data_byte
+        {
+        push(@out,"\tDB\t".join(',',@_)."\n");
+        }
+
 sub main'data_word
         {
-        push(@out,"\tDD\t$_[0]\n");
+        push(@out,"\tDD\t".join(',',@_)."\n");
+        }
+
+sub main'align
+        {
+        push(@out,"\tALIGN\t$_[0]\n");
         }
 
 sub out1p
@@ -368,7 +445,7 @@ sub out1p
         local($name,$p1)=@_;
         local($l,$t);
 
-        push(@out,"\t$name\t ".&conv($p1)."\n");
+        push(@out,"\t$name\t".&conv($p1)."\n");
         }
 
 sub main'picmeup
@@ -378,3 +455,18 @@ sub main'picmeup
         }
 
 sub main'blindpop { &out1("pop",@_); }
+
+sub main'initseg 
+        {
+        local($f)=@_;
+        local($tmp)=<<___;
+OPTION  DOTNAME
+.CRT\$XCU       SEGMENT DWORD PUBLIC 'DATA'
+EXTRN   _$f:NEAR
+DD      _$f
+.CRT\$XCU       ENDS
+___
+        push(@out,$tmp);
+        }
+
+1;
diff --git a/src/lib/libssl/src/crypto/perlasm/x86nasm.pl b/src/lib/libssl/src/crypto/perlasm/x86nasm.pl
index 4bdb3fe180..fa38f89c09 100644
--- a/src/lib/libssl/src/crypto/perlasm/x86nasm.pl
+++ b/src/lib/libssl/src/crypto/perlasm/x86nasm.pl
@@ -3,6 +3,7 @@
 package x86nasm;
 
 $label="L000";
+$under=($main'netware)?'':'_';
 
 %lb=(   'eax',  'al',
         'ebx',  'bl',
@@ -32,7 +33,8 @@ sub main'external_label
 {
         push(@labels,@_);
         foreach (@_) {
-                push(@out, "extern\t_$_\n");
+                push(@out,".") if ($main'mwerks);
+                push(@out, "extern\t${under}$_\n");
         }
 }
 
@@ -58,14 +60,19 @@ sub main'DWP
         &get_mem("DWORD",@_);
         }
 
+sub main'QWP
+        {
+        &get_mem("",@_);
+        }
+
 sub main'BC
         {
-        return "BYTE @_";
+        return (($main'mwerks)?"":"BYTE ")."@_";
         }
 
 sub main'DWC
         {
-        return "DWORD @_";
+        return (($main'mwerks)?"":"DWORD ")."@_";
         }
 
 sub main'stack_push
@@ -86,16 +93,22 @@ sub get_mem
         {
         my($size,$addr,$reg1,$reg2,$idx)=@_;
         my($t,$post);
-        my($ret)="$size [";
+        my($ret)=$size;
+        if ($ret ne "")
+                {
+                $ret .= " PTR" if ($main'mwerks);
+                $ret .= " ";
+                }
+        $ret .= "[";
         $addr =~ s/^\s+//;
         if ($addr =~ /^(.+)\+(.+)$/)
                 {
                 $reg2=&conv($1);
-                $addr="_$2";
+                $addr="$under$2";
                 }
-        elsif ($addr =~ /^[_a-zA-Z]/)
+        elsif ($addr =~ /^[_a-z][_a-z0-9]*$/i)
                 {
-                $addr="_$addr";
+                $addr="$under$addr";
                 }
 
         if ($addr =~ /^.+\-.+$/) { $addr="($addr)"; }
@@ -134,12 +147,14 @@ sub main'xorb	{ &out2("xor",@_); }
 sub main'add    { &out2("add",@_); }
 sub main'adc    { &out2("adc",@_); }
 sub main'sub    { &out2("sub",@_); }
+sub main'sbb    { &out2("sbb",@_); }
 sub main'rotl   { &out2("rol",@_); }
 sub main'rotr   { &out2("ror",@_); }
 sub main'exch   { &out2("xchg",@_); }
 sub main'cmp    { &out2("cmp",@_); }
 sub main'lea    { &out2("lea",@_); }
 sub main'mul    { &out1("mul",@_); }
+sub main'imul   { &out2("imul",@_); }
 sub main'div    { &out1("div",@_); }
 sub main'dec    { &out1("dec",@_); }
 sub main'inc    { &out1("inc",@_); }
@@ -147,29 +162,57 @@ sub main'jmp	{ &out1("jmp",@_); }
 sub main'jmp_ptr { &out1p("jmp",@_); }
 
 # This is a bit of a kludge: declare all branches as NEAR.
-sub main'je     { &out1("je NEAR",@_); }
-sub main'jle    { &out1("jle NEAR",@_); }
-sub main'jz     { &out1("jz NEAR",@_); }
-sub main'jge    { &out1("jge NEAR",@_); }
-sub main'jl     { &out1("jl NEAR",@_); }
-sub main'ja     { &out1("ja NEAR",@_); }
-sub main'jae    { &out1("jae NEAR",@_); }
-sub main'jb     { &out1("jb NEAR",@_); }
-sub main'jbe    { &out1("jbe NEAR",@_); }
-sub main'jc     { &out1("jc NEAR",@_); }
-sub main'jnc    { &out1("jnc NEAR",@_); }
-sub main'jnz    { &out1("jnz NEAR",@_); }
-sub main'jne    { &out1("jne NEAR",@_); }
-sub main'jno    { &out1("jno NEAR",@_); }
+$near=($main'mwerks)?'':'NEAR';
+sub main'je     { &out1("je $near",@_); }
+sub main'jle    { &out1("jle $near",@_); }
+sub main'jz     { &out1("jz $near",@_); }
+sub main'jge    { &out1("jge $near",@_); }
+sub main'jl     { &out1("jl $near",@_); }
+sub main'ja     { &out1("ja $near",@_); }
+sub main'jae    { &out1("jae $near",@_); }
+sub main'jb     { &out1("jb $near",@_); }
+sub main'jbe    { &out1("jbe $near",@_); }
+sub main'jc     { &out1("jc $near",@_); }
+sub main'jnc    { &out1("jnc $near",@_); }
+sub main'jnz    { &out1("jnz $near",@_); }
+sub main'jne    { &out1("jne $near",@_); }
+sub main'jno    { &out1("jno $near",@_); }
 
 sub main'push   { &out1("push",@_); $stack+=4; }
 sub main'pop    { &out1("pop",@_); $stack-=4; }
+sub main'pushf  { &out0("pushfd"); $stack+=4; }
+sub main'popf   { &out0("popfd"); $stack-=4; }
 sub main'bswap  { &out1("bswap",@_); &using486(); }
 sub main'not    { &out1("not",@_); }
-sub main'call   { &out1("call",($_[0]=~/^\$L/?'':'_').$_[0]); }
+sub main'call   { &out1("call",($_[0]=~/^\@L/?'':$under).$_[0]); }
+sub main'call_ptr { &out1p("call",@_); }
 sub main'ret    { &out0("ret"); }
 sub main'nop    { &out0("nop"); }
+sub main'test   { &out2("test",@_); }
+sub main'bt     { &out2("bt",@_); }
+sub main'leave  { &out0("leave"); }
+sub main'cpuid  { &out0("cpuid"); }
+sub main'rdtsc  { &out0("rdtsc"); }
+sub main'halt   { &out0("hlt"); }
 sub main'movz   { &out2("movzx",@_); }
+sub main'neg    { &out1("neg",@_); }
+sub main'cld    { &out0("cld"); }
+
+# SSE2
+sub main'emms   { &out0("emms"); }
+sub main'movd   { &out2("movd",@_); }
+sub main'movq   { &out2("movq",@_); }
+sub main'movdqu { &out2("movdqu",@_); }
+sub main'movdqa { &out2("movdqa",@_); }
+sub main'movdq2q{ &out2("movdq2q",@_); }
+sub main'movq2dq{ &out2("movq2dq",@_); }
+sub main'paddq  { &out2("paddq",@_); }
+sub main'pmuludq{ &out2("pmuludq",@_); }
+sub main'psrlq  { &out2("psrlq",@_); }
+sub main'psllq  { &out2("psllq",@_); }
+sub main'pxor   { &out2("pxor",@_); }
+sub main'por    { &out2("por",@_); }
+sub main'pand   { &out2("pand",@_); }
 
 sub out2
         {
@@ -177,7 +220,7 @@ sub out2
         my($l,$t);
 
         push(@out,"\t$name\t");
-        if ($name eq "lea")
+        if (!$main'mwerks and $name eq "lea")
                 {
                 $p1 =~ s/^[^\[]*\[/\[/;
                 $p2 =~ s/^[^\[]*\[/\[/;
@@ -221,15 +264,17 @@ sub using486
 
 sub main'file
         {
-        local $tmp;
-        $tmp=<<___;
+        if ($main'mwerks)       { push(@out,".section\t.text\n"); }
+        else    {
+                local $tmp=<<___;
 %ifdef __omf__
 section code    use32 class=code
 %else
 section .text
 %endif
 ___
-        push(@out,$tmp);
+                push(@out,$tmp);
+                }
         }
 
 sub main'function_begin
@@ -237,9 +282,10 @@ sub main'function_begin
         my($func,$extra)=@_;
 
         push(@labels,$func);
+        push(@out,".") if ($main'mwerks);
         my($tmp)=<<"EOF";
-global  _$func
-_$func:
+global  $under$func
+$under$func:
         push    ebp
         push    ebx
         push    esi
@@ -252,9 +298,10 @@ EOF
 sub main'function_begin_B
         {
         my($func,$extra)=@_;
+        push(@out,".") if ($main'mwerks);
         my($tmp)=<<"EOF";
-global  _$func
-_$func:
+global  $under$func
+$under$func:
 EOF
         push(@out,$tmp);
         $stack=4;
@@ -328,11 +375,18 @@ sub main'comment
                 }
         }
 
+sub main'public_label
+        {
+        $label{$_[0]}="${under}${_[0]}" if (!defined($label{$_[0]}));
+        push(@out,".") if ($main'mwerks);
+        push(@out,"global\t$label{$_[0]}\n");
+        }
+
 sub main'label
         {
         if (!defined($label{$_[0]}))
                 {
-                $label{$_[0]}="\$${label}${_[0]}";
+                $label{$_[0]}="\@${label}${_[0]}";
                 $label++;
                 }
         return($label{$_[0]});
@@ -342,15 +396,30 @@ sub main'set_label
         {
         if (!defined($label{$_[0]}))
                 {
-                $label{$_[0]}="\$${label}${_[0]}";
+                $label{$_[0]}="\@${label}${_[0]}";
                 $label++;
                 }
+        if ($_[1]!=0 && $_[1]>1)
+                {
+                main'align($_[1]);
+                }
         push(@out,"$label{$_[0]}:\n");
         }
 
+sub main'data_byte
+        {
+        push(@out,(($main'mwerks)?".byte\t":"DB\t").join(',',@_)."\n");
+        }
+
 sub main'data_word
         {
-        push(@out,"\tDD\t$_[0]\n");
+        push(@out,(($main'mwerks)?".long\t":"DD\t").join(',',@_)."\n");
+        }
+
+sub main'align
+        {
+        push(@out,".") if ($main'mwerks);
+        push(@out,"align\t$_[0]\n");
         }
 
 sub out1p
@@ -358,7 +427,7 @@ sub out1p
         my($name,$p1)=@_;
         my($l,$t);
 
-        push(@out,"\t$name\t ".&conv($p1)."\n");
+        push(@out,"\t$name\t".&conv($p1)."\n");
         }
 
 sub main'picmeup
@@ -368,3 +437,19 @@ sub main'picmeup
         }
 
 sub main'blindpop { &out1("pop",@_); }
+
+sub main'initseg
+        {
+        local($f)=@_;
+        if ($main'win32)
+                {
+                local($tmp)=<<___;
+segment .CRT\$XCU data
+extern  $under$f
+DD      $under$f
+___
+                push(@out,$tmp);
+                }
+        }
+
+1;
diff --git a/src/lib/libssl/src/crypto/perlasm/x86unix.pl b/src/lib/libssl/src/crypto/perlasm/x86unix.pl
index b61425e951..02d72a32bc 100644
--- a/src/lib/libssl/src/crypto/perlasm/x86unix.pl
+++ b/src/lib/libssl/src/crypto/perlasm/x86unix.pl
@@ -1,14 +1,15 @@
 #!/usr/local/bin/perl
 
-package x86unix;
+package x86unix;        # GAS actually...
 
 $label="L000";
 $const="";
 $constl=0;
 
 $align=($main'aout)?"4":"16";
-$under=($main'aout)?"_":"";
-$com_start=($main'sol)?"/":"#";
+$under=($main'aout or $main'coff)?"_":"";
+$dot=($main'aout)?"":".";
+$com_start="#" if ($main'aout or $main'coff);
 
 sub main'asm_init_output { @out=(); }
 sub main'asm_get_output { return(@out); }
@@ -57,6 +58,24 @@ if ($main'cpp)
         'edi',  '%edi',
         'ebp',  '%ebp',
         'esp',  '%esp',
+
+        'mm0',  '%mm0',
+        'mm1',  '%mm1',
+        'mm2',  '%mm2',
+        'mm3',  '%mm3',
+        'mm4',  '%mm4',
+        'mm5',  '%mm5',
+        'mm6',  '%mm6',
+        'mm7',  '%mm7',
+
+        'xmm0', '%xmm0',
+        'xmm1', '%xmm1',
+        'xmm2', '%xmm2',
+        'xmm3', '%xmm3',
+        'xmm4', '%xmm4',
+        'xmm5', '%xmm5',
+        'xmm6', '%xmm6',
+        'xmm7', '%xmm7',
         );
 
 %reg_val=(
@@ -103,6 +122,11 @@ sub main'DWP
         return($ret);
         }
 
+sub main'QWP
+        {
+        return(&main'DWP(@_));
+        }
+
 sub main'BP
         {
         return(&main'DWP(@_));
@@ -146,12 +170,14 @@ sub main'xorb	{ &out2("xorb",@_); }
 sub main'add    { &out2($_[0]=~/%[a-d][lh]/?"addb":"addl",@_); }
 sub main'adc    { &out2("adcl",@_); }
 sub main'sub    { &out2("subl",@_); }
+sub main'sbb    { &out2("sbbl",@_); }
 sub main'rotl   { &out2("roll",@_); }
 sub main'rotr   { &out2("rorl",@_); }
 sub main'exch   { &out2($_[0]=~/%[a-d][lh]/?"xchgb":"xchgl",@_); }
 sub main'cmp    { &out2("cmpl",@_); }
 sub main'lea    { &out2("leal",@_); }
 sub main'mul    { &out1("mull",@_); }
+sub main'imul   { &out2("imull",@_); }
 sub main'div    { &out1("divl",@_); }
 sub main'jmp    { &out1("jmp",@_); }
 sub main'jmp_ptr { &out1p("jmp",@_); }
@@ -173,15 +199,48 @@ sub main'dec	{ &out1("decl",@_); }
 sub main'inc    { &out1($_[0]=~/%[a-d][hl]/?"incb":"incl",@_); }
 sub main'push   { &out1("pushl",@_); $stack+=4; }
 sub main'pop    { &out1("popl",@_); $stack-=4; }
-sub main'pushf  { &out0("pushf"); $stack+=4; }
-sub main'popf   { &out0("popf"); $stack-=4; }
+sub main'pushf  { &out0("pushfl"); $stack+=4; }
+sub main'popf   { &out0("popfl"); $stack-=4; }
 sub main'not    { &out1("notl",@_); }
-sub main'call   { &out1("call",($_[0]=~/^\.L/?'':$under).$_[0]); }
+sub main'call   {       my $pre=$under;
+                        foreach $i (%label)
+                        { if ($label{$i} eq $_[0]) { $pre=''; last; } }
+                        &out1("call",$pre.$_[0]);
+                }
+sub main'call_ptr { &out1p("call",@_); }
 sub main'ret    { &out0("ret"); }
 sub main'nop    { &out0("nop"); }
-sub main'test   { &out2("testl",@_); }
+sub main'test   { &out2("testl",@_); }
+sub main'bt     { &out2("btl",@_); }
+sub main'leave  { &out0("leave"); }
+sub main'cpuid  { &out0(".byte\t0x0f,0xa2"); }
+sub main'rdtsc  { &out0(".byte\t0x0f,0x31"); }
+sub main'halt   { &out0("hlt"); }
 sub main'movz   { &out2("movzbl",@_); }
-sub main'neg    { &out1("negl",@_); }
+sub main'neg    { &out1("negl",@_); }
+sub main'cld    { &out0("cld"); }
+
+# SSE2
+sub main'emms   { &out0("emms"); }
+sub main'movd   { &out2("movd",@_); }
+sub main'movdqu { &out2("movdqu",@_); }
+sub main'movdqa { &out2("movdqa",@_); }
+sub main'movdq2q{ &out2("movdq2q",@_); }
+sub main'movq2dq{ &out2("movq2dq",@_); }
+sub main'paddq  { &out2("paddq",@_); }
+sub main'pmuludq{ &out2("pmuludq",@_); }
+sub main'psrlq  { &out2("psrlq",@_); }
+sub main'psllq  { &out2("psllq",@_); }
+sub main'pxor   { &out2("pxor",@_); }
+sub main'por    { &out2("por",@_); }
+sub main'pand   { &out2("pand",@_); }
+sub main'movq   {
+        local($p1,$p2,$optimize)=@_;
+        if ($optimize && $p1=~/^mm[0-7]$/ && $p2=~/^mm[0-7]$/)
+                # movq between mmx registers can sink Intel CPUs
+                {       push(@out,"\tpshufw\t\$0xe4,%$p2,%$p1\n");      }
+        else    {       &out2("movq",@_);                               }
+        }
 
 # The bswapl instruction is new for the 486. Emulate if i386.
 sub main'bswap
@@ -290,8 +349,6 @@ sub main'file
 
         local($tmp)=<<"EOF";
         .file   "$file.s"
-        .version        "01.01"
-gcc2_compiled.:
 EOF
         push(@out,$tmp);
         }
@@ -308,15 +365,17 @@ sub main'function_begin
 
         local($tmp)=<<"EOF";
 .text
-        .align $align
-.globl $func
+.globl  $func
 EOF
         push(@out,$tmp);
         if ($main'cpp)
-                { $tmp=push(@out,"\tTYPE($func,\@function)\n"); }
-        elsif ($main'gaswin)
-                { $tmp=push(@out,"\t.def\t$func;\t.scl\t2;\t.type\t32;\t.endef\n"); }
-        else    { $tmp=push(@out,"\t.type\t$func,\@function\n"); }
+                { $tmp=push(@out,"TYPE($func,\@function)\n"); }
+        elsif ($main'coff)
+                { $tmp=push(@out,".def\t$func;\t.scl\t2;\t.type\t32;\t.endef\n"); }
+        elsif ($main'aout and !$main'pic)
+                { }
+        else    { $tmp=push(@out,".type\t$func,\@function\n"); }
+        push(@out,".align\t$align\n");
         push(@out,"$func:\n");
 skip:
         $tmp=<<"EOF";
@@ -342,15 +401,17 @@ sub main'function_begin_B
 
         local($tmp)=<<"EOF";
 .text
-        .align $align
-.globl $func
+.globl  $func
 EOF
         push(@out,$tmp);
         if ($main'cpp)
-                { push(@out,"\tTYPE($func,\@function)\n"); }
-        elsif ($main'gaswin)
-                { $tmp=push(@out,"\t.def\t$func;\t.scl\t2;\t.type\t32;\t.endef\n"); }
-        else    { push(@out,"\t.type    $func,\@function\n"); }
+                { push(@out,"TYPE($func,\@function)\n"); }
+        elsif ($main'coff)
+                { $tmp=push(@out,".def\t$func;\t.scl\t2;\t.type\t32;\t.endef\n"); }
+        elsif ($main'aout and !$main'pic)
+                { }
+        else    { push(@out,".type      $func,\@function\n"); }
+        push(@out,".align\t$align\n");
         push(@out,"$func:\n");
 skip:
         $stack=4;
@@ -368,15 +429,15 @@ sub main'function_end
         popl    %ebx
         popl    %ebp
         ret
-.L_${func}_end:
+${dot}L_${func}_end:
 EOF
         push(@out,$tmp);
 
         if ($main'cpp)
-                { push(@out,"\tSIZE($func,.L_${func}_end-$func)\n"); }
-        elsif ($main'gaswin)
-                { $tmp=push(@out,"\t.align 4\n"); }
-        else    { push(@out,"\t.size\t$func,.L_${func}_end-$func\n"); }
+                { push(@out,"SIZE($func,${dot}L_${func}_end-$func)\n"); }
+        elsif ($main'coff or $main'aout)
+                { }
+        else    { push(@out,".size\t$func,${dot}L_${func}_end-$func\n"); }
         push(@out,".ident       \"$func\"\n");
         $stack=0;
         %label=();
@@ -402,13 +463,13 @@ sub main'function_end_B
 
         $func=$under.$func;
 
-        push(@out,".L_${func}_end:\n");
+        push(@out,"${dot}L_${func}_end:\n");
         if ($main'cpp)
-                { push(@out,"\tSIZE($func,.L_${func}_end-$func)\n"); }
-        elsif ($main'gaswin)
-                { push(@out,"\t.align 4\n"); }
-        else    { push(@out,"\t.size\t$func,.L_${func}_end-$func\n"); }
-        push(@out,".ident       \"desasm.pl\"\n");
+                { push(@out,"SIZE($func,${dot}L_${func}_end-$func)\n"); }
+        elsif ($main'coff or $main'aout)
+                { }
+        else    { push(@out,".size\t$func,${dot}L_${func}_end-$func\n"); }
+        push(@out,".ident       \"$func\"\n");
         $stack=0;
         %label=();
         }
@@ -449,10 +510,10 @@ sub main'swtmp
 
 sub main'comment
         {
-        if (!$main'openbsd && $main'elf)
+        if (!defined($com_start) or $main'elf)
+                {       # Regarding $main'elf above...
                         # GNU and SVR4 as'es use different comment delimiters,
-                {       # so we just skip comments...
-                push(@out,"\n");
+                push(@out,"\n");        # so we just skip ELF comments...
                 return;
                 }
         foreach (@_)
@@ -465,16 +526,16 @@ sub main'comment
         }
 
 sub main'public_label
-        {
-        $label{$_[0]}="${under}${_[0]}" if (!defined($label{$_[0]}));
-        push(@out,".globl\t$label{$_[0]}\n");
-        }
+        {
+        $label{$_[0]}="${under}${_[0]}" if (!defined($label{$_[0]}));
+        push(@out,".globl\t$label{$_[0]}\n");
+        }
 
 sub main'label
         {
         if (!defined($label{$_[0]}))
                 {
-                $label{$_[0]}=".${label}${_[0]}";
+                $label{$_[0]}="${dot}${label}${_[0]}";
                 $label++;
                 }
         return($label{$_[0]});
@@ -484,18 +545,35 @@ sub main'set_label
         {
         if (!defined($label{$_[0]}))
                 {
-                $label{$_[0]}=".${label}${_[0]}";
+                $label{$_[0]}="${dot}${label}${_[0]}";
                 $label++;
                 }
-        if ($main'openbsd)
-                { push(@out,"_ALIGN_TEXT\n") if ($_[1] != 0); }
-        else
-                { push(@out,".align $align\n") if ($_[1] != 0); }
+        if ($_[1]!=0)
+                {
+                if ($_[1]>1)    { main'align($_[1]);            }
+                else
+                        {
+                        if ($main'openbsd)
+                                { push(@out,"_ALIGN_TEXT\n"); }
+                        else
+                                { push(@out,".align $align\n"); }
+                        }
+                }
         push(@out,"$label{$_[0]}:\n");
         }
 
 sub main'file_end
         {
+        # try to detect if SSE2 or MMX extensions were used on ELF platform...
+        if ($main'elf && grep {/\b%[x]*mm[0-7]\b|OPENSSL_ia32cap_P\b/i} @out) {
+                local($tmp);
+
+                push (@out,"\n.section\t.bss\n");
+                push (@out,".comm\t${under}OPENSSL_ia32cap_P,4,4\n");
+
+                return;
+        }
+
         if ($const ne "")
                 {
                 push(@out,".section .rodata\n");
@@ -504,11 +582,31 @@ sub main'file_end
                 }
         }
 
+sub main'data_byte
+        {
+        push(@out,"\t.byte\t".join(',',@_)."\n");
+        }
+
 sub main'data_word
         {
         push(@out,"\t.long\t".join(',',@_)."\n");
         }
 
+sub main'align
+        {
+        my $val=$_[0],$p2,$i;
+        if ($main'aout) {
+                for ($p2=0;$val!=0;$val>>=1) { $p2++; }
+                $val=$p2-1;
+                $val.=",0x90";
+        }
+        push(@out,".align\t$val\n");
+        if ($main'openbsd)
+                { push(@out,"_ALIGN_TEXT\n"); }
+        else
+                { push(@out,".align $tval\n"); }
+        }
+
 # debug output functions: puts, putx, printf
 
 sub main'puts
@@ -588,7 +686,6 @@ sub main'picmeup
                 {
                 local($tmp)=<<___;
 #if (defined(ELF) || defined(SOL)) && defined(PIC)
-        .align  8
         call    1f
 1:      popl    $regs{$dst}
         addl    \$_GLOBAL_OFFSET_TABLE_+[.-1b],$regs{$dst}
@@ -611,13 +708,12 @@ ___
                 }
         elsif ($main'pic && ($main'elf || $main'aout))
                 {
-                push(@out,"\t.align\t8\n");
                 &main'call(&main'label("PIC_me_up"));
                 &main'set_label("PIC_me_up");
                 &main'blindpop($dst);
-                &main'add($dst,"\$$under"."_GLOBAL_OFFSET_TABLE_+[.-".
+                &main'add($dst,"\$${under}_GLOBAL_OFFSET_TABLE_+[.-".
                                 &main'label("PIC_me_up") . "]");
-                &main'mov($dst,&main'DWP($sym."\@GOT",$dst));
+                &main'mov($dst,&main'DWP($under.$sym."\@GOT",$dst));
                 }
         else
                 {
@@ -626,3 +722,41 @@ ___
         }
 
 sub main'blindpop { &out1("popl",@_); }
+
+sub main'initseg
+        {
+        local($f)=@_;
+        local($tmp);
+        if ($main'elf)
+                {
+                $tmp=<<___;
+.section        .init
+        call    $under$f
+        jmp     .Linitalign
+.align  $align
+.Linitalign:
+___
+                }
+        elsif ($main'coff)
+                {
+                $tmp=<<___;     # applies to both Cygwin and Mingw
+.section        .ctors
+.long   $under$f
+___
+                }
+        elsif ($main'aout)
+                {
+                local($ctor)="${under}_GLOBAL_\$I\$$f";
+                $tmp=".text\n";
+                $tmp.=".type    $ctor,\@function\n" if ($main'pic);
+                $tmp.=<<___;    # OpenBSD way...
+.globl  $ctor
+.align  2
+$ctor:
+        jmp     $under$f
+___
+                }
+        push(@out,$tmp) if ($tmp);
+        }
+
+1;
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_add.c b/src/lib/libssl/src/crypto/pkcs12/p12_add.c
index 27015dd8c3..41bdc00551 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_add.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_add.c
@@ -68,16 +68,16 @@ PKCS12_SAFEBAG *PKCS12_item_pack_safebag(void *obj, const ASN1_ITEM *it, int nid
         PKCS12_BAGS *bag;
         PKCS12_SAFEBAG *safebag;
         if (!(bag = PKCS12_BAGS_new())) {
-                PKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE);
+                PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         bag->type = OBJ_nid2obj(nid1);
         if (!ASN1_item_pack(obj, it, &bag->value.octet)) {
-                PKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE);
+                PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         if (!(safebag = PKCS12_SAFEBAG_new())) {
-                PKCS12err(PKCS12_F_PKCS12_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE);
+                PKCS12err(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         safebag->value.bag = bag;
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_crpt.c b/src/lib/libssl/src/crypto/pkcs12/p12_crpt.c
index 003ec7a33e..3ad33c49d8 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_crpt.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_crpt.c
@@ -84,19 +84,25 @@ EVP_PBE_alg_add(NID_pbe_WithSHA1And40BitRC2_CBC, EVP_rc2_40_cbc(),
 #endif
 }
 
-int PKCS12_PBE_keyivgen (EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
+int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
                 ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md, int en_de)
 {
         PBEPARAM *pbe;
         int saltlen, iter, ret;
-        unsigned char *salt, *pbuf;
+        unsigned char *salt;
+        const unsigned char *pbuf;
         unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH];
 
         /* Extract useful info from parameter */
+        if (param == NULL || param->type != V_ASN1_SEQUENCE ||
+            param->value.sequence == NULL) {
+                PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_DECODE_ERROR);
+                return 0;
+        }
+
         pbuf = param->value.sequence->data;
-        if (!param || (param->type != V_ASN1_SEQUENCE) ||
-           !(pbe = d2i_PBEPARAM (NULL, &pbuf, param->value.sequence->length))) {
-                EVPerr(PKCS12_F_PKCS12_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
+        if (!(pbe = d2i_PBEPARAM(NULL, &pbuf, param->value.sequence->length))) {
+                PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_DECODE_ERROR);
                 return 0;
         }
 
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_crt.c b/src/lib/libssl/src/crypto/pkcs12/p12_crt.c
index 40340a7bef..dbafda17b6 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_crt.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_crt.c
@@ -1,9 +1,9 @@
 /* p12_crt.c */
 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
- * project 1999.
+ * project.
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2002 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -60,113 +60,289 @@
 #include "cryptlib.h"
 #include <openssl/pkcs12.h>
 
+
+static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, PKCS12_SAFEBAG *bag);
+
 PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
              STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, int mac_iter,
              int keytype)
 {
-        PKCS12 *p12;
-        STACK_OF(PKCS12_SAFEBAG) *bags;
-        STACK_OF(PKCS7) *safes;
-        PKCS12_SAFEBAG *bag;
-        PKCS8_PRIV_KEY_INFO *p8;
-        PKCS7 *authsafe;
-        X509 *tcert;
+        PKCS12 *p12 = NULL;
+        STACK_OF(PKCS7) *safes = NULL;
+        STACK_OF(PKCS12_SAFEBAG) *bags = NULL;
+        PKCS12_SAFEBAG *bag = NULL;
         int i;
         unsigned char keyid[EVP_MAX_MD_SIZE];
-        unsigned int keyidlen;
+        unsigned int keyidlen = 0;
 
         /* Set defaults */
-        if(!nid_cert)
-                {
-#ifdef OPENSSL_FIPS
-                if (FIPS_mode())
-                        nid_cert = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
-                else
-#endif
-                        nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;
-                }
-        if(!nid_key) nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
-        if(!iter) iter = PKCS12_DEFAULT_ITER;
-        if(!mac_iter) mac_iter = 1;
+        if (!nid_cert)
+                nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;
+        if (!nid_key)
+                nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
+        if (!iter)
+                iter = PKCS12_DEFAULT_ITER;
+        if (!mac_iter)
+                mac_iter = 1;
 
-        if(!pkey || !cert) {
+        if(!pkey && !cert && !ca)
+                {
                 PKCS12err(PKCS12_F_PKCS12_CREATE,PKCS12_R_INVALID_NULL_ARGUMENT);
                 return NULL;
-        }
-
-        if(!X509_check_private_key(cert, pkey)) return NULL;
+                }
 
-        if(!(bags = sk_PKCS12_SAFEBAG_new_null ())) {
-                PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
-                return NULL;
-        }
+        if (pkey && cert)
+                {
+                if(!X509_check_private_key(cert, pkey))
+                        return NULL;
+                X509_digest(cert, EVP_sha1(), keyid, &keyidlen);
+                }
 
-        /* Add user certificate */
-        if(!(bag = PKCS12_x5092certbag(cert))) return NULL;
-        if(name && !PKCS12_add_friendlyname(bag, name, -1)) return NULL;
-        X509_digest(cert, EVP_sha1(), keyid, &keyidlen);
-        if(!PKCS12_add_localkeyid(bag, keyid, keyidlen)) return NULL;
+        if (cert)
+                {
+                bag = PKCS12_add_cert(&bags, cert);
+                if(name && !PKCS12_add_friendlyname(bag, name, -1))
+                        goto err;
+                if(keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen))
+                        goto err;
+                }
 
-        if(!sk_PKCS12_SAFEBAG_push(bags, bag)) {
-                PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
-                return NULL;
-        }
-        
         /* Add all other certificates */
-        if(ca) {
-                for(i = 0; i < sk_X509_num(ca); i++) {
-                        tcert = sk_X509_value(ca, i);
-                        if(!(bag = PKCS12_x5092certbag(tcert))) return NULL;
-                        if(!sk_PKCS12_SAFEBAG_push(bags, bag)) {
-                                PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
-                                return NULL;
+        for(i = 0; i < sk_X509_num(ca); i++)
+                {
+                if (!PKCS12_add_cert(&bags, sk_X509_value(ca, i)))
+                        goto err;
+                }
+
+        if (bags && !PKCS12_add_safe(&safes, bags, nid_cert, iter, pass))
+                        goto err;
+
+        sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
+        bags = NULL;
+
+        if (pkey)
+                {
+                int cspidx;
+                bag = PKCS12_add_key(&bags, pkey, keytype, iter, nid_key, pass);
+
+                if (!bag)
+                        goto err;
+
+                cspidx = EVP_PKEY_get_attr_by_NID(pkey, NID_ms_csp_name, -1);
+                if (cspidx >= 0)
+                        {
+                        X509_ATTRIBUTE *cspattr;
+                        cspattr = EVP_PKEY_get_attr(pkey, cspidx);
+                        if (!X509at_add1_attr(&bag->attrib, cspattr))
+                                goto err;
                         }
+
+                if(name && !PKCS12_add_friendlyname(bag, name, -1))
+                        goto err;
+                if(keyidlen && !PKCS12_add_localkeyid(bag, keyid, keyidlen))
+                        goto err;
                 }
-        }
 
-        /* Turn certbags into encrypted authsafe */
-        authsafe = PKCS12_pack_p7encdata (nid_cert, pass, -1, NULL, 0,
-                                          iter, bags);
+        if (bags && !PKCS12_add_safe(&safes, bags, -1, 0, NULL))
+                        goto err;
+
         sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
+        bags = NULL;
 
-        if (!authsafe) return NULL;
+        p12 = PKCS12_add_safes(safes, 0);
+
+        sk_PKCS7_pop_free(safes, PKCS7_free);
+
+        safes = NULL;
+
+        if ((mac_iter != -1) &&
+                !PKCS12_set_mac(p12, pass, -1, NULL, 0, mac_iter, NULL))
+            goto err;
+
+        return p12;
+
+        err:
+
+        if (p12)
+                PKCS12_free(p12);
+        if (safes)
+                sk_PKCS7_pop_free(safes, PKCS7_free);
+        if (bags)
+                sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
+        return NULL;
+
+}
+
+PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert)
+        {
+        PKCS12_SAFEBAG *bag = NULL;
+        char *name;
+        int namelen = -1;
+        unsigned char *keyid;
+        int keyidlen = -1;
+
+        /* Add user certificate */
+        if(!(bag = PKCS12_x5092certbag(cert)))
+                goto err;
+
+        /* Use friendlyName and localKeyID in certificate.
+         * (if present)
+         */
+
+        name = (char *)X509_alias_get0(cert, &namelen);
+
+        if(name && !PKCS12_add_friendlyname(bag, name, namelen))
+                goto err;
+
+        keyid = X509_keyid_get0(cert, &keyidlen);
+
+        if(keyid && !PKCS12_add_localkeyid(bag, keyid, keyidlen))
+                goto err;
+
+        if (!pkcs12_add_bag(pbags, bag))
+                goto err;
+
+        return bag;
+
+        err:
+
+        if (bag)
+                PKCS12_SAFEBAG_free(bag);
+
+        return NULL;
 
-        if(!(safes = sk_PKCS7_new_null ())
-           || !sk_PKCS7_push(safes, authsafe)) {
-                PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
-                return NULL;
         }
 
-        /* Make a shrouded key bag */
-        if(!(p8 = EVP_PKEY2PKCS8 (pkey))) return NULL;
-        if(keytype && !PKCS8_add_keyusage(p8, keytype)) return NULL;
-        bag = PKCS12_MAKE_SHKEYBAG (nid_key, pass, -1, NULL, 0, iter, p8);
-        if(!bag) return NULL;
-        PKCS8_PRIV_KEY_INFO_free(p8);
-        if (name && !PKCS12_add_friendlyname (bag, name, -1)) return NULL;
-        if(!PKCS12_add_localkeyid (bag, keyid, keyidlen)) return NULL;
-        if(!(bags = sk_PKCS12_SAFEBAG_new_null())
-           || !sk_PKCS12_SAFEBAG_push (bags, bag)) {
-                PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
-                return NULL;
+PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, EVP_PKEY *key,
+                                                int key_usage, int iter,
+                                                int nid_key, char *pass)
+        {
+
+        PKCS12_SAFEBAG *bag = NULL;
+        PKCS8_PRIV_KEY_INFO *p8 = NULL;
+
+        /* Make a PKCS#8 structure */
+        if(!(p8 = EVP_PKEY2PKCS8(key)))
+                goto err;
+        if(key_usage && !PKCS8_add_keyusage(p8, key_usage))
+                goto err;
+        if (nid_key != -1)
+                {
+                bag = PKCS12_MAKE_SHKEYBAG(nid_key, pass, -1, NULL, 0, iter, p8);
+                PKCS8_PRIV_KEY_INFO_free(p8);
+                }
+        else
+                bag = PKCS12_MAKE_KEYBAG(p8);
+
+        if(!bag)
+                goto err;
+
+        if (!pkcs12_add_bag(pbags, bag))
+                goto err;
+
+        return bag;
+
+        err:
+
+        if (bag)
+                PKCS12_SAFEBAG_free(bag);
+
+        return NULL;
+
         }
-        /* Turn it into unencrypted safe bag */
-        if(!(authsafe = PKCS12_pack_p7data (bags))) return NULL;
-        sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
-        if(!sk_PKCS7_push(safes, authsafe)) {
-                PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
-                return NULL;
+
+int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
+                                                int nid_safe, int iter, char *pass)
+        {
+        PKCS7 *p7 = NULL;
+        int free_safes = 0;
+
+        if (!*psafes)
+                {
+                *psafes = sk_PKCS7_new_null();
+                if (!*psafes)
+                        return 0;
+                free_safes = 1;
+                }
+        else
+                free_safes = 0;
+
+        if (nid_safe == 0)
+                nid_safe = NID_pbe_WithSHA1And40BitRC2_CBC;
+
+        if (nid_safe == -1)
+                p7 = PKCS12_pack_p7data(bags);
+        else
+                p7 = PKCS12_pack_p7encdata(nid_safe, pass, -1, NULL, 0,
+                                          iter, bags);
+        if (!p7)
+                goto err;
+
+        if (!sk_PKCS7_push(*psafes, p7))
+                goto err;
+
+        return 1;
+
+        err:
+        if (free_safes)
+                {
+                sk_PKCS7_free(*psafes);
+                *psafes = NULL;
+                }
+
+        if (p7)
+                PKCS7_free(p7);
+
+        return 0;
+
         }
 
-        if(!(p12 = PKCS12_init (NID_pkcs7_data))) return NULL;
+static int pkcs12_add_bag(STACK_OF(PKCS12_SAFEBAG) **pbags, PKCS12_SAFEBAG *bag)
+        {
+        int free_bags;
+        if (!pbags)
+                return 1;
+        if (!*pbags)
+                {
+                *pbags = sk_PKCS12_SAFEBAG_new_null();
+                if (!*pbags)
+                        return 0;
+                free_bags = 1;
+                }
+        else 
+                free_bags = 0;
 
-        if(!PKCS12_pack_authsafes (p12, safes)) return NULL;
+        if (!sk_PKCS12_SAFEBAG_push(*pbags, bag))
+                {
+                if (free_bags)
+                        {
+                        sk_PKCS12_SAFEBAG_free(*pbags);
+                        *pbags = NULL;
+                        }
+                return 0;
+                }
 
-        sk_PKCS7_pop_free(safes, PKCS7_free);
+        return 1;
+
+        }
+                
+
+PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int nid_p7)
+        {
+        PKCS12 *p12;
+        if (nid_p7 <= 0)
+                nid_p7 = NID_pkcs7_data;
+        p12 = PKCS12_init(nid_p7);
+
+        if (!p12)
+                return NULL;
 
-        if(!PKCS12_set_mac (p12, pass, -1, NULL, 0, mac_iter, NULL))
-            return NULL;
+        if(!PKCS12_pack_authsafes(p12, safes))
+                {
+                PKCS12_free(p12);
+                return NULL;
+                }
 
         return p12;
 
-}
+        }
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_decr.c b/src/lib/libssl/src/crypto/pkcs12/p12_decr.c
index b5684a83ba..74c961a92b 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_decr.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_decr.c
@@ -113,13 +113,14 @@ unsigned char * PKCS12_pbe_crypt(X509_ALGOR *algor, const char *pass,
 void * PKCS12_item_decrypt_d2i(X509_ALGOR *algor, const ASN1_ITEM *it,
              const char *pass, int passlen, ASN1_OCTET_STRING *oct, int zbuf)
 {
-        unsigned char *out, *p;
+        unsigned char *out;
+        const unsigned char *p;
         void *ret;
         int outlen;
 
         if (!PKCS12_pbe_crypt(algor, pass, passlen, oct->data, oct->length,
                                &out, &outlen, 0)) {
-                PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR);
+                PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I,PKCS12_R_PKCS12_PBE_CRYPT_ERROR);
                 return NULL;
         }
         p = out;
@@ -137,7 +138,7 @@ void * PKCS12_item_decrypt_d2i(X509_ALGOR *algor, const ASN1_ITEM *it,
 #endif
         ret = ASN1_item_d2i(NULL, &p, outlen, it);
         if (zbuf) OPENSSL_cleanse(out, outlen);
-        if(!ret) PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_DECODE_ERROR);
+        if(!ret) PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I,PKCS12_R_DECODE_ERROR);
         OPENSSL_free(out);
         return ret;
 }
@@ -154,17 +155,17 @@ ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor, const ASN1_ITEM *i
         unsigned char *in = NULL;
         int inlen;
         if (!(oct = M_ASN1_OCTET_STRING_new ())) {
-                PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,ERR_R_MALLOC_FAILURE);
+                PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         inlen = ASN1_item_i2d(obj, &in, it);
         if (!in) {
-                PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,PKCS12_R_ENCODE_ERROR);
+                PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT,PKCS12_R_ENCODE_ERROR);
                 return NULL;
         }
         if (!PKCS12_pbe_crypt(algor, pass, passlen, in, inlen, &oct->data,
                                  &oct->length, 1)) {
-                PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,PKCS12_R_ENCRYPT_ERROR);
+                PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT,PKCS12_R_ENCRYPT_ERROR);
                 OPENSSL_free(in);
                 return NULL;
         }
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_init.c b/src/lib/libssl/src/crypto/pkcs12/p12_init.c
index 5276b12669..6bdc132631 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_init.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_init.c
@@ -62,7 +62,7 @@
 
 /* Initialise a PKCS12 structure to take data */
 
-PKCS12 *PKCS12_init (int mode)
+PKCS12 *PKCS12_init(int mode)
 {
         PKCS12 *pkcs12;
         if (!(pkcs12 = PKCS12_new())) {
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_key.c b/src/lib/libssl/src/crypto/pkcs12/p12_key.c
index 9196a34b4a..18e72d0a1b 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_key.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_key.c
@@ -59,7 +59,7 @@
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/pkcs12.h>
-
+#include <openssl/bn.h>
 
 /* Uncomment out this line to get debugging info about key generation */
 /*#define DEBUG_KEYGEN*/
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_kiss.c b/src/lib/libssl/src/crypto/pkcs12/p12_kiss.c
index 2b31999e11..c2ee2cc6f3 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_kiss.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_kiss.c
@@ -80,7 +80,7 @@ static int parse_bag( PKCS12_SAFEBAG *bag, const char *pass, int passlen,
  * passed unitialised.
  */
 
-int PKCS12_parse (PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
+int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
              STACK_OF(X509) **ca)
 {
 
@@ -141,7 +141,7 @@ int PKCS12_parse (PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
 
 /* Parse the outer PKCS#12 structure */
 
-static int parse_pk12 (PKCS12 *p12, const char *pass, int passlen,
+static int parse_pk12(PKCS12 *p12, const char *pass, int passlen,
              EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
 {
         STACK_OF(PKCS7) *asafes;
@@ -178,10 +178,10 @@ static int parse_pk12 (PKCS12 *p12, const char *pass, int passlen,
 }
 
 
-static int parse_bags (STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass,
-                       int passlen, EVP_PKEY **pkey, X509 **cert,
-                       STACK_OF(X509) **ca, ASN1_OCTET_STRING **keyid,
-                       char *keymatch)
+static int parse_bags(STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass,
+                      int passlen, EVP_PKEY **pkey, X509 **cert,
+                      STACK_OF(X509) **ca, ASN1_OCTET_STRING **keyid,
+                      char *keymatch)
 {
         int i;
         for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) {
@@ -197,9 +197,9 @@ static int parse_bags (STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass,
 #define MATCH_ALL  0x3
 
 static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
-                      EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
-                      ASN1_OCTET_STRING **keyid,
-             char *keymatch)
+                     EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
+                     ASN1_OCTET_STRING **keyid,
+                     char *keymatch)
 {
         PKCS8_PRIV_KEY_INFO *p8;
         X509 *x509;
@@ -221,7 +221,7 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
                         if (M_ASN1_OCTET_STRING_cmp(*keyid, lkey)) lkey = NULL;
                 } else {
                         if (!(*keyid = M_ASN1_OCTET_STRING_dup(lkey))) {
-                                PKCS12err(PKCS12_F_PARSE_BAGS,ERR_R_MALLOC_FAILURE);
+                                PKCS12err(PKCS12_F_PARSE_BAG,ERR_R_MALLOC_FAILURE);
                                 return 0;
                     }
                 }
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_mutl.c b/src/lib/libssl/src/crypto/pkcs12/p12_mutl.c
index 140d21155e..c408cc8ab8 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_mutl.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_mutl.c
@@ -64,12 +64,12 @@
 #include <openssl/pkcs12.h>
 
 /* Generate a MAC */
-int PKCS12_gen_mac (PKCS12 *p12, const char *pass, int passlen,
-                    unsigned char *mac, unsigned int *maclen)
+int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen,
+                   unsigned char *mac, unsigned int *maclen)
 {
         const EVP_MD *md_type;
         HMAC_CTX hmac;
-        unsigned char key[PKCS12_MAC_KEY_LENGTH], *salt;
+        unsigned char key[EVP_MAX_MD_SIZE], *salt;
         int saltlen, iter;
 
         if (!PKCS7_type_is_data(p12->authsafes))
@@ -88,12 +88,12 @@ int PKCS12_gen_mac (PKCS12 *p12, const char *pass, int passlen,
                 return 0;
         }
         if(!PKCS12_key_gen (pass, passlen, salt, saltlen, PKCS12_MAC_ID, iter,
-                                 PKCS12_MAC_KEY_LENGTH, key, md_type)) {
+                                 EVP_MD_size(md_type), key, md_type)) {
                 PKCS12err(PKCS12_F_PKCS12_GEN_MAC,PKCS12_R_KEY_GEN_ERROR);
                 return 0;
         }
         HMAC_CTX_init(&hmac);
-        HMAC_Init_ex(&hmac, key, PKCS12_MAC_KEY_LENGTH, md_type, NULL);
+        HMAC_Init_ex(&hmac, key, EVP_MD_size(md_type), md_type, NULL);
         HMAC_Update(&hmac, p12->authsafes->d.data->data,
                                          p12->authsafes->d.data->length);
         HMAC_Final(&hmac, mac, maclen);
@@ -102,16 +102,16 @@ int PKCS12_gen_mac (PKCS12 *p12, const char *pass, int passlen,
 }
 
 /* Verify the mac */
-int PKCS12_verify_mac (PKCS12 *p12, const char *pass, int passlen)
+int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen)
 {
         unsigned char mac[EVP_MAX_MD_SIZE];
         unsigned int maclen;
         if(p12->mac == NULL) {
-                PKCS12err(PKCS12_F_VERIFY_MAC,PKCS12_R_MAC_ABSENT);
+                PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC,PKCS12_R_MAC_ABSENT);
                 return 0;
         }
         if (!PKCS12_gen_mac (p12, pass, passlen, mac, &maclen)) {
-                PKCS12err(PKCS12_F_VERIFY_MAC,PKCS12_R_MAC_GENERATION_ERROR);
+                PKCS12err(PKCS12_F_PKCS12_VERIFY_MAC,PKCS12_R_MAC_GENERATION_ERROR);
                 return 0;
         }
         if ((maclen != (unsigned int)p12->mac->dinfo->digest->length)
@@ -121,7 +121,7 @@ int PKCS12_verify_mac (PKCS12 *p12, const char *pass, int passlen)
 
 /* Set a mac */
 
-int PKCS12_set_mac (PKCS12 *p12, const char *pass, int passlen,
+int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen,
              unsigned char *salt, int saltlen, int iter, const EVP_MD *md_type)
 {
         unsigned char mac[EVP_MAX_MD_SIZE];
@@ -145,7 +145,7 @@ int PKCS12_set_mac (PKCS12 *p12, const char *pass, int passlen,
 }
 
 /* Set up a mac structure */
-int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
+int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
              const EVP_MD *md_type)
 {
         if (!(p12->mac = PKCS12_MAC_DATA_new())) return PKCS12_ERROR;
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_npas.c b/src/lib/libssl/src/crypto/pkcs12/p12_npas.c
index af708a2743..48eacc5c49 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_npas.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_npas.c
@@ -77,28 +77,26 @@ static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen);
 
 int PKCS12_newpass(PKCS12 *p12, char *oldpass, char *newpass)
 {
+        /* Check for NULL PKCS12 structure */
 
-/* Check for NULL PKCS12 structure */
-
-if(!p12) {
-        PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_INVALID_NULL_PKCS12_POINTER);
-        return 0;
-}
-
-/* Check the mac */
-
-if (!PKCS12_verify_mac(p12, oldpass, -1)) {
-        PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_MAC_VERIFY_FAILURE);
-        return 0;
-}
+        if(!p12) {
+                PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_INVALID_NULL_PKCS12_POINTER);
+                return 0;
+        }
 
-if (!newpass_p12(p12, oldpass, newpass)) {
-        PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_PARSE_ERROR);
-        return 0;
-}
+        /* Check the mac */
+        
+        if (!PKCS12_verify_mac(p12, oldpass, -1)) {
+                PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_MAC_VERIFY_FAILURE);
+                return 0;
+        }
 
-return 1;
+        if (!newpass_p12(p12, oldpass, newpass)) {
+                PKCS12err(PKCS12_F_PKCS12_NEWPASS,PKCS12_R_PARSE_ERROR);
+                return 0;
+        }
 
+        return 1;
 }
 
 /* Parse the outer PKCS#12 structure */
@@ -206,7 +204,8 @@ static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass)
 static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen)
 {
         PBEPARAM *pbe;
-        unsigned char *p;
+        const unsigned char *p;
+
         p = alg->parameter->value.sequence->data;
         pbe = d2i_PBEPARAM(NULL, &p, alg->parameter->value.sequence->length);
         *pnid = OBJ_obj2nid(alg->algorithm);
diff --git a/src/lib/libssl/src/crypto/pkcs12/pk12err.c b/src/lib/libssl/src/crypto/pkcs12/pk12err.c
index a33b37b1c7..07a1fb6907 100644
--- a/src/lib/libssl/src/crypto/pkcs12/pk12err.c
+++ b/src/lib/libssl/src/crypto/pkcs12/pk12err.c
@@ -70,16 +70,18 @@
 
 static ERR_STRING_DATA PKCS12_str_functs[]=
         {
+{ERR_FUNC(PKCS12_F_PARSE_BAG),  "PARSE_BAG"},
 {ERR_FUNC(PKCS12_F_PARSE_BAGS), "PARSE_BAGS"},
 {ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME),    "PKCS12_ADD_FRIENDLYNAME"},
 {ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_ASC),        "PKCS12_add_friendlyname_asc"},
 {ERR_FUNC(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI),        "PKCS12_add_friendlyname_uni"},
 {ERR_FUNC(PKCS12_F_PKCS12_ADD_LOCALKEYID),      "PKCS12_add_localkeyid"},
 {ERR_FUNC(PKCS12_F_PKCS12_CREATE),      "PKCS12_create"},
-{ERR_FUNC(PKCS12_F_PKCS12_DECRYPT_D2I), "PKCS12_DECRYPT_D2I"},
 {ERR_FUNC(PKCS12_F_PKCS12_GEN_MAC),     "PKCS12_gen_mac"},
-{ERR_FUNC(PKCS12_F_PKCS12_I2D_ENCRYPT), "PKCS12_I2D_ENCRYPT"},
 {ERR_FUNC(PKCS12_F_PKCS12_INIT),        "PKCS12_init"},
+{ERR_FUNC(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I),    "PKCS12_item_decrypt_d2i"},
+{ERR_FUNC(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT),    "PKCS12_item_i2d_encrypt"},
+{ERR_FUNC(PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG),   "PKCS12_item_pack_safebag"},
 {ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_ASC), "PKCS12_key_gen_asc"},
 {ERR_FUNC(PKCS12_F_PKCS12_KEY_GEN_UNI), "PKCS12_key_gen_uni"},
 {ERR_FUNC(PKCS12_F_PKCS12_MAKE_KEYBAG), "PKCS12_MAKE_KEYBAG"},
@@ -87,7 +89,6 @@ static ERR_STRING_DATA PKCS12_str_functs[]=
 {ERR_FUNC(PKCS12_F_PKCS12_NEWPASS),     "PKCS12_newpass"},
 {ERR_FUNC(PKCS12_F_PKCS12_PACK_P7DATA), "PKCS12_pack_p7data"},
 {ERR_FUNC(PKCS12_F_PKCS12_PACK_P7ENCDATA),      "PKCS12_pack_p7encdata"},
-{ERR_FUNC(PKCS12_F_PKCS12_PACK_SAFEBAG),        "PKCS12_PACK_SAFEBAG"},
 {ERR_FUNC(PKCS12_F_PKCS12_PARSE),       "PKCS12_parse"},
 {ERR_FUNC(PKCS12_F_PKCS12_PBE_CRYPT),   "PKCS12_pbe_crypt"},
 {ERR_FUNC(PKCS12_F_PKCS12_PBE_KEYIVGEN),        "PKCS12_PBE_keyivgen"},
@@ -95,9 +96,9 @@ static ERR_STRING_DATA PKCS12_str_functs[]=
 {ERR_FUNC(PKCS12_F_PKCS12_SET_MAC),     "PKCS12_set_mac"},
 {ERR_FUNC(PKCS12_F_PKCS12_UNPACK_AUTHSAFES),    "PKCS12_unpack_authsafes"},
 {ERR_FUNC(PKCS12_F_PKCS12_UNPACK_P7DATA),       "PKCS12_unpack_p7data"},
+{ERR_FUNC(PKCS12_F_PKCS12_VERIFY_MAC),  "PKCS12_verify_mac"},
 {ERR_FUNC(PKCS12_F_PKCS8_ADD_KEYUSAGE), "PKCS8_add_keyusage"},
 {ERR_FUNC(PKCS12_F_PKCS8_ENCRYPT),      "PKCS8_encrypt"},
-{ERR_FUNC(PKCS12_F_VERIFY_MAC), "VERIFY_MAC"},
 {0,NULL}
         };
 
@@ -132,15 +133,12 @@ static ERR_STRING_DATA PKCS12_str_reasons[]=
 
 void ERR_load_PKCS12_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(PKCS12_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,PKCS12_str_functs);
                 ERR_load_strings(0,PKCS12_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/pkcs12/pkcs12.h b/src/lib/libssl/src/crypto/pkcs12/pkcs12.h
index fb8af82d4f..a2d7e359a0 100644
--- a/src/lib/libssl/src/crypto/pkcs12/pkcs12.h
+++ b/src/lib/libssl/src/crypto/pkcs12/pkcs12.h
@@ -249,6 +249,15 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
 PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
                          STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter,
                                                  int mac_iter, int keytype);
+
+PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert);
+PKCS12_SAFEBAG *PKCS12_add_key(STACK_OF(PKCS12_SAFEBAG) **pbags, EVP_PKEY *key,
+                                                int key_usage, int iter,
+                                                int key_nid, char *pass);
+int PKCS12_add_safe(STACK_OF(PKCS7) **psafes, STACK_OF(PKCS12_SAFEBAG) *bags,
+                                        int safe_nid, int iter, char *pass);
+PKCS12 *PKCS12_add_safes(STACK_OF(PKCS7) *safes, int p7_nid);
+
 int i2d_PKCS12_bio(BIO *bp, PKCS12 *p12);
 int i2d_PKCS12_fp(FILE *fp, PKCS12 *p12);
 PKCS12 *d2i_PKCS12_bio(BIO *bp, PKCS12 **p12);
@@ -264,16 +273,18 @@ void ERR_load_PKCS12_strings(void);
 /* Error codes for the PKCS12 functions. */
 
 /* Function codes. */
+#define PKCS12_F_PARSE_BAG                               129
 #define PKCS12_F_PARSE_BAGS                              103
 #define PKCS12_F_PKCS12_ADD_FRIENDLYNAME                 100
 #define PKCS12_F_PKCS12_ADD_FRIENDLYNAME_ASC             127
 #define PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI             102
 #define PKCS12_F_PKCS12_ADD_LOCALKEYID                   104
 #define PKCS12_F_PKCS12_CREATE                           105
-#define PKCS12_F_PKCS12_DECRYPT_D2I                      106
 #define PKCS12_F_PKCS12_GEN_MAC                          107
-#define PKCS12_F_PKCS12_I2D_ENCRYPT                      108
 #define PKCS12_F_PKCS12_INIT                             109
+#define PKCS12_F_PKCS12_ITEM_DECRYPT_D2I                 106
+#define PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT                 108
+#define PKCS12_F_PKCS12_ITEM_PACK_SAFEBAG                117
 #define PKCS12_F_PKCS12_KEY_GEN_ASC                      110
 #define PKCS12_F_PKCS12_KEY_GEN_UNI                      111
 #define PKCS12_F_PKCS12_MAKE_KEYBAG                      112
@@ -281,17 +292,16 @@ void ERR_load_PKCS12_strings(void);
 #define PKCS12_F_PKCS12_NEWPASS                          128
 #define PKCS12_F_PKCS12_PACK_P7DATA                      114
 #define PKCS12_F_PKCS12_PACK_P7ENCDATA                   115
-#define PKCS12_F_PKCS12_PACK_SAFEBAG                     117
 #define PKCS12_F_PKCS12_PARSE                            118
 #define PKCS12_F_PKCS12_PBE_CRYPT                        119
 #define PKCS12_F_PKCS12_PBE_KEYIVGEN                     120
 #define PKCS12_F_PKCS12_SETUP_MAC                        122
 #define PKCS12_F_PKCS12_SET_MAC                          123
-#define PKCS12_F_PKCS12_UNPACK_AUTHSAFES                 129
-#define PKCS12_F_PKCS12_UNPACK_P7DATA                    130
+#define PKCS12_F_PKCS12_UNPACK_AUTHSAFES                 130
+#define PKCS12_F_PKCS12_UNPACK_P7DATA                    131
+#define PKCS12_F_PKCS12_VERIFY_MAC                       126
 #define PKCS12_F_PKCS8_ADD_KEYUSAGE                      124
 #define PKCS12_F_PKCS8_ENCRYPT                           125
-#define PKCS12_F_VERIFY_MAC                              126
 
 /* Reason codes. */
 #define PKCS12_R_CANT_PACK_STRUCTURE                     100
diff --git a/src/lib/libssl/src/crypto/pkcs7/bio_ber.c b/src/lib/libssl/src/crypto/pkcs7/bio_ber.c
index 895a91177b..31973fcd1f 100644
--- a/src/lib/libssl/src/crypto/pkcs7/bio_ber.c
+++ b/src/lib/libssl/src/crypto/pkcs7/bio_ber.c
@@ -204,7 +204,7 @@ int bio_ber_get_header(BIO *bio, BIO_BER_CTX *ctx)
                 if ((ctx->buf_len < BER_BUF_SIZE) &&
                         (ERR_GET_REASON(ERR_peek_error()) == ASN1_R_TOO_LONG))
                         {
-                        ERR_get_error(); /* clear the error */
+                        ERR_clear_error(); /* clear the error */
                         BIO_set_retry_read(b);
                         }
                 return(-1);
diff --git a/src/lib/libssl/src/crypto/pkcs7/example.c b/src/lib/libssl/src/crypto/pkcs7/example.c
index c993947cc3..2953d04b5c 100644
--- a/src/lib/libssl/src/crypto/pkcs7/example.c
+++ b/src/lib/libssl/src/crypto/pkcs7/example.c
@@ -123,7 +123,7 @@ int get_signed_seq2string(PKCS7_SIGNER_INFO *si, char **str1, char **str2)
         so=PKCS7_get_signed_attribute(si,signed_seq2string_nid);
         if (so && (so->type == V_ASN1_SEQUENCE))
                 {
-                ASN1_CTX c;
+                ASN1_const_CTX c;
                 ASN1_STRING *s;
                 long length;
                 ASN1_OCTET_STRING *os1,*os2;
@@ -144,7 +144,7 @@ int get_signed_seq2string(PKCS7_SIGNER_INFO *si, char **str1, char **str2)
                         goto err;
                 c.slen-=(c.p-c.q);
 
-                if (!asn1_Finish(&c)) goto err;
+                if (!asn1_const_Finish(&c)) goto err;
                 *str1=malloc(os1->length+1);
                 *str2=malloc(os2->length+1);
                 memcpy(*str1,os1->data,os1->length);
@@ -290,7 +290,7 @@ int sk_get_seq2string(STACK_OF(X509_ATTRIBUTE) *sk, char **str1, char **str2)
         so=PKCS7_get_signed_attribute(&si,signed_seq2string_nid);
         if (so->type == V_ASN1_SEQUENCE)
                 {
-                ASN1_CTX c;
+                ASN1_const_CTX c;
                 ASN1_STRING *s;
                 long length;
                 ASN1_OCTET_STRING *os1,*os2;
@@ -311,7 +311,7 @@ int sk_get_seq2string(STACK_OF(X509_ATTRIBUTE) *sk, char **str1, char **str2)
                         goto err;
                 c.slen-=(c.p-c.q);
 
-                if (!asn1_Finish(&c)) goto err;
+                if (!asn1_const_Finish(&c)) goto err;
                 *str1=malloc(os1->length+1);
                 *str2=malloc(os2->length+1);
                 memcpy(*str1,os1->data,os1->length);
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_asn1.c b/src/lib/libssl/src/crypto/pkcs7/pk7_asn1.c
index 46f0fc9375..77931feeb4 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pk7_asn1.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_asn1.c
@@ -69,30 +69,31 @@
 ASN1_ADB_TEMPLATE(p7default) = ASN1_EXP_OPT(PKCS7, d.other, ASN1_ANY, 0);
 
 ASN1_ADB(PKCS7) = {
-        ADB_ENTRY(NID_pkcs7_data, ASN1_EXP_OPT(PKCS7, d.data, ASN1_OCTET_STRING, 0)),
-        ADB_ENTRY(NID_pkcs7_signed, ASN1_EXP_OPT(PKCS7, d.sign, PKCS7_SIGNED, 0)),
-        ADB_ENTRY(NID_pkcs7_enveloped, ASN1_EXP_OPT(PKCS7, d.enveloped, PKCS7_ENVELOPE, 0)),
-        ADB_ENTRY(NID_pkcs7_signedAndEnveloped, ASN1_EXP_OPT(PKCS7, d.signed_and_enveloped, PKCS7_SIGN_ENVELOPE, 0)),
-        ADB_ENTRY(NID_pkcs7_digest, ASN1_EXP_OPT(PKCS7, d.digest, PKCS7_DIGEST, 0)),
-        ADB_ENTRY(NID_pkcs7_encrypted, ASN1_EXP_OPT(PKCS7, d.encrypted, PKCS7_ENCRYPT, 0))
+        ADB_ENTRY(NID_pkcs7_data, ASN1_NDEF_EXP_OPT(PKCS7, d.data, ASN1_OCTET_STRING_NDEF, 0)),
+        ADB_ENTRY(NID_pkcs7_signed, ASN1_NDEF_EXP_OPT(PKCS7, d.sign, PKCS7_SIGNED, 0)),
+        ADB_ENTRY(NID_pkcs7_enveloped, ASN1_NDEF_EXP_OPT(PKCS7, d.enveloped, PKCS7_ENVELOPE, 0)),
+        ADB_ENTRY(NID_pkcs7_signedAndEnveloped, ASN1_NDEF_EXP_OPT(PKCS7, d.signed_and_enveloped, PKCS7_SIGN_ENVELOPE, 0)),
+        ADB_ENTRY(NID_pkcs7_digest, ASN1_NDEF_EXP_OPT(PKCS7, d.digest, PKCS7_DIGEST, 0)),
+        ADB_ENTRY(NID_pkcs7_encrypted, ASN1_NDEF_EXP_OPT(PKCS7, d.encrypted, PKCS7_ENCRYPT, 0))
 } ASN1_ADB_END(PKCS7, 0, type, 0, &p7default_tt, NULL);
 
-ASN1_SEQUENCE(PKCS7) = {
+ASN1_NDEF_SEQUENCE(PKCS7) = {
         ASN1_SIMPLE(PKCS7, type, ASN1_OBJECT),
         ASN1_ADB_OBJECT(PKCS7)
-}ASN1_SEQUENCE_END(PKCS7)
+}ASN1_NDEF_SEQUENCE_END(PKCS7)
 
 IMPLEMENT_ASN1_FUNCTIONS(PKCS7)
+IMPLEMENT_ASN1_NDEF_FUNCTION(PKCS7)
 IMPLEMENT_ASN1_DUP_FUNCTION(PKCS7)
 
-ASN1_SEQUENCE(PKCS7_SIGNED) = {
+ASN1_NDEF_SEQUENCE(PKCS7_SIGNED) = {
         ASN1_SIMPLE(PKCS7_SIGNED, version, ASN1_INTEGER),
         ASN1_SET_OF(PKCS7_SIGNED, md_algs, X509_ALGOR),
         ASN1_SIMPLE(PKCS7_SIGNED, contents, PKCS7),
         ASN1_IMP_SEQUENCE_OF_OPT(PKCS7_SIGNED, cert, X509, 0),
         ASN1_IMP_SET_OF_OPT(PKCS7_SIGNED, crl, X509_CRL, 1),
         ASN1_SET_OF(PKCS7_SIGNED, signer_info, PKCS7_SIGNER_INFO)
-} ASN1_SEQUENCE_END(PKCS7_SIGNED)
+} ASN1_NDEF_SEQUENCE_END(PKCS7_SIGNED)
 
 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_SIGNED)
 
@@ -130,11 +131,11 @@ ASN1_SEQUENCE(PKCS7_ISSUER_AND_SERIAL) = {
 
 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_ISSUER_AND_SERIAL)
 
-ASN1_SEQUENCE(PKCS7_ENVELOPE) = {
+ASN1_NDEF_SEQUENCE(PKCS7_ENVELOPE) = {
         ASN1_SIMPLE(PKCS7_ENVELOPE, version, ASN1_INTEGER),
         ASN1_SET_OF(PKCS7_ENVELOPE, recipientinfo, PKCS7_RECIP_INFO),
         ASN1_SIMPLE(PKCS7_ENVELOPE, enc_data, PKCS7_ENC_CONTENT)
-} ASN1_SEQUENCE_END(PKCS7_ENVELOPE)
+} ASN1_NDEF_SEQUENCE_END(PKCS7_ENVELOPE)
 
 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_ENVELOPE)
 
@@ -157,15 +158,15 @@ ASN1_SEQUENCE_cb(PKCS7_RECIP_INFO, ri_cb) = {
 
 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_RECIP_INFO)
 
-ASN1_SEQUENCE(PKCS7_ENC_CONTENT) = {
+ASN1_NDEF_SEQUENCE(PKCS7_ENC_CONTENT) = {
         ASN1_SIMPLE(PKCS7_ENC_CONTENT, content_type, ASN1_OBJECT),
         ASN1_SIMPLE(PKCS7_ENC_CONTENT, algorithm, X509_ALGOR),
         ASN1_IMP_OPT(PKCS7_ENC_CONTENT, enc_data, ASN1_OCTET_STRING, 0)
-} ASN1_SEQUENCE_END(PKCS7_ENC_CONTENT)
+} ASN1_NDEF_SEQUENCE_END(PKCS7_ENC_CONTENT)
 
 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_ENC_CONTENT)
 
-ASN1_SEQUENCE(PKCS7_SIGN_ENVELOPE) = {
+ASN1_NDEF_SEQUENCE(PKCS7_SIGN_ENVELOPE) = {
         ASN1_SIMPLE(PKCS7_SIGN_ENVELOPE, version, ASN1_INTEGER),
         ASN1_SET_OF(PKCS7_SIGN_ENVELOPE, recipientinfo, PKCS7_RECIP_INFO),
         ASN1_SET_OF(PKCS7_SIGN_ENVELOPE, md_algs, X509_ALGOR),
@@ -173,23 +174,23 @@ ASN1_SEQUENCE(PKCS7_SIGN_ENVELOPE) = {
         ASN1_IMP_SET_OF_OPT(PKCS7_SIGN_ENVELOPE, cert, X509, 0),
         ASN1_IMP_SET_OF_OPT(PKCS7_SIGN_ENVELOPE, crl, X509_CRL, 1),
         ASN1_SET_OF(PKCS7_SIGN_ENVELOPE, signer_info, PKCS7_SIGNER_INFO)
-} ASN1_SEQUENCE_END(PKCS7_SIGN_ENVELOPE)
+} ASN1_NDEF_SEQUENCE_END(PKCS7_SIGN_ENVELOPE)
 
 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_SIGN_ENVELOPE)
 
-ASN1_SEQUENCE(PKCS7_ENCRYPT) = {
+ASN1_NDEF_SEQUENCE(PKCS7_ENCRYPT) = {
         ASN1_SIMPLE(PKCS7_ENCRYPT, version, ASN1_INTEGER),
         ASN1_SIMPLE(PKCS7_ENCRYPT, enc_data, PKCS7_ENC_CONTENT)
-} ASN1_SEQUENCE_END(PKCS7_ENCRYPT)
+} ASN1_NDEF_SEQUENCE_END(PKCS7_ENCRYPT)
 
 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_ENCRYPT)
 
-ASN1_SEQUENCE(PKCS7_DIGEST) = {
+ASN1_NDEF_SEQUENCE(PKCS7_DIGEST) = {
         ASN1_SIMPLE(PKCS7_DIGEST, version, ASN1_INTEGER),
         ASN1_SIMPLE(PKCS7_DIGEST, md, X509_ALGOR),
         ASN1_SIMPLE(PKCS7_DIGEST, contents, PKCS7),
         ASN1_SIMPLE(PKCS7_DIGEST, digest, ASN1_OCTET_STRING)
-} ASN1_SEQUENCE_END(PKCS7_DIGEST)
+} ASN1_NDEF_SEQUENCE_END(PKCS7_DIGEST)
 
 IMPLEMENT_ASN1_FUNCTIONS(PKCS7_DIGEST)
 
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_attr.c b/src/lib/libssl/src/crypto/pkcs7/pk7_attr.c
index 039141027a..735c8800e1 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pk7_attr.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_attr.c
@@ -96,7 +96,8 @@ int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, STACK_OF(X509_ALGOR) *cap)
 STACK_OF(X509_ALGOR) *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si)
         {
         ASN1_TYPE *cap;
-        unsigned char *p;
+        const unsigned char *p;
+
         cap = PKCS7_get_signed_attribute(si, NID_SMIMECapabilities);
         if (!cap || (cap->type != V_ASN1_SEQUENCE))
                 return NULL;
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c b/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c
index 4ac29ae14d..a03d7ebedf 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c
@@ -62,6 +62,7 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
+#include <openssl/err.h>
 
 static int add_attribute(STACK_OF(X509_ATTRIBUTE) **sk, int nid, int atrtype,
                          void *value);
@@ -101,18 +102,54 @@ static ASN1_OCTET_STRING *PKCS7_get_octet_string(PKCS7 *p7)
         return NULL;
         }
 
+static int PKCS7_bio_add_digest(BIO **pbio, X509_ALGOR *alg)
+        {
+        BIO *btmp;
+        const EVP_MD *md;
+        if ((btmp=BIO_new(BIO_f_md())) == NULL)
+                {
+                PKCS7err(PKCS7_F_PKCS7_BIO_ADD_DIGEST,ERR_R_BIO_LIB);
+                goto err;
+                }
+
+        md=EVP_get_digestbyobj(alg->algorithm);
+        if (md == NULL)
+                {
+                PKCS7err(PKCS7_F_PKCS7_BIO_ADD_DIGEST,PKCS7_R_UNKNOWN_DIGEST_TYPE);
+                goto err;
+                }
+
+        BIO_set_md(btmp,md);
+        if (*pbio == NULL)
+                *pbio=btmp;
+        else if (!BIO_push(*pbio,btmp))
+                {
+                PKCS7err(PKCS7_F_PKCS7_BIO_ADD_DIGEST,ERR_R_BIO_LIB);
+                goto err;
+                }
+        btmp=NULL;
+
+        return 1;
+
+        err:
+        if (btmp)
+                BIO_free(btmp);
+        return 0;
+
+        }
+
 BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
         {
         int i;
         BIO *out=NULL,*btmp=NULL;
-        X509_ALGOR *xa;
-        const EVP_MD *evp_md;
+        X509_ALGOR *xa = NULL;
         const EVP_CIPHER *evp_cipher=NULL;
         STACK_OF(X509_ALGOR) *md_sk=NULL;
         STACK_OF(PKCS7_RECIP_INFO) *rsk=NULL;
         X509_ALGOR *xalg=NULL;
         PKCS7_RECIP_INFO *ri=NULL;
         EVP_PKEY *pkey;
+        ASN1_OCTET_STRING *os=NULL;
 
         i=OBJ_obj2nid(p7->type);
         p7->state=PKCS7_S_HEADER;
@@ -121,6 +158,7 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                 {
         case NID_pkcs7_signed:
                 md_sk=p7->d.sign->md_algs;
+                os = PKCS7_get_octet_string(p7->d.sign->contents);
                 break;
         case NID_pkcs7_signedAndEnveloped:
                 rsk=p7->d.signed_and_enveloped->recipientinfo;
@@ -145,37 +183,21 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                         goto err;
                         }
                 break;
+        case NID_pkcs7_digest:
+                xa = p7->d.digest->md;
+                os = PKCS7_get_octet_string(p7->d.digest->contents);
+                break;
         default:
                 PKCS7err(PKCS7_F_PKCS7_DATAINIT,PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
                 goto err;
                 }
 
-        if (md_sk != NULL)
-                {
-                for (i=0; i<sk_X509_ALGOR_num(md_sk); i++)
-                        {
-                        xa=sk_X509_ALGOR_value(md_sk,i);
-                        if ((btmp=BIO_new(BIO_f_md())) == NULL)
-                                {
-                                PKCS7err(PKCS7_F_PKCS7_DATAINIT,ERR_R_BIO_LIB);
-                                goto err;
-                                }
-
-                        evp_md=EVP_get_digestbyobj(xa->algorithm);
-                        if (evp_md == NULL)
-                                {
-                                PKCS7err(PKCS7_F_PKCS7_DATAINIT,PKCS7_R_UNKNOWN_DIGEST_TYPE);
-                                goto err;
-                                }
+        for (i=0; i<sk_X509_ALGOR_num(md_sk); i++)
+                if (!PKCS7_bio_add_digest(&out, sk_X509_ALGOR_value(md_sk, i)))
+                        goto err;
 
-                        BIO_set_md(btmp,evp_md);
-                        if (out == NULL)
-                                out=btmp;
-                        else
-                                BIO_push(out,btmp);
-                        btmp=NULL;
-                        }
-                }
+        if (xa && !PKCS7_bio_add_digest(&out, xa))
+                        goto err;
 
         if (evp_cipher != NULL)
                 {
@@ -194,17 +216,25 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                 BIO_get_cipher_ctx(btmp, &ctx);
                 keylen=EVP_CIPHER_key_length(evp_cipher);
                 ivlen=EVP_CIPHER_iv_length(evp_cipher);
-                if (RAND_bytes(key,keylen) <= 0)
-                        goto err;
                 xalg->algorithm = OBJ_nid2obj(EVP_CIPHER_type(evp_cipher));
-                if (ivlen > 0) RAND_pseudo_bytes(iv,ivlen);
-                EVP_CipherInit_ex(ctx, evp_cipher, NULL, key, iv, 1);
+                if (ivlen > 0)
+                        if (RAND_pseudo_bytes(iv,ivlen) <= 0)
+                                goto err;
+                if (EVP_CipherInit_ex(ctx, evp_cipher, NULL, NULL, NULL, 1)<=0)
+                        goto err;
+                if (EVP_CIPHER_CTX_rand_key(ctx, key) <= 0)
+                        goto err;
+                if (EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, 1) <= 0)
+                        goto err;
 
                 if (ivlen > 0) {
-                        if (xalg->parameter == NULL) 
-                                                xalg->parameter=ASN1_TYPE_new();
+                        if (xalg->parameter == NULL) {
+                                xalg->parameter = ASN1_TYPE_new();
+                                if (xalg->parameter == NULL)
+                                        goto err;
+                        }
                         if(EVP_CIPHER_param_to_asn1(ctx, xalg->parameter) < 0)
-                                                                       goto err;
+                               goto err;
                 }
 
                 /* Lets do the pub key stuff :-) */
@@ -217,7 +247,8 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                                 PKCS7err(PKCS7_F_PKCS7_DATAINIT,PKCS7_R_MISSING_CERIPEND_INFO);
                                 goto err;
                                 }
-                        pkey=X509_get_pubkey(ri->cert);
+                        if ((pkey=X509_get_pubkey(ri->cert)) == NULL)
+                                goto err;
                         jj=EVP_PKEY_size(pkey);
                         EVP_PKEY_free(pkey);
                         if (max < jj) max=jj;
@@ -230,7 +261,8 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                 for (i=0; i<sk_PKCS7_RECIP_INFO_num(rsk); i++)
                         {
                         ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
-                        pkey=X509_get_pubkey(ri->cert);
+                        if ((pkey=X509_get_pubkey(ri->cert)) == NULL)
+                                goto err;
                         jj=EVP_PKEY_encrypt(tmp,key,keylen,pkey);
                         EVP_PKEY_free(pkey);
                         if (jj <= 0)
@@ -261,24 +293,16 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                 {
                 if (PKCS7_is_detached(p7))
                         bio=BIO_new(BIO_s_null());
-                else
+                else if (os && os->length > 0)
+                        bio = BIO_new_mem_buf(os->data, os->length);
+                if(bio == NULL)
                         {
-                        if (PKCS7_type_is_signed(p7))
-                                {
-                                ASN1_OCTET_STRING *os;
-                                os = PKCS7_get_octet_string(
-                                                        p7->d.sign->contents);
-                                if (os && os->length > 0)
-                                        bio = BIO_new_mem_buf(os->data,
-                                                                os->length);
-                                }
-                        if(bio == NULL)
-                                {
-                                bio=BIO_new(BIO_s_mem());
-                                BIO_set_mem_eof_return(bio,0);
-                                }
+                        bio=BIO_new(BIO_s_mem());
+                        if (bio == NULL)
+                                goto err;
+                        BIO_set_mem_eof_return(bio,0);
                         }
-        }
+                }
         BIO_push(out,bio);
         bio=NULL;
         if (0)
@@ -293,6 +317,17 @@ err:
         return(out);
         }
 
+static int pkcs7_cmp_ri(PKCS7_RECIP_INFO *ri, X509 *pcert)
+        {
+        int ret;
+        ret = X509_NAME_cmp(ri->issuer_and_serial->issuer,
+                                pcert->cert_info->issuer);
+        if (ret)
+                return ret;
+        return M_ASN1_INTEGER_cmp(pcert->cert_info->serialNumber,
+                                        ri->issuer_and_serial->serial);
+        }
+
 /* int */
 BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         {
@@ -403,18 +438,18 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                  * (if any)
                  */
 
-                for (i=0; i<sk_PKCS7_RECIP_INFO_num(rsk); i++) {
-                        ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
-                        if(!X509_NAME_cmp(ri->issuer_and_serial->issuer,
-                                        pcert->cert_info->issuer) &&
-                             !M_ASN1_INTEGER_cmp(pcert->cert_info->serialNumber,
-                                        ri->issuer_and_serial->serial)) break;
-                        ri=NULL;
-                }
-                if (ri == NULL) {
-                        PKCS7err(PKCS7_F_PKCS7_DATADECODE,
-                                 PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE);
-                        goto err;
+                if (pcert) {
+                        for (i=0; i<sk_PKCS7_RECIP_INFO_num(rsk); i++) {
+                                ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
+                                if (!pkcs7_cmp_ri(ri, pcert))
+                                        break;
+                                ri=NULL;
+                        }
+                        if (ri == NULL) {
+                                PKCS7err(PKCS7_F_PKCS7_DATADECODE,
+                                      PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE);
+                                goto err;
+                        }
                 }
 
                 jj=EVP_PKEY_size(pkey);
@@ -425,17 +460,46 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                         goto err;
                         }
 
-                jj=EVP_PKEY_decrypt(tmp, M_ASN1_STRING_data(ri->enc_key),
-                        M_ASN1_STRING_length(ri->enc_key), pkey);
-                if (jj <= 0)
+                /* If we haven't got a certificate try each ri in turn */
+
+                if (pcert == NULL)
                         {
-                        PKCS7err(PKCS7_F_PKCS7_DATADECODE,ERR_R_EVP_LIB);
-                        goto err;
+                        for (i=0; i<sk_PKCS7_RECIP_INFO_num(rsk); i++)
+                                {
+                                ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
+                                jj=EVP_PKEY_decrypt(tmp,
+                                        M_ASN1_STRING_data(ri->enc_key),
+                                        M_ASN1_STRING_length(ri->enc_key),
+                                                pkey);
+                                if (jj > 0)
+                                        break;
+                                ERR_clear_error();
+                                ri = NULL;
+                                }
+                        if (ri == NULL)
+                                {
+                                PKCS7err(PKCS7_F_PKCS7_DATADECODE,
+                                      PKCS7_R_NO_RECIPIENT_MATCHES_KEY);
+                                goto err;
+                                }
+                        }
+                else
+                        {
+                        jj=EVP_PKEY_decrypt(tmp,
+                                M_ASN1_STRING_data(ri->enc_key),
+                                M_ASN1_STRING_length(ri->enc_key), pkey);
+                        if (jj <= 0)
+                                {
+                                PKCS7err(PKCS7_F_PKCS7_DATADECODE,
+                                                                ERR_R_EVP_LIB);
+                                goto err;
+                                }
                         }
 
                 evp_ctx=NULL;
                 BIO_get_cipher_ctx(etmp,&evp_ctx);
-                EVP_CipherInit_ex(evp_ctx,evp_cipher,NULL,NULL,NULL,0);
+                if (EVP_CipherInit_ex(evp_ctx,evp_cipher,NULL,NULL,NULL,0) <= 0)
+                        goto err;
                 if (EVP_CIPHER_asn1_to_param(evp_ctx,enc_alg->parameter) < 0)
                         goto err;
 
@@ -451,7 +515,8 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                                 goto err;
                                 }
                 } 
-                EVP_CipherInit_ex(evp_ctx,NULL,NULL,tmp,NULL,0);
+                if (EVP_CipherInit_ex(evp_ctx,NULL,NULL,tmp,NULL,0) <= 0)
+                        goto err;
 
                 OPENSSL_cleanse(tmp,jj);
 
@@ -485,6 +550,8 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                         bio=BIO_new(BIO_s_mem());
                         BIO_set_mem_eof_return(bio,0);
                 }
+                if (bio == NULL)
+                        goto err;
 #endif
                 }
         BIO_push(out,bio);
@@ -504,6 +571,29 @@ err:
         return(out);
         }
 
+static BIO *PKCS7_find_digest(EVP_MD_CTX **pmd, BIO *bio, int nid)
+        {
+        for (;;)
+                {
+                bio=BIO_find_type(bio,BIO_TYPE_MD);
+                if (bio == NULL)
+                        {
+                        PKCS7err(PKCS7_F_PKCS7_FIND_DIGEST,PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST);
+                        return NULL;    
+                        }
+                BIO_get_md_ctx(bio,pmd);
+                if (*pmd == NULL)
+                        {
+                        PKCS7err(PKCS7_F_PKCS7_FIND_DIGEST,ERR_R_INTERNAL_ERROR);
+                        return NULL;
+                        }       
+                if (EVP_MD_CTX_type(*pmd) == nid)
+                        return bio;
+                bio=BIO_next(bio);
+                }
+        return NULL;
+        }
+
 int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
         {
         int ret=0;
@@ -528,7 +618,7 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                 si_sk=p7->d.signed_and_enveloped->signer_info;
                 if (!(os=M_ASN1_OCTET_STRING_new()))
                         {
-                        PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_MALLOC_FAILURE);
+                        PKCS7err(PKCS7_F_PKCS7_DATAFINAL,ERR_R_MALLOC_FAILURE);
                         goto err;
                         }
                 p7->d.signed_and_enveloped->enc_data->enc_data=os;
@@ -537,7 +627,7 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                 /* XXXXXXXXXXXXXXXX */
                 if (!(os=M_ASN1_OCTET_STRING_new()))
                         {
-                        PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_MALLOC_FAILURE);
+                        PKCS7err(PKCS7_F_PKCS7_DATAFINAL,ERR_R_MALLOC_FAILURE);
                         goto err;
                         }
                 p7->d.enveloped->enc_data->enc_data=os;
@@ -551,13 +641,24 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                         p7->d.sign->contents->d.data = NULL;
                 }
                 break;
+
+        case NID_pkcs7_digest:
+                os=PKCS7_get_octet_string(p7->d.digest->contents);
+                /* If detached data then the content is excluded */
+                if(PKCS7_type_is_data(p7->d.digest->contents) && p7->detached)
+                        {
+                        M_ASN1_OCTET_STRING_free(os);
+                        p7->d.digest->contents->d.data = NULL;
+                        }
+                break;
+
                 }
 
         if (si_sk != NULL)
                 {
                 if ((buf=BUF_MEM_new()) == NULL)
                         {
-                        PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_BIO_LIB);
+                        PKCS7err(PKCS7_F_PKCS7_DATAFINAL,ERR_R_BIO_LIB);
                         goto err;
                         }
                 for (i=0; i<sk_PKCS7_SIGNER_INFO_num(si_sk); i++)
@@ -568,32 +669,18 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                         j=OBJ_obj2nid(si->digest_alg->algorithm);
 
                         btmp=bio;
-                        for (;;)
-                                {
-                                if ((btmp=BIO_find_type(btmp,BIO_TYPE_MD)) 
-                                        == NULL)
-                                        {
-                                        PKCS7err(PKCS7_F_PKCS7_DATASIGN,PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST);
-                                        goto err;
-                                        }
-                                BIO_get_md_ctx(btmp,&mdc);
-                                if (mdc == NULL)
-                                        {
-                                        PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_INTERNAL_ERROR);
-                                        goto err;
-                                        }
-                                if (EVP_MD_CTX_type(mdc) == j)
-                                        break;
-                                else
-                                        btmp=BIO_next(btmp);
-                                }
-                        
+
+                        btmp = PKCS7_find_digest(&mdc, btmp, j);
+
+                        if (btmp == NULL)
+                                goto err;
+
                         /* We now have the EVP_MD_CTX, lets do the
                          * signing. */
                         EVP_MD_CTX_copy_ex(&ctx_tmp,mdc);
                         if (!BUF_MEM_grow_clean(buf,EVP_PKEY_size(si->pkey)))
                                 {
-                                PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_BIO_LIB);
+                                PKCS7err(PKCS7_F_PKCS7_DATAFINAL,ERR_R_BIO_LIB);
                                 goto err;
                                 }
 
@@ -615,13 +702,17 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                                         {
                                         if (!(sign_time=X509_gmtime_adj(NULL,0)))
                                                 {
-                                                PKCS7err(PKCS7_F_PKCS7_DATASIGN,
+                                                PKCS7err(PKCS7_F_PKCS7_DATAFINAL,
                                                         ERR_R_MALLOC_FAILURE);
                                                 goto err;
                                                 }
-                                        PKCS7_add_signed_attribute(si,
+                                        if (!PKCS7_add_signed_attribute(si,
                                                 NID_pkcs9_signingTime,
-                                                V_ASN1_UTCTIME,sign_time);
+                                                V_ASN1_UTCTIME,sign_time))
+                                                {
+                                                M_ASN1_UTCTIME_free(sign_time);
+                                                goto err;
+                                                }
                                         }
 
                                 /* Add digest */
@@ -629,20 +720,25 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                                 EVP_DigestFinal_ex(&ctx_tmp,md_data,&md_len);
                                 if (!(digest=M_ASN1_OCTET_STRING_new()))
                                         {
-                                        PKCS7err(PKCS7_F_PKCS7_DATASIGN,
+                                        PKCS7err(PKCS7_F_PKCS7_DATAFINAL,
                                                 ERR_R_MALLOC_FAILURE);
                                         goto err;
                                         }
                                 if (!M_ASN1_OCTET_STRING_set(digest,md_data,
                                                                 md_len))
                                         {
-                                        PKCS7err(PKCS7_F_PKCS7_DATASIGN,
+                                        PKCS7err(PKCS7_F_PKCS7_DATAFINAL,
                                                 ERR_R_MALLOC_FAILURE);
+                                        M_ASN1_OCTET_STRING_free(digest);
                                         goto err;
                                         }
-                                PKCS7_add_signed_attribute(si,
+                                if (!PKCS7_add_signed_attribute(si,
                                         NID_pkcs9_messageDigest,
-                                        V_ASN1_OCTET_STRING,digest);
+                                        V_ASN1_OCTET_STRING,digest))
+                                        {
+                                        M_ASN1_OCTET_STRING_free(digest);
+                                        goto err;
+                                        }
 
                                 /* Now sign the attributes */
                                 EVP_SignInit_ex(&ctx_tmp,md_tmp,NULL);
@@ -657,28 +753,42 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                         if (si->pkey->type == EVP_PKEY_DSA)
                                 ctx_tmp.digest=EVP_dss1();
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                        if (si->pkey->type == EVP_PKEY_EC)
+                                ctx_tmp.digest=EVP_ecdsa();
+#endif
 
                         if (!EVP_SignFinal(&ctx_tmp,(unsigned char *)buf->data,
                                 (unsigned int *)&buf->length,si->pkey))
                                 {
-                                PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_EVP_LIB);
+                                PKCS7err(PKCS7_F_PKCS7_DATAFINAL,ERR_R_EVP_LIB);
                                 goto err;
                                 }
                         if (!ASN1_STRING_set(si->enc_digest,
                                 (unsigned char *)buf->data,buf->length))
                                 {
-                                PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_ASN1_LIB);
+                                PKCS7err(PKCS7_F_PKCS7_DATAFINAL,ERR_R_ASN1_LIB);
                                 goto err;
                                 }
                         }
                 }
+        else if (i == NID_pkcs7_digest)
+                {
+                unsigned char md_data[EVP_MAX_MD_SIZE];
+                unsigned int md_len;
+                if (!PKCS7_find_digest(&mdc, bio,
+                                OBJ_obj2nid(p7->d.digest->md->algorithm)))
+                        goto err;
+                EVP_DigestFinal_ex(mdc,md_data,&md_len);
+                M_ASN1_OCTET_STRING_set(p7->d.digest->digest, md_data, md_len);
+                }
 
         if (!PKCS7_is_detached(p7))
                 {
                 btmp=BIO_find_type(bio,BIO_TYPE_MEM);
                 if (btmp == NULL)
                         {
-                        PKCS7err(PKCS7_F_PKCS7_DATASIGN,PKCS7_R_UNABLE_TO_FIND_MEM_BIO);
+                        PKCS7err(PKCS7_F_PKCS7_DATAFINAL,PKCS7_R_UNABLE_TO_FIND_MEM_BIO);
                         goto err;
                         }
                 BIO_get_mem_ptr(btmp,&buf_mem);
@@ -859,6 +969,9 @@ for (ii=0; ii<md_len; ii++) printf("%02X",md_dat[ii]); printf(" calc\n");
 #ifndef OPENSSL_NO_DSA
         if(pkey->type == EVP_PKEY_DSA) mdc_tmp.digest=EVP_dss1();
 #endif
+#ifndef OPENSSL_NO_ECDSA
+        if (pkey->type == EVP_PKEY_EC) mdc_tmp.digest=EVP_ecdsa();
+#endif
 
         i=EVP_VerifyFinal(&mdc_tmp,os->data,os->length, pkey);
         EVP_PKEY_free(pkey);
@@ -883,8 +996,13 @@ PKCS7_ISSUER_AND_SERIAL *PKCS7_get_issuer_and_serial(PKCS7 *p7, int idx)
         int i;
 
         i=OBJ_obj2nid(p7->type);
-        if (i != NID_pkcs7_signedAndEnveloped) return(NULL);
+        if (i != NID_pkcs7_signedAndEnveloped)
+                return NULL;
+        if (p7->d.signed_and_enveloped == NULL)
+                return NULL;
         rsk=p7->d.signed_and_enveloped->recipientinfo;
+        if (rsk == NULL)
+                return NULL;
         ri=sk_PKCS7_RECIP_INFO_value(rsk,0);
         if (sk_PKCS7_RECIP_INFO_num(rsk) <= idx) return(NULL);
         ri=sk_PKCS7_RECIP_INFO_value(rsk,idx);
@@ -938,6 +1056,8 @@ int PKCS7_set_signed_attributes(PKCS7_SIGNER_INFO *p7si,
         if (p7si->auth_attr != NULL)
                 sk_X509_ATTRIBUTE_pop_free(p7si->auth_attr,X509_ATTRIBUTE_free);
         p7si->auth_attr=sk_X509_ATTRIBUTE_dup(sk);
+        if (p7si->auth_attr == NULL)
+                return 0;
         for (i=0; i<sk_X509_ATTRIBUTE_num(sk); i++)
                 {
                 if ((sk_X509_ATTRIBUTE_set(p7si->auth_attr,i,
@@ -956,6 +1076,8 @@ int PKCS7_set_attributes(PKCS7_SIGNER_INFO *p7si, STACK_OF(X509_ATTRIBUTE) *sk)
                 sk_X509_ATTRIBUTE_pop_free(p7si->unauth_attr,
                                            X509_ATTRIBUTE_free);
         p7si->unauth_attr=sk_X509_ATTRIBUTE_dup(sk);
+        if (p7si->unauth_attr == NULL)
+                return 0;
         for (i=0; i<sk_X509_ATTRIBUTE_num(sk); i++)
                 {
                 if ((sk_X509_ATTRIBUTE_set(p7si->unauth_attr,i,
@@ -985,10 +1107,16 @@ static int add_attribute(STACK_OF(X509_ATTRIBUTE) **sk, int nid, int atrtype,
 
         if (*sk == NULL)
                 {
-                *sk = sk_X509_ATTRIBUTE_new_null();
+                if (!(*sk = sk_X509_ATTRIBUTE_new_null()))
+                        return 0;
 new_attrib:
-                attr=X509_ATTRIBUTE_create(nid,atrtype,value);
-                sk_X509_ATTRIBUTE_push(*sk,attr);
+                if (!(attr=X509_ATTRIBUTE_create(nid,atrtype,value)))
+                        return 0;
+                if (!sk_X509_ATTRIBUTE_push(*sk,attr))
+                        {
+                        X509_ATTRIBUTE_free(attr);
+                        return 0;
+                        }
                 }
         else
                 {
@@ -1001,7 +1129,13 @@ new_attrib:
                                 {
                                 X509_ATTRIBUTE_free(attr);
                                 attr=X509_ATTRIBUTE_create(nid,atrtype,value);
-                                sk_X509_ATTRIBUTE_set(*sk,i,attr);
+                                if (attr == NULL)
+                                        return 0;
+                                if (!sk_X509_ATTRIBUTE_set(*sk,i,attr))
+                                        {
+                                        X509_ATTRIBUTE_free(attr);
+                                        return 0;
+                                        }
                                 goto end;
                                 }
                         }
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c b/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c
index ee1817c7af..f2490941a3 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c
@@ -138,6 +138,10 @@ int PKCS7_set_content(PKCS7 *p7, PKCS7 *p7_data)
                 p7->d.sign->contents=p7_data;
                 break;
         case NID_pkcs7_digest:
+                if (p7->d.digest->contents != NULL)
+                        PKCS7_free(p7->d.digest->contents);
+                p7->d.digest->contents=p7_data;
+                break;
         case NID_pkcs7_data:
         case NID_pkcs7_enveloped:
         case NID_pkcs7_signedAndEnveloped:
@@ -206,6 +210,12 @@ int PKCS7_set_type(PKCS7 *p7, int type)
                 break;
 
         case NID_pkcs7_digest:
+                p7->type=obj;
+                if ((p7->d.digest=PKCS7_DIGEST_new())
+                        == NULL) goto err;
+                if (!ASN1_INTEGER_set(p7->d.digest->version,0))
+                        goto err;
+                break;
         default:
                 PKCS7err(PKCS7_F_PKCS7_SET_TYPE,PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
                 goto err;
@@ -215,6 +225,13 @@ err:
         return(0);
         }
 
+int PKCS7_set0_type_other(PKCS7 *p7, int type, ASN1_TYPE *other)
+        {
+        p7->type = OBJ_nid2obj(type);
+        p7->d.other = other;
+        return 1;
+        }
+
 int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *psi)
         {
         int i,j,nid;
@@ -254,16 +271,23 @@ int PKCS7_add_signer(PKCS7 *p7, PKCS7_SIGNER_INFO *psi)
         if (!j) /* we need to add another algorithm */
                 {
                 if(!(alg=X509_ALGOR_new())
-                        || !(alg->parameter = ASN1_TYPE_new())) {
+                        || !(alg->parameter = ASN1_TYPE_new()))
+                        {
+                        X509_ALGOR_free(alg);
                         PKCS7err(PKCS7_F_PKCS7_ADD_SIGNER,ERR_R_MALLOC_FAILURE);
                         return(0);
-                }
+                        }
                 alg->algorithm=OBJ_nid2obj(nid);
                 alg->parameter->type = V_ASN1_NULL;
-                sk_X509_ALGOR_push(md_sk,alg);
+                if (!sk_X509_ALGOR_push(md_sk,alg))
+                        {
+                        X509_ALGOR_free(alg);
+                        return 0;
+                        }
                 }
 
-        sk_PKCS7_SIGNER_INFO_push(signer_sk,psi);
+        if (!sk_PKCS7_SIGNER_INFO_push(signer_sk,psi))
+                return 0;
         return(1);
         }
 
@@ -288,8 +312,17 @@ int PKCS7_add_certificate(PKCS7 *p7, X509 *x509)
 
         if (*sk == NULL)
                 *sk=sk_X509_new_null();
+        if (*sk == NULL)
+                {
+                PKCS7err(PKCS7_F_PKCS7_ADD_CERTIFICATE,ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
         CRYPTO_add(&x509->references,1,CRYPTO_LOCK_X509);
-        sk_X509_push(*sk,x509);
+        if (!sk_X509_push(*sk,x509))
+                {
+                X509_free(x509);
+                return 0;
+                }
         return(1);
         }
 
@@ -314,18 +347,31 @@ int PKCS7_add_crl(PKCS7 *p7, X509_CRL *crl)
 
         if (*sk == NULL)
                 *sk=sk_X509_CRL_new_null();
+        if (*sk == NULL)
+                {
+                PKCS7err(PKCS7_F_PKCS7_ADD_CRL,ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
 
         CRYPTO_add(&crl->references,1,CRYPTO_LOCK_X509_CRL);
-        sk_X509_CRL_push(*sk,crl);
+        if (!sk_X509_CRL_push(*sk,crl))
+                {
+                X509_CRL_free(crl);
+                return 0;
+                }
         return(1);
         }
 
 int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
              const EVP_MD *dgst)
         {
+        int nid;
         char is_dsa;
-        if (pkey->type == EVP_PKEY_DSA) is_dsa = 1;
-        else is_dsa = 0;
+
+        if (pkey->type == EVP_PKEY_DSA || pkey->type == EVP_PKEY_EC)
+                is_dsa = 1;
+        else
+                is_dsa = 0;
         /* We now need to add another PKCS7_SIGNER_INFO entry */
         if (!ASN1_INTEGER_set(p7i->version,1))
                 goto err;
@@ -355,16 +401,38 @@ int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
                 goto err;
         p7i->digest_alg->parameter->type=V_ASN1_NULL;
 
-        p7i->digest_enc_alg->algorithm=OBJ_nid2obj(EVP_PKEY_type(pkey->type));
-
         if (p7i->digest_enc_alg->parameter != NULL)
                 ASN1_TYPE_free(p7i->digest_enc_alg->parameter);
-        if(is_dsa) p7i->digest_enc_alg->parameter = NULL;
-        else {
+        nid = EVP_PKEY_type(pkey->type);
+        if (nid == EVP_PKEY_RSA)
+                {
+                p7i->digest_enc_alg->algorithm=OBJ_nid2obj(NID_rsaEncryption);
                 if (!(p7i->digest_enc_alg->parameter=ASN1_TYPE_new()))
                         goto err;
                 p7i->digest_enc_alg->parameter->type=V_ASN1_NULL;
-        }
+                }
+        else if (nid == EVP_PKEY_DSA)
+                {
+#if 1
+                /* use 'dsaEncryption' OID for compatibility with other software
+                 * (PKCS #7 v1.5 does specify how to handle DSA) ... */
+                p7i->digest_enc_alg->algorithm=OBJ_nid2obj(NID_dsa);
+#else
+                /* ... although the 'dsaWithSHA1' OID (as required by RFC 2630 for CMS)
+                 * would make more sense. */
+                p7i->digest_enc_alg->algorithm=OBJ_nid2obj(NID_dsaWithSHA1);
+#endif
+                p7i->digest_enc_alg->parameter = NULL; /* special case for DSA: omit 'parameter'! */
+                }
+        else if (nid == EVP_PKEY_EC)
+                {
+                p7i->digest_enc_alg->algorithm=OBJ_nid2obj(NID_ecdsa_with_SHA1);
+                if (!(p7i->digest_enc_alg->parameter=ASN1_TYPE_new()))
+                        goto err;
+                p7i->digest_enc_alg->parameter->type=V_ASN1_NULL;
+                }
+        else
+                return(0);
 
         return(1);
 err:
@@ -381,9 +449,28 @@ PKCS7_SIGNER_INFO *PKCS7_add_signature(PKCS7 *p7, X509 *x509, EVP_PKEY *pkey,
         if (!PKCS7_add_signer(p7,si)) goto err;
         return(si);
 err:
+        PKCS7_SIGNER_INFO_free(si);
         return(NULL);
         }
 
+int PKCS7_set_digest(PKCS7 *p7, const EVP_MD *md)
+        {
+        if (PKCS7_type_is_digest(p7))
+                {
+                if(!(p7->d.digest->md->parameter = ASN1_TYPE_new()))
+                        {
+                        PKCS7err(PKCS7_F_PKCS7_SET_DIGEST,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                        }
+                p7->d.digest->md->parameter->type = V_ASN1_NULL;
+                p7->d.digest->md->algorithm = OBJ_nid2obj(EVP_MD_nid(md));
+                return 1;
+                }
+                
+        PKCS7err(PKCS7_F_PKCS7_SET_DIGEST,PKCS7_R_WRONG_CONTENT_TYPE);
+        return 1;
+        }
+
 STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7)
         {
         if (PKCS7_type_is_signed(p7))
@@ -407,6 +494,7 @@ PKCS7_RECIP_INFO *PKCS7_add_recipient(PKCS7 *p7, X509 *x509)
         if (!PKCS7_add_recipient_info(p7,ri)) goto err;
         return(ri);
 err:
+        PKCS7_RECIP_INFO_free(ri);
         return(NULL);
         }
 
@@ -429,7 +517,8 @@ int PKCS7_add_recipient_info(PKCS7 *p7, PKCS7_RECIP_INFO *ri)
                 return(0);
                 }
 
-        sk_PKCS7_RECIP_INFO_push(sk,ri);
+        if (!sk_PKCS7_RECIP_INFO_push(sk,ri))
+                return 0;
         return(1);
         }
 
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_mime.c b/src/lib/libssl/src/crypto/pkcs7/pk7_mime.c
index 927b88c3e7..17b68992f7 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pk7_mime.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_mime.c
@@ -1,6 +1,6 @@
 /* pk7_mime.c */
 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
- * project 1999.
+ * project.
  */
 /* ====================================================================
  * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
@@ -86,6 +86,7 @@ STACK_OF(MIME_PARAM) *params;		/* Zero or more parameters */
 DECLARE_STACK_OF(MIME_HEADER)
 IMPLEMENT_STACK_OF(MIME_HEADER)
 
+static int pkcs7_output_data(BIO *bio, BIO *data, PKCS7 *p7, int flags);
 static int B64_write_PKCS7(BIO *bio, PKCS7 *p7);
 static PKCS7 *B64_read_PKCS7(BIO *bio);
 static char * strip_ends(char *name);
@@ -109,9 +110,6 @@ static void mime_hdr_free(MIME_HEADER *hdr);
 #define MAX_SMLEN 1024
 #define mime_debug(x) /* x */
 
-
-typedef void (*stkfree)();
-
 /* Base 64 read and write of PKCS#7 structure */
 
 static int B64_write_PKCS7(BIO *bio, PKCS7 *p7)
@@ -123,7 +121,7 @@ static int B64_write_PKCS7(BIO *bio, PKCS7 *p7)
         }
         bio = BIO_push(b64, bio);
         i2d_PKCS7_bio(bio, p7);
-        BIO_flush(bio);
+        (void)BIO_flush(bio);
         bio = BIO_pop(bio);
         BIO_free(b64);
         return 1;
@@ -140,7 +138,7 @@ static PKCS7 *B64_read_PKCS7(BIO *bio)
         bio = BIO_push(b64, bio);
         if(!(p7 = d2i_PKCS7_bio(bio, NULL))) 
                 PKCS7err(PKCS7_F_B64_READ_PKCS7,PKCS7_R_DECODE_ERROR);
-        BIO_flush(bio);
+        (void)BIO_flush(bio);
         bio = BIO_pop(bio);
         BIO_free(b64);
         return p7;
@@ -182,7 +180,7 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags)
                                                 mime_eol, mime_eol);
                 /* Now write out the first part */
                 BIO_printf(bio, "------%s%s", bound, mime_eol);
-                SMIME_crlf_copy(data, bio, flags);
+                pkcs7_output_data(bio, data, p7, flags);
                 BIO_printf(bio, "%s------%s%s", mime_eol, bound, mime_eol);
 
                 /* Headers for signature */
@@ -196,7 +194,7 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags)
                                                         mime_eol, mime_eol);
                 B64_write_PKCS7(bio, p7);
                 BIO_printf(bio,"%s------%s--%s%s", mime_eol, bound,
-                                                mime_eol, mime_eol);
+                                                        mime_eol, mime_eol);
                 return 1;
         }
 
@@ -231,6 +229,46 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags)
         return 1;
 }
 
+/* Handle output of PKCS#7 data */
+
+
+static int pkcs7_output_data(BIO *out, BIO *data, PKCS7 *p7, int flags)
+        {
+        BIO *tmpbio, *p7bio;
+
+        if (!(flags & PKCS7_STREAM))
+                {
+                SMIME_crlf_copy(data, out, flags);
+                return 1;
+                }
+
+        /* Partial sign operation */
+
+        /* Initialize sign operation */
+        p7bio = PKCS7_dataInit(p7, out);
+
+        /* Copy data across, computing digests etc */
+        SMIME_crlf_copy(data, p7bio, flags);
+
+        /* Must be detached */
+        PKCS7_set_detached(p7, 1);
+
+        /* Finalize signatures */
+        PKCS7_dataFinal(p7, p7bio);
+
+        /* Now remove any digests prepended to the BIO */
+
+        while (p7bio != out)
+                {
+                tmpbio = BIO_pop(p7bio);
+                BIO_free(p7bio);
+                p7bio = tmpbio;
+                }
+
+        return 1;
+
+        }
+
 /* SMIME reader: handle multipart/signed and opaque signing.
  * in multipart case the content is placed in a memory BIO
  * pointed to by "bcont". In opaque this is set to NULL
@@ -339,56 +377,6 @@ PKCS7 *SMIME_read_PKCS7(BIO *bio, BIO **bcont)
 
 }
 
-/* Copy text from one BIO to another making the output CRLF at EOL */
-int SMIME_crlf_copy(BIO *in, BIO *out, int flags)
-{
-        char eol;
-        int len;
-        char linebuf[MAX_SMLEN];
-        if(flags & PKCS7_BINARY) {
-                while((len = BIO_read(in, linebuf, MAX_SMLEN)) > 0)
-                                                BIO_write(out, linebuf, len);
-                return 1;
-        }
-        if(flags & PKCS7_TEXT) BIO_printf(out, "Content-Type: text/plain\r\n\r\n");
-        while ((len = BIO_gets(in, linebuf, MAX_SMLEN)) > 0) {
-                eol = strip_eol(linebuf, &len);
-                if (len)
-                        BIO_write(out, linebuf, len);
-                if(eol) BIO_write(out, "\r\n", 2);
-        }
-        return 1;
-}
-
-/* Strip off headers if they are text/plain */
-int SMIME_text(BIO *in, BIO *out)
-{
-        char iobuf[4096];
-        int len;
-        STACK_OF(MIME_HEADER) *headers;
-        MIME_HEADER *hdr;
-
-        if (!(headers = mime_parse_hdr(in))) {
-                PKCS7err(PKCS7_F_SMIME_TEXT,PKCS7_R_MIME_PARSE_ERROR);
-                return 0;
-        }
-        if(!(hdr = mime_hdr_find(headers, "content-type")) || !hdr->value) {
-                PKCS7err(PKCS7_F_SMIME_TEXT,PKCS7_R_MIME_NO_CONTENT_TYPE);
-                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-                return 0;
-        }
-        if (strcmp (hdr->value, "text/plain")) {
-                PKCS7err(PKCS7_F_SMIME_TEXT,PKCS7_R_INVALID_MIME_TYPE);
-                ERR_add_error_data(2, "type: ", hdr->value);
-                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-                return 0;
-        }
-        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-        while ((len = BIO_read(in, iobuf, sizeof(iobuf))) > 0)
-                                                BIO_write(out, iobuf, len);
-        return 1;
-}
-
 /* Split a multipart/XXX message body into component parts: result is
  * canonical parts in a STACK of bios
  */
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_smime.c b/src/lib/libssl/src/crypto/pkcs7/pk7_smime.c
index 99a0d63f38..5c6b0fe24b 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pk7_smime.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_smime.c
@@ -1,9 +1,9 @@
 /* pk7_smime.c */
 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
- * project 1999.
+ * project.
  */
 /* ====================================================================
- * Copyright (c) 1999-2003 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -66,10 +66,10 @@
 PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
                   BIO *data, int flags)
 {
-        PKCS7 *p7;
+        PKCS7 *p7 = NULL;
         PKCS7_SIGNER_INFO *si;
-        BIO *p7bio;
-        STACK_OF(X509_ALGOR) *smcap;
+        BIO *p7bio = NULL;
+        STACK_OF(X509_ALGOR) *smcap = NULL;
         int i;
 
         if(!X509_check_private_key(signcert, pkey)) {
@@ -82,66 +82,87 @@ PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
                 return NULL;
         }
 
-        PKCS7_set_type(p7, NID_pkcs7_signed);
+        if (!PKCS7_set_type(p7, NID_pkcs7_signed))
+                goto err;
 
-        PKCS7_content_new(p7, NID_pkcs7_data);
+        if (!PKCS7_content_new(p7, NID_pkcs7_data))
+                goto err;
 
-        if (!(si = PKCS7_add_signature(p7,signcert,pkey,EVP_sha1()))) {
+        if (!(si = PKCS7_add_signature(p7,signcert,pkey,EVP_sha1()))) {
                 PKCS7err(PKCS7_F_PKCS7_SIGN,PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR);
-                return NULL;
+                goto err;
         }
 
         if(!(flags & PKCS7_NOCERTS)) {
-                PKCS7_add_certificate(p7, signcert);
+                if (!PKCS7_add_certificate(p7, signcert))
+                        goto err;
                 if(certs) for(i = 0; i < sk_X509_num(certs); i++)
-                        PKCS7_add_certificate(p7, sk_X509_value(certs, i));
-        }
-
-        if(!(p7bio = PKCS7_dataInit(p7, NULL))) {
-                PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
-                return NULL;
+                        if (!PKCS7_add_certificate(p7, sk_X509_value(certs, i)))
+                                goto err;
         }
 
-
-        SMIME_crlf_copy(data, p7bio, flags);
-
         if(!(flags & PKCS7_NOATTR)) {
-                PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
-                                V_ASN1_OBJECT, OBJ_nid2obj(NID_pkcs7_data));
+                if (!PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
+                                V_ASN1_OBJECT, OBJ_nid2obj(NID_pkcs7_data)))
+                        goto err;
                 /* Add SMIMECapabilities */
                 if(!(flags & PKCS7_NOSMIMECAP))
                 {
                 if(!(smcap = sk_X509_ALGOR_new_null())) {
                         PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
-                        return NULL;
+                        goto err;
                 }
 #ifndef OPENSSL_NO_DES
-                PKCS7_simple_smimecap (smcap, NID_des_ede3_cbc, -1);
+                if (!PKCS7_simple_smimecap (smcap, NID_des_ede3_cbc, -1))
+                        goto err;
 #endif
 #ifndef OPENSSL_NO_RC2
-                PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 128);
-                PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 64);
+                if (!PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 128))
+                        goto err;
+                if (!PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 64))
+                        goto err;
 #endif
 #ifndef OPENSSL_NO_DES
-                PKCS7_simple_smimecap (smcap, NID_des_cbc, -1);
+                if (!PKCS7_simple_smimecap (smcap, NID_des_cbc, -1))
+                        goto err;
 #endif
 #ifndef OPENSSL_NO_RC2
-                PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 40);
+                if (!PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 40))
+                        goto err;
 #endif
-                PKCS7_add_attrib_smimecap (si, smcap);
+                if (!PKCS7_add_attrib_smimecap (si, smcap))
+                        goto err;
                 sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
+                smcap = NULL;
                 }
         }
 
         if(flags & PKCS7_DETACHED)PKCS7_set_detached(p7, 1);
 
-        if (!PKCS7_dataFinal(p7,p7bio)) {
+        if (flags & PKCS7_STREAM)
+                return p7;
+
+
+        if (!(p7bio = PKCS7_dataInit(p7, NULL))) {
+                PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
+                goto err;
+        }
+
+        SMIME_crlf_copy(data, p7bio, flags);
+
+
+        if (!PKCS7_dataFinal(p7,p7bio)) {
                 PKCS7err(PKCS7_F_PKCS7_SIGN,PKCS7_R_PKCS7_DATASIGN);
-                return NULL;
+                goto err;
         }
 
-        BIO_free_all(p7bio);
+        BIO_free_all(p7bio);
         return p7;
+err:
+        sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
+        BIO_free_all(p7bio);
+        PKCS7_free(p7);
+        return NULL;
 }
 
 int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
@@ -215,6 +236,8 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
                         sk_X509_free(signers);
                         return 0;
                 }
+                if (!(flags & PKCS7_NOCRL))
+                        X509_STORE_CTX_set0_crls(&cert_ctx, p7->d.sign->crl);
                 i = X509_verify_cert(&cert_ctx);
                 if (i <= 0) j = X509_STORE_CTX_get_error(&cert_ctx);
                 X509_STORE_CTX_cleanup(&cert_ctx);
@@ -251,7 +274,8 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
                 tmpin = indata;
                 
 
-        p7bio=PKCS7_dataInit(p7,tmpin);
+        if (!(p7bio=PKCS7_dataInit(p7,tmpin)))
+                goto err;
 
         if(flags & PKCS7_TEXT) {
                 if(!(tmpout = BIO_new(BIO_s_mem()))) {
@@ -330,7 +354,7 @@ STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
 
         if(sk_PKCS7_SIGNER_INFO_num(sinfos) <= 0) {
                 PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_NO_SIGNERS);
-                return 0;
+                return NULL;
         }
 
         if(!(signers = sk_X509_new_null())) {
@@ -353,10 +377,13 @@ STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
             if (!signer) {
                         PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND);
                         sk_X509_free(signers);
-                        return 0;
+                        return NULL;
             }
 
-            sk_X509_push(signers, signer);
+            if (!sk_X509_push(signers, signer)) {
+                        sk_X509_free(signers);
+                        return NULL;
+            }
         }
         return signers;
 }
@@ -376,7 +403,8 @@ PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, const EVP_CIPHER *cipher,
                 return NULL;
         }
 
-        PKCS7_set_type(p7, NID_pkcs7_enveloped);
+        if (!PKCS7_set_type(p7, NID_pkcs7_enveloped))
+                goto err;
         if(!PKCS7_set_cipher(p7, cipher)) {
                 PKCS7err(PKCS7_F_PKCS7_ENCRYPT,PKCS7_R_ERROR_SETTING_CIPHER);
                 goto err;
@@ -398,7 +426,7 @@ PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, const EVP_CIPHER *cipher,
 
         SMIME_crlf_copy(in, p7bio, flags);
 
-        BIO_flush(p7bio);
+        (void)BIO_flush(p7bio);
 
         if (!PKCS7_dataFinal(p7,p7bio)) {
                 PKCS7err(PKCS7_F_PKCS7_ENCRYPT,PKCS7_R_PKCS7_DATAFINAL_ERROR);
@@ -410,7 +438,7 @@ PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, const EVP_CIPHER *cipher,
 
         err:
 
-        BIO_free(p7bio);
+        BIO_free_all(p7bio);
         PKCS7_free(p7);
         return NULL;
 
@@ -432,7 +460,7 @@ int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags)
                 return 0;
         }
 
-        if(!X509_check_private_key(cert, pkey)) {
+        if(cert && !X509_check_private_key(cert, pkey)) {
                 PKCS7err(PKCS7_F_PKCS7_DECRYPT,
                                 PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE);
                 return 0;
@@ -448,10 +476,13 @@ int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags)
                 /* Encrypt BIOs can't do BIO_gets() so add a buffer BIO */
                 if(!(tmpbuf = BIO_new(BIO_f_buffer()))) {
                         PKCS7err(PKCS7_F_PKCS7_DECRYPT, ERR_R_MALLOC_FAILURE);
+                        BIO_free_all(tmpmem);
                         return 0;
                 }
                 if(!(bread = BIO_push(tmpbuf, tmpmem))) {
                         PKCS7err(PKCS7_F_PKCS7_DECRYPT, ERR_R_MALLOC_FAILURE);
+                        BIO_free_all(tmpbuf);
+                        BIO_free_all(tmpmem);
                         return 0;
                 }
                 ret = SMIME_text(bread, data);
diff --git a/src/lib/libssl/src/crypto/pkcs7/pkcs7.h b/src/lib/libssl/src/crypto/pkcs7/pkcs7.h
index 15372e18f8..cc092d262d 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pkcs7.h
+++ b/src/lib/libssl/src/crypto/pkcs7/pkcs7.h
@@ -233,6 +233,8 @@ DECLARE_PKCS12_STACK_OF(PKCS7)
                 (OBJ_obj2nid((a)->type) == NID_pkcs7_signedAndEnveloped)
 #define PKCS7_type_is_data(a)   (OBJ_obj2nid((a)->type) == NID_pkcs7_data)
 
+#define PKCS7_type_is_digest(a)   (OBJ_obj2nid((a)->type) == NID_pkcs7_digest)
+
 #define PKCS7_set_detached(p,v) \
                 PKCS7_ctrl(p,PKCS7_OP_SET_DETACHED_SIGNATURE,v,NULL)
 #define PKCS7_get_detached(p) \
@@ -262,6 +264,8 @@ DECLARE_PKCS12_STACK_OF(PKCS7)
 #define PKCS7_NOSMIMECAP        0x200
 #define PKCS7_NOOLDMIMETYPE     0x400
 #define PKCS7_CRLFEOL           0x800
+#define PKCS7_STREAM            0x1000
+#define PKCS7_NOCRL             0x2000
 
 /* Flags: for compatibility with older code */
 
@@ -302,10 +306,12 @@ DECLARE_ASN1_FUNCTIONS(PKCS7)
 DECLARE_ASN1_ITEM(PKCS7_ATTR_SIGN)
 DECLARE_ASN1_ITEM(PKCS7_ATTR_VERIFY)
 
+DECLARE_ASN1_NDEF_FUNCTION(PKCS7)
 
 long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg);
 
 int PKCS7_set_type(PKCS7 *p7, int type);
+int PKCS7_set0_type_other(PKCS7 *p7, int type, ASN1_TYPE *other);
 int PKCS7_set_content(PKCS7 *p7, PKCS7 *p7_data);
 int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
         const EVP_MD *dgst);
@@ -326,6 +332,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert);
 PKCS7_SIGNER_INFO *PKCS7_add_signature(PKCS7 *p7, X509 *x509,
         EVP_PKEY *pkey, const EVP_MD *dgst);
 X509 *PKCS7_cert_from_signer_info(PKCS7 *p7, PKCS7_SIGNER_INFO *si);
+int PKCS7_set_digest(PKCS7 *p7, const EVP_MD *md);
 STACK_OF(PKCS7_SIGNER_INFO) *PKCS7_get_signer_info(PKCS7 *p7);
 
 PKCS7_RECIP_INFO *PKCS7_add_recipient(PKCS7 *p7, X509 *x509);
@@ -381,16 +388,20 @@ void ERR_load_PKCS7_strings(void);
 #define PKCS7_F_PKCS7_ADD_CRL                            101
 #define PKCS7_F_PKCS7_ADD_RECIPIENT_INFO                 102
 #define PKCS7_F_PKCS7_ADD_SIGNER                         103
+#define PKCS7_F_PKCS7_BIO_ADD_DIGEST                     125
 #define PKCS7_F_PKCS7_CTRL                               104
 #define PKCS7_F_PKCS7_DATADECODE                         112
+#define PKCS7_F_PKCS7_DATAFINAL                          128
 #define PKCS7_F_PKCS7_DATAINIT                           105
 #define PKCS7_F_PKCS7_DATASIGN                           106
 #define PKCS7_F_PKCS7_DATAVERIFY                         107
 #define PKCS7_F_PKCS7_DECRYPT                            114
 #define PKCS7_F_PKCS7_ENCRYPT                            115
+#define PKCS7_F_PKCS7_FIND_DIGEST                        127
 #define PKCS7_F_PKCS7_GET0_SIGNERS                       124
 #define PKCS7_F_PKCS7_SET_CIPHER                         108
 #define PKCS7_F_PKCS7_SET_CONTENT                        109
+#define PKCS7_F_PKCS7_SET_DIGEST                         126
 #define PKCS7_F_PKCS7_SET_TYPE                           110
 #define PKCS7_F_PKCS7_SIGN                               116
 #define PKCS7_F_PKCS7_SIGNATUREVERIFY                    113
@@ -421,13 +432,15 @@ void ERR_load_PKCS7_strings(void);
 #define PKCS7_R_NO_MULTIPART_BODY_FAILURE                136
 #define PKCS7_R_NO_MULTIPART_BOUNDARY                    137
 #define PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE         115
+#define PKCS7_R_NO_RECIPIENT_MATCHES_KEY                 146
 #define PKCS7_R_NO_SIGNATURES_ON_DATA                    123
 #define PKCS7_R_NO_SIGNERS                               142
 #define PKCS7_R_NO_SIG_CONTENT_TYPE                      138
 #define PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE     104
 #define PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR                124
+#define PKCS7_R_PKCS7_DATAFINAL                          126
 #define PKCS7_R_PKCS7_DATAFINAL_ERROR                    125
-#define PKCS7_R_PKCS7_DATASIGN                           126
+#define PKCS7_R_PKCS7_DATASIGN                           145
 #define PKCS7_R_PKCS7_PARSE_ERROR                        139
 #define PKCS7_R_PKCS7_SIG_PARSE_ERROR                    140
 #define PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE   127
diff --git a/src/lib/libssl/src/crypto/pkcs7/pkcs7err.c b/src/lib/libssl/src/crypto/pkcs7/pkcs7err.c
index 19894c80a4..c0e3d4cd33 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pkcs7err.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pkcs7err.c
@@ -77,16 +77,20 @@ static ERR_STRING_DATA PKCS7_str_functs[]=
 {ERR_FUNC(PKCS7_F_PKCS7_ADD_CRL),       "PKCS7_add_crl"},
 {ERR_FUNC(PKCS7_F_PKCS7_ADD_RECIPIENT_INFO),    "PKCS7_add_recipient_info"},
 {ERR_FUNC(PKCS7_F_PKCS7_ADD_SIGNER),    "PKCS7_add_signer"},
+{ERR_FUNC(PKCS7_F_PKCS7_BIO_ADD_DIGEST),        "PKCS7_BIO_ADD_DIGEST"},
 {ERR_FUNC(PKCS7_F_PKCS7_CTRL),  "PKCS7_ctrl"},
 {ERR_FUNC(PKCS7_F_PKCS7_DATADECODE),    "PKCS7_dataDecode"},
+{ERR_FUNC(PKCS7_F_PKCS7_DATAFINAL),     "PKCS7_dataFinal"},
 {ERR_FUNC(PKCS7_F_PKCS7_DATAINIT),      "PKCS7_dataInit"},
 {ERR_FUNC(PKCS7_F_PKCS7_DATASIGN),      "PKCS7_DATASIGN"},
 {ERR_FUNC(PKCS7_F_PKCS7_DATAVERIFY),    "PKCS7_dataVerify"},
 {ERR_FUNC(PKCS7_F_PKCS7_DECRYPT),       "PKCS7_decrypt"},
 {ERR_FUNC(PKCS7_F_PKCS7_ENCRYPT),       "PKCS7_encrypt"},
+{ERR_FUNC(PKCS7_F_PKCS7_FIND_DIGEST),   "PKCS7_FIND_DIGEST"},
 {ERR_FUNC(PKCS7_F_PKCS7_GET0_SIGNERS),  "PKCS7_get0_signers"},
 {ERR_FUNC(PKCS7_F_PKCS7_SET_CIPHER),    "PKCS7_set_cipher"},
 {ERR_FUNC(PKCS7_F_PKCS7_SET_CONTENT),   "PKCS7_set_content"},
+{ERR_FUNC(PKCS7_F_PKCS7_SET_DIGEST),    "PKCS7_set_digest"},
 {ERR_FUNC(PKCS7_F_PKCS7_SET_TYPE),      "PKCS7_set_type"},
 {ERR_FUNC(PKCS7_F_PKCS7_SIGN),  "PKCS7_sign"},
 {ERR_FUNC(PKCS7_F_PKCS7_SIGNATUREVERIFY),       "PKCS7_signatureVerify"},
@@ -120,11 +124,13 @@ static ERR_STRING_DATA PKCS7_str_reasons[]=
 {ERR_REASON(PKCS7_R_NO_MULTIPART_BODY_FAILURE),"no multipart body failure"},
 {ERR_REASON(PKCS7_R_NO_MULTIPART_BOUNDARY),"no multipart boundary"},
 {ERR_REASON(PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE),"no recipient matches certificate"},
+{ERR_REASON(PKCS7_R_NO_RECIPIENT_MATCHES_KEY),"no recipient matches key"},
 {ERR_REASON(PKCS7_R_NO_SIGNATURES_ON_DATA),"no signatures on data"},
 {ERR_REASON(PKCS7_R_NO_SIGNERS)          ,"no signers"},
 {ERR_REASON(PKCS7_R_NO_SIG_CONTENT_TYPE) ,"no sig content type"},
 {ERR_REASON(PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE),"operation not supported on this type"},
 {ERR_REASON(PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR),"pkcs7 add signature error"},
+{ERR_REASON(PKCS7_R_PKCS7_DATAFINAL)     ,"pkcs7 datafinal"},
 {ERR_REASON(PKCS7_R_PKCS7_DATAFINAL_ERROR),"pkcs7 datafinal error"},
 {ERR_REASON(PKCS7_R_PKCS7_DATASIGN)      ,"pkcs7 datasign"},
 {ERR_REASON(PKCS7_R_PKCS7_PARSE_ERROR)   ,"pkcs7 parse error"},
@@ -150,15 +156,12 @@ static ERR_STRING_DATA PKCS7_str_reasons[]=
 
 void ERR_load_PKCS7_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(PKCS7_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,PKCS7_str_functs);
                 ERR_load_strings(0,PKCS7_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/rand/md_rand.c b/src/lib/libssl/src/crypto/rand/md_rand.c
index c84968df88..9783d0c23e 100644
--- a/src/lib/libssl/src/crypto/rand/md_rand.c
+++ b/src/lib/libssl/src/crypto/rand/md_rand.c
@@ -126,7 +126,6 @@
 
 #include <openssl/crypto.h>
 #include <openssl/err.h>
-#include <openssl/fips.h>
 
 #ifdef BN_DEBUG
 # define PREDICT
@@ -153,7 +152,7 @@ static unsigned long locking_thread = 0; /* valid iff crypto_lock_rand is set */
 int rand_predictable=0;
 #endif
 
-const char *RAND_version="RAND" OPENSSL_VERSION_PTEXT;
+const char RAND_version[]="RAND" OPENSSL_VERSION_PTEXT;
 
 static void ssleay_rand_cleanup(void);
 static void ssleay_rand_seed(const void *buf, int num);
@@ -301,7 +300,7 @@ static void ssleay_rand_add(const void *buf, int num, double add)
          * other thread's seeding remains without effect (except for
          * the incremented counter).  By XORing it we keep at least as
          * much entropy as fits into md. */
-        for (k = 0; k < sizeof md; k++)
+        for (k = 0; k < (int)sizeof(md); k++)
                 {
                 md[k] ^= local_md[k];
                 }
@@ -316,7 +315,7 @@ static void ssleay_rand_add(const void *buf, int num, double add)
 
 static void ssleay_rand_seed(const void *buf, int num)
         {
-        ssleay_rand_add(buf, num, num);
+        ssleay_rand_add(buf, num, (double)num);
         }
 
 static int ssleay_rand_bytes(unsigned char *buf, int num)
@@ -333,14 +332,6 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
 #endif
         int do_stir_pool = 0;
 
-#ifdef OPENSSL_FIPS
-        if(FIPS_mode())
-            {
-            FIPSerr(FIPS_F_SSLEAY_RAND_BYTES,FIPS_R_NON_FIPS_METHOD);
-            return 0;
-            }
-#endif
-
 #ifdef PREDICT
         if (rand_predictable)
                 {
@@ -529,7 +520,7 @@ static int ssleay_rand_pseudo_bytes(unsigned char *buf, int num)
                 err = ERR_peek_error();
                 if (ERR_GET_LIB(err) == ERR_LIB_RAND &&
                     ERR_GET_REASON(err) == RAND_R_PRNG_NOT_SEEDED)
-                        (void)ERR_get_error();
+                        ERR_clear_error();
                 }
         return (ret);
         }
diff --git a/src/lib/libssl/src/crypto/rand/rand.h b/src/lib/libssl/src/crypto/rand/rand.h
index 604df9be6c..ac6c021763 100644
--- a/src/lib/libssl/src/crypto/rand/rand.h
+++ b/src/lib/libssl/src/crypto/rand/rand.h
@@ -72,10 +72,13 @@ extern "C" {
 #endif
 
 #if defined(OPENSSL_FIPS)
-#define FIPS_RAND_SIZE_T int
+#define FIPS_RAND_SIZE_T size_t
 #endif
 
-typedef struct rand_meth_st
+/* Already defined in ossl_typ.h */
+/* typedef struct rand_meth_st RAND_METHOD; */
+
+struct rand_meth_st
         {
         void (*seed)(const void *buf, int num);
         int (*bytes)(unsigned char *buf, int num);
@@ -83,7 +86,7 @@ typedef struct rand_meth_st
         void (*add)(const void *buf, int num, double entropy);
         int (*pseudorand)(unsigned char *buf, int num);
         int (*status)(void);
-        } RAND_METHOD;
+        };
 
 #ifdef BN_DEBUG
 extern int rand_predictable;
@@ -125,17 +128,11 @@ void ERR_load_RAND_strings(void);
 /* Error codes for the RAND functions. */
 
 /* Function codes. */
-#define RAND_F_FIPS_RAND_BYTES                           102
 #define RAND_F_RAND_GET_RAND_METHOD                      101
 #define RAND_F_SSLEAY_RAND_BYTES                         100
 
 /* Reason codes. */
-#define RAND_R_NON_FIPS_METHOD                           101
-#define RAND_R_PRNG_ASKING_FOR_TOO_MUCH                  105
-#define RAND_R_PRNG_NOT_REKEYED                          103
-#define RAND_R_PRNG_NOT_RESEEDED                         104
 #define RAND_R_PRNG_NOT_SEEDED                           100
-#define RAND_R_PRNG_STUCK                                102
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/rand/rand_egd.c b/src/lib/libssl/src/crypto/rand/rand_egd.c
index cd666abfcb..50bce6caba 100644
--- a/src/lib/libssl/src/crypto/rand/rand_egd.c
+++ b/src/lib/libssl/src/crypto/rand/rand_egd.c
@@ -95,7 +95,7 @@
  *   RAND_egd() is a wrapper for RAND_egd_bytes() with numbytes=255.
  */
 
-#if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_VOS)
+#if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_VOS)
 int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
         {
         return(-1);
diff --git a/src/lib/libssl/src/crypto/rand/rand_err.c b/src/lib/libssl/src/crypto/rand/rand_err.c
index 97f96e1aee..386934dcd1 100644
--- a/src/lib/libssl/src/crypto/rand/rand_err.c
+++ b/src/lib/libssl/src/crypto/rand/rand_err.c
@@ -70,7 +70,6 @@
 
 static ERR_STRING_DATA RAND_str_functs[]=
         {
-{ERR_FUNC(RAND_F_FIPS_RAND_BYTES),      "FIPS_RAND_BYTES"},
 {ERR_FUNC(RAND_F_RAND_GET_RAND_METHOD), "RAND_get_rand_method"},
 {ERR_FUNC(RAND_F_SSLEAY_RAND_BYTES),    "SSLEAY_RAND_BYTES"},
 {0,NULL}
@@ -78,12 +77,7 @@ static ERR_STRING_DATA RAND_str_functs[]=
 
 static ERR_STRING_DATA RAND_str_reasons[]=
         {
-{ERR_REASON(RAND_R_NON_FIPS_METHOD)      ,"non fips method"},
-{ERR_REASON(RAND_R_PRNG_ASKING_FOR_TOO_MUCH),"prng asking for too much"},
-{ERR_REASON(RAND_R_PRNG_NOT_REKEYED)     ,"prng not rekeyed"},
-{ERR_REASON(RAND_R_PRNG_NOT_RESEEDED)    ,"prng not reseeded"},
 {ERR_REASON(RAND_R_PRNG_NOT_SEEDED)      ,"PRNG not seeded"},
-{ERR_REASON(RAND_R_PRNG_STUCK)           ,"prng stuck"},
 {0,NULL}
         };
 
@@ -91,15 +85,12 @@ static ERR_STRING_DATA RAND_str_reasons[]=
 
 void ERR_load_RAND_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(RAND_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,RAND_str_functs);
                 ERR_load_strings(0,RAND_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/rand/rand_lib.c b/src/lib/libssl/src/crypto/rand/rand_lib.c
index a21bde79de..513e338985 100644
--- a/src/lib/libssl/src/crypto/rand/rand_lib.c
+++ b/src/lib/libssl/src/crypto/rand/rand_lib.c
@@ -63,8 +63,6 @@
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
-#include <openssl/fips.h>
-#include <openssl/fips_rand.h>
 
 #ifndef OPENSSL_NO_ENGINE
 /* non-NULL if default_RAND_meth is ENGINE-provided */
@@ -104,22 +102,8 @@ const RAND_METHOD *RAND_get_rand_method(void)
                         funct_ref = e;
                 else
 #endif
-#ifdef OPENSSL_FIPS
-                        if(FIPS_mode())
-                                default_RAND_meth=FIPS_rand_method();
-                        else
-#endif
-                                default_RAND_meth = RAND_SSLeay();
+                        default_RAND_meth = RAND_SSLeay();
                 }
-
-#ifdef OPENSSL_FIPS
-        if(FIPS_mode()
-                && default_RAND_meth != FIPS_rand_check())
-            {
-            RANDerr(RAND_F_RAND_GET_RAND_METHOD,RAND_R_NON_FIPS_METHOD);
-            return 0;
-            }
-#endif
         return default_RAND_meth;
         }
 
diff --git a/src/lib/libssl/src/crypto/rand/rand_unix.c b/src/lib/libssl/src/crypto/rand/rand_unix.c
index 9376554fae..6c2be5cb96 100644
--- a/src/lib/libssl/src/crypto/rand/rand_unix.c
+++ b/src/lib/libssl/src/crypto/rand/rand_unix.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -108,6 +108,7 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+#include <stdio.h>
 
 #define USE_SOCKETS
 #include "e_os.h"
@@ -115,7 +116,7 @@
 #include <openssl/rand.h>
 #include "rand_lcl.h"
 
-#if !(defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_OS2) || defined(OPENSSL_SYS_VXWORKS))
+#if !(defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_OS2) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_NETWARE))
 
 #include <sys/types.h>
 #include <sys/time.h>
@@ -124,6 +125,13 @@
 #include <fcntl.h>
 #include <unistd.h>
 #include <time.h>
+#if defined(OPENSSL_SYS_LINUX) /* should actually be available virtually everywhere */
+# include <poll.h>
+#endif
+#include <limits.h>
+#ifndef FD_SETSIZE
+# define FD_SETSIZE (8*sizeof(fd_set))
+#endif
 
 #ifdef __OpenBSD__
 int RAND_poll(void)
@@ -142,7 +150,7 @@ int RAND_poll(void)
 
         return 1;
 }
-#else
+#else /* !defined(__OpenBSD__) */
 int RAND_poll(void)
 {
         unsigned long l;
@@ -154,7 +162,8 @@ int RAND_poll(void)
 #ifdef DEVRANDOM
         static const char *randomfiles[] = { DEVRANDOM };
         struct stat randomstats[sizeof(randomfiles)/sizeof(randomfiles[0])];
-        int fd,i;
+        int fd;
+        size_t i;
 #endif
 #ifdef DEVRANDOM_EGD
         static const char *egdsockets[] = { DEVRANDOM_EGD, NULL };
@@ -182,10 +191,9 @@ int RAND_poll(void)
 #endif
                         )) >= 0)
                         {
-                        struct timeval t = { 0, 10*1000 }; /* Spend 10ms on
-                                                              each file. */
-                        int r,j;
-                        fd_set fset;
+                        int usec = 10*1000; /* spend 10ms on each file */
+                        int r;
+                        size_t j;
                         struct stat *st=&randomstats[i];
 
                         /* Avoid using same input... Used to be O_NOFOLLOW
@@ -201,35 +209,75 @@ int RAND_poll(void)
 
                         do
                                 {
-                                FD_ZERO(&fset);
-                                FD_SET(fd, &fset);
-                                r = -1;
+                                int try_read = 0;
 
-                                if (select(fd+1,&fset,NULL,NULL,&t) < 0)
-                                        t.tv_usec=0;
-                                else if (FD_ISSET(fd, &fset))
+#if defined(OPENSSL_SYS_LINUX)
+                                /* use poll() */
+                                struct pollfd pset;
+                                
+                                pset.fd = fd;
+                                pset.events = POLLIN;
+                                pset.revents = 0;
+
+                                if (poll(&pset, 1, usec / 1000) < 0)
+                                        usec = 0;
+                                else
+                                        try_read = (pset.revents & POLLIN) != 0;
+
+#else
+                                /* use select() */
+                                fd_set fset;
+                                struct timeval t;
+                                
+                                t.tv_sec = 0;
+                                t.tv_usec = usec;
+
+                                if (FD_SETSIZE > 0 && fd >= FD_SETSIZE)
+                                        {
+                                        /* can't use select, so just try to read once anyway */
+                                        try_read = 1;
+                                        }
+                                else
+                                        {
+                                        FD_ZERO(&fset);
+                                        FD_SET(fd, &fset);
+                                        
+                                        if (select(fd+1,&fset,NULL,NULL,&t) >= 0)
+                                                {
+                                                usec = t.tv_usec;
+                                                if (FD_ISSET(fd, &fset))
+                                                        try_read = 1;
+                                                }
+                                        else
+                                                usec = 0;
+                                        }
+#endif
+                                
+                                if (try_read)
                                         {
-                                        r=read(fd,(unsigned char *)tmpbuf+n,
-                                               ENTROPY_NEEDED-n);
+                                        r = read(fd,(unsigned char *)tmpbuf+n, ENTROPY_NEEDED-n);
                                         if (r > 0)
                                                 n += r;
                                         }
-
-                                /* Some Unixen will update t, some
-                                   won't.  For those who won't, give
-                                   up here, otherwise, we will do
+                                else
+                                        r = -1;
+                                
+                                /* Some Unixen will update t in select(), some
+                                   won't.  For those who won't, or if we
+                                   didn't use select() in the first place,
+                                   give up here, otherwise, we will do
                                    this once again for the remaining
                                    time. */
-                                if (t.tv_usec == 10*1000)
-                                        t.tv_usec=0;
+                                if (usec == 10*1000)
+                                        usec = 0;
                                 }
-                        while ((r > 0 || (errno == EINTR || errno == EAGAIN))
-                                && t.tv_usec != 0 && n < ENTROPY_NEEDED);
+                        while ((r > 0 ||
+                               (errno == EINTR || errno == EAGAIN)) && usec != 0 && n < ENTROPY_NEEDED);
 
                         close(fd);
                         }
                 }
-#endif
+#endif /* defined(DEVRANDOM) */
 
 #ifdef DEVRANDOM_EGD
         /* Use an EGD socket to read entropy from an EGD or PRNGD entropy
@@ -244,24 +292,24 @@ int RAND_poll(void)
                 if (r > 0)
                         n += r;
                 }
-#endif
+#endif /* defined(DEVRANDOM_EGD) */
 
 #if defined(DEVRANDOM) || defined(DEVRANDOM_EGD)
         if (n > 0)
                 {
-                RAND_add(tmpbuf,sizeof tmpbuf,n);
+                RAND_add(tmpbuf,sizeof tmpbuf,(double)n);
                 OPENSSL_cleanse(tmpbuf,n);
                 }
 #endif
 
         /* put in some default random data, we need more than just this */
         l=curr_pid;
-        RAND_add(&l,sizeof(l),0);
+        RAND_add(&l,sizeof(l),0.0);
         l=getuid();
-        RAND_add(&l,sizeof(l),0);
+        RAND_add(&l,sizeof(l),0.0);
 
         l=time(NULL);
-        RAND_add(&l,sizeof(l),0);
+        RAND_add(&l,sizeof(l),0.0);
 
 #if defined(DEVRANDOM) || defined(DEVRANDOM_EGD)
         return 1;
@@ -270,12 +318,13 @@ int RAND_poll(void)
 #endif
 }
 
-#endif
-#endif
+#endif /* defined(__OpenBSD__) */
+#endif /* !(defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_OS2) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_NETWARE)) */
+
 
 #if defined(OPENSSL_SYS_VXWORKS)
 int RAND_poll(void)
-{
-    return 0;
-}
+        {
+        return 0;
+        }
 #endif
diff --git a/src/lib/libssl/src/crypto/rand/rand_win.c b/src/lib/libssl/src/crypto/rand/rand_win.c
index 30c69161ef..00dbe4232c 100644
--- a/src/lib/libssl/src/crypto/rand/rand_win.c
+++ b/src/lib/libssl/src/crypto/rand/rand_win.c
@@ -121,6 +121,10 @@
 #include <wincrypt.h>
 #include <tlhelp32.h>
 
+/* Limit the time spent walking through the heap, processes, threads and modules to
+   a maximum of 1000 miliseconds each, unless CryptoGenRandom failed */
+#define MAXDELAY 1000
+
 /* Intel hardware RNG CSP -- available from
  * http://developer.intel.com/design/security/rng/redist_license.htm
  */
@@ -152,6 +156,7 @@ typedef struct tagCURSORINFO
 #define CURSOR_SHOWING     0x00000001
 #endif /* CURSOR_SHOWING */
 
+#if !defined(OPENSSL_SYS_WINCE)
 typedef BOOL (WINAPI *CRYPTACQUIRECONTEXTW)(HCRYPTPROV *, LPCWSTR, LPCWSTR,
                                     DWORD, DWORD);
 typedef BOOL (WINAPI *CRYPTGENRANDOM)(HCRYPTPROV, DWORD, BYTE *);
@@ -163,7 +168,7 @@ typedef DWORD (WINAPI *GETQUEUESTATUS)(UINT);
 
 typedef HANDLE (WINAPI *CREATETOOLHELP32SNAPSHOT)(DWORD, DWORD);
 typedef BOOL (WINAPI *CLOSETOOLHELP32SNAPSHOT)(HANDLE);
-typedef BOOL (WINAPI *HEAP32FIRST)(LPHEAPENTRY32, DWORD, DWORD);
+typedef BOOL (WINAPI *HEAP32FIRST)(LPHEAPENTRY32, DWORD, size_t);
 typedef BOOL (WINAPI *HEAP32NEXT)(LPHEAPENTRY32);
 typedef BOOL (WINAPI *HEAP32LIST)(HANDLE, LPHEAPLIST32);
 typedef BOOL (WINAPI *PROCESS32)(HANDLE, LPPROCESSENTRY32);
@@ -171,9 +176,7 @@ typedef BOOL (WINAPI *THREAD32)(HANDLE, LPTHREADENTRY32);
 typedef BOOL (WINAPI *MODULE32)(HANDLE, LPMODULEENTRY32);
 
 #include <lmcons.h>
-#ifndef OPENSSL_SYS_WINCE
 #include <lmstats.h>
-#endif
 #if 1 /* The NET API is Unicode only.  It requires the use of the UNICODE
        * macro.  When UNICODE is defined LPTSTR becomes LPWSTR.  LMSTR was
        * was added to the Platform SDK to allow the NET API to be used in
@@ -184,26 +187,14 @@ typedef NET_API_STATUS (NET_API_FUNCTION * NETSTATGET)
         (LPWSTR, LPWSTR, DWORD, DWORD, LPBYTE*);
 typedef NET_API_STATUS (NET_API_FUNCTION * NETFREE)(LPBYTE);
 #endif /* 1 */
+#endif /* !OPENSSL_SYS_WINCE */
 
 int RAND_poll(void)
 {
         MEMORYSTATUS m;
         HCRYPTPROV hProvider = 0;
-        BYTE buf[64];
         DWORD w;
-        HWND h;
-
-        HMODULE advapi, kernel, user, netapi;
-        CRYPTACQUIRECONTEXTW acquire = 0;
-        CRYPTGENRANDOM gen = 0;
-        CRYPTRELEASECONTEXT release = 0;
-#if 1 /* There was previously a problem with NETSTATGET.  Currently, this
-       * section is still experimental, but if all goes well, this conditional
-       * will be removed
-       */
-        NETSTATGET netstatget = 0;
-        NETFREE netfree = 0;
-#endif /* 1 */
+        int good = 0;
 
         /* Determine the OS version we are on so we can turn off things 
          * that do not work properly.
@@ -212,21 +203,24 @@ int RAND_poll(void)
         osverinfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO) ;
         GetVersionEx( &osverinfo ) ;
 
-#if defined(OPENSSL_SYS_WINCE) && WCEPLATFORM!=MS_HPC_PRO
-#ifndef CryptAcquireContext
-#define CryptAcquireContext CryptAcquireContextW
-#endif
+#if defined(OPENSSL_SYS_WINCE)
+# if defined(_WIN32_WCE) && _WIN32_WCE>=300
+/* Even though MSDN says _WIN32_WCE>=210, it doesn't seem to be available
+ * in commonly available implementations prior 300... */
+        {
+        BYTE buf[64];
         /* poll the CryptoAPI PRNG */
         /* The CryptoAPI returns sizeof(buf) bytes of randomness */
-        if (CryptAcquireContext(&hProvider, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
+        if (CryptAcquireContextW(&hProvider, NULL, NULL, PROV_RSA_FULL,
+                                CRYPT_VERIFYCONTEXT))
                 {
                 if (CryptGenRandom(hProvider, sizeof(buf), buf))
                         RAND_add(buf, sizeof(buf), sizeof(buf));
                 CryptReleaseContext(hProvider, 0); 
                 }
-#endif
-
-#ifndef OPENSSL_SYS_WINCE
+        }
+# endif
+#else   /* OPENSSL_SYS_WINCE */
         /*
          * None of below libraries are present on Windows CE, which is
          * why we #ifndef the whole section. This also excuses us from
@@ -240,17 +234,19 @@ int RAND_poll(void)
          * implement own shim routine, which would accept ANSI argument
          * and expand it to Unicode.
          */
-
+        {
         /* load functions dynamically - not available on all systems */
-        advapi = LoadLibrary(TEXT("ADVAPI32.DLL"));
-        kernel = LoadLibrary(TEXT("KERNEL32.DLL"));
-        user = LoadLibrary(TEXT("USER32.DLL"));
-        netapi = LoadLibrary(TEXT("NETAPI32.DLL"));
-
-#if 1 /* There was previously a problem with NETSTATGET.  Currently, this
-       * section is still experimental, but if all goes well, this conditional
-       * will be removed
-       */
+        HMODULE advapi = LoadLibrary(TEXT("ADVAPI32.DLL"));
+        HMODULE kernel = LoadLibrary(TEXT("KERNEL32.DLL"));
+        HMODULE user = NULL;
+        HMODULE netapi = LoadLibrary(TEXT("NETAPI32.DLL"));
+        CRYPTACQUIRECONTEXTW acquire = NULL;
+        CRYPTGENRANDOM gen = NULL;
+        CRYPTRELEASECONTEXT release = NULL;
+        NETSTATGET netstatget = NULL;
+        NETFREE netfree = NULL;
+        BYTE buf[64];
+
         if (netapi)
                 {
                 netstatget = (NETSTATGET) GetProcAddress(netapi,"NetStatisticsGet");
@@ -280,7 +276,6 @@ int RAND_poll(void)
 
         if (netapi)
                 FreeLibrary(netapi);
-#endif /* 1 */
 
         /* It appears like this can cause an exception deep within ADVAPI32.DLL
          * at random times on Windows 2000.  Reported by Jeffrey Altman.  
@@ -356,12 +351,13 @@ int RAND_poll(void)
                 {
                 /* poll the CryptoAPI PRNG */
                 /* The CryptoAPI returns sizeof(buf) bytes of randomness */
-                if (acquire(&hProvider, 0, 0, PROV_RSA_FULL,
+                if (acquire(&hProvider, NULL, NULL, PROV_RSA_FULL,
                         CRYPT_VERIFYCONTEXT))
                         {
                         if (gen(hProvider, sizeof(buf), buf) != 0)
                                 {
                                 RAND_add(buf, sizeof(buf), 0);
+                                good = 1;
 #if 0
                                 printf("randomness from PROV_RSA_FULL\n");
 #endif
@@ -375,6 +371,7 @@ int RAND_poll(void)
                         if (gen(hProvider, sizeof(buf), buf) != 0)
                                 {
                                 RAND_add(buf, sizeof(buf), sizeof(buf));
+                                good = 1;
 #if 0
                                 printf("randomness from PROV_INTEL_SEC\n");
 #endif
@@ -386,7 +383,9 @@ int RAND_poll(void)
         if (advapi)
                 FreeLibrary(advapi);
 
-        if (user)
+        if ((osverinfo.dwPlatformId != VER_PLATFORM_WIN32_NT ||
+             !OPENSSL_isservice()) &&
+            (user = LoadLibrary(TEXT("USER32.DLL"))))
                 {
                 GETCURSORINFO cursor;
                 GETFOREGROUNDWINDOW win;
@@ -399,7 +398,7 @@ int RAND_poll(void)
                 if (win)
                         {
                         /* window handle */
-                        h = win();
+                        HWND h = win();
                         RAND_add(&h, sizeof(h), 0);
                         }
                 if (cursor)
@@ -464,6 +463,7 @@ int RAND_poll(void)
                 PROCESSENTRY32 p;
                 THREADENTRY32 t;
                 MODULEENTRY32 m;
+                DWORD stoptime = 0;
 
                 snap = (CREATETOOLHELP32SNAPSHOT)
                         GetProcAddress(kernel, "CreateToolhelp32Snapshot");
@@ -495,6 +495,7 @@ int RAND_poll(void)
                          * of entropy.
                          */
                         hlist.dwSize = sizeof(HEAPLIST32);              
+                        if (good) stoptime = GetTickCount() + MAXDELAY;
                         if (heaplist_first(handle, &hlist))
                                 do
                                         {
@@ -512,18 +513,20 @@ int RAND_poll(void)
                                                         && --entrycnt > 0);
                                                 }
                                         } while (heaplist_next(handle,
-                                                &hlist));
-                        
+                                                &hlist) && GetTickCount() < stoptime);
+
                         /* process walking */
                         /* PROCESSENTRY32 contains 9 fields that will change
                          * with each entry.  Consider each field a source of
                          * 1 byte of entropy.
                          */
                         p.dwSize = sizeof(PROCESSENTRY32);
+                
+                        if (good) stoptime = GetTickCount() + MAXDELAY;
                         if (process_first(handle, &p))
                                 do
                                         RAND_add(&p, p.dwSize, 9);
-                                while (process_next(handle, &p));
+                                while (process_next(handle, &p) && GetTickCount() < stoptime);
 
                         /* thread walking */
                         /* THREADENTRY32 contains 6 fields that will change
@@ -531,10 +534,11 @@ int RAND_poll(void)
                          * 1 byte of entropy.
                          */
                         t.dwSize = sizeof(THREADENTRY32);
+                        if (good) stoptime = GetTickCount() + MAXDELAY;
                         if (thread_first(handle, &t))
                                 do
                                         RAND_add(&t, t.dwSize, 6);
-                                while (thread_next(handle, &t));
+                                while (thread_next(handle, &t) && GetTickCount() < stoptime);
 
                         /* module walking */
                         /* MODULEENTRY32 contains 9 fields that will change
@@ -542,18 +546,22 @@ int RAND_poll(void)
                          * 1 byte of entropy.
                          */
                         m.dwSize = sizeof(MODULEENTRY32);
+                        if (good) stoptime = GetTickCount() + MAXDELAY;
                         if (module_first(handle, &m))
                                 do
                                         RAND_add(&m, m.dwSize, 9);
-                                while (module_next(handle, &m));
+                                while (module_next(handle, &m)
+                                                && (GetTickCount() < stoptime));
                         if (close_snap)
                                 close_snap(handle);
                         else
                                 CloseHandle(handle);
+
                         }
 
                 FreeLibrary(kernel);
                 }
+        }
 #endif /* !OPENSSL_SYS_WINCE */
 
         /* timer data */
@@ -693,6 +701,9 @@ static void readscreen(void)
   int           y;              /* y-coordinate of screen lines to grab */
   int           n = 16;         /* number of screen lines to grab at a time */
 
+  if (GetVersion() >= 0x80000000 || !OPENSSL_isservice())
+    return;
+
   /* Create a screen DC and a memory DC compatible to screen DC */
   hScrDC = CreateDC(TEXT("DISPLAY"), NULL, NULL, NULL);
   hMemDC = CreateCompatibleDC(hScrDC);
diff --git a/src/lib/libssl/src/crypto/rand/randfile.c b/src/lib/libssl/src/crypto/rand/randfile.c
index d847d8ebdf..005cb38cb0 100644
--- a/src/lib/libssl/src/crypto/rand/randfile.c
+++ b/src/lib/libssl/src/crypto/rand/randfile.c
@@ -102,10 +102,8 @@ int RAND_load_file(const char *file, long bytes)
 
         if (file == NULL) return(0);
 
-        i=stat(file,&sb);
-        /* If the state fails, put some crap in anyway */
-        RAND_add(&sb,sizeof(sb),0);
-        if (i < 0) return(0);
+        if (stat(file,&sb) < 0) return(0);
+        RAND_add(&sb,sizeof(sb),0.0);
         if (bytes == 0) return(ret);
 
         in=fopen(file,"rb");
@@ -128,8 +126,12 @@ int RAND_load_file(const char *file, long bytes)
                         n = BUFSIZE;
                 i=fread(buf,1,n,in);
                 if (i <= 0) break;
+#ifdef PURIFY
+                RAND_add(buf,i,(double)i);
+#else
                 /* even if n != i, use the full array */
-                RAND_add(buf,n,i);
+                RAND_add(buf,n,(double)i);
+#endif
                 ret+=i;
                 if (bytes > 0)
                         {
diff --git a/src/lib/libssl/src/crypto/rand/randtest.c b/src/lib/libssl/src/crypto/rand/randtest.c
index 701932e6ee..9e92a70b03 100644
--- a/src/lib/libssl/src/crypto/rand/randtest.c
+++ b/src/lib/libssl/src/crypto/rand/randtest.c
@@ -65,7 +65,7 @@
 /* some FIPS 140-1 random number test */
 /* some simple tests */
 
-int main()
+int main(int argc,char **argv)
         {
         unsigned char buf[2500];
         int i,j,k,s,sign,nsign,err=0;
@@ -211,6 +211,9 @@ int main()
         printf("test 4 done\n");
  err:
         err=((err)?1:0);
+#ifdef OPENSSL_SYS_NETWARE
+    if (err) printf("ERROR: %d\n", err);
+#endif
         EXIT(err);
         return(err);
         }
diff --git a/src/lib/libssl/src/crypto/rc2/rc2.h b/src/lib/libssl/src/crypto/rc2/rc2.h
index 71788158d8..34c8362317 100644
--- a/src/lib/libssl/src/crypto/rc2/rc2.h
+++ b/src/lib/libssl/src/crypto/rc2/rc2.h
@@ -59,6 +59,7 @@
 #ifndef HEADER_RC2_H
 #define HEADER_RC2_H
 
+#include <openssl/opensslconf.h> /* OPENSSL_NO_RC2, RC2_INT */
 #ifdef OPENSSL_NO_RC2
 #error RC2 is disabled.
 #endif
@@ -66,7 +67,6 @@
 #define RC2_ENCRYPT     1
 #define RC2_DECRYPT     0
 
-#include <openssl/opensslconf.h> /* RC2_INT */
 #define RC2_BLOCK       8
 #define RC2_KEY_LENGTH  16
 
@@ -79,10 +79,7 @@ typedef struct rc2_key_st
         RC2_INT data[64];
         } RC2_KEY;
 
-#ifdef OPENSSL_FIPS 
-void private_RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,
-                                                                int bits);
-#endif
+ 
 void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,int bits);
 void RC2_ecb_encrypt(const unsigned char *in,unsigned char *out,RC2_KEY *key,
                      int enc);
diff --git a/src/lib/libssl/src/crypto/rc2/rc2_ecb.c b/src/lib/libssl/src/crypto/rc2/rc2_ecb.c
index d3e8c2718a..fff86c7af8 100644
--- a/src/lib/libssl/src/crypto/rc2/rc2_ecb.c
+++ b/src/lib/libssl/src/crypto/rc2/rc2_ecb.c
@@ -60,7 +60,7 @@
 #include "rc2_locl.h"
 #include <openssl/opensslv.h>
 
-const char *RC2_version="RC2" OPENSSL_VERSION_PTEXT;
+const char RC2_version[]="RC2" OPENSSL_VERSION_PTEXT;
 
 /* RC2 as implemented frm a posting from
  * Newsgroups: sci.crypt
diff --git a/src/lib/libssl/src/crypto/rc2/rc2_skey.c b/src/lib/libssl/src/crypto/rc2/rc2_skey.c
index 9652865188..4953642056 100644
--- a/src/lib/libssl/src/crypto/rc2/rc2_skey.c
+++ b/src/lib/libssl/src/crypto/rc2/rc2_skey.c
@@ -57,8 +57,6 @@
  */
 
 #include <openssl/rc2.h>
-#include <openssl/crypto.h>
-#include <openssl/fips.h>
 #include "rc2_locl.h"
 
 static unsigned char key_table[256]={
@@ -86,25 +84,17 @@ static unsigned char key_table[256]={
         0xfe,0x7f,0xc1,0xad,
         };
 
+#if defined(_MSC_VER) && defined(_ARM_)
+#pragma optimize("g",off)
+#endif
+
 /* It has come to my attention that there are 2 versions of the RC2
  * key schedule.  One which is normal, and anther which has a hook to
  * use a reduced key length.
  * BSAFE uses the 'retarded' version.  What I previously shipped is
  * the same as specifying 1024 for the 'bits' parameter.  Bsafe uses
  * a version where the bits parameter is the same as len*8 */
-
-#ifdef OPENSSL_FIPS
-void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data, int bits)
-        {
-        if (FIPS_mode())
-                FIPS_BAD_ABORT(RC2)
-        private_RC2_set_key(key, len, data, bits);
-        }
-void private_RC2_set_key(RC2_KEY *key, int len, const unsigned char *data,
-                                                                int bits)
-#else
 void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data, int bits)
-#endif
         {
         int i,j;
         unsigned char *k;
@@ -150,3 +140,6 @@ void RC2_set_key(RC2_KEY *key, int len, const unsigned char *data, int bits)
                 *(ki--)=((k[i]<<8)|k[i-1])&0xffff;
         }
 
+#if defined(_MSC_VER)
+#pragma optimize("",on)
+#endif
diff --git a/src/lib/libssl/src/crypto/rc2/rc2speed.c b/src/lib/libssl/src/crypto/rc2/rc2speed.c
index 4d0e1242ea..85cf6f65bf 100644
--- a/src/lib/libssl/src/crypto/rc2/rc2speed.c
+++ b/src/lib/libssl/src/crypto/rc2/rc2speed.c
@@ -69,7 +69,10 @@
 #include OPENSSL_UNISTD_IO
 OPENSSL_DECLARE_EXIT
 
+#ifndef OPENSSL_SYS_NETWARE
 #include <signal.h>
+#endif
+
 #ifndef _IRIX
 #include <time.h>
 #endif
diff --git a/src/lib/libssl/src/crypto/rc2/rc2test.c b/src/lib/libssl/src/crypto/rc2/rc2test.c
index b67bafb49f..0e117436bb 100644
--- a/src/lib/libssl/src/crypto/rc2/rc2test.c
+++ b/src/lib/libssl/src/crypto/rc2/rc2test.c
@@ -205,6 +205,9 @@ int main(int argc, char *argv[])
                 printf("ok\n");
 #endif
 
+#ifdef OPENSSL_SYS_NETWARE
+    if (err) printf("ERROR: %d\n", err);
+#endif
         EXIT(err);
         return(err);
         }
diff --git a/src/lib/libssl/src/crypto/rc4/asm/rc4-586.pl b/src/lib/libssl/src/crypto/rc4/asm/rc4-586.pl
index d6e98f0811..ef7eee766c 100644
--- a/src/lib/libssl/src/crypto/rc4/asm/rc4-586.pl
+++ b/src/lib/libssl/src/crypto/rc4/asm/rc4-586.pl
@@ -200,22 +200,23 @@ sub RC4
 
         &lea    ($ty,&DWP(0,$in,$ty));
         &mov    (&swtmp(2),$ty);
+        &movz   ($tx,&BP(0,$d,$x));
 
         # strangely enough unrolled loop performs over 20% slower...
         &set_label("RC4_CHAR_loop");
-                &movz   ($tx,&BP(0,$d,$x));
                 &add    (&LB($y),&LB($tx));
                 &movz   ($ty,&BP(0,$d,$y));
                 &movb   (&BP(0,$d,$y),&LB($tx));
                 &movb   (&BP(0,$d,$x),&LB($ty));
                 &add    (&LB($ty),&LB($tx));
                 &movz   ($ty,&BP(0,$d,$ty));
+                &add    (&LB($x),1);
                 &xorb   (&LB($ty),&BP(0,$in));
-                &movb   (&BP(0,$out),&LB($ty));
-                &inc    (&LB($x));
-                &inc    ($in);
-                &inc    ($out);
+                &lea    ($in,&DWP(1,$in));
+                &movz   ($tx,&BP(0,$d,$x));
                 &cmp    ($in,&swtmp(2));
+                &movb   (&BP(0,$out),&LB($ty));
+                &lea    ($out,&DWP(1,$out));
         &jb     (&label("RC4_CHAR_loop"));
 
         &set_label("finished");
diff --git a/src/lib/libssl/src/crypto/rc4/rc4.c b/src/lib/libssl/src/crypto/rc4/rc4.c
index b39c070292..c900b26055 100644
--- a/src/lib/libssl/src/crypto/rc4/rc4.c
+++ b/src/lib/libssl/src/crypto/rc4/rc4.c
@@ -60,6 +60,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <openssl/rc4.h>
+#include <openssl/evp.h>
 
 char *usage[]={
 "usage: rc4 args\n",
@@ -162,7 +163,7 @@ bad:
                 keystr=buf;
                 }
 
-        EVP_Digest((unsigned char *)keystr,(unsigned long)strlen(keystr),md,NULL,EVP_md5());
+        EVP_Digest((unsigned char *)keystr,strlen(keystr),md,NULL,EVP_md5(),NULL);
         OPENSSL_cleanse(keystr,strlen(keystr));
         RC4_set_key(&key,MD5_DIGEST_LENGTH,md);
         
diff --git a/src/lib/libssl/src/crypto/rc4/rc4.h b/src/lib/libssl/src/crypto/rc4/rc4.h
index ae0cea75b8..7aec04fe93 100644
--- a/src/lib/libssl/src/crypto/rc4/rc4.h
+++ b/src/lib/libssl/src/crypto/rc4/rc4.h
@@ -59,12 +59,11 @@
 #ifndef HEADER_RC4_H
 #define HEADER_RC4_H
 
+#include <openssl/opensslconf.h> /* OPENSSL_NO_RC4, RC4_INT */
 #ifdef OPENSSL_NO_RC4
 #error RC4 is disabled.
 #endif
 
-#include <openssl/opensslconf.h> /* RC4_INT */
-
 #ifdef  __cplusplus
 extern "C" {
 #endif
@@ -77,9 +76,6 @@ typedef struct rc4_key_st
 
  
 const char *RC4_options(void);
-#ifdef OPENSSL_FIPS
-void private_RC4_set_key(RC4_KEY *key, int len, const unsigned char *data);
-#endif
 void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data);
 void RC4(RC4_KEY *key, unsigned long len, const unsigned char *indata,
                 unsigned char *outdata);
diff --git a/src/lib/libssl/src/crypto/rc4/rc4_enc.c b/src/lib/libssl/src/crypto/rc4/rc4_enc.c
index d5f18a3a70..0660ea60a2 100644
--- a/src/lib/libssl/src/crypto/rc4/rc4_enc.c
+++ b/src/lib/libssl/src/crypto/rc4/rc4_enc.c
@@ -157,7 +157,7 @@ void RC4(RC4_KEY *key, unsigned long len, const unsigned char *indata,
                 if (!is_endian.little)
                         {       /* BIG-ENDIAN CASE */
 # define BESHFT(c)      (((sizeof(RC4_CHUNK)-(c)-1)*8)&(sizeof(RC4_CHUNK)*8-1))
-                        for (;len&-sizeof(RC4_CHUNK);len-=sizeof(RC4_CHUNK))
+                        for (;len&~(sizeof(RC4_CHUNK)-1);len-=sizeof(RC4_CHUNK))
                                 {
                                 ichunk  = *(RC4_CHUNK *)indata;
                                 otp  = RC4_STEP<<BESHFT(0);
@@ -210,7 +210,7 @@ void RC4(RC4_KEY *key, unsigned long len, const unsigned char *indata,
                 else
                         {       /* LITTLE-ENDIAN CASE */
 # define LESHFT(c)      (((c)*8)&(sizeof(RC4_CHUNK)*8-1))
-                        for (;len&-sizeof(RC4_CHUNK);len-=sizeof(RC4_CHUNK))
+                        for (;len&~(sizeof(RC4_CHUNK)-1);len-=sizeof(RC4_CHUNK))
                                 {
                                 ichunk  = *(RC4_CHUNK *)indata;
                                 otp  = RC4_STEP;
diff --git a/src/lib/libssl/src/crypto/rc4/rc4_skey.c b/src/lib/libssl/src/crypto/rc4/rc4_skey.c
index 60510624fd..46b77ec321 100644
--- a/src/lib/libssl/src/crypto/rc4/rc4_skey.c
+++ b/src/lib/libssl/src/crypto/rc4/rc4_skey.c
@@ -57,12 +57,10 @@
  */
 
 #include <openssl/rc4.h>
-#include <openssl/crypto.h>
-#include <openssl/fips.h>
 #include "rc4_locl.h"
 #include <openssl/opensslv.h>
 
-const char *RC4_version="RC4" OPENSSL_VERSION_PTEXT;
+const char RC4_version[]="RC4" OPENSSL_VERSION_PTEXT;
 
 const char *RC4_options(void)
         {
@@ -87,7 +85,7 @@ const char *RC4_options(void)
  * Date: Wed, 14 Sep 1994 06:35:31 GMT
  */
 
-FIPS_NON_FIPS_VCIPHER_Init(RC4)
+void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data)
         {
         register RC4_INT tmp;
         register int id1,id2;
@@ -95,26 +93,59 @@ FIPS_NON_FIPS_VCIPHER_Init(RC4)
         unsigned int i;
         
         d= &(key->data[0]);
-
-        for (i=0; i<256; i++)
-                d[i]=i;
         key->x = 0;     
         key->y = 0;     
         id1=id2=0;     
 
-#define SK_LOOP(n) { \
+#define SK_LOOP(d,n) { \
                 tmp=d[(n)]; \
                 id2 = (data[id1] + tmp + id2) & 0xff; \
                 if (++id1 == len) id1=0; \
                 d[(n)]=d[id2]; \
                 d[id2]=tmp; }
 
+#if defined(OPENSSL_CPUID_OBJ) && !defined(OPENSSL_NO_ASM)
+# if    defined(__i386)   || defined(__i386__)   || defined(_M_IX86) || \
+        defined(__INTEL__) || \
+        defined(__x86_64) || defined(__x86_64__) || defined(_M_AMD64)
+        if (sizeof(RC4_INT) > 1) {
+                /*
+                 * Unlike all other x86 [and x86_64] implementations,
+                 * Intel P4 core [including EM64T] was found to perform
+                 * poorly with wider RC4_INT. Performance improvement
+                 * for IA-32 hand-coded assembler turned out to be 2.8x
+                 * if re-coded for RC4_CHAR! It's however inappropriate
+                 * to just switch to RC4_CHAR for x86[_64], as non-P4
+                 * implementations suffer from significant performance
+                 * losses then, e.g. PIII exhibits >2x deterioration,
+                 * and so does Opteron. In order to assure optimal
+                 * all-round performance, we detect P4 at run-time by
+                 * checking upon reserved bit 20 in CPU capability
+                 * vector and set up compressed key schedule, which is
+                 * recognized by correspondingly updated assembler
+                 * module... Bit 20 is set up by OPENSSL_ia32_cpuid.
+                 *
+                 *                              <appro@fy.chalmers.se>
+                 */
+                if (OPENSSL_ia32cap_P & (1<<20)) {
+                        unsigned char *cp=(unsigned char *)d;
+
+                        for (i=0;i<256;i++) cp[i]=i;
+                        for (i=0;i<256;i++) SK_LOOP(cp,i);
+                        /* mark schedule as compressed! */
+                        d[256/sizeof(RC4_INT)]=-1;
+                        return;
+                }
+        }
+# endif
+#endif
+        for (i=0; i < 256; i++) d[i]=i;
         for (i=0; i < 256; i+=4)
                 {
-                SK_LOOP(i+0);
-                SK_LOOP(i+1);
-                SK_LOOP(i+2);
-                SK_LOOP(i+3);
+                SK_LOOP(d,i+0);
+                SK_LOOP(d,i+1);
+                SK_LOOP(d,i+2);
+                SK_LOOP(d,i+3);
                 }
         }
     
diff --git a/src/lib/libssl/src/crypto/rc4/rc4speed.c b/src/lib/libssl/src/crypto/rc4/rc4speed.c
index ced98c52df..0ebd38123d 100644
--- a/src/lib/libssl/src/crypto/rc4/rc4speed.c
+++ b/src/lib/libssl/src/crypto/rc4/rc4speed.c
@@ -69,7 +69,10 @@
 #include OPENSSL_UNISTD_IO
 OPENSSL_DECLARE_EXIT
 
+#ifndef OPENSSL_SYS_NETWARE
 #include <signal.h>
+#endif
+
 #ifndef _IRIX
 #include <time.h>
 #endif
diff --git a/src/lib/libssl/src/crypto/rc4/rc4test.c b/src/lib/libssl/src/crypto/rc4/rc4test.c
index b9d8f20975..54b597fa26 100644
--- a/src/lib/libssl/src/crypto/rc4/rc4test.c
+++ b/src/lib/libssl/src/crypto/rc4/rc4test.c
@@ -70,6 +70,7 @@ int main(int argc, char *argv[])
 }
 #else
 #include <openssl/rc4.h>
+#include <openssl/sha.h>
 
 static unsigned char keys[7][30]={
         {8,0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef},
@@ -113,13 +114,11 @@ static unsigned char output[7][30]={
 
 int main(int argc, char *argv[])
         {
-        int i,err=0;
-        int j;
+        int err=0;
+        unsigned int i, j;
         unsigned char *p;
         RC4_KEY key;
-        unsigned char buf[512],obuf[512];
-
-        for (i=0; i<512; i++) buf[i]=0x01;
+        unsigned char obuf[512];
 
         for (i=0; i<6; i++)
                 {
@@ -130,12 +129,12 @@ int main(int argc, char *argv[])
                         {
                         printf("error calculating RC4\n");
                         printf("output:");
-                        for (j=0; j<data_len[i]+1; j++)
+                        for (j=0; j<data_len[i]+1U; j++)
                                 printf(" %02x",obuf[j]);
                         printf("\n");
                         printf("expect:");
                         p= &(output[i][0]);
-                        for (j=0; j<data_len[i]+1; j++)
+                        for (j=0; j<data_len[i]+1U; j++)
                                 printf(" %02x",*(p++));
                         printf("\n");
                         err++;
@@ -181,12 +180,12 @@ int main(int argc, char *argv[])
                         {
                         printf("error in RC4 multi-call processing\n");
                         printf("output:");
-                        for (j=0; j<data_len[3]+1; j++)
+                        for (j=0; j<data_len[3]+1U; j++)
                                 printf(" %02x",obuf[j]);
                         printf("\n");
                         printf("expect:");
                         p= &(output[3][0]);
-                        for (j=0; j<data_len[3]+1; j++)
+                        for (j=0; j<data_len[3]+1U; j++)
                                 printf(" %02x",*(p++));
                         err++;
                         }
@@ -197,6 +196,40 @@ int main(int argc, char *argv[])
                         }
                 }
         printf("done\n");
+        printf("bulk test ");
+        {   unsigned char buf[513];
+            SHA_CTX c;
+            unsigned char md[SHA_DIGEST_LENGTH];
+            static unsigned char expected[]={
+                0xa4,0x7b,0xcc,0x00,0x3d,0xd0,0xbd,0xe1,0xac,0x5f,
+                0x12,0x1e,0x45,0xbc,0xfb,0x1a,0xa1,0xf2,0x7f,0xc5 };
+
+                RC4_set_key(&key,keys[0][0],&(keys[3][1]));
+                memset(buf,'\0',sizeof(buf));
+                SHA1_Init(&c);
+                for (i=0;i<2571;i++) {
+                        RC4(&key,sizeof(buf),buf,buf);
+                        SHA1_Update(&c,buf,sizeof(buf));
+                }
+                SHA1_Final(md,&c);
+
+                if (memcmp(md,expected,sizeof(md))) {
+                        printf("error in RC4 bulk test\n");
+                        printf("output:");
+                        for (j=0; j<sizeof(md); j++)
+                                printf(" %02x",md[j]);
+                        printf("\n");
+                        printf("expect:");
+                        for (j=0; j<sizeof(md); j++)
+                                printf(" %02x",expected[j]);
+                        printf("\n");
+                        err++;
+                }
+                else    printf("ok\n");
+        }
+#ifdef OPENSSL_SYS_NETWARE
+    if (err) printf("ERROR: %d\n", err);
+#endif
         EXIT(err);
         return(0);
         }
diff --git a/src/lib/libssl/src/crypto/rc5/rc5.h b/src/lib/libssl/src/crypto/rc5/rc5.h
index aa3f26920b..4b3c153b50 100644
--- a/src/lib/libssl/src/crypto/rc5/rc5.h
+++ b/src/lib/libssl/src/crypto/rc5/rc5.h
@@ -59,6 +59,8 @@
 #ifndef HEADER_RC5_H
 #define HEADER_RC5_H
 
+#include <openssl/opensslconf.h> /* OPENSSL_NO_RC5 */
+
 #ifdef  __cplusplus
 extern "C" {
 #endif
@@ -92,10 +94,7 @@ typedef struct rc5_key_st
         RC5_32_INT data[2*(RC5_16_ROUNDS+1)];
         } RC5_32_KEY;
 
-#ifdef OPENSSL_FIPS 
-void private_RC5_32_set_key(RC5_32_KEY *key, int len, const unsigned char *data,
-        int rounds);
-#endif
+ 
 void RC5_32_set_key(RC5_32_KEY *key, int len, const unsigned char *data,
         int rounds);
 void RC5_32_ecb_encrypt(const unsigned char *in,unsigned char *out,RC5_32_KEY *key,
diff --git a/src/lib/libssl/src/crypto/ripemd/asm/rmd-586.pl b/src/lib/libssl/src/crypto/ripemd/asm/rmd-586.pl
index 0ab6f76bff..4f3c4c967f 100644
--- a/src/lib/libssl/src/crypto/ripemd/asm/rmd-586.pl
+++ b/src/lib/libssl/src/crypto/ripemd/asm/rmd-586.pl
@@ -1,7 +1,7 @@
 #!/usr/local/bin/perl
 
 # Normal is the
-# ripemd160_block_asm_host_order(RIPEMD160_CTX *c, ULONG *X,int blocks);
+# ripemd160_block_asm_data_order(RIPEMD160_CTX *c, ULONG *X,int blocks);
 
 $normal=0;
 
@@ -56,7 +56,7 @@ $KR3=0x7A6D76E9;
          8, 5,12, 9,12, 5,14, 6, 8,13, 6, 5,15,13,11,11,
         );
 
-&ripemd160_block("ripemd160_block_asm_host_order");
+&ripemd160_block("ripemd160_block_asm_data_order");
 &asm_finish();
 
 sub Xv
diff --git a/src/lib/libssl/src/crypto/ripemd/ripemd.h b/src/lib/libssl/src/crypto/ripemd/ripemd.h
index 7d0d998189..033a5965b5 100644
--- a/src/lib/libssl/src/crypto/ripemd/ripemd.h
+++ b/src/lib/libssl/src/crypto/ripemd/ripemd.h
@@ -60,6 +60,7 @@
 #define HEADER_RIPEMD_H
 
 #include <openssl/e_os2.h>
+#include <stddef.h>
 
 #ifdef  __cplusplus
 extern "C" {
@@ -87,16 +88,13 @@ typedef struct RIPEMD160state_st
         RIPEMD160_LONG A,B,C,D,E;
         RIPEMD160_LONG Nl,Nh;
         RIPEMD160_LONG data[RIPEMD160_LBLOCK];
-        int num;
+        unsigned int   num;
         } RIPEMD160_CTX;
 
-#ifdef OPENSSL_FIPS
-int private_RIPEMD160_Init(RIPEMD160_CTX *c);
-#endif
 int RIPEMD160_Init(RIPEMD160_CTX *c);
-int RIPEMD160_Update(RIPEMD160_CTX *c, const void *data, unsigned long len);
+int RIPEMD160_Update(RIPEMD160_CTX *c, const void *data, size_t len);
 int RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c);
-unsigned char *RIPEMD160(const unsigned char *d, unsigned long n,
+unsigned char *RIPEMD160(const unsigned char *d, size_t n,
         unsigned char *md);
 void RIPEMD160_Transform(RIPEMD160_CTX *c, const unsigned char *b);
 #ifdef  __cplusplus
diff --git a/src/lib/libssl/src/crypto/ripemd/rmd_dgst.c b/src/lib/libssl/src/crypto/ripemd/rmd_dgst.c
index 58ff010d11..1f2401aa7e 100644
--- a/src/lib/libssl/src/crypto/ripemd/rmd_dgst.c
+++ b/src/lib/libssl/src/crypto/ripemd/rmd_dgst.c
@@ -58,19 +58,18 @@
 
 #include <stdio.h>
 #include "rmd_locl.h"
-#include <openssl/fips.h>
 #include <openssl/opensslv.h>
 
-const char *RMD160_version="RIPE-MD160" OPENSSL_VERSION_PTEXT;
+const char RMD160_version[]="RIPE-MD160" OPENSSL_VERSION_PTEXT;
 
 #  ifdef RMD160_ASM
-     void ripemd160_block_x86(RIPEMD160_CTX *c, unsigned long *p,int num);
+     void ripemd160_block_x86(RIPEMD160_CTX *c, unsigned long *p,size_t num);
 #    define ripemd160_block ripemd160_block_x86
 #  else
-     void ripemd160_block(RIPEMD160_CTX *c, unsigned long *p,int num);
+     void ripemd160_block(RIPEMD160_CTX *c, unsigned long *p,size_t num);
 #  endif
 
-FIPS_NON_FIPS_MD_Init(RIPEMD160)
+int RIPEMD160_Init(RIPEMD160_CTX *c)
         {
         c->A=RIPEMD160_A;
         c->B=RIPEMD160_B;
@@ -83,212 +82,11 @@ FIPS_NON_FIPS_MD_Init(RIPEMD160)
         return 1;
         }
 
-#ifndef ripemd160_block_host_order
-#ifdef X
-#undef X
-#endif
-#define X(i)    XX[i]
-void ripemd160_block_host_order (RIPEMD160_CTX *ctx, const void *p, int num)
-        {
-        const RIPEMD160_LONG *XX=p;
-        register volatile unsigned MD32_REG_T A,B,C,D,E;
-        register unsigned MD32_REG_T a,b,c,d,e;
-
-        for (;num--;XX+=HASH_LBLOCK)
-                {
-
-        A=ctx->A; B=ctx->B; C=ctx->C; D=ctx->D; E=ctx->E;
-
-        RIP1(A,B,C,D,E,WL00,SL00);
-        RIP1(E,A,B,C,D,WL01,SL01);
-        RIP1(D,E,A,B,C,WL02,SL02);
-        RIP1(C,D,E,A,B,WL03,SL03);
-        RIP1(B,C,D,E,A,WL04,SL04);
-        RIP1(A,B,C,D,E,WL05,SL05);
-        RIP1(E,A,B,C,D,WL06,SL06);
-        RIP1(D,E,A,B,C,WL07,SL07);
-        RIP1(C,D,E,A,B,WL08,SL08);
-        RIP1(B,C,D,E,A,WL09,SL09);
-        RIP1(A,B,C,D,E,WL10,SL10);
-        RIP1(E,A,B,C,D,WL11,SL11);
-        RIP1(D,E,A,B,C,WL12,SL12);
-        RIP1(C,D,E,A,B,WL13,SL13);
-        RIP1(B,C,D,E,A,WL14,SL14);
-        RIP1(A,B,C,D,E,WL15,SL15);
-
-        RIP2(E,A,B,C,D,WL16,SL16,KL1);
-        RIP2(D,E,A,B,C,WL17,SL17,KL1);
-        RIP2(C,D,E,A,B,WL18,SL18,KL1);
-        RIP2(B,C,D,E,A,WL19,SL19,KL1);
-        RIP2(A,B,C,D,E,WL20,SL20,KL1);
-        RIP2(E,A,B,C,D,WL21,SL21,KL1);
-        RIP2(D,E,A,B,C,WL22,SL22,KL1);
-        RIP2(C,D,E,A,B,WL23,SL23,KL1);
-        RIP2(B,C,D,E,A,WL24,SL24,KL1);
-        RIP2(A,B,C,D,E,WL25,SL25,KL1);
-        RIP2(E,A,B,C,D,WL26,SL26,KL1);
-        RIP2(D,E,A,B,C,WL27,SL27,KL1);
-        RIP2(C,D,E,A,B,WL28,SL28,KL1);
-        RIP2(B,C,D,E,A,WL29,SL29,KL1);
-        RIP2(A,B,C,D,E,WL30,SL30,KL1);
-        RIP2(E,A,B,C,D,WL31,SL31,KL1);
-
-        RIP3(D,E,A,B,C,WL32,SL32,KL2);
-        RIP3(C,D,E,A,B,WL33,SL33,KL2);
-        RIP3(B,C,D,E,A,WL34,SL34,KL2);
-        RIP3(A,B,C,D,E,WL35,SL35,KL2);
-        RIP3(E,A,B,C,D,WL36,SL36,KL2);
-        RIP3(D,E,A,B,C,WL37,SL37,KL2);
-        RIP3(C,D,E,A,B,WL38,SL38,KL2);
-        RIP3(B,C,D,E,A,WL39,SL39,KL2);
-        RIP3(A,B,C,D,E,WL40,SL40,KL2);
-        RIP3(E,A,B,C,D,WL41,SL41,KL2);
-        RIP3(D,E,A,B,C,WL42,SL42,KL2);
-        RIP3(C,D,E,A,B,WL43,SL43,KL2);
-        RIP3(B,C,D,E,A,WL44,SL44,KL2);
-        RIP3(A,B,C,D,E,WL45,SL45,KL2);
-        RIP3(E,A,B,C,D,WL46,SL46,KL2);
-        RIP3(D,E,A,B,C,WL47,SL47,KL2);
-
-        RIP4(C,D,E,A,B,WL48,SL48,KL3);
-        RIP4(B,C,D,E,A,WL49,SL49,KL3);
-        RIP4(A,B,C,D,E,WL50,SL50,KL3);
-        RIP4(E,A,B,C,D,WL51,SL51,KL3);
-        RIP4(D,E,A,B,C,WL52,SL52,KL3);
-        RIP4(C,D,E,A,B,WL53,SL53,KL3);
-        RIP4(B,C,D,E,A,WL54,SL54,KL3);
-        RIP4(A,B,C,D,E,WL55,SL55,KL3);
-        RIP4(E,A,B,C,D,WL56,SL56,KL3);
-        RIP4(D,E,A,B,C,WL57,SL57,KL3);
-        RIP4(C,D,E,A,B,WL58,SL58,KL3);
-        RIP4(B,C,D,E,A,WL59,SL59,KL3);
-        RIP4(A,B,C,D,E,WL60,SL60,KL3);
-        RIP4(E,A,B,C,D,WL61,SL61,KL3);
-        RIP4(D,E,A,B,C,WL62,SL62,KL3);
-        RIP4(C,D,E,A,B,WL63,SL63,KL3);
-
-        RIP5(B,C,D,E,A,WL64,SL64,KL4);
-        RIP5(A,B,C,D,E,WL65,SL65,KL4);
-        RIP5(E,A,B,C,D,WL66,SL66,KL4);
-        RIP5(D,E,A,B,C,WL67,SL67,KL4);
-        RIP5(C,D,E,A,B,WL68,SL68,KL4);
-        RIP5(B,C,D,E,A,WL69,SL69,KL4);
-        RIP5(A,B,C,D,E,WL70,SL70,KL4);
-        RIP5(E,A,B,C,D,WL71,SL71,KL4);
-        RIP5(D,E,A,B,C,WL72,SL72,KL4);
-        RIP5(C,D,E,A,B,WL73,SL73,KL4);
-        RIP5(B,C,D,E,A,WL74,SL74,KL4);
-        RIP5(A,B,C,D,E,WL75,SL75,KL4);
-        RIP5(E,A,B,C,D,WL76,SL76,KL4);
-        RIP5(D,E,A,B,C,WL77,SL77,KL4);
-        RIP5(C,D,E,A,B,WL78,SL78,KL4);
-        RIP5(B,C,D,E,A,WL79,SL79,KL4);
-
-        a=A; b=B; c=C; d=D; e=E;
-        /* Do other half */
-        A=ctx->A; B=ctx->B; C=ctx->C; D=ctx->D; E=ctx->E;
-
-        RIP5(A,B,C,D,E,WR00,SR00,KR0);
-        RIP5(E,A,B,C,D,WR01,SR01,KR0);
-        RIP5(D,E,A,B,C,WR02,SR02,KR0);
-        RIP5(C,D,E,A,B,WR03,SR03,KR0);
-        RIP5(B,C,D,E,A,WR04,SR04,KR0);
-        RIP5(A,B,C,D,E,WR05,SR05,KR0);
-        RIP5(E,A,B,C,D,WR06,SR06,KR0);
-        RIP5(D,E,A,B,C,WR07,SR07,KR0);
-        RIP5(C,D,E,A,B,WR08,SR08,KR0);
-        RIP5(B,C,D,E,A,WR09,SR09,KR0);
-        RIP5(A,B,C,D,E,WR10,SR10,KR0);
-        RIP5(E,A,B,C,D,WR11,SR11,KR0);
-        RIP5(D,E,A,B,C,WR12,SR12,KR0);
-        RIP5(C,D,E,A,B,WR13,SR13,KR0);
-        RIP5(B,C,D,E,A,WR14,SR14,KR0);
-        RIP5(A,B,C,D,E,WR15,SR15,KR0);
-
-        RIP4(E,A,B,C,D,WR16,SR16,KR1);
-        RIP4(D,E,A,B,C,WR17,SR17,KR1);
-        RIP4(C,D,E,A,B,WR18,SR18,KR1);
-        RIP4(B,C,D,E,A,WR19,SR19,KR1);
-        RIP4(A,B,C,D,E,WR20,SR20,KR1);
-        RIP4(E,A,B,C,D,WR21,SR21,KR1);
-        RIP4(D,E,A,B,C,WR22,SR22,KR1);
-        RIP4(C,D,E,A,B,WR23,SR23,KR1);
-        RIP4(B,C,D,E,A,WR24,SR24,KR1);
-        RIP4(A,B,C,D,E,WR25,SR25,KR1);
-        RIP4(E,A,B,C,D,WR26,SR26,KR1);
-        RIP4(D,E,A,B,C,WR27,SR27,KR1);
-        RIP4(C,D,E,A,B,WR28,SR28,KR1);
-        RIP4(B,C,D,E,A,WR29,SR29,KR1);
-        RIP4(A,B,C,D,E,WR30,SR30,KR1);
-        RIP4(E,A,B,C,D,WR31,SR31,KR1);
-
-        RIP3(D,E,A,B,C,WR32,SR32,KR2);
-        RIP3(C,D,E,A,B,WR33,SR33,KR2);
-        RIP3(B,C,D,E,A,WR34,SR34,KR2);
-        RIP3(A,B,C,D,E,WR35,SR35,KR2);
-        RIP3(E,A,B,C,D,WR36,SR36,KR2);
-        RIP3(D,E,A,B,C,WR37,SR37,KR2);
-        RIP3(C,D,E,A,B,WR38,SR38,KR2);
-        RIP3(B,C,D,E,A,WR39,SR39,KR2);
-        RIP3(A,B,C,D,E,WR40,SR40,KR2);
-        RIP3(E,A,B,C,D,WR41,SR41,KR2);
-        RIP3(D,E,A,B,C,WR42,SR42,KR2);
-        RIP3(C,D,E,A,B,WR43,SR43,KR2);
-        RIP3(B,C,D,E,A,WR44,SR44,KR2);
-        RIP3(A,B,C,D,E,WR45,SR45,KR2);
-        RIP3(E,A,B,C,D,WR46,SR46,KR2);
-        RIP3(D,E,A,B,C,WR47,SR47,KR2);
-
-        RIP2(C,D,E,A,B,WR48,SR48,KR3);
-        RIP2(B,C,D,E,A,WR49,SR49,KR3);
-        RIP2(A,B,C,D,E,WR50,SR50,KR3);
-        RIP2(E,A,B,C,D,WR51,SR51,KR3);
-        RIP2(D,E,A,B,C,WR52,SR52,KR3);
-        RIP2(C,D,E,A,B,WR53,SR53,KR3);
-        RIP2(B,C,D,E,A,WR54,SR54,KR3);
-        RIP2(A,B,C,D,E,WR55,SR55,KR3);
-        RIP2(E,A,B,C,D,WR56,SR56,KR3);
-        RIP2(D,E,A,B,C,WR57,SR57,KR3);
-        RIP2(C,D,E,A,B,WR58,SR58,KR3);
-        RIP2(B,C,D,E,A,WR59,SR59,KR3);
-        RIP2(A,B,C,D,E,WR60,SR60,KR3);
-        RIP2(E,A,B,C,D,WR61,SR61,KR3);
-        RIP2(D,E,A,B,C,WR62,SR62,KR3);
-        RIP2(C,D,E,A,B,WR63,SR63,KR3);
-
-        RIP1(B,C,D,E,A,WR64,SR64);
-        RIP1(A,B,C,D,E,WR65,SR65);
-        RIP1(E,A,B,C,D,WR66,SR66);
-        RIP1(D,E,A,B,C,WR67,SR67);
-        RIP1(C,D,E,A,B,WR68,SR68);
-        RIP1(B,C,D,E,A,WR69,SR69);
-        RIP1(A,B,C,D,E,WR70,SR70);
-        RIP1(E,A,B,C,D,WR71,SR71);
-        RIP1(D,E,A,B,C,WR72,SR72);
-        RIP1(C,D,E,A,B,WR73,SR73);
-        RIP1(B,C,D,E,A,WR74,SR74);
-        RIP1(A,B,C,D,E,WR75,SR75);
-        RIP1(E,A,B,C,D,WR76,SR76);
-        RIP1(D,E,A,B,C,WR77,SR77);
-        RIP1(C,D,E,A,B,WR78,SR78);
-        RIP1(B,C,D,E,A,WR79,SR79);
-
-        D     =ctx->B+c+D;
-        ctx->B=ctx->C+d+E;
-        ctx->C=ctx->D+e+A;
-        ctx->D=ctx->E+a+B;
-        ctx->E=ctx->A+b+C;
-        ctx->A=D;
-
-                }
-        }
-#endif
-
 #ifndef ripemd160_block_data_order
 #ifdef X
 #undef X
 #endif
-void ripemd160_block_data_order (RIPEMD160_CTX *ctx, const void *p, int num)
+void ripemd160_block_data_order (RIPEMD160_CTX *ctx, const void *p, size_t num)
         {
         const unsigned char *data=p;
         register volatile unsigned MD32_REG_T A,B,C,D,E;
diff --git a/src/lib/libssl/src/crypto/ripemd/rmd_locl.h b/src/lib/libssl/src/crypto/ripemd/rmd_locl.h
index 7b835dfbd4..f14b346e66 100644
--- a/src/lib/libssl/src/crypto/ripemd/rmd_locl.h
+++ b/src/lib/libssl/src/crypto/ripemd/rmd_locl.h
@@ -72,28 +72,20 @@
  */
 #ifdef RMD160_ASM
 # if defined(__i386) || defined(__i386__) || defined(_M_IX86) || defined(__INTEL__)
-#  define ripemd160_block_host_order ripemd160_block_asm_host_order
+#  define ripemd160_block_data_order ripemd160_block_asm_data_order
 # endif
 #endif
 
-void ripemd160_block_host_order (RIPEMD160_CTX *c, const void *p,int num);
-void ripemd160_block_data_order (RIPEMD160_CTX *c, const void *p,int num);
-
-#if defined(__i386) || defined(__i386__) || defined(_M_IX86) || defined(__INTEL__)
-#define ripemd160_block_data_order ripemd160_block_host_order
-#endif
+void ripemd160_block_data_order (RIPEMD160_CTX *c, const void *p,size_t num);
 
 #define DATA_ORDER_IS_LITTLE_ENDIAN
 
 #define HASH_LONG               RIPEMD160_LONG
-#define HASH_LONG_LOG2          RIPEMD160_LONG_LOG2
 #define HASH_CTX                RIPEMD160_CTX
 #define HASH_CBLOCK             RIPEMD160_CBLOCK
-#define HASH_LBLOCK             RIPEMD160_LBLOCK
 #define HASH_UPDATE             RIPEMD160_Update
 #define HASH_TRANSFORM          RIPEMD160_Transform
 #define HASH_FINAL              RIPEMD160_Final
-#define HASH_BLOCK_HOST_ORDER   ripemd160_block_host_order
 #define HASH_MAKE_STRING(c,s)   do {    \
         unsigned long ll;               \
         ll=(c)->A; HOST_l2c(ll,(s));    \
@@ -102,9 +94,7 @@ void ripemd160_block_data_order (RIPEMD160_CTX *c, const void *p,int num);
         ll=(c)->D; HOST_l2c(ll,(s));    \
         ll=(c)->E; HOST_l2c(ll,(s));    \
         } while (0)
-#if !defined(L_ENDIAN) || defined(ripemd160_block_data_order)
 #define HASH_BLOCK_DATA_ORDER   ripemd160_block_data_order
-#endif
 
 #include "md32_common.h"
 
diff --git a/src/lib/libssl/src/crypto/ripemd/rmd_one.c b/src/lib/libssl/src/crypto/ripemd/rmd_one.c
index b88446b267..3efb13758f 100644
--- a/src/lib/libssl/src/crypto/ripemd/rmd_one.c
+++ b/src/lib/libssl/src/crypto/ripemd/rmd_one.c
@@ -61,7 +61,7 @@
 #include <openssl/ripemd.h>
 #include <openssl/crypto.h>
 
-unsigned char *RIPEMD160(const unsigned char *d, unsigned long n,
+unsigned char *RIPEMD160(const unsigned char *d, size_t n,
              unsigned char *md)
         {
         RIPEMD160_CTX c;
diff --git a/src/lib/libssl/src/crypto/ripemd/rmdtest.c b/src/lib/libssl/src/crypto/ripemd/rmdtest.c
index d4c709e646..fb34e0e836 100644
--- a/src/lib/libssl/src/crypto/ripemd/rmdtest.c
+++ b/src/lib/libssl/src/crypto/ripemd/rmdtest.c
@@ -103,19 +103,19 @@ static char *pt(unsigned char *md);
 int main(int argc, char *argv[])
         {
         int i,err=0;
-        unsigned char **P,**R;
+        char **P,**R;
         char *p;
         unsigned char md[RIPEMD160_DIGEST_LENGTH];
 
-        P=(unsigned char **)test;
-        R=(unsigned char **)ret;
+        P=test;
+        R=ret;
         i=1;
         while (*P != NULL)
                 {
 #ifdef CHARSET_EBCDIC
                 ebcdic2ascii((char *)*P, (char *)*P, strlen((char *)*P));
 #endif
-                EVP_Digest(&(P[0][0]),(unsigned long)strlen((char *)*P),md,NULL,EVP_ripemd160(), NULL);
+                EVP_Digest(&(P[0][0]),strlen((char *)*P),md,NULL,EVP_ripemd160(), NULL);
                 p=pt(md);
                 if (strcmp(p,(char *)*R) != 0)
                         {
diff --git a/src/lib/libssl/src/crypto/rsa/rsa.h b/src/lib/libssl/src/crypto/rsa/rsa.h
index dbed701e89..6b5e4f8a9a 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa.h
+++ b/src/lib/libssl/src/crypto/rsa/rsa.h
@@ -64,25 +64,25 @@
 #ifndef OPENSSL_NO_BIO
 #include <openssl/bio.h>
 #endif
-#include <openssl/bn.h>
 #include <openssl/crypto.h>
 #include <openssl/ossl_typ.h>
+#ifndef OPENSSL_NO_DEPRECATED
+#include <openssl/bn.h>
+#endif
 
 #ifdef OPENSSL_NO_RSA
 #error RSA is disabled.
 #endif
 
-#if defined(OPENSSL_FIPS)
-#define FIPS_RSA_SIZE_T int
-#endif
-
 #ifdef  __cplusplus
 extern "C" {
 #endif
 
-typedef struct rsa_st RSA;
+/* Declared already in ossl_typ.h */
+/* typedef struct rsa_st RSA; */
+/* typedef struct rsa_meth_st RSA_METHOD; */
 
-typedef struct rsa_meth_st
+struct rsa_meth_st
         {
         const char *name;
         int (*rsa_pub_enc)(int flen,const unsigned char *from,
@@ -97,7 +97,7 @@ typedef struct rsa_meth_st
         int (*rsa_priv_dec)(int flen,const unsigned char *from,
                             unsigned char *to,
                             RSA *rsa,int padding);
-        int (*rsa_mod_exp)(BIGNUM *r0,const BIGNUM *I,RSA *rsa); /* Can be null */
+        int (*rsa_mod_exp)(BIGNUM *r0,const BIGNUM *I,RSA *rsa,BN_CTX *ctx); /* Can be null */
         int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                           const BIGNUM *m, BN_CTX *ctx,
                           BN_MONT_CTX *m_ctx); /* Can be null */
@@ -118,8 +118,12 @@ typedef struct rsa_meth_st
         int (*rsa_verify)(int dtype,
                 const unsigned char *m, unsigned int m_length,
                 unsigned char *sigbuf, unsigned int siglen, const RSA *rsa);
-
-        } RSA_METHOD;
+/* If this callback is NULL, the builtin software RSA key-gen will be used. This
+ * is for behavioural compatibility whilst the code gets rewired, but one day
+ * it would be nice to assume there are no such things as "builtin software"
+ * implementations. */
+        int (*rsa_keygen)(RSA *rsa, int bits, BIGNUM *e, BN_GENCB *cb);
+        };
 
 struct rsa_st
         {
@@ -152,12 +156,19 @@ struct rsa_st
          * NULL */
         char *bignum_data;
         BN_BLINDING *blinding;
+        BN_BLINDING *mt_blinding;
         };
 
-#define OPENSSL_RSA_MAX_MODULUS_BITS    16384
+#ifndef OPENSSL_RSA_MAX_MODULUS_BITS
+# define OPENSSL_RSA_MAX_MODULUS_BITS   16384
+#endif
 
-#define OPENSSL_RSA_SMALL_MODULUS_BITS  3072
-#define OPENSSL_RSA_MAX_PUBEXP_BITS     64 /* exponent limit enforced for "small" modulus only */
+#ifndef OPENSSL_RSA_SMALL_MODULUS_BITS
+# define OPENSSL_RSA_SMALL_MODULUS_BITS 3072
+#endif
+#ifndef OPENSSL_RSA_MAX_PUBEXP_BITS
+# define OPENSSL_RSA_MAX_PUBEXP_BITS    64 /* exponent limit enforced for "large" modulus only */
+#endif
 
 #define RSA_3   0x3L
 #define RSA_F4  0x10001L
@@ -184,13 +195,27 @@ struct rsa_st
                                                 * default (ignoring RSA_FLAG_BLINDING),
                                                 * but other engines might not need it
                                                 */
-#define RSA_FLAG_NO_EXP_CONSTTIME       0x0100 /* new with 0.9.7h; the built-in RSA
+#define RSA_FLAG_NO_CONSTTIME           0x0100 /* new with 0.9.8f; the built-in RSA
+                                                * implementation now uses constant time
+                                                * operations by default in private key operations,
+                                                * e.g., constant time modular exponentiation, 
+                                                * modular inverse without leaking branches, 
+                                                * division without leaking branches. This 
+                                                * flag disables these constant time 
+                                                * operations and results in faster RSA 
+                                                * private key operations.
+                                                */ 
+#ifndef OPENSSL_NO_DEPRECATED
+#define RSA_FLAG_NO_EXP_CONSTTIME RSA_FLAG_NO_CONSTTIME /* deprecated name for the flag*/
+                                                /* new with 0.9.7h; the built-in RSA
                                                 * implementation now uses constant time
                                                 * modular exponentiation for secret exponents
                                                 * by default. This flag causes the
                                                 * faster variable sliding window method to
                                                 * be used for all exponents.
                                                 */
+#endif
+
 
 #define RSA_PKCS1_PADDING       1
 #define RSA_SSLV23_PADDING      2
@@ -206,18 +231,17 @@ struct rsa_st
 RSA *   RSA_new(void);
 RSA *   RSA_new_method(ENGINE *engine);
 int     RSA_size(const RSA *);
+
+/* Deprecated version */
+#ifndef OPENSSL_NO_DEPRECATED
 RSA *   RSA_generate_key(int bits, unsigned long e,void
                 (*callback)(int,int,void *),void *cb_arg);
+#endif /* !defined(OPENSSL_NO_DEPRECATED) */
+
+/* New version */
+int     RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e, BN_GENCB *cb);
+
 int     RSA_check_key(const RSA *);
-#ifdef OPENSSL_FIPS
-int RSA_X931_derive(RSA *rsa, BIGNUM *p1, BIGNUM *p2, BIGNUM *q1, BIGNUM *q2,
-                        void (*cb)(int, int, void *), void *cb_arg,
-                        const BIGNUM *Xp1, const BIGNUM *Xp2, const BIGNUM *Xp,
-                        const BIGNUM *Xq1, const BIGNUM *Xq2, const BIGNUM *Xq,
-                        const BIGNUM *e);
-RSA *RSA_X931_generate_key(int bits, const BIGNUM *e,
-             void (*cb)(int,int,void *), void *cb_arg);
-#endif
         /* next 4 return -1 on error */
 int     RSA_public_encrypt(int flen, const unsigned char *from,
                 unsigned char *to, RSA *rsa,int padding);
@@ -257,11 +281,19 @@ int	RSA_print_fp(FILE *fp, const RSA *r,int offset);
 int     RSA_print(BIO *bp, const RSA *r,int offset);
 #endif
 
-int i2d_RSA_NET(const RSA *a, unsigned char **pp, int (*cb)(), int sgckey);
-RSA *d2i_RSA_NET(RSA **a, const unsigned char **pp, long length, int (*cb)(), int sgckey);
+int i2d_RSA_NET(const RSA *a, unsigned char **pp,
+                int (*cb)(char *buf, int len, const char *prompt, int verify),
+                int sgckey);
+RSA *d2i_RSA_NET(RSA **a, const unsigned char **pp, long length,
+                 int (*cb)(char *buf, int len, const char *prompt, int verify),
+                 int sgckey);
 
-int i2d_Netscape_RSA(const RSA *a, unsigned char **pp, int (*cb)());
-RSA *d2i_Netscape_RSA(RSA **a, const unsigned char **pp, long length, int (*cb)());
+int i2d_Netscape_RSA(const RSA *a, unsigned char **pp,
+                     int (*cb)(char *buf, int len, const char *prompt,
+                               int verify));
+RSA *d2i_Netscape_RSA(RSA **a, const unsigned char **pp, long length,
+                      int (*cb)(char *buf, int len, const char *prompt,
+                                int verify));
 
 /* The following 2 functions sign and verify a X509_SIG ASN1 object
  * inside PKCS#1 padded RSA encryption */
@@ -281,6 +313,7 @@ int RSA_verify_ASN1_OCTET_STRING(int type,
 
 int RSA_blinding_on(RSA *rsa, BN_CTX *ctx);
 void RSA_blinding_off(RSA *rsa);
+BN_BLINDING *RSA_setup_blinding(RSA *rsa, BN_CTX *ctx);
 
 int RSA_padding_add_PKCS1_type_1(unsigned char *to,int tlen,
         const unsigned char *f,int fl);
@@ -336,14 +369,21 @@ void ERR_load_RSA_strings(void);
 
 /* Function codes. */
 #define RSA_F_MEMORY_LOCK                                100
+#define RSA_F_RSA_BUILTIN_KEYGEN                         129
 #define RSA_F_RSA_CHECK_KEY                              123
 #define RSA_F_RSA_EAY_PRIVATE_DECRYPT                    101
 #define RSA_F_RSA_EAY_PRIVATE_ENCRYPT                    102
 #define RSA_F_RSA_EAY_PUBLIC_DECRYPT                     103
 #define RSA_F_RSA_EAY_PUBLIC_ENCRYPT                     104
 #define RSA_F_RSA_GENERATE_KEY                           105
+#define RSA_F_RSA_MEMORY_LOCK                            130
 #define RSA_F_RSA_NEW_METHOD                             106
 #define RSA_F_RSA_NULL                                   124
+#define RSA_F_RSA_NULL_MOD_EXP                           131
+#define RSA_F_RSA_NULL_PRIVATE_DECRYPT                   132
+#define RSA_F_RSA_NULL_PRIVATE_ENCRYPT                   133
+#define RSA_F_RSA_NULL_PUBLIC_DECRYPT                    134
+#define RSA_F_RSA_NULL_PUBLIC_ENCRYPT                    135
 #define RSA_F_RSA_PADDING_ADD_NONE                       107
 #define RSA_F_RSA_PADDING_ADD_PKCS1_OAEP                 121
 #define RSA_F_RSA_PADDING_ADD_PKCS1_PSS                  125
@@ -359,6 +399,7 @@ void ERR_load_RSA_strings(void);
 #define RSA_F_RSA_PADDING_CHECK_X931                     128
 #define RSA_F_RSA_PRINT                                  115
 #define RSA_F_RSA_PRINT_FP                               116
+#define RSA_F_RSA_SETUP_BLINDING                         136
 #define RSA_F_RSA_SIGN                                   117
 #define RSA_F_RSA_SIGN_ASN1_OCTET_STRING                 118
 #define RSA_F_RSA_VERIFY                                 119
@@ -392,6 +433,7 @@ void ERR_load_RSA_strings(void);
 #define RSA_R_KEY_SIZE_TOO_SMALL                         120
 #define RSA_R_LAST_OCTET_INVALID                         134
 #define RSA_R_MODULUS_TOO_LARGE                          105
+#define RSA_R_NO_PUBLIC_EXPONENT                         140
 #define RSA_R_NULL_BEFORE_BLOCK_MISSING                  113
 #define RSA_R_N_DOES_NOT_EQUAL_P_Q                       127
 #define RSA_R_OAEP_DECODING_ERROR                        121
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_asn1.c b/src/lib/libssl/src/crypto/rsa/rsa_asn1.c
index 1455a7e0e4..bbbf26d50e 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_asn1.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_asn1.c
@@ -63,10 +63,10 @@
 #include <openssl/asn1t.h>
 
 static ASN1_METHOD method={
-        (int (*)())  i2d_RSAPrivateKey,
-        (char *(*)())d2i_RSAPrivateKey,
-        (char *(*)())RSA_new,
-        (void (*)()) RSA_free};
+        (I2D_OF(void))     i2d_RSAPrivateKey,
+        (D2I_OF(void))     d2i_RSAPrivateKey,
+        (void *(*)(void))  RSA_new,
+        (void (*)(void *)) RSA_free};
 
 ASN1_METHOD *RSAPrivateKey_asn1_meth(void)
         {
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_chk.c b/src/lib/libssl/src/crypto/rsa/rsa_chk.c
index 002f2cb487..9d848db8c6 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_chk.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_chk.c
@@ -75,7 +75,7 @@ int RSA_check_key(const RSA *key)
                 }
         
         /* p prime? */
-        r = BN_is_prime(key->p, BN_prime_checks, NULL, NULL, NULL);
+        r = BN_is_prime_ex(key->p, BN_prime_checks, NULL, NULL);
         if (r != 1)
                 {
                 ret = r;
@@ -85,7 +85,7 @@ int RSA_check_key(const RSA *key)
                 }
         
         /* q prime? */
-        r = BN_is_prime(key->q, BN_prime_checks, NULL, NULL, NULL);
+        r = BN_is_prime_ex(key->q, BN_prime_checks, NULL, NULL);
         if (r != 1)
                 {
                 ret = r;
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_eay.c b/src/lib/libssl/src/crypto/rsa/rsa_eay.c
index 610889dc80..bb77d0f67e 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_eay.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_eay.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -115,7 +115,7 @@
 #include <openssl/rsa.h>
 #include <openssl/rand.h>
 
-#if !defined(RSA_NULL) && !defined(OPENSSL_FIPS)
+#ifndef RSA_NULL
 
 static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
                 unsigned char *to, RSA *rsa,int padding);
@@ -125,7 +125,7 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
                 unsigned char *to, RSA *rsa,int padding);
 static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                 unsigned char *to, RSA *rsa,int padding);
-static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa);
+static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa, BN_CTX *ctx);
 static int RSA_eay_init(RSA *rsa);
 static int RSA_eay_finish(RSA *rsa);
 static RSA_METHOD rsa_pkcs1_eay_meth={
@@ -141,7 +141,8 @@ static RSA_METHOD rsa_pkcs1_eay_meth={
         0, /* flags */
         NULL,
         0, /* rsa_sign */
-        0  /* rsa_verify */
+        0, /* rsa_verify */
+        NULL /* rsa_keygen */
         };
 
 const RSA_METHOD *RSA_PKCS1_SSLeay(void)
@@ -149,19 +150,53 @@ const RSA_METHOD *RSA_PKCS1_SSLeay(void)
         return(&rsa_pkcs1_eay_meth);
         }
 
+/* Usage example;
+ *    MONT_HELPER(rsa->_method_mod_p, bn_ctx, rsa->p, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err);
+ */
+#define MONT_HELPER(method_mod, ctx, m, pre_cond, err_instr) \
+        if ((pre_cond) && ((method_mod) == NULL) && \
+                        !BN_MONT_CTX_set_locked(&(method_mod), \
+                                CRYPTO_LOCK_RSA, \
+                                (m), (ctx))) \
+                err_instr
+
 static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        BIGNUM f,ret;
+        BIGNUM *f,*ret;
         int i,j,k,num=0,r= -1;
         unsigned char *buf=NULL;
         BN_CTX *ctx=NULL;
 
-        BN_init(&f);
-        BN_init(&ret);
+        if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
+                {
+                RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE);
+                return -1;
+                }
+
+        if (BN_ucmp(rsa->n, rsa->e) <= 0)
+                {
+                RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
+                return -1;
+                }
+
+        /* for large moduli, enforce exponent limit */
+        if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)
+                {
+                if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)
+                        {
+                        RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE);
+                        return -1;
+                        }
+                }
+        
         if ((ctx=BN_CTX_new()) == NULL) goto err;
+        BN_CTX_start(ctx);
+        f = BN_CTX_get(ctx);
+        ret = BN_CTX_get(ctx);
         num=BN_num_bytes(rsa->n);
-        if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL)
+        buf = OPENSSL_malloc(num);
+        if (!f || !ret || !buf)
                 {
                 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);
                 goto err;
@@ -189,37 +224,34 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
                 }
         if (i <= 0) goto err;
 
-        if (BN_bin2bn(buf,num,&f) == NULL) goto err;
+        if (BN_bin2bn(buf,num,f) == NULL) goto err;
         
-        if (BN_ucmp(&f, rsa->n) >= 0)
-                {       
+        if (BN_ucmp(f, rsa->n) >= 0)
+                {
                 /* usually the padding functions would catch this */
                 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
                 goto err;
                 }
 
-        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
-                {
-                if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n,
-                                        CRYPTO_LOCK_RSA, rsa->n, ctx))
-                        goto err;
-                }
+        MONT_HELPER(rsa->_method_mod_n, ctx, rsa->n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
 
-        if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx,
+        if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx,
                 rsa->_method_mod_n)) goto err;
 
         /* put in leading 0 bytes if the number is less than the
          * length of the modulus */
-        j=BN_num_bytes(&ret);
-        i=BN_bn2bin(&ret,&(to[num-j]));
+        j=BN_num_bytes(ret);
+        i=BN_bn2bin(ret,&(to[num-j]));
         for (k=0; k<(num-i); k++)
                 to[k]=0;
 
         r=num;
 err:
-        if (ctx != NULL) BN_CTX_free(ctx);
-        BN_clear_free(&f);
-        BN_clear_free(&ret);
+        if (ctx != NULL)
+                {
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
+                }
         if (buf != NULL) 
                 {
                 OPENSSL_cleanse(buf,num);
@@ -228,64 +260,101 @@ err:
         return(r);
         }
 
-static int rsa_eay_blinding(RSA *rsa, BN_CTX *ctx)
-        {
-        int ret = 1;
-        CRYPTO_w_lock(CRYPTO_LOCK_RSA);
-        /* Check again inside the lock - the macro's check is racey */
-        if(rsa->blinding == NULL)
-                ret = RSA_blinding_on(rsa, ctx);
-        CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
-        return ret;
-        }
+static BN_BLINDING *rsa_get_blinding(RSA *rsa, int *local, BN_CTX *ctx)
+{
+        BN_BLINDING *ret;
+        int got_write_lock = 0;
 
-#define BLINDING_HELPER(rsa, ctx, err_instr) \
-        do { \
-                if((!((rsa)->flags & RSA_FLAG_NO_BLINDING)) && \
-                    ((rsa)->blinding == NULL) && \
-                    !rsa_eay_blinding(rsa, ctx)) \
-                    err_instr \
-        } while(0)
+        CRYPTO_r_lock(CRYPTO_LOCK_RSA);
 
-static BN_BLINDING *setup_blinding(RSA *rsa, BN_CTX *ctx)
-        {
-        BIGNUM *A, *Ai;
-        BN_BLINDING *ret = NULL;
+        if (rsa->blinding == NULL)
+                {
+                CRYPTO_r_unlock(CRYPTO_LOCK_RSA);
+                CRYPTO_w_lock(CRYPTO_LOCK_RSA);
+                got_write_lock = 1;
 
-        /* added in OpenSSL 0.9.6j and 0.9.7b */
+                if (rsa->blinding == NULL)
+                        rsa->blinding = RSA_setup_blinding(rsa, ctx);
+                }
 
-        /* NB: similar code appears in RSA_blinding_on (rsa_lib.c);
-         * this should be placed in a new function of its own, but for reasons
-         * of binary compatibility can't */
+        ret = rsa->blinding;
+        if (ret == NULL)
+                goto err;
 
-        BN_CTX_start(ctx);
-        A = BN_CTX_get(ctx);
-        if ((RAND_status() == 0) && rsa->d != NULL && rsa->d->d != NULL)
+        if (BN_BLINDING_get_thread_id(ret) == CRYPTO_thread_id())
                 {
-                /* if PRNG is not properly seeded, resort to secret exponent as unpredictable seed */
-                RAND_add(rsa->d->d, rsa->d->dmax * sizeof rsa->d->d[0], 0);
-                if (!BN_pseudo_rand_range(A,rsa->n)) goto err;
+                /* rsa->blinding is ours! */
+
+                *local = 1;
                 }
         else
                 {
-                if (!BN_rand_range(A,rsa->n)) goto err;
+                /* resort to rsa->mt_blinding instead */
+
+                *local = 0; /* instructs rsa_blinding_convert(), rsa_blinding_invert()
+                             * that the BN_BLINDING is shared, meaning that accesses
+                             * require locks, and that the blinding factor must be
+                             * stored outside the BN_BLINDING
+                             */
+
+                if (rsa->mt_blinding == NULL)
+                        {
+                        if (!got_write_lock)
+                                {
+                                CRYPTO_r_unlock(CRYPTO_LOCK_RSA);
+                                CRYPTO_w_lock(CRYPTO_LOCK_RSA);
+                                got_write_lock = 1;
+                                }
+                        
+                        if (rsa->mt_blinding == NULL)
+                                rsa->mt_blinding = RSA_setup_blinding(rsa, ctx);
+                        }
+                ret = rsa->mt_blinding;
                 }
-        if ((Ai=BN_mod_inverse(NULL,A,rsa->n,ctx)) == NULL) goto err;
 
-        if (!rsa->meth->bn_mod_exp(A,A,rsa->e,rsa->n,ctx,rsa->_method_mod_n))
-                goto err;
-        ret = BN_BLINDING_new(A,Ai,rsa->n);
-        BN_free(Ai);
-err:
-        BN_CTX_end(ctx);
+ err:
+        if (got_write_lock)
+                CRYPTO_w_unlock(CRYPTO_LOCK_RSA);
+        else
+                CRYPTO_r_unlock(CRYPTO_LOCK_RSA);
         return ret;
-        }
+}
+
+static int rsa_blinding_convert(BN_BLINDING *b, int local, BIGNUM *f,
+        BIGNUM *r, BN_CTX *ctx)
+{
+        if (local)
+                return BN_BLINDING_convert_ex(f, NULL, b, ctx);
+        else
+                {
+                int ret;
+                CRYPTO_r_lock(CRYPTO_LOCK_RSA_BLINDING);
+                ret = BN_BLINDING_convert_ex(f, r, b, ctx);
+                CRYPTO_r_unlock(CRYPTO_LOCK_RSA_BLINDING);
+                return ret;
+                }
+}
+
+static int rsa_blinding_invert(BN_BLINDING *b, int local, BIGNUM *f,
+        BIGNUM *r, BN_CTX *ctx)
+{
+        if (local)
+                return BN_BLINDING_invert_ex(f, NULL, b, ctx);
+        else
+                {
+                int ret;
+                CRYPTO_w_lock(CRYPTO_LOCK_RSA_BLINDING);
+                ret = BN_BLINDING_invert_ex(f, r, b, ctx);
+                CRYPTO_w_unlock(CRYPTO_LOCK_RSA_BLINDING);
+                return ret;
+                }
+}
 
 /* signing */
 static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        BIGNUM f,ret, *res;
+        BIGNUM *f, *ret, *br, *res;
         int i,j,k,num=0,r= -1;
         unsigned char *buf=NULL;
         BN_CTX *ctx=NULL;
@@ -318,8 +387,13 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                 }
 
         if ((ctx=BN_CTX_new()) == NULL) goto err;
-        num=BN_num_bytes(rsa->n);
-        if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL)
+        BN_CTX_start(ctx);
+        f   = BN_CTX_get(ctx);
+        br  = BN_CTX_get(ctx);
+        ret = BN_CTX_get(ctx);
+        num = BN_num_bytes(rsa->n);
+        buf = OPENSSL_malloc(num);
+        if(!f || !ret || !buf)
                 {
                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE);
                 goto err;
@@ -330,6 +404,9 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
         case RSA_PKCS1_PADDING:
                 i=RSA_padding_add_PKCS1_type_1(buf,num,from,flen);
                 break;
+        case RSA_X931_PADDING:
+                i=RSA_padding_add_X931(buf,num,from,flen);
+                break;
         case RSA_NO_PADDING:
                 i=RSA_padding_add_none(buf,num,from,flen);
                 break;
@@ -340,26 +417,18 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                 }
         if (i <= 0) goto err;
 
-        if (BN_bin2bn(buf,num,&f) == NULL) goto err;
+        if (BN_bin2bn(buf,num,f) == NULL) goto err;
         
-        if (BN_ucmp(&f, rsa->n) >= 0)
+        if (BN_ucmp(f, rsa->n) >= 0)
                 {       
                 /* usually the padding functions would catch this */
                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
                 goto err;
                 }
 
-        BLINDING_HELPER(rsa, ctx, goto err;);
-        blinding = rsa->blinding;
-        
-        /* Now unless blinding is disabled, 'blinding' is non-NULL.
-         * But the BN_BLINDING object may be owned by some other thread
-         * (we don't want to keep it constant and we don't want to use
-         * lots of locking to avoid race conditions, so only a single
-         * thread can use it; other threads have to use local blinding
-         * factors) */
         if (!(rsa->flags & RSA_FLAG_NO_BLINDING))
                 {
+                blinding = rsa_get_blinding(rsa, &local_blinding, ctx);
                 if (blinding == NULL)
                         {
                         RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_INTERNAL_ERROR);
@@ -368,20 +437,8 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                 }
         
         if (blinding != NULL)
-                {
-                if (blinding->thread_id != CRYPTO_thread_id())
-                        {
-                        /* we need a local one-time blinding factor */
-
-                        blinding = setup_blinding(rsa, ctx);
-                        if (blinding == NULL)
-                                goto err;
-                        local_blinding = 1;
-                        }
-                }
-
-        if (blinding)
-                if (!BN_BLINDING_convert(&f, blinding, ctx)) goto err;
+                if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))
+                        goto err;
 
         if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
                 ((rsa->p != NULL) &&
@@ -390,37 +447,42 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                 (rsa->dmq1 != NULL) &&
                 (rsa->iqmp != NULL)) )
                 { 
-                if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err;
+                if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) goto err;
                 }
         else
                 {
                 BIGNUM local_d;
                 BIGNUM *d = NULL;
                 
-                if (!(rsa->flags & RSA_FLAG_NO_EXP_CONSTTIME))
+                if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
                         {
                         BN_init(&local_d);
                         d = &local_d;
-                        BN_with_flags(d, rsa->d, BN_FLG_EXP_CONSTTIME);
+                        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
                         }
                 else
-                        d = rsa->d;
-                if (!rsa->meth->bn_mod_exp(&ret,&f,d,rsa->n,ctx,NULL)) goto err;
+                        d= rsa->d;
+
+                MONT_HELPER(rsa->_method_mod_n, ctx, rsa->n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
+
+                if (!rsa->meth->bn_mod_exp(ret,f,d,rsa->n,ctx,
+                                rsa->_method_mod_n)) goto err;
                 }
 
         if (blinding)
-                if (!BN_BLINDING_invert(&ret, blinding, ctx)) goto err;
+                if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))
+                        goto err;
 
         if (padding == RSA_X931_PADDING)
                 {
-                BN_sub(&f, rsa->n, &ret);
-                if (BN_cmp(&ret, &f))
-                        res = &f;
+                BN_sub(f, rsa->n, ret);
+                if (BN_cmp(ret, f))
+                        res = f;
                 else
-                        res = &ret;
+                        res = ret;
                 }
         else
-                res = &ret;
+                res = ret;
 
         /* put in leading 0 bytes if the number is less than the
          * length of the modulus */
@@ -431,11 +493,11 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
 
         r=num;
 err:
-        if (ctx != NULL) BN_CTX_free(ctx);
-        BN_clear_free(&ret);
-        BN_clear_free(&f);
-        if (local_blinding)
-                BN_BLINDING_free(blinding);
+        if (ctx != NULL)
+                {
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
+                }
         if (buf != NULL)
                 {
                 OPENSSL_cleanse(buf,num);
@@ -447,7 +509,7 @@ err:
 static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        BIGNUM f,ret;
+        BIGNUM *f, *ret, *br;
         int j,num=0,r= -1;
         unsigned char *p;
         unsigned char *buf=NULL;
@@ -455,14 +517,14 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
         int local_blinding = 0;
         BN_BLINDING *blinding = NULL;
 
-        BN_init(&f);
-        BN_init(&ret);
-        ctx=BN_CTX_new();
-        if (ctx == NULL) goto err;
-
-        num=BN_num_bytes(rsa->n);
-
-        if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL)
+        if((ctx = BN_CTX_new()) == NULL) goto err;
+        BN_CTX_start(ctx);
+        f   = BN_CTX_get(ctx);
+        br  = BN_CTX_get(ctx);
+        ret = BN_CTX_get(ctx);
+        num = BN_num_bytes(rsa->n);
+        buf = OPENSSL_malloc(num);
+        if(!f || !ret || !buf)
                 {
                 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE);
                 goto err;
@@ -477,25 +539,17 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                 }
 
         /* make data into a big number */
-        if (BN_bin2bn(from,(int)flen,&f) == NULL) goto err;
+        if (BN_bin2bn(from,(int)flen,f) == NULL) goto err;
 
-        if (BN_ucmp(&f, rsa->n) >= 0)
+        if (BN_ucmp(f, rsa->n) >= 0)
                 {
                 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
                 goto err;
                 }
 
-        BLINDING_HELPER(rsa, ctx, goto err;);
-        blinding = rsa->blinding;
-        
-        /* Now unless blinding is disabled, 'blinding' is non-NULL.
-         * But the BN_BLINDING object may be owned by some other thread
-         * (we don't want to keep it constant and we don't want to use
-         * lots of locking to avoid race conditions, so only a single
-         * thread can use it; other threads have to use local blinding
-         * factors) */
         if (!(rsa->flags & RSA_FLAG_NO_BLINDING))
                 {
+                blinding = rsa_get_blinding(rsa, &local_blinding, ctx);
                 if (blinding == NULL)
                         {
                         RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);
@@ -504,20 +558,8 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                 }
         
         if (blinding != NULL)
-                {
-                if (blinding->thread_id != CRYPTO_thread_id())
-                        {
-                        /* we need a local one-time blinding factor */
-
-                        blinding = setup_blinding(rsa, ctx);
-                        if (blinding == NULL)
-                                goto err;
-                        local_blinding = 1;
-                        }
-                }
-
-        if (blinding)
-                if (!BN_BLINDING_convert(&f, blinding, ctx)) goto err;
+                if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))
+                        goto err;
 
         /* do the decrypt */
         if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
@@ -527,29 +569,33 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                 (rsa->dmq1 != NULL) &&
                 (rsa->iqmp != NULL)) )
                 {
-                if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err;
+                if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) goto err;
                 }
         else
                 {
                 BIGNUM local_d;
                 BIGNUM *d = NULL;
                 
-                if (!(rsa->flags & RSA_FLAG_NO_EXP_CONSTTIME))
+                if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
                         {
                         d = &local_d;
-                        BN_with_flags(d, rsa->d, BN_FLG_EXP_CONSTTIME);
+                        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
                         }
                 else
                         d = rsa->d;
-                if (!rsa->meth->bn_mod_exp(&ret,&f,d,rsa->n,ctx,NULL))
-                        goto err;
+
+                MONT_HELPER(rsa->_method_mod_n, ctx, rsa->n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
+                if (!rsa->meth->bn_mod_exp(ret,f,d,rsa->n,ctx,
+                                rsa->_method_mod_n))
+                  goto err;
                 }
 
         if (blinding)
-                if (!BN_BLINDING_invert(&ret, blinding, ctx)) goto err;
+                if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))
+                        goto err;
 
         p=buf;
-        j=BN_bn2bin(&ret,p); /* j is only used with no-padding mode */
+        j=BN_bn2bin(ret,p); /* j is only used with no-padding mode */
 
         switch (padding)
                 {
@@ -575,11 +621,11 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_PADDING_CHECK_FAILED);
 
 err:
-        if (ctx != NULL) BN_CTX_free(ctx);
-        BN_clear_free(&f);
-        BN_clear_free(&ret);
-        if (local_blinding)
-                BN_BLINDING_free(blinding);
+        if (ctx != NULL)
+                {
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
+                }
         if (buf != NULL)
                 {
                 OPENSSL_cleanse(buf,num);
@@ -592,7 +638,7 @@ err:
 static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        BIGNUM f,ret;
+        BIGNUM *f,*ret;
         int i,num=0,r= -1;
         unsigned char *p;
         unsigned char *buf=NULL;
@@ -619,15 +665,14 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
                         return -1;
                         }
                 }
-
-        BN_init(&f);
-        BN_init(&ret);
-        ctx=BN_CTX_new();
-        if (ctx == NULL) goto err;
-
+        
+        if((ctx = BN_CTX_new()) == NULL) goto err;
+        BN_CTX_start(ctx);
+        f = BN_CTX_get(ctx);
+        ret = BN_CTX_get(ctx);
         num=BN_num_bytes(rsa->n);
-        buf=(unsigned char *)OPENSSL_malloc(num);
-        if (buf == NULL)
+        buf = OPENSSL_malloc(num);
+        if(!f || !ret || !buf)
                 {
                 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,ERR_R_MALLOC_FAILURE);
                 goto err;
@@ -641,37 +686,33 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
                 goto err;
                 }
 
-        if (BN_bin2bn(from,flen,&f) == NULL) goto err;
+        if (BN_bin2bn(from,flen,f) == NULL) goto err;
 
-        if (BN_ucmp(&f, rsa->n) >= 0)
+        if (BN_ucmp(f, rsa->n) >= 0)
                 {
                 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
                 goto err;
                 }
 
-        /* do the decrypt */
-
-        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
-                {
-                if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n,
-                                        CRYPTO_LOCK_RSA, rsa->n, ctx))
-                        goto err;
-                }
+        MONT_HELPER(rsa->_method_mod_n, ctx, rsa->n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
 
-        if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx,
+        if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx,
                 rsa->_method_mod_n)) goto err;
 
-        if ((padding == RSA_X931_PADDING) && ((ret.d[0] & 0xf) != 12))
-                BN_sub(&ret, rsa->n, &ret);
+        if ((padding == RSA_X931_PADDING) && ((ret->d[0] & 0xf) != 12))
+                BN_sub(ret, rsa->n, ret);
 
         p=buf;
-        i=BN_bn2bin(&ret,p);
+        i=BN_bn2bin(ret,p);
 
         switch (padding)
                 {
         case RSA_PKCS1_PADDING:
                 r=RSA_padding_check_PKCS1_type_1(to,num,buf,i,num);
                 break;
+        case RSA_X931_PADDING:
+                r=RSA_padding_check_X931(to,num,buf,i,num);
+                break;
         case RSA_NO_PADDING:
                 r=RSA_padding_check_none(to,num,buf,i,num);
                 break;
@@ -683,9 +724,11 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
                 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_PADDING_CHECK_FAILED);
 
 err:
-        if (ctx != NULL) BN_CTX_free(ctx);
-        BN_clear_free(&f);
-        BN_clear_free(&ret);
+        if (ctx != NULL)
+                {
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
+                }
         if (buf != NULL)
                 {
                 OPENSSL_cleanse(buf,num);
@@ -694,59 +737,111 @@ err:
         return(r);
         }
 
-static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
+static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
         {
-        BIGNUM r1,m1,vrfy;
-        BIGNUM local_dmp1, local_dmq1;
-        BIGNUM *dmp1, *dmq1;
+        BIGNUM *r1,*m1,*vrfy;
+        BIGNUM local_dmp1,local_dmq1,local_c,local_r1;
+        BIGNUM *dmp1,*dmq1,*c,*pr1;
         int ret=0;
-        BN_CTX *ctx;
 
-        BN_init(&m1);
-        BN_init(&r1);
-        BN_init(&vrfy);
-        if ((ctx=BN_CTX_new()) == NULL) goto err;
+        BN_CTX_start(ctx);
+        r1 = BN_CTX_get(ctx);
+        m1 = BN_CTX_get(ctx);
+        vrfy = BN_CTX_get(ctx);
+
+        {
+                BIGNUM local_p, local_q;
+                BIGNUM *p = NULL, *q = NULL;
+
+                /* Make sure BN_mod_inverse in Montgomery intialization uses the
+                 * BN_FLG_CONSTTIME flag (unless RSA_FLAG_NO_CONSTTIME is set)
+                 */
+                if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                        {
+                        BN_init(&local_p);
+                        p = &local_p;
+                        BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);
+
+                        BN_init(&local_q);
+                        q = &local_q;
+                        BN_with_flags(q, rsa->q, BN_FLG_CONSTTIME);
+                        }
+                else
+                        {
+                        p = rsa->p;
+                        q = rsa->q;
+                        }
+
+                MONT_HELPER(rsa->_method_mod_p, ctx, p, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err);
+                MONT_HELPER(rsa->_method_mod_q, ctx, q, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err);
+        }
 
-        if (rsa->flags & RSA_FLAG_CACHE_PRIVATE)
+        MONT_HELPER(rsa->_method_mod_n, ctx, rsa->n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
+
+        /* compute I mod q */
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
                 {
-                if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_p,
-                                        CRYPTO_LOCK_RSA, rsa->p, ctx))
-                        goto err;
-                if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_q,
-                                        CRYPTO_LOCK_RSA, rsa->q, ctx))
-                        goto err;
+                c = &local_c;
+                BN_with_flags(c, I, BN_FLG_CONSTTIME);
+                if (!BN_mod(r1,c,rsa->q,ctx)) goto err;
+                }
+        else
+                {
+                if (!BN_mod(r1,I,rsa->q,ctx)) goto err;
                 }
 
-        if (!BN_mod(&r1,I,rsa->q,ctx)) goto err;
-        if (!(rsa->flags & RSA_FLAG_NO_EXP_CONSTTIME))
+        /* compute r1^dmq1 mod q */
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
                 {
                 dmq1 = &local_dmq1;
-                BN_with_flags(dmq1, rsa->dmq1, BN_FLG_EXP_CONSTTIME);
+                BN_with_flags(dmq1, rsa->dmq1, BN_FLG_CONSTTIME);
                 }
         else
                 dmq1 = rsa->dmq1;
-        if (!rsa->meth->bn_mod_exp(&m1,&r1,dmq1,rsa->q,ctx,
+        if (!rsa->meth->bn_mod_exp(m1,r1,dmq1,rsa->q,ctx,
                 rsa->_method_mod_q)) goto err;
 
-        if (!BN_mod(&r1,I,rsa->p,ctx)) goto err;
-        if (!(rsa->flags & RSA_FLAG_NO_EXP_CONSTTIME))
+        /* compute I mod p */
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                {
+                c = &local_c;
+                BN_with_flags(c, I, BN_FLG_CONSTTIME);
+                if (!BN_mod(r1,c,rsa->p,ctx)) goto err;
+                }
+        else
+                {
+                if (!BN_mod(r1,I,rsa->p,ctx)) goto err;
+                }
+
+        /* compute r1^dmp1 mod p */
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
                 {
                 dmp1 = &local_dmp1;
-                BN_with_flags(dmp1, rsa->dmp1, BN_FLG_EXP_CONSTTIME);
+                BN_with_flags(dmp1, rsa->dmp1, BN_FLG_CONSTTIME);
                 }
         else
                 dmp1 = rsa->dmp1;
-        if (!rsa->meth->bn_mod_exp(r0,&r1,dmp1,rsa->p,ctx,
+        if (!rsa->meth->bn_mod_exp(r0,r1,dmp1,rsa->p,ctx,
                 rsa->_method_mod_p)) goto err;
 
-        if (!BN_sub(r0,r0,&m1)) goto err;
+        if (!BN_sub(r0,r0,m1)) goto err;
         /* This will help stop the size of r0 increasing, which does
          * affect the multiply if it optimised for a power of 2 size */
-        if (r0->neg)
+        if (BN_is_negative(r0))
                 if (!BN_add(r0,r0,rsa->p)) goto err;
 
-        if (!BN_mul(&r1,r0,rsa->iqmp,ctx)) goto err;
-        if (!BN_mod(r0,&r1,rsa->p,ctx)) goto err;
+        if (!BN_mul(r1,r0,rsa->iqmp,ctx)) goto err;
+
+        /* Turn BN_FLG_CONSTTIME flag on before division operation */
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                {
+                pr1 = &local_r1;
+                BN_with_flags(pr1, r1, BN_FLG_CONSTTIME);
+                }
+        else
+                pr1 = r1;
+        if (!BN_mod(r0,pr1,rsa->p,ctx)) goto err;
+
         /* If p < q it is occasionally possible for the correction of
          * adding 'p' if r0 is negative above to leave the result still
          * negative. This can break the private key operations: the following
@@ -754,23 +849,23 @@ static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
          * This will *never* happen with OpenSSL generated keys because
          * they ensure p > q [steve]
          */
-        if (r0->neg)
+        if (BN_is_negative(r0))
                 if (!BN_add(r0,r0,rsa->p)) goto err;
-        if (!BN_mul(&r1,r0,rsa->q,ctx)) goto err;
-        if (!BN_add(r0,&r1,&m1)) goto err;
+        if (!BN_mul(r1,r0,rsa->q,ctx)) goto err;
+        if (!BN_add(r0,r1,m1)) goto err;
 
         if (rsa->e && rsa->n)
                 {
-                if (!rsa->meth->bn_mod_exp(&vrfy,r0,rsa->e,rsa->n,ctx,NULL)) goto err;
+                if (!rsa->meth->bn_mod_exp(vrfy,r0,rsa->e,rsa->n,ctx,rsa->_method_mod_n)) goto err;
                 /* If 'I' was greater than (or equal to) rsa->n, the operation
                  * will be equivalent to using 'I mod n'. However, the result of
                  * the verify will *always* be less than 'n' so we don't check
                  * for absolute equality, just congruency. */
-                if (!BN_sub(&vrfy, &vrfy, I)) goto err;
-                if (!BN_mod(&vrfy, &vrfy, rsa->n, ctx)) goto err;
-                if (vrfy.neg)
-                        if (!BN_add(&vrfy, &vrfy, rsa->n)) goto err;
-                if (!BN_is_zero(&vrfy))
+                if (!BN_sub(vrfy, vrfy, I)) goto err;
+                if (!BN_mod(vrfy, vrfy, rsa->n, ctx)) goto err;
+                if (BN_is_negative(vrfy))
+                        if (!BN_add(vrfy, vrfy, rsa->n)) goto err;
+                if (!BN_is_zero(vrfy))
                         {
                         /* 'I' and 'vrfy' aren't congruent mod n. Don't leak
                          * miscalculated CRT output, just do a raw (slower)
@@ -779,22 +874,20 @@ static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
                         BIGNUM local_d;
                         BIGNUM *d = NULL;
                 
-                        if (!(rsa->flags & RSA_FLAG_NO_EXP_CONSTTIME))
+                        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
                                 {
                                 d = &local_d;
-                                BN_with_flags(d, rsa->d, BN_FLG_EXP_CONSTTIME);
+                                BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
                                 }
                         else
                                 d = rsa->d;
-                        if (!rsa->meth->bn_mod_exp(r0,I,d,rsa->n,ctx,NULL)) goto err;
+                        if (!rsa->meth->bn_mod_exp(r0,I,d,rsa->n,ctx,
+                                                   rsa->_method_mod_n)) goto err;
                         }
                 }
         ret=1;
 err:
-        BN_clear_free(&m1);
-        BN_clear_free(&r1);
-        BN_clear_free(&vrfy);
-        BN_CTX_free(ctx);
+        BN_CTX_end(ctx);
         return(ret);
         }
 
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_err.c b/src/lib/libssl/src/crypto/rsa/rsa_err.c
index ddcb28e663..fe3ba1b44b 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_err.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_err.c
@@ -71,14 +71,21 @@
 static ERR_STRING_DATA RSA_str_functs[]=
         {
 {ERR_FUNC(RSA_F_MEMORY_LOCK),   "MEMORY_LOCK"},
+{ERR_FUNC(RSA_F_RSA_BUILTIN_KEYGEN),    "RSA_BUILTIN_KEYGEN"},
 {ERR_FUNC(RSA_F_RSA_CHECK_KEY), "RSA_check_key"},
 {ERR_FUNC(RSA_F_RSA_EAY_PRIVATE_DECRYPT),       "RSA_EAY_PRIVATE_DECRYPT"},
 {ERR_FUNC(RSA_F_RSA_EAY_PRIVATE_ENCRYPT),       "RSA_EAY_PRIVATE_ENCRYPT"},
 {ERR_FUNC(RSA_F_RSA_EAY_PUBLIC_DECRYPT),        "RSA_EAY_PUBLIC_DECRYPT"},
 {ERR_FUNC(RSA_F_RSA_EAY_PUBLIC_ENCRYPT),        "RSA_EAY_PUBLIC_ENCRYPT"},
 {ERR_FUNC(RSA_F_RSA_GENERATE_KEY),      "RSA_generate_key"},
+{ERR_FUNC(RSA_F_RSA_MEMORY_LOCK),       "RSA_memory_lock"},
 {ERR_FUNC(RSA_F_RSA_NEW_METHOD),        "RSA_new_method"},
 {ERR_FUNC(RSA_F_RSA_NULL),      "RSA_NULL"},
+{ERR_FUNC(RSA_F_RSA_NULL_MOD_EXP),      "RSA_NULL_MOD_EXP"},
+{ERR_FUNC(RSA_F_RSA_NULL_PRIVATE_DECRYPT),      "RSA_NULL_PRIVATE_DECRYPT"},
+{ERR_FUNC(RSA_F_RSA_NULL_PRIVATE_ENCRYPT),      "RSA_NULL_PRIVATE_ENCRYPT"},
+{ERR_FUNC(RSA_F_RSA_NULL_PUBLIC_DECRYPT),       "RSA_NULL_PUBLIC_DECRYPT"},
+{ERR_FUNC(RSA_F_RSA_NULL_PUBLIC_ENCRYPT),       "RSA_NULL_PUBLIC_ENCRYPT"},
 {ERR_FUNC(RSA_F_RSA_PADDING_ADD_NONE),  "RSA_padding_add_none"},
 {ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP),    "RSA_padding_add_PKCS1_OAEP"},
 {ERR_FUNC(RSA_F_RSA_PADDING_ADD_PKCS1_PSS),     "RSA_padding_add_PKCS1_PSS"},
@@ -94,6 +101,7 @@ static ERR_STRING_DATA RSA_str_functs[]=
 {ERR_FUNC(RSA_F_RSA_PADDING_CHECK_X931),        "RSA_padding_check_X931"},
 {ERR_FUNC(RSA_F_RSA_PRINT),     "RSA_print"},
 {ERR_FUNC(RSA_F_RSA_PRINT_FP),  "RSA_print_fp"},
+{ERR_FUNC(RSA_F_RSA_SETUP_BLINDING),    "RSA_setup_blinding"},
 {ERR_FUNC(RSA_F_RSA_SIGN),      "RSA_sign"},
 {ERR_FUNC(RSA_F_RSA_SIGN_ASN1_OCTET_STRING),    "RSA_sign_ASN1_OCTET_STRING"},
 {ERR_FUNC(RSA_F_RSA_VERIFY),    "RSA_verify"},
@@ -130,20 +138,21 @@ static ERR_STRING_DATA RSA_str_reasons[]=
 {ERR_REASON(RSA_R_KEY_SIZE_TOO_SMALL)    ,"key size too small"},
 {ERR_REASON(RSA_R_LAST_OCTET_INVALID)    ,"last octet invalid"},
 {ERR_REASON(RSA_R_MODULUS_TOO_LARGE)     ,"modulus too large"},
+{ERR_REASON(RSA_R_NO_PUBLIC_EXPONENT)    ,"no public exponent"},
 {ERR_REASON(RSA_R_NULL_BEFORE_BLOCK_MISSING),"null before block missing"},
 {ERR_REASON(RSA_R_N_DOES_NOT_EQUAL_P_Q)  ,"n does not equal p q"},
 {ERR_REASON(RSA_R_OAEP_DECODING_ERROR)   ,"oaep decoding error"},
-{ERR_REASON(RSA_R_SLEN_RECOVERY_FAILED)  ,"salt length recovery failed"},
 {ERR_REASON(RSA_R_PADDING_CHECK_FAILED)  ,"padding check failed"},
 {ERR_REASON(RSA_R_P_NOT_PRIME)           ,"p not prime"},
 {ERR_REASON(RSA_R_Q_NOT_PRIME)           ,"q not prime"},
 {ERR_REASON(RSA_R_RSA_OPERATIONS_NOT_SUPPORTED),"rsa operations not supported"},
+{ERR_REASON(RSA_R_SLEN_CHECK_FAILED)     ,"salt length check failed"},
+{ERR_REASON(RSA_R_SLEN_RECOVERY_FAILED)  ,"salt length recovery failed"},
 {ERR_REASON(RSA_R_SSLV3_ROLLBACK_ATTACK) ,"sslv3 rollback attack"},
 {ERR_REASON(RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD),"the asn1 object identifier is not known for this md"},
 {ERR_REASON(RSA_R_UNKNOWN_ALGORITHM_TYPE),"unknown algorithm type"},
 {ERR_REASON(RSA_R_UNKNOWN_PADDING_TYPE)  ,"unknown padding type"},
 {ERR_REASON(RSA_R_WRONG_SIGNATURE_LENGTH),"wrong signature length"},
-{ERR_REASON(RSA_R_SLEN_CHECK_FAILED)     ,"salt length check failed"},
 {0,NULL}
         };
 
@@ -151,15 +160,12 @@ static ERR_STRING_DATA RSA_str_reasons[]=
 
 void ERR_load_RSA_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(RSA_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,RSA_str_functs);
                 ERR_load_strings(0,RSA_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_gen.c b/src/lib/libssl/src/crypto/rsa/rsa_gen.c
index dd1422cc98..767f7ab682 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_gen.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_gen.c
@@ -56,26 +56,42 @@
  * [including the GNU Public Licence.]
  */
 
+
+/* NB: these functions have been "upgraded", the deprecated versions (which are
+ * compatibility wrappers using these functions) are in rsa_depr.c.
+ * - Geoff
+ */
+
 #include <stdio.h>
 #include <time.h>
 #include "cryptlib.h"
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
 
-#ifndef OPENSSL_FIPS
+static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb);
 
-RSA *RSA_generate_key(int bits, unsigned long e_value,
-             void (*callback)(int,int,void *), void *cb_arg)
+/* NB: this wrapper would normally be placed in rsa_lib.c and the static
+ * implementation would probably be in rsa_eay.c. Nonetheless, is kept here so
+ * that we don't introduce a new linker dependency. Eg. any application that
+ * wasn't previously linking object code related to key-generation won't have to
+ * now just because key-generation is part of RSA_METHOD. */
+int RSA_generate_key_ex(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
+        {
+        if(rsa->meth->rsa_keygen)
+                return rsa->meth->rsa_keygen(rsa, bits, e_value, cb);
+        return rsa_builtin_keygen(rsa, bits, e_value, cb);
+        }
+
+static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb)
         {
-        RSA *rsa=NULL;
         BIGNUM *r0=NULL,*r1=NULL,*r2=NULL,*r3=NULL,*tmp;
-        int bitsp,bitsq,ok= -1,n=0,i;
-        BN_CTX *ctx=NULL,*ctx2=NULL;
+        BIGNUM local_r0,local_d,local_p;
+        BIGNUM *pr0,*d,*p;
+        int bitsp,bitsq,ok= -1,n=0;
+        BN_CTX *ctx=NULL;
 
         ctx=BN_CTX_new();
         if (ctx == NULL) goto err;
-        ctx2=BN_CTX_new();
-        if (ctx2 == NULL) goto err;
         BN_CTX_start(ctx);
         r0 = BN_CTX_get(ctx);
         r1 = BN_CTX_get(ctx);
@@ -85,49 +101,58 @@ RSA *RSA_generate_key(int bits, unsigned long e_value,
 
         bitsp=(bits+1)/2;
         bitsq=bits-bitsp;
-        rsa=RSA_new();
-        if (rsa == NULL) goto err;
 
-        /* set e */ 
-        rsa->e=BN_new();
-        if (rsa->e == NULL) goto err;
+        /* We need the RSA components non-NULL */
+        if(!rsa->n && ((rsa->n=BN_new()) == NULL)) goto err;
+        if(!rsa->d && ((rsa->d=BN_new()) == NULL)) goto err;
+        if(!rsa->e && ((rsa->e=BN_new()) == NULL)) goto err;
+        if(!rsa->p && ((rsa->p=BN_new()) == NULL)) goto err;
+        if(!rsa->q && ((rsa->q=BN_new()) == NULL)) goto err;
+        if(!rsa->dmp1 && ((rsa->dmp1=BN_new()) == NULL)) goto err;
+        if(!rsa->dmq1 && ((rsa->dmq1=BN_new()) == NULL)) goto err;
+        if(!rsa->iqmp && ((rsa->iqmp=BN_new()) == NULL)) goto err;
 
-#if 1
-        /* The problem is when building with 8, 16, or 32 BN_ULONG,
-         * unsigned long can be larger */
-        for (i=0; i<sizeof(unsigned long)*8; i++)
-                {
-                if (e_value & (1UL<<i))
-                        BN_set_bit(rsa->e,i);
-                }
-#else
-        if (!BN_set_word(rsa->e,e_value)) goto err;
-#endif
+        BN_copy(rsa->e, e_value);
 
         /* generate p and q */
         for (;;)
                 {
-                rsa->p=BN_generate_prime(NULL,bitsp,0,NULL,NULL,callback,cb_arg);
-                if (rsa->p == NULL) goto err;
+                if(!BN_generate_prime_ex(rsa->p, bitsp, 0, NULL, NULL, cb))
+                        goto err;
                 if (!BN_sub(r2,rsa->p,BN_value_one())) goto err;
                 if (!BN_gcd(r1,r2,rsa->e,ctx)) goto err;
                 if (BN_is_one(r1)) break;
-                if (callback != NULL) callback(2,n++,cb_arg);
-                BN_free(rsa->p);
+                if(!BN_GENCB_call(cb, 2, n++))
+                        goto err;
                 }
-        if (callback != NULL) callback(3,0,cb_arg);
+        if(!BN_GENCB_call(cb, 3, 0))
+                goto err;
         for (;;)
                 {
-                rsa->q=BN_generate_prime(NULL,bitsq,0,NULL,NULL,callback,cb_arg);
-                if (rsa->q == NULL) goto err;
+                /* When generating ridiculously small keys, we can get stuck
+                 * continually regenerating the same prime values. Check for
+                 * this and bail if it happens 3 times. */
+                unsigned int degenerate = 0;
+                do
+                        {
+                        if(!BN_generate_prime_ex(rsa->q, bitsq, 0, NULL, NULL, cb))
+                                goto err;
+                        } while((BN_cmp(rsa->p, rsa->q) == 0) && (++degenerate < 3));
+                if(degenerate == 3)
+                        {
+                        ok = 0; /* we set our own err */
+                        RSAerr(RSA_F_RSA_BUILTIN_KEYGEN,RSA_R_KEY_SIZE_TOO_SMALL);
+                        goto err;
+                        }
                 if (!BN_sub(r2,rsa->q,BN_value_one())) goto err;
                 if (!BN_gcd(r1,r2,rsa->e,ctx)) goto err;
-                if (BN_is_one(r1) && (BN_cmp(rsa->p,rsa->q) != 0))
+                if (BN_is_one(r1))
                         break;
-                if (callback != NULL) callback(2,n++,cb_arg);
-                BN_free(rsa->q);
+                if(!BN_GENCB_call(cb, 2, n++))
+                        goto err;
                 }
-        if (callback != NULL) callback(3,1,cb_arg);
+        if(!BN_GENCB_call(cb, 3, 1))
+                goto err;
         if (BN_cmp(rsa->p,rsa->q) < 0)
                 {
                 tmp=rsa->p;
@@ -136,66 +161,59 @@ RSA *RSA_generate_key(int bits, unsigned long e_value,
                 }
 
         /* calculate n */
-        rsa->n=BN_new();
-        if (rsa->n == NULL) goto err;
         if (!BN_mul(rsa->n,rsa->p,rsa->q,ctx)) goto err;
 
         /* calculate d */
         if (!BN_sub(r1,rsa->p,BN_value_one())) goto err;        /* p-1 */
         if (!BN_sub(r2,rsa->q,BN_value_one())) goto err;        /* q-1 */
         if (!BN_mul(r0,r1,r2,ctx)) goto err;    /* (p-1)(q-1) */
-
-/* should not be needed, since gcd(p-1,e) == 1 and gcd(q-1,e) == 1 */
-/*      for (;;)
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
                 {
-                if (!BN_gcd(r3,r0,rsa->e,ctx)) goto err;
-                if (BN_is_one(r3)) break;
+                  pr0 = &local_r0;
+                  BN_with_flags(pr0, r0, BN_FLG_CONSTTIME);
+                }
+        else
+          pr0 = r0;
+        if (!BN_mod_inverse(rsa->d,rsa->e,pr0,ctx)) goto err;   /* d */
 
-                if (1)
-                        {
-                        if (!BN_add_word(rsa->e,2L)) goto err;
-                        continue;
-                        }
-                RSAerr(RSA_F_RSA_GENERATE_KEY,RSA_R_BAD_E_VALUE);
-                goto err;
+        /* set up d for correct BN_FLG_CONSTTIME flag */
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                {
+                d = &local_d;
+                BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);
                 }
-*/
-        rsa->d=BN_mod_inverse(NULL,rsa->e,r0,ctx2);     /* d */
-        if (rsa->d == NULL) goto err;
+        else
+                d = rsa->d;
 
         /* calculate d mod (p-1) */
-        rsa->dmp1=BN_new();
-        if (rsa->dmp1 == NULL) goto err;
-        if (!BN_mod(rsa->dmp1,rsa->d,r1,ctx)) goto err;
+        if (!BN_mod(rsa->dmp1,d,r1,ctx)) goto err;
 
         /* calculate d mod (q-1) */
-        rsa->dmq1=BN_new();
-        if (rsa->dmq1 == NULL) goto err;
-        if (!BN_mod(rsa->dmq1,rsa->d,r2,ctx)) goto err;
+        if (!BN_mod(rsa->dmq1,d,r2,ctx)) goto err;
 
         /* calculate inverse of q mod p */
-        rsa->iqmp=BN_mod_inverse(NULL,rsa->q,rsa->p,ctx2);
-        if (rsa->iqmp == NULL) goto err;
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
+                {
+                p = &local_p;
+                BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);
+                }
+        else
+                p = rsa->p;
+        if (!BN_mod_inverse(rsa->iqmp,rsa->q,p,ctx)) goto err;
 
         ok=1;
 err:
         if (ok == -1)
                 {
-                RSAerr(RSA_F_RSA_GENERATE_KEY,ERR_LIB_BN);
+                RSAerr(RSA_F_RSA_BUILTIN_KEYGEN,ERR_LIB_BN);
                 ok=0;
                 }
         if (ctx != NULL)
-                BN_CTX_end(ctx);
-        BN_CTX_free(ctx);
-        BN_CTX_free(ctx2);
-        
-        if (!ok)
                 {
-                if (rsa != NULL) RSA_free(rsa);
-                return(NULL);
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
                 }
-        else
-                return(rsa);
+
+        return ok;
         }
 
-#endif
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_lib.c b/src/lib/libssl/src/crypto/rsa/rsa_lib.c
index e4d622851e..104aa4c1f2 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_lib.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_lib.c
@@ -67,7 +67,7 @@
 #include <openssl/engine.h>
 #endif
 
-const char *RSA_version="RSA" OPENSSL_VERSION_PTEXT;
+const char RSA_version[]="RSA" OPENSSL_VERSION_PTEXT;
 
 static const RSA_METHOD *default_RSA_meth=NULL;
 
@@ -179,6 +179,7 @@ RSA *RSA_new_method(ENGINE *engine)
         ret->_method_mod_p=NULL;
         ret->_method_mod_q=NULL;
         ret->blinding=NULL;
+        ret->mt_blinding=NULL;
         ret->bignum_data=NULL;
         ret->flags=ret->meth->flags;
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_RSA, ret, &ret->ex_data);
@@ -232,6 +233,7 @@ void RSA_free(RSA *r)
         if (r->dmq1 != NULL) BN_clear_free(r->dmq1);
         if (r->iqmp != NULL) BN_clear_free(r->iqmp);
         if (r->blinding != NULL) BN_BLINDING_free(r->blinding);
+        if (r->mt_blinding != NULL) BN_BLINDING_free(r->mt_blinding);
         if (r->bignum_data != NULL) OPENSSL_free_locked(r->bignum_data);
         OPENSSL_free(r);
         }
@@ -314,59 +316,117 @@ void RSA_blinding_off(RSA *rsa)
         rsa->flags |= RSA_FLAG_NO_BLINDING;
         }
 
-int RSA_blinding_on(RSA *rsa, BN_CTX *p_ctx)
+int RSA_blinding_on(RSA *rsa, BN_CTX *ctx)
         {
-        BIGNUM *A,*Ai = NULL;
-        BN_CTX *ctx;
         int ret=0;
 
-        if (p_ctx == NULL)
+        if (rsa->blinding != NULL)
+                RSA_blinding_off(rsa);
+
+        rsa->blinding = RSA_setup_blinding(rsa, ctx);
+        if (rsa->blinding == NULL)
+                goto err;
+
+        rsa->flags |= RSA_FLAG_BLINDING;
+        rsa->flags &= ~RSA_FLAG_NO_BLINDING;
+        ret=1;
+err:
+        return(ret);
+        }
+
+static BIGNUM *rsa_get_public_exp(const BIGNUM *d, const BIGNUM *p,
+        const BIGNUM *q, BN_CTX *ctx)
+{
+        BIGNUM *ret = NULL, *r0, *r1, *r2;
+
+        if (d == NULL || p == NULL || q == NULL)
+                return NULL;
+
+        BN_CTX_start(ctx);
+        r0 = BN_CTX_get(ctx);
+        r1 = BN_CTX_get(ctx);
+        r2 = BN_CTX_get(ctx);
+        if (r2 == NULL)
+                goto err;
+
+        if (!BN_sub(r1, p, BN_value_one())) goto err;
+        if (!BN_sub(r2, q, BN_value_one())) goto err;
+        if (!BN_mul(r0, r1, r2, ctx)) goto err;
+
+        ret = BN_mod_inverse(NULL, d, r0, ctx);
+err:
+        BN_CTX_end(ctx);
+        return ret;
+}
+
+BN_BLINDING *RSA_setup_blinding(RSA *rsa, BN_CTX *in_ctx)
+{
+        BIGNUM local_n;
+        BIGNUM *e,*n;
+        BN_CTX *ctx;
+        BN_BLINDING *ret = NULL;
+
+        if (in_ctx == NULL)
                 {
-                if ((ctx=BN_CTX_new()) == NULL) goto err;
+                if ((ctx = BN_CTX_new()) == NULL) return 0;
                 }
         else
-                ctx=p_ctx;
+                ctx = in_ctx;
 
-        /* XXXXX: Shouldn't this be RSA_blinding_off(rsa)? */
-        if (rsa->blinding != NULL)
+        BN_CTX_start(ctx);
+        e  = BN_CTX_get(ctx);
+        if (e == NULL)
                 {
-                BN_BLINDING_free(rsa->blinding);
-                rsa->blinding = NULL;
+                RSAerr(RSA_F_RSA_SETUP_BLINDING, ERR_R_MALLOC_FAILURE);
+                goto err;
                 }
 
-        /* NB: similar code appears in setup_blinding (rsa_eay.c);
-         * this should be placed in a new function of its own, but for reasons
-         * of binary compatibility can't */
+        if (rsa->e == NULL)
+                {
+                e = rsa_get_public_exp(rsa->d, rsa->p, rsa->q, ctx);
+                if (e == NULL)
+                        {
+                        RSAerr(RSA_F_RSA_SETUP_BLINDING, RSA_R_NO_PUBLIC_EXPONENT);
+                        goto err;
+                        }
+                }
+        else
+                e = rsa->e;
 
-        BN_CTX_start(ctx);
-        A = BN_CTX_get(ctx);
+        
         if ((RAND_status() == 0) && rsa->d != NULL && rsa->d->d != NULL)
                 {
-                /* if PRNG is not properly seeded, resort to secret exponent as unpredictable seed */
-                RAND_add(rsa->d->d, rsa->d->dmax * sizeof rsa->d->d[0], 0);
-                if (!BN_pseudo_rand_range(A,rsa->n)) goto err;
+                /* if PRNG is not properly seeded, resort to secret
+                 * exponent as unpredictable seed */
+                RAND_add(rsa->d->d, rsa->d->dmax * sizeof rsa->d->d[0], 0.0);
                 }
-        else
+
+        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
                 {
-                if (!BN_rand_range(A,rsa->n)) goto err;
+                /* Set BN_FLG_CONSTTIME flag */
+                n = &local_n;
+                BN_with_flags(n, rsa->n, BN_FLG_CONSTTIME);
                 }
-        if ((Ai=BN_mod_inverse(NULL,A,rsa->n,ctx)) == NULL) goto err;
+        else
+                n = rsa->n;
 
-        if (!rsa->meth->bn_mod_exp(A,A,rsa->e,rsa->n,ctx,rsa->_method_mod_n))
+        ret = BN_BLINDING_create_param(NULL, e, n, ctx,
+                        rsa->meth->bn_mod_exp, rsa->_method_mod_n);
+        if (ret == NULL)
+                {
+                RSAerr(RSA_F_RSA_SETUP_BLINDING, ERR_R_BN_LIB);
                 goto err;
-        if ((rsa->blinding=BN_BLINDING_new(A,Ai,rsa->n)) == NULL) goto err;
-        /* to make things thread-safe without excessive locking,
-         * rsa->blinding will be used just by the current thread: */
-        rsa->blinding->thread_id = CRYPTO_thread_id();
-        rsa->flags |= RSA_FLAG_BLINDING;
-        rsa->flags &= ~RSA_FLAG_NO_BLINDING;
-        ret=1;
+                }
+        BN_BLINDING_set_thread_id(ret, CRYPTO_thread_id());
 err:
-        if (Ai != NULL) BN_free(Ai);
         BN_CTX_end(ctx);
-        if (ctx != p_ctx) BN_CTX_free(ctx);
-        return(ret);
-        }
+        if (in_ctx == NULL)
+                BN_CTX_free(ctx);
+        if(rsa->e == NULL)
+                BN_free(e);
+
+        return ret;
+}
 
 int RSA_memory_lock(RSA *r)
         {
@@ -389,7 +449,7 @@ int RSA_memory_lock(RSA *r)
                 j+= (*t[i])->top;
         if ((p=OPENSSL_malloc_locked((off+j)*sizeof(BN_ULONG))) == NULL)
                 {
-                RSAerr(RSA_F_MEMORY_LOCK,ERR_R_MALLOC_FAILURE);
+                RSAerr(RSA_F_RSA_MEMORY_LOCK,ERR_R_MALLOC_FAILURE);
                 return(0);
                 }
         bn=(BIGNUM *)p;
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_null.c b/src/lib/libssl/src/crypto/rsa/rsa_null.c
index 64057fbdcf..491572c82b 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_null.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_null.c
@@ -94,6 +94,9 @@ static RSA_METHOD rsa_null_meth={
         RSA_null_finish,
         0,
         NULL,
+        NULL,
+        NULL,
+        NULL
         };
 
 const RSA_METHOD *RSA_null_method(void)
@@ -104,35 +107,35 @@ const RSA_METHOD *RSA_null_method(void)
 static int RSA_null_public_encrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        RSAerr(RSA_F_RSA_NULL_PUBLIC_ENCRYPT, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
         return -1;
         }
 
 static int RSA_null_private_encrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        RSAerr(RSA_F_RSA_NULL_PRIVATE_ENCRYPT, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
         return -1;
         }
 
 static int RSA_null_private_decrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        RSAerr(RSA_F_RSA_NULL_PRIVATE_DECRYPT, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
         return -1;
         }
 
 static int RSA_null_public_decrypt(int flen, const unsigned char *from,
              unsigned char *to, RSA *rsa, int padding)
         {
-        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        RSAerr(RSA_F_RSA_NULL_PUBLIC_DECRYPT, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
         return -1;
         }
 
 #if 0 /* not currently used */
 static int RSA_null_mod_exp(BIGNUM *r0, BIGNUM *I, RSA *rsa)
         {
-        RSAerr(RSA_F_RSA_NULL, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
+        ...err(RSA_F_RSA_NULL_MOD_EXP, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED);
         return -1;
         }
 #endif
@@ -146,5 +149,3 @@ static int RSA_null_finish(RSA *rsa)
         {
         return(1);
         }
-
-
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_oaep.c b/src/lib/libssl/src/crypto/rsa/rsa_oaep.c
index d43ecaca63..3652677a99 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_oaep.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_oaep.c
@@ -28,6 +28,9 @@
 #include <openssl/rand.h>
 #include <openssl/sha.h>
 
+int MGF1(unsigned char *mask, long len,
+        const unsigned char *seed, long seedlen);
+
 int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
         const unsigned char *from, int flen,
         const unsigned char *param, int plen)
@@ -73,13 +76,11 @@ int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
            20);
 #endif
 
-        PKCS1_MGF1(dbmask, emlen - SHA_DIGEST_LENGTH, seed, SHA_DIGEST_LENGTH,
-                                                                EVP_sha1());
+        MGF1(dbmask, emlen - SHA_DIGEST_LENGTH, seed, SHA_DIGEST_LENGTH);
         for (i = 0; i < emlen - SHA_DIGEST_LENGTH; i++)
                 db[i] ^= dbmask[i];
 
-        PKCS1_MGF1(seedmask, SHA_DIGEST_LENGTH, db, emlen - SHA_DIGEST_LENGTH,
-                                                                EVP_sha1());
+        MGF1(seedmask, SHA_DIGEST_LENGTH, db, emlen - SHA_DIGEST_LENGTH);
         for (i = 0; i < SHA_DIGEST_LENGTH; i++)
                 seed[i] ^= seedmask[i];
 
@@ -95,6 +96,7 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
         const unsigned char *maskeddb;
         int lzero;
         unsigned char *db = NULL, seed[SHA_DIGEST_LENGTH], phash[SHA_DIGEST_LENGTH];
+        unsigned char *padded_from;
         int bad = 0;
 
         if (--num < 2 * SHA_DIGEST_LENGTH + 1)
@@ -105,8 +107,6 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
         lzero = num - flen;
         if (lzero < 0)
                 {
-                /* lzero == -1 */
-
                 /* signalling this error immediately after detection might allow
                  * for side-channel attacks (e.g. timing if 'plen' is huge
                  * -- cf. James H. Manger, "A Chosen Ciphertext Attack on RSA Optimal
@@ -114,22 +114,30 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
                  * so we use a 'bad' flag */
                 bad = 1;
                 lzero = 0;
+                flen = num; /* don't overflow the memcpy to padded_from */
                 }
-        maskeddb = from - lzero + SHA_DIGEST_LENGTH;
 
         dblen = num - SHA_DIGEST_LENGTH;
-        db = OPENSSL_malloc(dblen);
+        db = OPENSSL_malloc(dblen + num);
         if (db == NULL)
                 {
-                RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);
+                RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);
                 return -1;
                 }
 
-        PKCS1_MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen, EVP_sha1());
-        for (i = lzero; i < SHA_DIGEST_LENGTH; i++)
-                seed[i] ^= from[i - lzero];
+        /* Always do this zero-padding copy (even when lzero == 0)
+         * to avoid leaking timing info about the value of lzero. */
+        padded_from = db + dblen;
+        memset(padded_from, 0, lzero);
+        memcpy(padded_from + lzero, from, flen);
+
+        maskeddb = padded_from + SHA_DIGEST_LENGTH;
+
+        MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen);
+        for (i = 0; i < SHA_DIGEST_LENGTH; i++)
+                seed[i] ^= padded_from[i];
   
-        PKCS1_MGF1(db, dblen, seed, SHA_DIGEST_LENGTH, EVP_sha1());
+        MGF1(db, dblen, seed, SHA_DIGEST_LENGTH);
         for (i = 0; i < dblen; i++)
                 db[i] ^= maskeddb[i];
 
@@ -142,13 +150,13 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
                 for (i = SHA_DIGEST_LENGTH; i < dblen; i++)
                         if (db[i] != 0x00)
                                 break;
-                if (db[i] != 0x01 || i++ >= dblen)
+                if (i == dblen || db[i] != 0x01)
                         goto decoding_err;
                 else
                         {
                         /* everything looks OK */
 
-                        mlen = dblen - i;
+                        mlen = dblen - ++i;
                         if (tlen < mlen)
                                 {
                                 RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE);
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_saos.c b/src/lib/libssl/src/crypto/rsa/rsa_saos.c
index 24fc94835e..f98e0a80a6 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_saos.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_saos.c
@@ -107,7 +107,8 @@ int RSA_verify_ASN1_OCTET_STRING(int dtype,
         RSA *rsa)
         {
         int i,ret=0;
-        unsigned char *p,*s;
+        unsigned char *s;
+        const unsigned char *p;
         ASN1_OCTET_STRING *sig=NULL;
 
         if (siglen != (unsigned int)RSA_size(rsa))
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_sign.c b/src/lib/libssl/src/crypto/rsa/rsa_sign.c
index db86f1ac58..71aabeea1b 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_sign.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_sign.c
@@ -146,7 +146,7 @@ int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
              unsigned char *sigbuf, unsigned int siglen, RSA *rsa)
         {
         int i,ret=0,sigtype;
-        unsigned char *p,*s;
+        unsigned char *s;
         X509_SIG *sig=NULL;
 
         if (siglen != (unsigned int)RSA_size(rsa))
@@ -181,7 +181,7 @@ int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
                                 RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
                 else ret = 1;
         } else {
-                p=s;
+                const unsigned char *p=s;
                 sig=d2i_X509_SIG(NULL,&p,(long)i);
 
                 if (sig == NULL) goto err;
diff --git a/src/lib/libssl/src/crypto/rsa/rsa_test.c b/src/lib/libssl/src/crypto/rsa/rsa_test.c
index 218bb2a39b..4080de8bcf 100644
--- a/src/lib/libssl/src/crypto/rsa/rsa_test.c
+++ b/src/lib/libssl/src/crypto/rsa/rsa_test.c
@@ -8,6 +8,7 @@
 #include <openssl/crypto.h>
 #include <openssl/err.h>
 #include <openssl/rand.h>
+#include <openssl/bn.h>
 #ifdef OPENSSL_NO_RSA
 int main(int argc, char *argv[])
 {
@@ -218,6 +219,7 @@ int main(int argc, char *argv[])
     int plen;
     int clen = 0;
     int num;
+    int n;
 
     CRYPTO_malloc_debug_init();
     CRYPTO_dbg_set_options(V_CRYPTO_MDEBUG_ALL);
@@ -241,7 +243,7 @@ int main(int argc, char *argv[])
         clen = key3(key, ctext_ex);
         break;
         }
-        if (v/3 > 1) key->flags |= RSA_FLAG_NO_EXP_CONSTTIME;
+        if (v/3 >= 1) key->flags |= RSA_FLAG_NO_CONSTTIME;
 
         num = RSA_public_encrypt(plen, ptext_ex, ctext, key,
                                  RSA_PKCS1_PADDING);
@@ -277,7 +279,7 @@ int main(int argc, char *argv[])
             err=1;
             goto next;
             }
-  
+
         num = RSA_private_decrypt(num, ctext, ptext, key,
                                   RSA_PKCS1_OAEP_PADDING);
         if (num != plen || memcmp(ptext, ptext_ex, num) != 0)
@@ -286,10 +288,7 @@ int main(int argc, char *argv[])
             err=1;
             }
         else if (memcmp(ctext, ctext_ex, num) == 0)
-            {
             printf("OAEP test vector %d passed!\n", v);
-            goto next;
-            }
     
         /* Different ciphertexts (rsa_oaep.c without -DPKCS_TESTVECT).
            Try decrypting ctext_ex */
@@ -304,6 +303,26 @@ int main(int argc, char *argv[])
             }
         else
             printf("OAEP encryption/decryption ok\n");
+
+        /* Try decrypting corrupted ciphertexts */
+        for(n = 0 ; n < clen ; ++n)
+            {
+            int b;
+            unsigned char saved = ctext[n];
+            for(b = 0 ; b < 256 ; ++b)
+                {
+                if(b == saved)
+                    continue;
+                ctext[n] = b;
+                num = RSA_private_decrypt(num, ctext, ptext, key,
+                                          RSA_PKCS1_OAEP_PADDING);
+                if(num > 0)
+                    {
+                    printf("Corrupt data decrypted!\n");
+                    err = 1;
+                    }
+                }
+            }
     next:
         RSA_free(key);
         }
@@ -313,6 +332,9 @@ int main(int argc, char *argv[])
 
     CRYPTO_mem_leaks_fp(stderr);
 
+#ifdef OPENSSL_SYS_NETWARE
+    if (err) printf("ERROR: %d\n", err);
+#endif
     return err;
     }
 #endif
diff --git a/src/lib/libssl/src/crypto/sha/asm/sha1-586.pl b/src/lib/libssl/src/crypto/sha/asm/sha1-586.pl
index 041acc0348..0b4dab2bd5 100644
--- a/src/lib/libssl/src/crypto/sha/asm/sha1-586.pl
+++ b/src/lib/libssl/src/crypto/sha/asm/sha1-586.pl
@@ -1,4 +1,16 @@
-#!/usr/local/bin/perl
+#!/usr/bin/env perl
+
+# ====================================================================
+# [Re]written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
+# project. The module is, however, dual licensed under OpenSSL and
+# CRYPTOGAMS licenses depending on where you obtain it. For further
+# details see http://www.openssl.org/~appro/cryptogams/.
+# ====================================================================
+
+# "[Re]written" was achieved in two major overhauls. In 2004 BODY_*
+# functions were re-implemented to address P4 performance issue [see
+# commentary below], and in 2006 the rest was rewritten in order to
+# gain freedom to liberate licensing terms.
 
 # It was noted that Intel IA-32 C compiler generates code which
 # performs ~30% *faster* on P4 CPU than original *hand-coded*
@@ -9,7 +21,7 @@
 #
 #               compared with original  compared with Intel cc
 #               assembler impl.         generated code
-# Pentium       -25%                    +37%
+# Pentium       -16%                    +48%
 # PIII/AMD      +8%                     +16%
 # P4            +85%(!)                 +45%
 #
@@ -17,174 +29,115 @@
 # improvement on P4 outweights the loss and incorporate this
 # re-tuned code to 0.9.7 and later.
 # ----------------------------------------------------------------
-# Those who for any particular reason absolutely must score on
-# Pentium can replace this module with one from 0.9.6 distribution.
-# This "offer" shall be revoked the moment programming interface to
-# this module is changed, in which case this paragraph should be
-# removed.
-# ----------------------------------------------------------------
 #                                       <appro@fy.chalmers.se>
 
-$normal=0;
-
-push(@INC,"perlasm","../../perlasm");
+$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
+push(@INC,"${dir}","${dir}../../perlasm");
 require "x86asm.pl";
 
 &asm_init($ARGV[0],"sha1-586.pl",$ARGV[$#ARGV] eq "386");
 
 $A="eax";
-$B="ecx";
-$C="ebx";
+$B="ebx";
+$C="ecx";
 $D="edx";
 $E="edi";
 $T="esi";
 $tmp1="ebp";
 
-$off=9*4;
-
-@K=(0x5a827999,0x6ed9eba1,0x8f1bbcdc,0xca62c1d6);
-
-&sha1_block_data("sha1_block_asm_data_order");
-
-&asm_finish();
-
-sub Nn
-        {
-        local($p)=@_;
-        local(%n)=($A,$T,$B,$A,$C,$B,$D,$C,$E,$D,$T,$E);
-        return($n{$p});
-        }
-
-sub Np
-        {
-        local($p)=@_;
-        local(%n)=($A,$T,$B,$A,$C,$B,$D,$C,$E,$D,$T,$E);
-        local(%n)=($A,$B,$B,$C,$C,$D,$D,$E,$E,$T,$T,$A);
-        return($n{$p});
-        }
-
-sub Na
-        {
-        local($n)=@_;
-        return( (($n   )&0x0f),
-                (($n+ 2)&0x0f),
-                (($n+ 8)&0x0f),
-                (($n+13)&0x0f),
-                (($n+ 1)&0x0f));
-        }
-
-sub X_expand
-        {
-        local($in)=@_;
-
-        &comment("First, load the words onto the stack in network byte order");
-        for ($i=0; $i<16; $i+=2)
-                {
-                &mov($A,&DWP(($i+0)*4,$in,"",0));# unless $i == 0;
-                 &mov($B,&DWP(($i+1)*4,$in,"",0));
-                &bswap($A);
-                 &bswap($B);
-                &mov(&swtmp($i+0),$A);
-                 &mov(&swtmp($i+1),$B);
-                }
-
-        &comment("We now have the X array on the stack");
-        &comment("starting at sp-4");
-        }
-
-# Rules of engagement
-# F is always trashable at the start, the running total.
-# E becomes the next F so it can be trashed after it has been 'accumulated'
-# F becomes A in the next round.  We don't need to access it much.
-# During the X update part, the result ends up in $X[$n0].
+@V=($A,$B,$C,$D,$E,$T);
 
 sub BODY_00_15
         {
-        local($pos,$K,$X,$n,$a,$b,$c,$d,$e,$f)=@_;
+        local($n,$a,$b,$c,$d,$e,$f)=@_;
 
         &comment("00_15 $n");
 
-        &mov($tmp1,$a);
-         &mov($f,$c);                   # f to hold F_00_19(b,c,d)
+        &mov($f,$c);                    # f to hold F_00_19(b,c,d)
+         if ($n==0)  { &mov($tmp1,$a); }
+         else        { &mov($a,$tmp1); }
         &rotl($tmp1,5);                 # tmp1=ROTATE(a,5)
          &xor($f,$d);
-        &and($f,$b);
-         &rotr($b,2);                   # b=ROTATE(b,30)
         &add($tmp1,$e);                 # tmp1+=e;
-         &mov($e,&swtmp($n));           # e becomes volatile and
-                                        # is loaded with xi
-        &xor($f,$d);                    # f holds F_00_19(b,c,d)
-         &lea($tmp1,&DWP($K,$tmp1,$e,1));# tmp1+=K_00_19+xi
-        
-        &add($f,$tmp1);                 # f+=tmp1
+         &and($f,$b);
+        &mov($e,&swtmp($n%16));         # e becomes volatile and is loaded
+                                        # with xi, also note that e becomes
+                                        # f in next round...
+         &xor($f,$d);                   # f holds F_00_19(b,c,d)
+        &rotr($b,2);                    # b=ROTATE(b,30)
+         &lea($tmp1,&DWP(0x5a827999,$tmp1,$e)); # tmp1+=K_00_19+xi
+
+        if ($n==15) { &add($f,$tmp1); } # f+=tmp1
+        else        { &add($tmp1,$f); } # f becomes a in next round
         }
 
 sub BODY_16_19
         {
-        local($pos,$K,$X,$n,$a,$b,$c,$d,$e,$f)=@_;
-        local($n0,$n1,$n2,$n3,$np)=&Na($n);
+        local($n,$a,$b,$c,$d,$e,$f)=@_;
 
         &comment("16_19 $n");
 
-        &mov($f,&swtmp($n1));           # f to hold Xupdate(xi,xa,xb,xc,xd)
+        &mov($f,&swtmp($n%16));         # f to hold Xupdate(xi,xa,xb,xc,xd)
          &mov($tmp1,$c);                # tmp1 to hold F_00_19(b,c,d)
-        &xor($f,&swtmp($n0));
+        &xor($f,&swtmp(($n+2)%16));
          &xor($tmp1,$d);
-        &xor($f,&swtmp($n2));
+        &xor($f,&swtmp(($n+8)%16));
          &and($tmp1,$b);                # tmp1 holds F_00_19(b,c,d)
-        &xor($f,&swtmp($n3));           # f holds xa^xb^xc^xd
-         &rotr($b,2);                   # b=ROTATE(b,30)
-        &xor($tmp1,$d);                 # tmp1=F_00_19(b,c,d)
-         &rotl($f,1);                   # f=ROATE(f,1)
-        &mov(&swtmp($n0),$f);           # xi=f
-        &lea($f,&DWP($K,$f,$e,1));      # f+=K_00_19+e
+        &rotr($b,2);                    # b=ROTATE(b,30)
+         &xor($f,&swtmp(($n+13)%16));   # f holds xa^xb^xc^xd
+        &rotl($f,1);                    # f=ROTATE(f,1)
+         &xor($tmp1,$d);                # tmp1=F_00_19(b,c,d)
+        &mov(&swtmp($n%16),$f);         # xi=f
+        &lea($f,&DWP(0x5a827999,$f,$e));# f+=K_00_19+e
          &mov($e,$a);                   # e becomes volatile
-        &add($f,$tmp1);                 # f+=F_00_19(b,c,d)
-         &rotl($e,5);                   # e=ROTATE(a,5)
+        &rotl($e,5);                    # e=ROTATE(a,5)
+         &add($f,$tmp1);                # f+=F_00_19(b,c,d)
         &add($f,$e);                    # f+=ROTATE(a,5)
         }
 
 sub BODY_20_39
         {
-        local($pos,$K,$X,$n,$a,$b,$c,$d,$e,$f)=@_;
+        local($n,$a,$b,$c,$d,$e,$f)=@_;
+        local $K=($n<40)?0x6ed9eba1:0xca62c1d6;
 
         &comment("20_39 $n");
-        local($n0,$n1,$n2,$n3,$np)=&Na($n);
 
-        &mov($f,&swtmp($n0));           # f to hold Xupdate(xi,xa,xb,xc,xd)
-         &mov($tmp1,$b);                # tmp1 to hold F_20_39(b,c,d)
-        &xor($f,&swtmp($n1));
-         &rotr($b,2);                   # b=ROTATE(b,30)
-        &xor($f,&swtmp($n2));
-         &xor($tmp1,$c);
-        &xor($f,&swtmp($n3));           # f holds xa^xb^xc^xd
-         &xor($tmp1,$d);                # tmp1 holds F_20_39(b,c,d)
+        &mov($tmp1,$b);                 # tmp1 to hold F_20_39(b,c,d)
+         &mov($f,&swtmp($n%16));        # f to hold Xupdate(xi,xa,xb,xc,xd)
+        &rotr($b,2);                    # b=ROTATE(b,30)
+         &xor($f,&swtmp(($n+2)%16));
+        &xor($tmp1,$c);
+         &xor($f,&swtmp(($n+8)%16));
+        &xor($tmp1,$d);                 # tmp1 holds F_20_39(b,c,d)
+         &xor($f,&swtmp(($n+13)%16));   # f holds xa^xb^xc^xd
         &rotl($f,1);                    # f=ROTATE(f,1)
-        &mov(&swtmp($n0),$f);           # xi=f
-        &lea($f,&DWP($K,$f,$e,1));      # f+=K_20_39+e
+         &add($tmp1,$e);
+        &mov(&swtmp($n%16),$f);         # xi=f
          &mov($e,$a);                   # e becomes volatile
         &rotl($e,5);                    # e=ROTATE(a,5)
-         &add($f,$tmp1);                # f+=F_20_39(b,c,d)
+         &lea($f,&DWP($K,$f,$tmp1));    # f+=K_20_39+e
         &add($f,$e);                    # f+=ROTATE(a,5)
         }
 
 sub BODY_40_59
         {
-        local($pos,$K,$X,$n,$a,$b,$c,$d,$e,$f)=@_;
+        local($n,$a,$b,$c,$d,$e,$f)=@_;
 
         &comment("40_59 $n");
-        local($n0,$n1,$n2,$n3,$np)=&Na($n);
 
-        &mov($f,&swtmp($n0));           # f to hold Xupdate(xi,xa,xb,xc,xd)
+        &mov($f,&swtmp($n%16));         # f to hold Xupdate(xi,xa,xb,xc,xd)
+         &mov($tmp1,&swtmp(($n+2)%16));
+        &xor($f,$tmp1);
+         &mov($tmp1,&swtmp(($n+8)%16));
+        &xor($f,$tmp1);
+         &mov($tmp1,&swtmp(($n+13)%16));
+        &xor($f,$tmp1);                 # f holds xa^xb^xc^xd
          &mov($tmp1,$b);                # tmp1 to hold F_40_59(b,c,d)
-        &xor($f,&swtmp($n1));
+        &rotl($f,1);                    # f=ROTATE(f,1)
          &or($tmp1,$c);
-        &xor($f,&swtmp($n2));
+        &mov(&swtmp($n%16),$f);         # xi=f
          &and($tmp1,$d);
-        &xor($f,&swtmp($n3));           # f holds xa^xb^xc^xd
-        &rotl($f,1);                    # f=ROTATE(f,1)
-        &mov(&swtmp($n0),$f);           # xi=f
-        &lea($f,&DWP($K,$f,$e,1));      # f+=K_40_59+e
+        &lea($f,&DWP(0x8f1bbcdc,$f,$e));# f+=K_40_59+e
          &mov($e,$b);                   # e becomes volatile and is used
                                         # to calculate F_40_59(b,c,d)
         &rotr($b,2);                    # b=ROTATE(b,30)
@@ -192,234 +145,75 @@ sub BODY_40_59
         &or($tmp1,$e);                  # tmp1 holds F_40_59(b,c,d)             
          &mov($e,$a);
         &rotl($e,5);                    # e=ROTATE(a,5)
-        &add($tmp1,$e);                 # tmp1+=ROTATE(a,5)
-        &add($f,$tmp1);                 # f+=tmp1;
-        }
-
-sub BODY_60_79
-        {
-        &BODY_20_39(@_);
+         &add($f,$tmp1);                # f+=tmp1;
+        &add($f,$e);                    # f+=ROTATE(a,5)
         }
 
-sub sha1_block_host
-        {
-        local($name, $sclabel)=@_;
+&function_begin("sha1_block_data_order",16);
+        &mov($tmp1,&wparam(0)); # SHA_CTX *c
+        &mov($T,&wparam(1));    # const void *input
+        &mov($A,&wparam(2));    # size_t num
+        &stack_push(16);        # allocate X[16]
+        &shl($A,6);
+        &add($A,$T);
+        &mov(&wparam(2),$A);    # pointer beyond the end of input
+        &mov($E,&DWP(16,$tmp1));# pre-load E
 
-        &function_begin_B($name,"");
+        &set_label("loop",16);
 
-        # parameter 1 is the MD5_CTX structure.
-        # A     0
-        # B     4
-        # C     8
-        # D     12
-        # E     16
-
-        &mov("ecx",     &wparam(2));
-         &push("esi");
-        &shl("ecx",6);
-         &mov("esi",    &wparam(1));
-        &push("ebp");
-         &add("ecx","esi");     # offset to leave on
-        &push("ebx");
-         &mov("ebp",    &wparam(0));
-        &push("edi");
-         &mov($D,       &DWP(12,"ebp","",0));
-        &stack_push(18+9);
-         &mov($E,       &DWP(16,"ebp","",0));
-        &mov($C,        &DWP( 8,"ebp","",0));
-         &mov(&swtmp(17),"ecx");
-
-        &comment("First we need to setup the X array");
-
-        for ($i=0; $i<16; $i+=2)
+        # copy input chunk to X, but reversing byte order!
+        for ($i=0; $i<16; $i+=4)
                 {
-                &mov($A,&DWP(($i+0)*4,"esi","",0));# unless $i == 0;
-                 &mov($B,&DWP(($i+1)*4,"esi","",0));
+                &mov($A,&DWP(4*($i+0),$T));
+                &mov($B,&DWP(4*($i+1),$T));
+                &mov($C,&DWP(4*($i+2),$T));
+                &mov($D,&DWP(4*($i+3),$T));
+                &bswap($A);
+                &bswap($B);
+                &bswap($C);
+                &bswap($D);
                 &mov(&swtmp($i+0),$A);
-                 &mov(&swtmp($i+1),$B);
+                &mov(&swtmp($i+1),$B);
+                &mov(&swtmp($i+2),$C);
+                &mov(&swtmp($i+3),$D);
                 }
-        &jmp($sclabel);
-        &function_end_B($name);
-        }
-
-
-sub sha1_block_data
-        {
-        local($name)=@_;
-
-        &function_begin_B($name,"");
-
-        # parameter 1 is the MD5_CTX structure.
-        # A     0
-        # B     4
-        # C     8
-        # D     12
-        # E     16
-
-        &mov("ecx",     &wparam(2));
-         &push("esi");
-        &shl("ecx",6);
-         &mov("esi",    &wparam(1));
-        &push("ebp");
-         &add("ecx","esi");     # offset to leave on
-        &push("ebx");
-         &mov("ebp",    &wparam(0));
-        &push("edi");
-         &mov($D,       &DWP(12,"ebp","",0));
-        &stack_push(18+9);
-         &mov($E,       &DWP(16,"ebp","",0));
-        &mov($C,        &DWP( 8,"ebp","",0));
-         &mov(&swtmp(17),"ecx");
-
-        &comment("First we need to setup the X array");
-
-        &set_label("start") unless $normal;
-
-        &X_expand("esi");
-         &mov(&wparam(1),"esi");
-
-        &set_label("shortcut", 0, 1);
-        &comment("");
-        &comment("Start processing");
-
-        # odd start
-        &mov($A,        &DWP( 0,"ebp","",0));
-         &mov($B,       &DWP( 4,"ebp","",0));
-        $X="esp";
-        &BODY_00_15(-2,$K[0],$X, 0,$A,$B,$C,$D,$E,$T);
-        &BODY_00_15( 0,$K[0],$X, 1,$T,$A,$B,$C,$D,$E);
-        &BODY_00_15( 0,$K[0],$X, 2,$E,$T,$A,$B,$C,$D);
-        &BODY_00_15( 0,$K[0],$X, 3,$D,$E,$T,$A,$B,$C);
-        &BODY_00_15( 0,$K[0],$X, 4,$C,$D,$E,$T,$A,$B);
-        &BODY_00_15( 0,$K[0],$X, 5,$B,$C,$D,$E,$T,$A);
-        &BODY_00_15( 0,$K[0],$X, 6,$A,$B,$C,$D,$E,$T);
-        &BODY_00_15( 0,$K[0],$X, 7,$T,$A,$B,$C,$D,$E);
-        &BODY_00_15( 0,$K[0],$X, 8,$E,$T,$A,$B,$C,$D);
-        &BODY_00_15( 0,$K[0],$X, 9,$D,$E,$T,$A,$B,$C);
-        &BODY_00_15( 0,$K[0],$X,10,$C,$D,$E,$T,$A,$B);
-        &BODY_00_15( 0,$K[0],$X,11,$B,$C,$D,$E,$T,$A);
-        &BODY_00_15( 0,$K[0],$X,12,$A,$B,$C,$D,$E,$T);
-        &BODY_00_15( 0,$K[0],$X,13,$T,$A,$B,$C,$D,$E);
-        &BODY_00_15( 0,$K[0],$X,14,$E,$T,$A,$B,$C,$D);
-        &BODY_00_15( 1,$K[0],$X,15,$D,$E,$T,$A,$B,$C);
-        &BODY_16_19(-1,$K[0],$X,16,$C,$D,$E,$T,$A,$B);
-        &BODY_16_19( 0,$K[0],$X,17,$B,$C,$D,$E,$T,$A);
-        &BODY_16_19( 0,$K[0],$X,18,$A,$B,$C,$D,$E,$T);
-        &BODY_16_19( 1,$K[0],$X,19,$T,$A,$B,$C,$D,$E);
-
-        &BODY_20_39(-1,$K[1],$X,20,$E,$T,$A,$B,$C,$D);
-        &BODY_20_39( 0,$K[1],$X,21,$D,$E,$T,$A,$B,$C);
-        &BODY_20_39( 0,$K[1],$X,22,$C,$D,$E,$T,$A,$B);
-        &BODY_20_39( 0,$K[1],$X,23,$B,$C,$D,$E,$T,$A);
-        &BODY_20_39( 0,$K[1],$X,24,$A,$B,$C,$D,$E,$T);
-        &BODY_20_39( 0,$K[1],$X,25,$T,$A,$B,$C,$D,$E);
-        &BODY_20_39( 0,$K[1],$X,26,$E,$T,$A,$B,$C,$D);
-        &BODY_20_39( 0,$K[1],$X,27,$D,$E,$T,$A,$B,$C);
-        &BODY_20_39( 0,$K[1],$X,28,$C,$D,$E,$T,$A,$B);
-        &BODY_20_39( 0,$K[1],$X,29,$B,$C,$D,$E,$T,$A);
-        &BODY_20_39( 0,$K[1],$X,30,$A,$B,$C,$D,$E,$T);
-        &BODY_20_39( 0,$K[1],$X,31,$T,$A,$B,$C,$D,$E);
-        &BODY_20_39( 0,$K[1],$X,32,$E,$T,$A,$B,$C,$D);
-        &BODY_20_39( 0,$K[1],$X,33,$D,$E,$T,$A,$B,$C);
-        &BODY_20_39( 0,$K[1],$X,34,$C,$D,$E,$T,$A,$B);
-        &BODY_20_39( 0,$K[1],$X,35,$B,$C,$D,$E,$T,$A);
-        &BODY_20_39( 0,$K[1],$X,36,$A,$B,$C,$D,$E,$T);
-        &BODY_20_39( 0,$K[1],$X,37,$T,$A,$B,$C,$D,$E);
-        &BODY_20_39( 0,$K[1],$X,38,$E,$T,$A,$B,$C,$D);
-        &BODY_20_39( 1,$K[1],$X,39,$D,$E,$T,$A,$B,$C);
-
-        &BODY_40_59(-1,$K[2],$X,40,$C,$D,$E,$T,$A,$B);
-        &BODY_40_59( 0,$K[2],$X,41,$B,$C,$D,$E,$T,$A);
-        &BODY_40_59( 0,$K[2],$X,42,$A,$B,$C,$D,$E,$T);
-        &BODY_40_59( 0,$K[2],$X,43,$T,$A,$B,$C,$D,$E);
-        &BODY_40_59( 0,$K[2],$X,44,$E,$T,$A,$B,$C,$D);
-        &BODY_40_59( 0,$K[2],$X,45,$D,$E,$T,$A,$B,$C);
-        &BODY_40_59( 0,$K[2],$X,46,$C,$D,$E,$T,$A,$B);
-        &BODY_40_59( 0,$K[2],$X,47,$B,$C,$D,$E,$T,$A);
-        &BODY_40_59( 0,$K[2],$X,48,$A,$B,$C,$D,$E,$T);
-        &BODY_40_59( 0,$K[2],$X,49,$T,$A,$B,$C,$D,$E);
-        &BODY_40_59( 0,$K[2],$X,50,$E,$T,$A,$B,$C,$D);
-        &BODY_40_59( 0,$K[2],$X,51,$D,$E,$T,$A,$B,$C);
-        &BODY_40_59( 0,$K[2],$X,52,$C,$D,$E,$T,$A,$B);
-        &BODY_40_59( 0,$K[2],$X,53,$B,$C,$D,$E,$T,$A);
-        &BODY_40_59( 0,$K[2],$X,54,$A,$B,$C,$D,$E,$T);
-        &BODY_40_59( 0,$K[2],$X,55,$T,$A,$B,$C,$D,$E);
-        &BODY_40_59( 0,$K[2],$X,56,$E,$T,$A,$B,$C,$D);
-        &BODY_40_59( 0,$K[2],$X,57,$D,$E,$T,$A,$B,$C);
-        &BODY_40_59( 0,$K[2],$X,58,$C,$D,$E,$T,$A,$B);
-        &BODY_40_59( 1,$K[2],$X,59,$B,$C,$D,$E,$T,$A);
-
-        &BODY_60_79(-1,$K[3],$X,60,$A,$B,$C,$D,$E,$T);
-        &BODY_60_79( 0,$K[3],$X,61,$T,$A,$B,$C,$D,$E);
-        &BODY_60_79( 0,$K[3],$X,62,$E,$T,$A,$B,$C,$D);
-        &BODY_60_79( 0,$K[3],$X,63,$D,$E,$T,$A,$B,$C);
-        &BODY_60_79( 0,$K[3],$X,64,$C,$D,$E,$T,$A,$B);
-        &BODY_60_79( 0,$K[3],$X,65,$B,$C,$D,$E,$T,$A);
-        &BODY_60_79( 0,$K[3],$X,66,$A,$B,$C,$D,$E,$T);
-        &BODY_60_79( 0,$K[3],$X,67,$T,$A,$B,$C,$D,$E);
-        &BODY_60_79( 0,$K[3],$X,68,$E,$T,$A,$B,$C,$D);
-        &BODY_60_79( 0,$K[3],$X,69,$D,$E,$T,$A,$B,$C);
-        &BODY_60_79( 0,$K[3],$X,70,$C,$D,$E,$T,$A,$B);
-        &BODY_60_79( 0,$K[3],$X,71,$B,$C,$D,$E,$T,$A);
-        &BODY_60_79( 0,$K[3],$X,72,$A,$B,$C,$D,$E,$T);
-        &BODY_60_79( 0,$K[3],$X,73,$T,$A,$B,$C,$D,$E);
-        &BODY_60_79( 0,$K[3],$X,74,$E,$T,$A,$B,$C,$D);
-        &BODY_60_79( 0,$K[3],$X,75,$D,$E,$T,$A,$B,$C);
-        &BODY_60_79( 0,$K[3],$X,76,$C,$D,$E,$T,$A,$B);
-        &BODY_60_79( 0,$K[3],$X,77,$B,$C,$D,$E,$T,$A);
-        &BODY_60_79( 0,$K[3],$X,78,$A,$B,$C,$D,$E,$T);
-        &BODY_60_79( 2,$K[3],$X,79,$T,$A,$B,$C,$D,$E);
-
-        &comment("End processing");
-        &comment("");
-        # D is the tmp value
-
-        # E -> A
-        # T -> B
-        # A -> C
-        # B -> D
-        # C -> E
-        # D -> T
-
-        &mov($tmp1,&wparam(0));
-
-         &mov($D,       &DWP(12,$tmp1,"",0));
-        &add($D,$B);
-         &mov($B,       &DWP( 4,$tmp1,"",0));
-        &add($B,$T);
-         &mov($T,       $A);
-        &mov($A,        &DWP( 0,$tmp1,"",0));
-         &mov(&DWP(12,$tmp1,"",0),$D);
-
-        &add($A,$E);
-         &mov($E,       &DWP(16,$tmp1,"",0));
-        &add($E,$C);
-         &mov($C,       &DWP( 8,$tmp1,"",0));
-        &add($C,$T);
-
-         &mov(&DWP( 0,$tmp1,"",0),$A);
-        &mov("esi",&wparam(1));
-         &mov(&DWP( 8,$tmp1,"",0),$C);
-        &add("esi",64);
-         &mov("eax",&swtmp(17));
-        &mov(&DWP(16,$tmp1,"",0),$E);
-         &cmp("esi","eax");
-        &mov(&DWP( 4,$tmp1,"",0),$B);
-         &jb(&label("start"));
-
-        &stack_pop(18+9);
-         &pop("edi");
-        &pop("ebx");
-         &pop("ebp");
-        &pop("esi");
-         &ret();
-
-        # keep a note of shortcut label so it can be used outside
-        # block.
-        my $sclabel = &label("shortcut");
-
-        &function_end_B($name);
-        # Putting this here avoids problems with MASM in debugging mode
-        &sha1_block_host("sha1_block_asm_host_order", $sclabel);
-        }
+        &mov(&wparam(1),$T);    # redundant in 1st spin
+
+        &mov($A,&DWP(0,$tmp1)); # load SHA_CTX
+        &mov($B,&DWP(4,$tmp1));
+        &mov($C,&DWP(8,$tmp1));
+        &mov($D,&DWP(12,$tmp1));
+        # E is pre-loaded
+
+        for($i=0;$i<16;$i++)    { &BODY_00_15($i,@V); unshift(@V,pop(@V)); }
+        for(;$i<20;$i++)        { &BODY_16_19($i,@V); unshift(@V,pop(@V)); }
+        for(;$i<40;$i++)        { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
+        for(;$i<60;$i++)        { &BODY_40_59($i,@V); unshift(@V,pop(@V)); }
+        for(;$i<80;$i++)        { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
+
+        (($V[5] eq $D) and ($V[0] eq $E)) or die;       # double-check
+
+        &mov($tmp1,&wparam(0)); # re-load SHA_CTX*
+        &mov($D,&wparam(1));    # D is last "T" and is discarded
+
+        &add($E,&DWP(0,$tmp1)); # E is last "A"...
+        &add($T,&DWP(4,$tmp1));
+        &add($A,&DWP(8,$tmp1));
+        &add($B,&DWP(12,$tmp1));
+        &add($C,&DWP(16,$tmp1));
+
+        &mov(&DWP(0,$tmp1),$E); # update SHA_CTX
+         &add($D,64);           # advance input pointer
+        &mov(&DWP(4,$tmp1),$T);
+         &cmp($D,&wparam(2));   # have we reached the end yet?
+        &mov(&DWP(8,$tmp1),$A);
+         &mov($E,$C);           # C is last "E" which needs to be "pre-loaded"
+        &mov(&DWP(12,$tmp1),$B);
+         &mov($T,$D);           # input pointer
+        &mov(&DWP(16,$tmp1),$C);
+        &jb(&label("loop"));
+
+        &stack_pop(16);
+&function_end("sha1_block_data_order");
 
+&asm_finish();
diff --git a/src/lib/libssl/src/crypto/sha/sha.h b/src/lib/libssl/src/crypto/sha/sha.h
index 79c07b0fd1..eed44d7f94 100644
--- a/src/lib/libssl/src/crypto/sha/sha.h
+++ b/src/lib/libssl/src/crypto/sha/sha.h
@@ -60,6 +60,7 @@
 #define HEADER_SHA_H
 
 #include <openssl/e_os2.h>
+#include <stddef.h>
 
 #ifdef  __cplusplus
 extern "C" {
@@ -70,7 +71,7 @@ extern "C" {
 #endif
 
 #if defined(OPENSSL_FIPS)
-#define FIPS_SHA_SIZE_T unsigned long
+#define FIPS_SHA_SIZE_T size_t
 #endif
 
 /*
@@ -101,26 +102,97 @@ typedef struct SHAstate_st
         SHA_LONG h0,h1,h2,h3,h4;
         SHA_LONG Nl,Nh;
         SHA_LONG data[SHA_LBLOCK];
-        int num;
+        unsigned int num;
         } SHA_CTX;
 
 #ifndef OPENSSL_NO_SHA0
-#ifdef OPENSSL_FIPS
-int private_SHA_Init(SHA_CTX *c);
-#endif
 int SHA_Init(SHA_CTX *c);
-int SHA_Update(SHA_CTX *c, const void *data, unsigned long len);
+int SHA_Update(SHA_CTX *c, const void *data, size_t len);
 int SHA_Final(unsigned char *md, SHA_CTX *c);
-unsigned char *SHA(const unsigned char *d, unsigned long n,unsigned char *md);
+unsigned char *SHA(const unsigned char *d, size_t n, unsigned char *md);
 void SHA_Transform(SHA_CTX *c, const unsigned char *data);
 #endif
 #ifndef OPENSSL_NO_SHA1
 int SHA1_Init(SHA_CTX *c);
-int SHA1_Update(SHA_CTX *c, const void *data, unsigned long len);
+int SHA1_Update(SHA_CTX *c, const void *data, size_t len);
 int SHA1_Final(unsigned char *md, SHA_CTX *c);
-unsigned char *SHA1(const unsigned char *d, unsigned long n,unsigned char *md);
+unsigned char *SHA1(const unsigned char *d, size_t n, unsigned char *md);
 void SHA1_Transform(SHA_CTX *c, const unsigned char *data);
 #endif
+
+#define SHA256_CBLOCK   (SHA_LBLOCK*4)  /* SHA-256 treats input data as a
+                                         * contiguous array of 32 bit
+                                         * wide big-endian values. */
+#define SHA224_DIGEST_LENGTH    28
+#define SHA256_DIGEST_LENGTH    32
+
+typedef struct SHA256state_st
+        {
+        SHA_LONG h[8];
+        SHA_LONG Nl,Nh;
+        SHA_LONG data[SHA_LBLOCK];
+        unsigned int num,md_len;
+        } SHA256_CTX;
+
+#ifndef OPENSSL_NO_SHA256
+int SHA224_Init(SHA256_CTX *c);
+int SHA224_Update(SHA256_CTX *c, const void *data, size_t len);
+int SHA224_Final(unsigned char *md, SHA256_CTX *c);
+unsigned char *SHA224(const unsigned char *d, size_t n,unsigned char *md);
+int SHA256_Init(SHA256_CTX *c);
+int SHA256_Update(SHA256_CTX *c, const void *data, size_t len);
+int SHA256_Final(unsigned char *md, SHA256_CTX *c);
+unsigned char *SHA256(const unsigned char *d, size_t n,unsigned char *md);
+void SHA256_Transform(SHA256_CTX *c, const unsigned char *data);
+#endif
+
+#define SHA384_DIGEST_LENGTH    48
+#define SHA512_DIGEST_LENGTH    64
+
+#ifndef OPENSSL_NO_SHA512
+/*
+ * Unlike 32-bit digest algorithms, SHA-512 *relies* on SHA_LONG64
+ * being exactly 64-bit wide. See Implementation Notes in sha512.c
+ * for further details.
+ */
+#define SHA512_CBLOCK   (SHA_LBLOCK*8)  /* SHA-512 treats input data as a
+                                         * contiguous array of 64 bit
+                                         * wide big-endian values. */
+#if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__)
+#define SHA_LONG64 unsigned __int64
+#define U64(C)     C##UI64
+#elif defined(__arch64__)
+#define SHA_LONG64 unsigned long
+#define U64(C)     C##UL
+#else
+#define SHA_LONG64 unsigned long long
+#define U64(C)     C##ULL
+#endif
+
+typedef struct SHA512state_st
+        {
+        SHA_LONG64 h[8];
+        SHA_LONG64 Nl,Nh;
+        union {
+                SHA_LONG64      d[SHA_LBLOCK];
+                unsigned char   p[SHA512_CBLOCK];
+        } u;
+        unsigned int num,md_len;
+        } SHA512_CTX;
+#endif
+
+#ifndef OPENSSL_NO_SHA512
+int SHA384_Init(SHA512_CTX *c);
+int SHA384_Update(SHA512_CTX *c, const void *data, size_t len);
+int SHA384_Final(unsigned char *md, SHA512_CTX *c);
+unsigned char *SHA384(const unsigned char *d, size_t n,unsigned char *md);
+int SHA512_Init(SHA512_CTX *c);
+int SHA512_Update(SHA512_CTX *c, const void *data, size_t len);
+int SHA512_Final(unsigned char *md, SHA512_CTX *c);
+unsigned char *SHA512(const unsigned char *d, size_t n,unsigned char *md);
+void SHA512_Transform(SHA512_CTX *c, const unsigned char *data);
+#endif
+
 #ifdef  __cplusplus
 }
 #endif
diff --git a/src/lib/libssl/src/crypto/sha/sha1_one.c b/src/lib/libssl/src/crypto/sha/sha1_one.c
index f4694b701b..7c65b60276 100644
--- a/src/lib/libssl/src/crypto/sha/sha1_one.c
+++ b/src/lib/libssl/src/crypto/sha/sha1_one.c
@@ -61,8 +61,8 @@
 #include <openssl/sha.h>
 #include <openssl/crypto.h>
 
-#if !defined(OPENSSL_NO_SHA1) && !defined(OPENSSL_FIPS)
-unsigned char *SHA1(const unsigned char *d, unsigned long n, unsigned char *md)
+#ifndef OPENSSL_NO_SHA1
+unsigned char *SHA1(const unsigned char *d, size_t n, unsigned char *md)
         {
         SHA_CTX c;
         static unsigned char m[SHA_DIGEST_LENGTH];
diff --git a/src/lib/libssl/src/crypto/sha/sha1dgst.c b/src/lib/libssl/src/crypto/sha/sha1dgst.c
index 1e2009b760..50d1925cde 100644
--- a/src/lib/libssl/src/crypto/sha/sha1dgst.c
+++ b/src/lib/libssl/src/crypto/sha/sha1dgst.c
@@ -56,26 +56,19 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/opensslconf.h>
 #if !defined(OPENSSL_NO_SHA1) && !defined(OPENSSL_NO_SHA)
 
 #undef  SHA_0
 #define SHA_1
 
 #include <openssl/opensslv.h>
-#include <openssl/opensslconf.h>
 
-#ifndef OPENSSL_FIPS
-const char *SHA1_version="SHA1" OPENSSL_VERSION_PTEXT;
+const char SHA1_version[]="SHA1" OPENSSL_VERSION_PTEXT;
 
 /* The implementation is in ../md32_common.h */
 
 #include "sha_locl.h"
 
-#else /* ndef OPENSSL_FIPS */
-
-static void *dummy=&dummy;
-
-#endif /* ndef OPENSSL_FIPS */
-
 #endif
 
diff --git a/src/lib/libssl/src/crypto/sha/sha1test.c b/src/lib/libssl/src/crypto/sha/sha1test.c
index 4f2e4ada2d..6feb3964c7 100644
--- a/src/lib/libssl/src/crypto/sha/sha1test.c
+++ b/src/lib/libssl/src/crypto/sha/sha1test.c
@@ -106,7 +106,7 @@ static char *pt(unsigned char *md);
 int main(int argc, char *argv[])
         {
         int i,err=0;
-        unsigned char **P,**R;
+        char **P,**R;
         static unsigned char buf[1000];
         char *p,*r;
         EVP_MD_CTX c;
@@ -118,12 +118,12 @@ int main(int argc, char *argv[])
 #endif
 
         EVP_MD_CTX_init(&c);
-        P=(unsigned char **)test;
-        R=(unsigned char **)ret;
+        P=test;
+        R=ret;
         i=1;
         while (*P != NULL)
                 {
-                EVP_Digest(*P,(unsigned long)strlen((char *)*P),md,NULL,EVP_sha1(), NULL);
+                EVP_Digest(*P,strlen((char *)*P),md,NULL,EVP_sha1(), NULL);
                 p=pt(md);
                 if (strcmp(p,(char *)*R) != 0)
                         {
@@ -157,6 +157,10 @@ int main(int argc, char *argv[])
                 }
         else
                 printf("test 3 ok\n");
+
+#ifdef OPENSSL_SYS_NETWARE
+    if (err) printf("ERROR: %d\n", err);
+#endif
         EXIT(err);
         EVP_MD_CTX_cleanup(&c);
         return(0);
diff --git a/src/lib/libssl/src/crypto/sha/sha_dgst.c b/src/lib/libssl/src/crypto/sha/sha_dgst.c
index 5a4b3ab204..70eb56032c 100644
--- a/src/lib/libssl/src/crypto/sha/sha_dgst.c
+++ b/src/lib/libssl/src/crypto/sha/sha_dgst.c
@@ -56,6 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
+#include <openssl/opensslconf.h>
 #if !defined(OPENSSL_NO_SHA0) && !defined(OPENSSL_NO_SHA)
 
 #undef  SHA_1
@@ -63,7 +64,7 @@
 
 #include <openssl/opensslv.h>
 
-const char *SHA_version="SHA" OPENSSL_VERSION_PTEXT;
+const char SHA_version[]="SHA" OPENSSL_VERSION_PTEXT;
 
 /* The implementation is in ../md32_common.h */
 
diff --git a/src/lib/libssl/src/crypto/sha/sha_locl.h b/src/lib/libssl/src/crypto/sha/sha_locl.h
index a3623f72da..e37e5726e3 100644
--- a/src/lib/libssl/src/crypto/sha/sha_locl.h
+++ b/src/lib/libssl/src/crypto/sha/sha_locl.h
@@ -62,17 +62,11 @@
 #include <openssl/opensslconf.h>
 #include <openssl/sha.h>
 
-#ifndef SHA_LONG_LOG2
-#define SHA_LONG_LOG2   2       /* default to 32 bits */
-#endif
-
 #define DATA_ORDER_IS_BIG_ENDIAN
 
 #define HASH_LONG               SHA_LONG
-#define HASH_LONG_LOG2          SHA_LONG_LOG2
 #define HASH_CTX                SHA_CTX
 #define HASH_CBLOCK             SHA_CBLOCK
-#define HASH_LBLOCK             SHA_LBLOCK
 #define HASH_MAKE_STRING(c,s)   do {    \
         unsigned long ll;               \
         ll=(c)->h0; HOST_l2c(ll,(s));   \
@@ -88,12 +82,10 @@
 # define HASH_TRANSFORM                 SHA_Transform
 # define HASH_FINAL                     SHA_Final
 # define HASH_INIT                      SHA_Init
-# define HASH_BLOCK_HOST_ORDER          sha_block_host_order
 # define HASH_BLOCK_DATA_ORDER          sha_block_data_order
 # define Xupdate(a,ix,ia,ib,ic,id)      (ix=(a)=(ia^ib^ic^id))
 
-  void sha_block_host_order (SHA_CTX *c, const void *p,int num);
-  void sha_block_data_order (SHA_CTX *c, const void *p,int num);
+static void sha_block_data_order (SHA_CTX *c, const void *p,size_t num);
 
 #elif defined(SHA_1)
 
@@ -101,7 +93,6 @@
 # define HASH_TRANSFORM                 SHA1_Transform
 # define HASH_FINAL                     SHA1_Final
 # define HASH_INIT                      SHA1_Init
-# define HASH_BLOCK_HOST_ORDER          sha1_block_host_order
 # define HASH_BLOCK_DATA_ORDER          sha1_block_data_order
 # if defined(__MWERKS__) && defined(__MC68K__)
    /* Metrowerks for Motorola fails otherwise:-( <appro@fy.chalmers.se> */
@@ -114,22 +105,10 @@
                                         )
 # endif
 
-# ifdef SHA1_ASM
-#  if defined(__i386) || defined(__i386__) || defined(_M_IX86) || defined(__INTEL__)
-#   define sha1_block_host_order                sha1_block_asm_host_order
-#   define DONT_IMPLEMENT_BLOCK_HOST_ORDER
-#   define sha1_block_data_order                sha1_block_asm_data_order
-#   define DONT_IMPLEMENT_BLOCK_DATA_ORDER
-#   define HASH_BLOCK_DATA_ORDER_ALIGNED        sha1_block_asm_data_order
-#  elif defined(__ia64) || defined(__ia64__) || defined(_M_IA64)
-#   define sha1_block_host_order                sha1_block_asm_host_order
-#   define DONT_IMPLEMENT_BLOCK_HOST_ORDER
-#   define sha1_block_data_order                sha1_block_asm_data_order
-#   define DONT_IMPLEMENT_BLOCK_DATA_ORDER
-#  endif
-# endif
-  void sha1_block_host_order (SHA_CTX *c, const void *p,int num);
-  void sha1_block_data_order (SHA_CTX *c, const void *p,int num);
+#ifndef SHA1_ASM
+static
+#endif
+void sha1_block_data_order (SHA_CTX *c, const void *p,size_t num);
 
 #else
 # error "Either SHA_0 or SHA_1 must be defined."
@@ -143,11 +122,7 @@
 #define INIT_DATA_h3 0x10325476UL
 #define INIT_DATA_h4 0xc3d2e1f0UL
 
-#if defined(SHA_0) && defined(OPENSSL_FIPS)
-FIPS_NON_FIPS_MD_Init(SHA)
-#else
 int HASH_INIT (SHA_CTX *c)
-#endif
         {
         c->h0=INIT_DATA_h0;
         c->h1=INIT_DATA_h1;
@@ -177,6 +152,8 @@ int HASH_INIT (SHA_CTX *c)
 #define F_40_59(b,c,d)  (((b) & (c)) | (((b)|(c)) & (d))) 
 #define F_60_79(b,c,d)  F_20_39(b,c,d)
 
+#ifndef OPENSSL_SMALL_FOOTPRINT
+
 #define BODY_00_15(i,a,b,c,d,e,f,xi) \
         (f)=xi+(e)+K_00_19+ROTATE((a),5)+F_00_19((b),(c),(d)); \
         (b)=ROTATE((b),30);
@@ -229,11 +206,11 @@ int HASH_INIT (SHA_CTX *c)
 # define X(i)   XX[i]
 #endif
 
-#ifndef DONT_IMPLEMENT_BLOCK_HOST_ORDER
-void HASH_BLOCK_HOST_ORDER (SHA_CTX *c, const void *d, int num)
+#if !defined(SHA_1) || !defined(SHA1_ASM)
+static void HASH_BLOCK_DATA_ORDER (SHA_CTX *c, const void *p, size_t num)
         {
-        const SHA_LONG *W=d;
-        register unsigned MD32_REG_T A,B,C,D,E,T;
+        const unsigned char *data=p;
+        register unsigned MD32_REG_T A,B,C,D,E,T,l;
 #ifndef MD32_XARRAY
         unsigned MD32_REG_T     XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7,
                                 XX8, XX9,XX10,XX11,XX12,XX13,XX14,XX15;
@@ -248,41 +225,71 @@ void HASH_BLOCK_HOST_ORDER (SHA_CTX *c, const void *d, int num)
         E=c->h4;
 
         for (;;)
+                        {
+        const union { long one; char little; } is_endian = {1};
+
+        if (!is_endian.little && sizeof(SHA_LONG)==4 && ((size_t)p%4)==0)
+                {
+                const SHA_LONG *W=(const SHA_LONG *)data;
+
+                X( 0) = W[0];                           X( 1) = W[ 1];
+                BODY_00_15( 0,A,B,C,D,E,T,X( 0));       X( 2) = W[ 2];
+                BODY_00_15( 1,T,A,B,C,D,E,X( 1));       X( 3) = W[ 3];
+                BODY_00_15( 2,E,T,A,B,C,D,X( 2));       X( 4) = W[ 4];
+                BODY_00_15( 3,D,E,T,A,B,C,X( 3));       X( 5) = W[ 5];
+                BODY_00_15( 4,C,D,E,T,A,B,X( 4));       X( 6) = W[ 6];
+                BODY_00_15( 5,B,C,D,E,T,A,X( 5));       X( 7) = W[ 7];
+                BODY_00_15( 6,A,B,C,D,E,T,X( 6));       X( 8) = W[ 8];
+                BODY_00_15( 7,T,A,B,C,D,E,X( 7));       X( 9) = W[ 9];
+                BODY_00_15( 8,E,T,A,B,C,D,X( 8));       X(10) = W[10];
+                BODY_00_15( 9,D,E,T,A,B,C,X( 9));       X(11) = W[11];
+                BODY_00_15(10,C,D,E,T,A,B,X(10));       X(12) = W[12];
+                BODY_00_15(11,B,C,D,E,T,A,X(11));       X(13) = W[13];
+                BODY_00_15(12,A,B,C,D,E,T,X(12));       X(14) = W[14];
+                BODY_00_15(13,T,A,B,C,D,E,X(13));       X(15) = W[15];
+                BODY_00_15(14,E,T,A,B,C,D,X(14));
+                BODY_00_15(15,D,E,T,A,B,C,X(15));
+
+                data += SHA_CBLOCK;
+                }
+        else
                 {
-        BODY_00_15( 0,A,B,C,D,E,T,W[ 0]);
-        BODY_00_15( 1,T,A,B,C,D,E,W[ 1]);
-        BODY_00_15( 2,E,T,A,B,C,D,W[ 2]);
-        BODY_00_15( 3,D,E,T,A,B,C,W[ 3]);
-        BODY_00_15( 4,C,D,E,T,A,B,W[ 4]);
-        BODY_00_15( 5,B,C,D,E,T,A,W[ 5]);
-        BODY_00_15( 6,A,B,C,D,E,T,W[ 6]);
-        BODY_00_15( 7,T,A,B,C,D,E,W[ 7]);
-        BODY_00_15( 8,E,T,A,B,C,D,W[ 8]);
-        BODY_00_15( 9,D,E,T,A,B,C,W[ 9]);
-        BODY_00_15(10,C,D,E,T,A,B,W[10]);
-        BODY_00_15(11,B,C,D,E,T,A,W[11]);
-        BODY_00_15(12,A,B,C,D,E,T,W[12]);
-        BODY_00_15(13,T,A,B,C,D,E,W[13]);
-        BODY_00_15(14,E,T,A,B,C,D,W[14]);
-        BODY_00_15(15,D,E,T,A,B,C,W[15]);
-
-        BODY_16_19(16,C,D,E,T,A,B,X( 0),W[ 0],W[ 2],W[ 8],W[13]);
-        BODY_16_19(17,B,C,D,E,T,A,X( 1),W[ 1],W[ 3],W[ 9],W[14]);
-        BODY_16_19(18,A,B,C,D,E,T,X( 2),W[ 2],W[ 4],W[10],W[15]);
-        BODY_16_19(19,T,A,B,C,D,E,X( 3),W[ 3],W[ 5],W[11],X( 0));
-
-        BODY_20_31(20,E,T,A,B,C,D,X( 4),W[ 4],W[ 6],W[12],X( 1));
-        BODY_20_31(21,D,E,T,A,B,C,X( 5),W[ 5],W[ 7],W[13],X( 2));
-        BODY_20_31(22,C,D,E,T,A,B,X( 6),W[ 6],W[ 8],W[14],X( 3));
-        BODY_20_31(23,B,C,D,E,T,A,X( 7),W[ 7],W[ 9],W[15],X( 4));
-        BODY_20_31(24,A,B,C,D,E,T,X( 8),W[ 8],W[10],X( 0),X( 5));
-        BODY_20_31(25,T,A,B,C,D,E,X( 9),W[ 9],W[11],X( 1),X( 6));
-        BODY_20_31(26,E,T,A,B,C,D,X(10),W[10],W[12],X( 2),X( 7));
-        BODY_20_31(27,D,E,T,A,B,C,X(11),W[11],W[13],X( 3),X( 8));
-        BODY_20_31(28,C,D,E,T,A,B,X(12),W[12],W[14],X( 4),X( 9));
-        BODY_20_31(29,B,C,D,E,T,A,X(13),W[13],W[15],X( 5),X(10));
-        BODY_20_31(30,A,B,C,D,E,T,X(14),W[14],X( 0),X( 6),X(11));
-        BODY_20_31(31,T,A,B,C,D,E,X(15),W[15],X( 1),X( 7),X(12));
+                HOST_c2l(data,l); X( 0)=l;              HOST_c2l(data,l); X( 1)=l;
+                BODY_00_15( 0,A,B,C,D,E,T,X( 0));       HOST_c2l(data,l); X( 2)=l;
+                BODY_00_15( 1,T,A,B,C,D,E,X( 1));       HOST_c2l(data,l); X( 3)=l;
+                BODY_00_15( 2,E,T,A,B,C,D,X( 2));       HOST_c2l(data,l); X( 4)=l;
+                BODY_00_15( 3,D,E,T,A,B,C,X( 3));       HOST_c2l(data,l); X( 5)=l;
+                BODY_00_15( 4,C,D,E,T,A,B,X( 4));       HOST_c2l(data,l); X( 6)=l;
+                BODY_00_15( 5,B,C,D,E,T,A,X( 5));       HOST_c2l(data,l); X( 7)=l;
+                BODY_00_15( 6,A,B,C,D,E,T,X( 6));       HOST_c2l(data,l); X( 8)=l;
+                BODY_00_15( 7,T,A,B,C,D,E,X( 7));       HOST_c2l(data,l); X( 9)=l;
+                BODY_00_15( 8,E,T,A,B,C,D,X( 8));       HOST_c2l(data,l); X(10)=l;
+                BODY_00_15( 9,D,E,T,A,B,C,X( 9));       HOST_c2l(data,l); X(11)=l;
+                BODY_00_15(10,C,D,E,T,A,B,X(10));       HOST_c2l(data,l); X(12)=l;
+                BODY_00_15(11,B,C,D,E,T,A,X(11));       HOST_c2l(data,l); X(13)=l;
+                BODY_00_15(12,A,B,C,D,E,T,X(12));       HOST_c2l(data,l); X(14)=l;
+                BODY_00_15(13,T,A,B,C,D,E,X(13));       HOST_c2l(data,l); X(15)=l;
+                BODY_00_15(14,E,T,A,B,C,D,X(14));
+                BODY_00_15(15,D,E,T,A,B,C,X(15));
+                }
+
+        BODY_16_19(16,C,D,E,T,A,B,X( 0),X( 0),X( 2),X( 8),X(13));
+        BODY_16_19(17,B,C,D,E,T,A,X( 1),X( 1),X( 3),X( 9),X(14));
+        BODY_16_19(18,A,B,C,D,E,T,X( 2),X( 2),X( 4),X(10),X(15));
+        BODY_16_19(19,T,A,B,C,D,E,X( 3),X( 3),X( 5),X(11),X( 0));
+
+        BODY_20_31(20,E,T,A,B,C,D,X( 4),X( 4),X( 6),X(12),X( 1));
+        BODY_20_31(21,D,E,T,A,B,C,X( 5),X( 5),X( 7),X(13),X( 2));
+        BODY_20_31(22,C,D,E,T,A,B,X( 6),X( 6),X( 8),X(14),X( 3));
+        BODY_20_31(23,B,C,D,E,T,A,X( 7),X( 7),X( 9),X(15),X( 4));
+        BODY_20_31(24,A,B,C,D,E,T,X( 8),X( 8),X(10),X( 0),X( 5));
+        BODY_20_31(25,T,A,B,C,D,E,X( 9),X( 9),X(11),X( 1),X( 6));
+        BODY_20_31(26,E,T,A,B,C,D,X(10),X(10),X(12),X( 2),X( 7));
+        BODY_20_31(27,D,E,T,A,B,C,X(11),X(11),X(13),X( 3),X( 8));
+        BODY_20_31(28,C,D,E,T,A,B,X(12),X(12),X(14),X( 4),X( 9));
+        BODY_20_31(29,B,C,D,E,T,A,X(13),X(13),X(15),X( 5),X(10));
+        BODY_20_31(30,A,B,C,D,E,T,X(14),X(14),X( 0),X( 6),X(11));
+        BODY_20_31(31,T,A,B,C,D,E,X(15),X(15),X( 1),X( 7),X(12));
 
         BODY_32_39(32,E,T,A,B,C,D,X( 0),X( 2),X( 8),X(13));
         BODY_32_39(33,D,E,T,A,B,C,X( 1),X( 3),X( 9),X(14));
@@ -341,7 +348,7 @@ void HASH_BLOCK_HOST_ORDER (SHA_CTX *c, const void *d, int num)
         c->h3=(c->h3+B)&0xffffffffL;
         c->h4=(c->h4+C)&0xffffffffL;
 
-        if (--num <= 0) break;
+        if (--num == 0) break;
 
         A=c->h0;
         B=c->h1;
@@ -349,22 +356,48 @@ void HASH_BLOCK_HOST_ORDER (SHA_CTX *c, const void *d, int num)
         D=c->h3;
         E=c->h4;
 
-        W+=SHA_LBLOCK;
-                }
+                        }
         }
 #endif
 
-#ifndef DONT_IMPLEMENT_BLOCK_DATA_ORDER
-void HASH_BLOCK_DATA_ORDER (SHA_CTX *c, const void *p, int num)
+#else   /* OPENSSL_SMALL_FOOTPRINT */
+
+#define BODY_00_15(xi)           do {   \
+        T=E+K_00_19+F_00_19(B,C,D);     \
+        E=D, D=C, C=ROTATE(B,30), B=A;  \
+        A=ROTATE(A,5)+T+xi;         } while(0)
+
+#define BODY_16_19(xa,xb,xc,xd)  do {   \
+        Xupdate(T,xa,xa,xb,xc,xd);      \
+        T+=E+K_00_19+F_00_19(B,C,D);    \
+        E=D, D=C, C=ROTATE(B,30), B=A;  \
+        A=ROTATE(A,5)+T;            } while(0)
+
+#define BODY_20_39(xa,xb,xc,xd)  do {   \
+        Xupdate(T,xa,xa,xb,xc,xd);      \
+        T+=E+K_20_39+F_20_39(B,C,D);    \
+        E=D, D=C, C=ROTATE(B,30), B=A;  \
+        A=ROTATE(A,5)+T;            } while(0)
+
+#define BODY_40_59(xa,xb,xc,xd)  do {   \
+        Xupdate(T,xa,xa,xb,xc,xd);      \
+        T+=E+K_40_59+F_40_59(B,C,D);    \
+        E=D, D=C, C=ROTATE(B,30), B=A;  \
+        A=ROTATE(A,5)+T;            } while(0)
+
+#define BODY_60_79(xa,xb,xc,xd)  do {   \
+        Xupdate(T,xa,xa,xb,xc,xd);      \
+        T=E+K_60_79+F_60_79(B,C,D);     \
+        E=D, D=C, C=ROTATE(B,30), B=A;  \
+        A=ROTATE(A,5)+T+xa;         } while(0)
+
+#if !defined(SHA_1) || !defined(SHA1_ASM)
+static void HASH_BLOCK_DATA_ORDER (SHA_CTX *c, const void *p, size_t num)
         {
         const unsigned char *data=p;
         register unsigned MD32_REG_T A,B,C,D,E,T,l;
-#ifndef MD32_XARRAY
-        unsigned MD32_REG_T     XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7,
-                                XX8, XX9,XX10,XX11,XX12,XX13,XX14,XX15;
-#else
-        SHA_LONG        XX[16];
-#endif
+        int i;
+        SHA_LONG        X[16];
 
         A=c->h0;
         B=c->h1;
@@ -374,101 +407,24 @@ void HASH_BLOCK_DATA_ORDER (SHA_CTX *c, const void *p, int num)
 
         for (;;)
                 {
-
-        HOST_c2l(data,l); X( 0)=l;              HOST_c2l(data,l); X( 1)=l;
-        BODY_00_15( 0,A,B,C,D,E,T,X( 0));       HOST_c2l(data,l); X( 2)=l;
-        BODY_00_15( 1,T,A,B,C,D,E,X( 1));       HOST_c2l(data,l); X( 3)=l;
-        BODY_00_15( 2,E,T,A,B,C,D,X( 2));       HOST_c2l(data,l); X( 4)=l;
-        BODY_00_15( 3,D,E,T,A,B,C,X( 3));       HOST_c2l(data,l); X( 5)=l;
-        BODY_00_15( 4,C,D,E,T,A,B,X( 4));       HOST_c2l(data,l); X( 6)=l;
-        BODY_00_15( 5,B,C,D,E,T,A,X( 5));       HOST_c2l(data,l); X( 7)=l;
-        BODY_00_15( 6,A,B,C,D,E,T,X( 6));       HOST_c2l(data,l); X( 8)=l;
-        BODY_00_15( 7,T,A,B,C,D,E,X( 7));       HOST_c2l(data,l); X( 9)=l;
-        BODY_00_15( 8,E,T,A,B,C,D,X( 8));       HOST_c2l(data,l); X(10)=l;
-        BODY_00_15( 9,D,E,T,A,B,C,X( 9));       HOST_c2l(data,l); X(11)=l;
-        BODY_00_15(10,C,D,E,T,A,B,X(10));       HOST_c2l(data,l); X(12)=l;
-        BODY_00_15(11,B,C,D,E,T,A,X(11));       HOST_c2l(data,l); X(13)=l;
-        BODY_00_15(12,A,B,C,D,E,T,X(12));       HOST_c2l(data,l); X(14)=l;
-        BODY_00_15(13,T,A,B,C,D,E,X(13));       HOST_c2l(data,l); X(15)=l;
-        BODY_00_15(14,E,T,A,B,C,D,X(14));
-        BODY_00_15(15,D,E,T,A,B,C,X(15));
-
-        BODY_16_19(16,C,D,E,T,A,B,X( 0),X( 0),X( 2),X( 8),X(13));
-        BODY_16_19(17,B,C,D,E,T,A,X( 1),X( 1),X( 3),X( 9),X(14));
-        BODY_16_19(18,A,B,C,D,E,T,X( 2),X( 2),X( 4),X(10),X(15));
-        BODY_16_19(19,T,A,B,C,D,E,X( 3),X( 3),X( 5),X(11),X( 0));
-
-        BODY_20_31(20,E,T,A,B,C,D,X( 4),X( 4),X( 6),X(12),X( 1));
-        BODY_20_31(21,D,E,T,A,B,C,X( 5),X( 5),X( 7),X(13),X( 2));
-        BODY_20_31(22,C,D,E,T,A,B,X( 6),X( 6),X( 8),X(14),X( 3));
-        BODY_20_31(23,B,C,D,E,T,A,X( 7),X( 7),X( 9),X(15),X( 4));
-        BODY_20_31(24,A,B,C,D,E,T,X( 8),X( 8),X(10),X( 0),X( 5));
-        BODY_20_31(25,T,A,B,C,D,E,X( 9),X( 9),X(11),X( 1),X( 6));
-        BODY_20_31(26,E,T,A,B,C,D,X(10),X(10),X(12),X( 2),X( 7));
-        BODY_20_31(27,D,E,T,A,B,C,X(11),X(11),X(13),X( 3),X( 8));
-        BODY_20_31(28,C,D,E,T,A,B,X(12),X(12),X(14),X( 4),X( 9));
-        BODY_20_31(29,B,C,D,E,T,A,X(13),X(13),X(15),X( 5),X(10));
-        BODY_20_31(30,A,B,C,D,E,T,X(14),X(14),X( 0),X( 6),X(11));
-        BODY_20_31(31,T,A,B,C,D,E,X(15),X(15),X( 1),X( 7),X(12));
-
-        BODY_32_39(32,E,T,A,B,C,D,X( 0),X( 2),X( 8),X(13));
-        BODY_32_39(33,D,E,T,A,B,C,X( 1),X( 3),X( 9),X(14));
-        BODY_32_39(34,C,D,E,T,A,B,X( 2),X( 4),X(10),X(15));
-        BODY_32_39(35,B,C,D,E,T,A,X( 3),X( 5),X(11),X( 0));
-        BODY_32_39(36,A,B,C,D,E,T,X( 4),X( 6),X(12),X( 1));
-        BODY_32_39(37,T,A,B,C,D,E,X( 5),X( 7),X(13),X( 2));
-        BODY_32_39(38,E,T,A,B,C,D,X( 6),X( 8),X(14),X( 3));
-        BODY_32_39(39,D,E,T,A,B,C,X( 7),X( 9),X(15),X( 4));
-
-        BODY_40_59(40,C,D,E,T,A,B,X( 8),X(10),X( 0),X( 5));
-        BODY_40_59(41,B,C,D,E,T,A,X( 9),X(11),X( 1),X( 6));
-        BODY_40_59(42,A,B,C,D,E,T,X(10),X(12),X( 2),X( 7));
-        BODY_40_59(43,T,A,B,C,D,E,X(11),X(13),X( 3),X( 8));
-        BODY_40_59(44,E,T,A,B,C,D,X(12),X(14),X( 4),X( 9));
-        BODY_40_59(45,D,E,T,A,B,C,X(13),X(15),X( 5),X(10));
-        BODY_40_59(46,C,D,E,T,A,B,X(14),X( 0),X( 6),X(11));
-        BODY_40_59(47,B,C,D,E,T,A,X(15),X( 1),X( 7),X(12));
-        BODY_40_59(48,A,B,C,D,E,T,X( 0),X( 2),X( 8),X(13));
-        BODY_40_59(49,T,A,B,C,D,E,X( 1),X( 3),X( 9),X(14));
-        BODY_40_59(50,E,T,A,B,C,D,X( 2),X( 4),X(10),X(15));
-        BODY_40_59(51,D,E,T,A,B,C,X( 3),X( 5),X(11),X( 0));
-        BODY_40_59(52,C,D,E,T,A,B,X( 4),X( 6),X(12),X( 1));
-        BODY_40_59(53,B,C,D,E,T,A,X( 5),X( 7),X(13),X( 2));
-        BODY_40_59(54,A,B,C,D,E,T,X( 6),X( 8),X(14),X( 3));
-        BODY_40_59(55,T,A,B,C,D,E,X( 7),X( 9),X(15),X( 4));
-        BODY_40_59(56,E,T,A,B,C,D,X( 8),X(10),X( 0),X( 5));
-        BODY_40_59(57,D,E,T,A,B,C,X( 9),X(11),X( 1),X( 6));
-        BODY_40_59(58,C,D,E,T,A,B,X(10),X(12),X( 2),X( 7));
-        BODY_40_59(59,B,C,D,E,T,A,X(11),X(13),X( 3),X( 8));
-
-        BODY_60_79(60,A,B,C,D,E,T,X(12),X(14),X( 4),X( 9));
-        BODY_60_79(61,T,A,B,C,D,E,X(13),X(15),X( 5),X(10));
-        BODY_60_79(62,E,T,A,B,C,D,X(14),X( 0),X( 6),X(11));
-        BODY_60_79(63,D,E,T,A,B,C,X(15),X( 1),X( 7),X(12));
-        BODY_60_79(64,C,D,E,T,A,B,X( 0),X( 2),X( 8),X(13));
-        BODY_60_79(65,B,C,D,E,T,A,X( 1),X( 3),X( 9),X(14));
-        BODY_60_79(66,A,B,C,D,E,T,X( 2),X( 4),X(10),X(15));
-        BODY_60_79(67,T,A,B,C,D,E,X( 3),X( 5),X(11),X( 0));
-        BODY_60_79(68,E,T,A,B,C,D,X( 4),X( 6),X(12),X( 1));
-        BODY_60_79(69,D,E,T,A,B,C,X( 5),X( 7),X(13),X( 2));
-        BODY_60_79(70,C,D,E,T,A,B,X( 6),X( 8),X(14),X( 3));
-        BODY_60_79(71,B,C,D,E,T,A,X( 7),X( 9),X(15),X( 4));
-        BODY_60_79(72,A,B,C,D,E,T,X( 8),X(10),X( 0),X( 5));
-        BODY_60_79(73,T,A,B,C,D,E,X( 9),X(11),X( 1),X( 6));
-        BODY_60_79(74,E,T,A,B,C,D,X(10),X(12),X( 2),X( 7));
-        BODY_60_79(75,D,E,T,A,B,C,X(11),X(13),X( 3),X( 8));
-        BODY_60_79(76,C,D,E,T,A,B,X(12),X(14),X( 4),X( 9));
-        BODY_60_79(77,B,C,D,E,T,A,X(13),X(15),X( 5),X(10));
-        BODY_60_79(78,A,B,C,D,E,T,X(14),X( 0),X( 6),X(11));
-        BODY_60_79(79,T,A,B,C,D,E,X(15),X( 1),X( 7),X(12));
-        
-        c->h0=(c->h0+E)&0xffffffffL; 
-        c->h1=(c->h1+T)&0xffffffffL;
-        c->h2=(c->h2+A)&0xffffffffL;
-        c->h3=(c->h3+B)&0xffffffffL;
-        c->h4=(c->h4+C)&0xffffffffL;
-
-        if (--num <= 0) break;
+        for (i=0;i<16;i++)
+        { HOST_c2l(data,l); X[i]=l; BODY_00_15(X[i]); }
+        for (i=0;i<4;i++)
+        { BODY_16_19(X[i],       X[i+2],      X[i+8],     X[(i+13)&15]); }
+        for (;i<24;i++)
+        { BODY_20_39(X[i&15],    X[(i+2)&15], X[(i+8)&15],X[(i+13)&15]); }
+        for (i=0;i<20;i++)
+        { BODY_40_59(X[(i+8)&15],X[(i+10)&15],X[i&15],    X[(i+5)&15]);  }
+        for (i=4;i<24;i++)
+        { BODY_60_79(X[(i+8)&15],X[(i+10)&15],X[i&15],    X[(i+5)&15]);  }
+
+        c->h0=(c->h0+A)&0xffffffffL; 
+        c->h1=(c->h1+B)&0xffffffffL;
+        c->h2=(c->h2+C)&0xffffffffL;
+        c->h3=(c->h3+D)&0xffffffffL;
+        c->h4=(c->h4+E)&0xffffffffL;
+
+        if (--num == 0) break;
 
         A=c->h0;
         B=c->h1;
@@ -479,3 +435,5 @@ void HASH_BLOCK_DATA_ORDER (SHA_CTX *c, const void *p, int num)
                 }
         }
 #endif
+
+#endif
diff --git a/src/lib/libssl/src/crypto/sha/sha_one.c b/src/lib/libssl/src/crypto/sha/sha_one.c
index d4f4d344df..3bae623ce8 100644
--- a/src/lib/libssl/src/crypto/sha/sha_one.c
+++ b/src/lib/libssl/src/crypto/sha/sha_one.c
@@ -62,7 +62,7 @@
 #include <openssl/crypto.h>
 
 #ifndef OPENSSL_NO_SHA0
-unsigned char *SHA(const unsigned char *d, unsigned long n, unsigned char *md)
+unsigned char *SHA(const unsigned char *d, size_t n, unsigned char *md)
         {
         SHA_CTX c;
         static unsigned char m[SHA_DIGEST_LENGTH];
diff --git a/src/lib/libssl/src/crypto/sha/shatest.c b/src/lib/libssl/src/crypto/sha/shatest.c
index ff702aa53e..ed0fe06a7b 100644
--- a/src/lib/libssl/src/crypto/sha/shatest.c
+++ b/src/lib/libssl/src/crypto/sha/shatest.c
@@ -106,7 +106,7 @@ static char *pt(unsigned char *md);
 int main(int argc, char *argv[])
         {
         int i,err=0;
-        unsigned char **P,**R;
+        char **P,**R;
         static unsigned char buf[1000];
         char *p,*r;
         EVP_MD_CTX c;
@@ -118,12 +118,12 @@ int main(int argc, char *argv[])
 #endif
 
         EVP_MD_CTX_init(&c);
-        P=(unsigned char **)test;
-        R=(unsigned char **)ret;
+        P=test;
+        R=ret;
         i=1;
         while (*P != NULL)
                 {
-                EVP_Digest(*P,(unsigned long)strlen((char *)*P),md,NULL,EVP_sha(), NULL);
+                EVP_Digest(*P,strlen((char *)*P),md,NULL,EVP_sha(), NULL);
                 p=pt(md);
                 if (strcmp(p,(char *)*R) != 0)
                         {
@@ -157,6 +157,10 @@ int main(int argc, char *argv[])
                 }
         else
                 printf("test 3 ok\n");
+
+#ifdef OPENSSL_SYS_NETWARE
+    if (err) printf("ERROR: %d\n", err);
+#endif
         EVP_MD_CTX_cleanup(&c);
         EXIT(err);
         return(0);
diff --git a/src/lib/libssl/src/crypto/stack/safestack.h b/src/lib/libssl/src/crypto/stack/safestack.h
index 6010b7f122..78cc485e6d 100644
--- a/src/lib/libssl/src/crypto/stack/safestack.h
+++ b/src/lib/libssl/src/crypto/stack/safestack.h
@@ -55,13 +55,22 @@
 #ifndef HEADER_SAFESTACK_H
 #define HEADER_SAFESTACK_H
 
-typedef void (*openssl_fptr)(void);
-#define openssl_fcast(f) ((openssl_fptr)f)
-
 #include <openssl/stack.h>
 
 #ifdef DEBUG_SAFESTACK
 
+#ifndef CHECKED_PTR_OF
+#define CHECKED_PTR_OF(type, p) \
+    ((void*) (1 ? p : (type*)0))
+#endif
+
+#define CHECKED_SK_FREE_FUNC(type, p) \
+    ((void (*)(void *)) ((1 ? p : (void (*)(type *))0)))
+
+#define CHECKED_SK_CMP_FUNC(type, p) \
+    ((int (*)(const char * const *, const char * const *)) \
+        ((1 ? p : (int (*)(const type * const *, const type * const *))0)))
+
 #define STACK_OF(type) struct stack_st_##type
 #define PREDECLARE_STACK_OF(type) STACK_OF(type);
 
@@ -76,75 +85,71 @@ STACK_OF(type) \
 /* SKM_sk_... stack macros are internal to safestack.h:
  * never use them directly, use sk_<type>_... instead */
 #define SKM_sk_new(type, cmp) \
-        ((STACK_OF(type) * (*)(int (*)(const type * const *, const type * const *)))openssl_fcast(sk_new))(cmp)
+        ((STACK_OF(type) *)sk_new(CHECKED_SK_CMP_FUNC(type, cmp)))
 #define SKM_sk_new_null(type) \
-        ((STACK_OF(type) * (*)(void))openssl_fcast(sk_new_null))()
+        ((STACK_OF(type) *)sk_new_null())
 #define SKM_sk_free(type, st) \
-        ((void (*)(STACK_OF(type) *))openssl_fcast(sk_free))(st)
+        sk_free(CHECKED_PTR_OF(STACK_OF(type), st))
 #define SKM_sk_num(type, st) \
-        ((int (*)(const STACK_OF(type) *))openssl_fcast(sk_num))(st)
+        sk_num(CHECKED_PTR_OF(STACK_OF(type), st))
 #define SKM_sk_value(type, st,i) \
-        ((type * (*)(const STACK_OF(type) *, int))openssl_fcast(sk_value))(st, i)
+        ((type *)sk_value(CHECKED_PTR_OF(STACK_OF(type), st), i))
 #define SKM_sk_set(type, st,i,val) \
-        ((type * (*)(STACK_OF(type) *, int, type *))openssl_fcast(sk_set))(st, i, val)
+        sk_set(CHECKED_PTR_OF(STACK_OF(type), st), i, CHECKED_PTR_OF(type, val))
 #define SKM_sk_zero(type, st) \
-        ((void (*)(STACK_OF(type) *))openssl_fcast(sk_zero))(st)
+        sk_zero(CHECKED_PTR_OF(STACK_OF(type), st))
 #define SKM_sk_push(type, st,val) \
-        ((int (*)(STACK_OF(type) *, type *))openssl_fcast(sk_push))(st, val)
+        sk_push(CHECKED_PTR_OF(STACK_OF(type), st), CHECKED_PTR_OF(type, val))
 #define SKM_sk_unshift(type, st,val) \
-        ((int (*)(STACK_OF(type) *, type *))openssl_fcast(sk_unshift))(st, val)
+        sk_unshift(CHECKED_PTR_OF(STACK_OF(type), st), CHECKED_PTR_OF(type, val))
 #define SKM_sk_find(type, st,val) \
-        ((int (*)(STACK_OF(type) *, type *))openssl_fcast(sk_find))(st, val)
+        sk_find(CHECKED_PTR_OF(STACK_OF(type), st), CHECKED_PTR_OF(type, val))
 #define SKM_sk_delete(type, st,i) \
-        ((type * (*)(STACK_OF(type) *, int))openssl_fcast(sk_delete))(st, i)
+        (type *)sk_delete(CHECKED_PTR_OF(STACK_OF(type), st), i)
 #define SKM_sk_delete_ptr(type, st,ptr) \
-        ((type * (*)(STACK_OF(type) *, type *))openssl_fcast(sk_delete_ptr))(st, ptr)
+        (type *)sk_delete_ptr(CHECKED_PTR_OF(STACK_OF(type), st), CHECKED_PTR_OF(type, ptr))
 #define SKM_sk_insert(type, st,val,i) \
-        ((int (*)(STACK_OF(type) *, type *, int))openssl_fcast(sk_insert))(st, val, i)
+        sk_insert(CHECKED_PTR_OF(STACK_OF(type), st), CHECKED_PTR_OF(type, val), i)
 #define SKM_sk_set_cmp_func(type, st,cmp) \
-        ((int (*(*)(STACK_OF(type) *, int (*)(const type * const *, const type * const *))) \
-          (const type * const *, const type * const *))openssl_fcast(sk_set_cmp_func))\
-        (st, cmp)
+        ((int (*)(const type * const *,const type * const *)) \
+        sk_set_cmp_func(CHECKED_PTR_OF(STACK_OF(type), st), CHECKED_SK_CMP_FUNC(type, cmp)))
 #define SKM_sk_dup(type, st) \
-        ((STACK_OF(type) *(*)(STACK_OF(type) *))openssl_fcast(sk_dup))(st)
+        (STACK_OF(type) *)sk_dup(CHECKED_PTR_OF(STACK_OF(type), st))
 #define SKM_sk_pop_free(type, st,free_func) \
-        ((void (*)(STACK_OF(type) *, void (*)(type *)))openssl_fcast(sk_pop_free))\
-        (st, free_func)
+        sk_pop_free(CHECKED_PTR_OF(STACK_OF(type), st), CHECKED_SK_FREE_FUNC(type, free_func))
 #define SKM_sk_shift(type, st) \
-        ((type * (*)(STACK_OF(type) *))openssl_fcast(sk_shift))(st)
+        (type *)sk_shift(CHECKED_PTR_OF(STACK_OF(type), st))
 #define SKM_sk_pop(type, st) \
-        ((type * (*)(STACK_OF(type) *))openssl_fcast(sk_pop))(st)
+        (type *)sk_pop(CHECKED_PTR_OF(STACK_OF(type), st))
 #define SKM_sk_sort(type, st) \
-        ((void (*)(STACK_OF(type) *))openssl_fcast(sk_sort))(st)
+        sk_sort(CHECKED_PTR_OF(STACK_OF(type), st))
 #define SKM_sk_is_sorted(type, st) \
-        ((int (*)(const STACK_OF(type) *))openssl_fcast(sk_is_sorted))(st)
+        sk_is_sorted(CHECKED_PTR_OF(STACK_OF(type), st))
 
 #define SKM_ASN1_SET_OF_d2i(type, st, pp, length, d2i_func, free_func, ex_tag, ex_class) \
-        ((STACK_OF(type) * (*) (STACK_OF(type) **,unsigned char **, long , \
-                                       type *(*)(type **, unsigned char **,long), \
-                                       void (*)(type *), int ,int )) openssl_fcast(d2i_ASN1_SET)) \
-                                                (st,pp,length, d2i_func, free_func, ex_tag,ex_class)
+        (STACK_OF(type) *)d2i_ASN1_SET(CHECKED_PTR_OF(STACK_OF(type), st), \
+                                pp, length, \
+                                CHECKED_D2I_OF(type, d2i_func), \
+                                CHECKED_SK_FREE_FUNC(type, free_func), \
+                                ex_tag, ex_class)
+
 #define SKM_ASN1_SET_OF_i2d(type, st, pp, i2d_func, ex_tag, ex_class, is_set) \
-        ((int (*)(STACK_OF(type) *,unsigned char **, \
-                           int (*)(type *,unsigned char **), int , int , int)) openssl_fcast(i2d_ASN1_SET)) \
-                                                (st,pp,i2d_func,ex_tag,ex_class,is_set)
+        i2d_ASN1_SET(CHECKED_PTR_OF(STACK_OF(type), st), pp, \
+                                CHECKED_I2D_OF(type, i2d_func), \
+                                ex_tag, ex_class, is_set)
 
 #define SKM_ASN1_seq_pack(type, st, i2d_func, buf, len) \
-        ((unsigned char *(*)(STACK_OF(type) *, \
-                                    int (*)(type *,unsigned char **), unsigned char **,int *)) openssl_fcast(ASN1_seq_pack)) \
-                                (st, i2d_func, buf, len)
+        ASN1_seq_pack(CHECKED_PTR_OF(STACK_OF(type), st), \
+                        CHECKED_I2D_OF(type, i2d_func), buf, len)
+
 #define SKM_ASN1_seq_unpack(type, buf, len, d2i_func, free_func) \
-        ((STACK_OF(type) * (*)(unsigned char *,int, \
-                                       type *(*)(type **,unsigned char **, long), \
-                                       void (*)(type *)))openssl_fcast(ASN1_seq_unpack)) \
-                                        (buf,len,d2i_func, free_func)
+        (STACK_OF(type) *)ASN1_seq_unpack(buf, len, CHECKED_D2I_OF(type, d2i_func), CHECKED_SK_FREE_FUNC(type, free_func))
 
 #define SKM_PKCS12_decrypt_d2i(type, algor, d2i_func, free_func, pass, passlen, oct, seq) \
-        ((STACK_OF(type) * (*)(X509_ALGOR *, \
-                                type *(*)(type **, unsigned char **, long), void (*)(type *), \
-                                const char *, int, \
-                                ASN1_STRING *, int))openssl_fcast(PKCS12_decrypt_d2i)) \
-                                (algor,d2i_func,free_func,pass,passlen,oct,seq)
+        (STACK_OF(type) *)PKCS12_decrypt_d2i(algor, \
+                                CHECKED_D2I_OF(type, d2i_func), \
+                                CHECKED_SK_FREE_FUNC(type, free_func), \
+                                pass, passlen, oct, seq)
 
 #else
 
@@ -170,7 +175,7 @@ STACK_OF(type) \
 #define SKM_sk_push(type, st,val) \
         sk_push(st, (char *)val)
 #define SKM_sk_unshift(type, st,val) \
-        sk_unshift(st, val)
+        sk_unshift(st, (char *)val)
 #define SKM_sk_find(type, st,val) \
         sk_find(st, (char *)val)
 #define SKM_sk_delete(type, st,i) \
@@ -196,14 +201,14 @@ STACK_OF(type) \
         sk_is_sorted(st)
 
 #define SKM_ASN1_SET_OF_d2i(type, st, pp, length, d2i_func, free_func, ex_tag, ex_class) \
-        d2i_ASN1_SET(st,pp,length, (char *(*)())d2i_func, (void (*)(void *))free_func, ex_tag,ex_class)
+        d2i_ASN1_SET(st,pp,length, (void *(*)(void ** ,const unsigned char ** ,long))d2i_func, (void (*)(void *))free_func, ex_tag,ex_class)
 #define SKM_ASN1_SET_OF_i2d(type, st, pp, i2d_func, ex_tag, ex_class, is_set) \
-        i2d_ASN1_SET(st,pp,i2d_func,ex_tag,ex_class,is_set)
+        i2d_ASN1_SET(st,pp,(int (*)(void *, unsigned char **))i2d_func,ex_tag,ex_class,is_set)
 
 #define SKM_ASN1_seq_pack(type, st, i2d_func, buf, len) \
-        ASN1_seq_pack(st, i2d_func, buf, len)
+        ASN1_seq_pack(st, (int (*)(void *, unsigned char **))i2d_func, buf, len)
 #define SKM_ASN1_seq_unpack(type, buf, len, d2i_func, free_func) \
-        ASN1_seq_unpack(buf,len,(char *(*)())d2i_func, (void(*)(void *))free_func)
+        ASN1_seq_unpack(buf,len,(void *(*)(void **,const unsigned char **,long))d2i_func, (void(*)(void *))free_func)
 
 #define SKM_PKCS12_decrypt_d2i(type, algor, d2i_func, free_func, pass, passlen, oct, seq) \
         ((STACK *)PKCS12_decrypt_d2i(algor,(char *(*)())d2i_func, (void(*)(void *))free_func,pass,passlen,oct,seq))
@@ -221,6 +226,7 @@ STACK_OF(type) \
 #define sk_ACCESS_DESCRIPTION_push(st, val) SKM_sk_push(ACCESS_DESCRIPTION, (st), (val))
 #define sk_ACCESS_DESCRIPTION_unshift(st, val) SKM_sk_unshift(ACCESS_DESCRIPTION, (st), (val))
 #define sk_ACCESS_DESCRIPTION_find(st, val) SKM_sk_find(ACCESS_DESCRIPTION, (st), (val))
+#define sk_ACCESS_DESCRIPTION_find_ex(st, val) SKM_sk_find_ex(ACCESS_DESCRIPTION, (st), (val))
 #define sk_ACCESS_DESCRIPTION_delete(st, i) SKM_sk_delete(ACCESS_DESCRIPTION, (st), (i))
 #define sk_ACCESS_DESCRIPTION_delete_ptr(st, ptr) SKM_sk_delete_ptr(ACCESS_DESCRIPTION, (st), (ptr))
 #define sk_ACCESS_DESCRIPTION_insert(st, val, i) SKM_sk_insert(ACCESS_DESCRIPTION, (st), (val), (i))
@@ -232,6 +238,28 @@ STACK_OF(type) \
 #define sk_ACCESS_DESCRIPTION_sort(st) SKM_sk_sort(ACCESS_DESCRIPTION, (st))
 #define sk_ACCESS_DESCRIPTION_is_sorted(st) SKM_sk_is_sorted(ACCESS_DESCRIPTION, (st))
 
+#define sk_ASIdOrRange_new(st) SKM_sk_new(ASIdOrRange, (st))
+#define sk_ASIdOrRange_new_null() SKM_sk_new_null(ASIdOrRange)
+#define sk_ASIdOrRange_free(st) SKM_sk_free(ASIdOrRange, (st))
+#define sk_ASIdOrRange_num(st) SKM_sk_num(ASIdOrRange, (st))
+#define sk_ASIdOrRange_value(st, i) SKM_sk_value(ASIdOrRange, (st), (i))
+#define sk_ASIdOrRange_set(st, i, val) SKM_sk_set(ASIdOrRange, (st), (i), (val))
+#define sk_ASIdOrRange_zero(st) SKM_sk_zero(ASIdOrRange, (st))
+#define sk_ASIdOrRange_push(st, val) SKM_sk_push(ASIdOrRange, (st), (val))
+#define sk_ASIdOrRange_unshift(st, val) SKM_sk_unshift(ASIdOrRange, (st), (val))
+#define sk_ASIdOrRange_find(st, val) SKM_sk_find(ASIdOrRange, (st), (val))
+#define sk_ASIdOrRange_find_ex(st, val) SKM_sk_find_ex(ASIdOrRange, (st), (val))
+#define sk_ASIdOrRange_delete(st, i) SKM_sk_delete(ASIdOrRange, (st), (i))
+#define sk_ASIdOrRange_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASIdOrRange, (st), (ptr))
+#define sk_ASIdOrRange_insert(st, val, i) SKM_sk_insert(ASIdOrRange, (st), (val), (i))
+#define sk_ASIdOrRange_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(ASIdOrRange, (st), (cmp))
+#define sk_ASIdOrRange_dup(st) SKM_sk_dup(ASIdOrRange, st)
+#define sk_ASIdOrRange_pop_free(st, free_func) SKM_sk_pop_free(ASIdOrRange, (st), (free_func))
+#define sk_ASIdOrRange_shift(st) SKM_sk_shift(ASIdOrRange, (st))
+#define sk_ASIdOrRange_pop(st) SKM_sk_pop(ASIdOrRange, (st))
+#define sk_ASIdOrRange_sort(st) SKM_sk_sort(ASIdOrRange, (st))
+#define sk_ASIdOrRange_is_sorted(st) SKM_sk_is_sorted(ASIdOrRange, (st))
+
 #define sk_ASN1_GENERALSTRING_new(st) SKM_sk_new(ASN1_GENERALSTRING, (st))
 #define sk_ASN1_GENERALSTRING_new_null() SKM_sk_new_null(ASN1_GENERALSTRING)
 #define sk_ASN1_GENERALSTRING_free(st) SKM_sk_free(ASN1_GENERALSTRING, (st))
@@ -242,6 +270,7 @@ STACK_OF(type) \
 #define sk_ASN1_GENERALSTRING_push(st, val) SKM_sk_push(ASN1_GENERALSTRING, (st), (val))
 #define sk_ASN1_GENERALSTRING_unshift(st, val) SKM_sk_unshift(ASN1_GENERALSTRING, (st), (val))
 #define sk_ASN1_GENERALSTRING_find(st, val) SKM_sk_find(ASN1_GENERALSTRING, (st), (val))
+#define sk_ASN1_GENERALSTRING_find_ex(st, val) SKM_sk_find_ex(ASN1_GENERALSTRING, (st), (val))
 #define sk_ASN1_GENERALSTRING_delete(st, i) SKM_sk_delete(ASN1_GENERALSTRING, (st), (i))
 #define sk_ASN1_GENERALSTRING_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_GENERALSTRING, (st), (ptr))
 #define sk_ASN1_GENERALSTRING_insert(st, val, i) SKM_sk_insert(ASN1_GENERALSTRING, (st), (val), (i))
@@ -263,6 +292,7 @@ STACK_OF(type) \
 #define sk_ASN1_INTEGER_push(st, val) SKM_sk_push(ASN1_INTEGER, (st), (val))
 #define sk_ASN1_INTEGER_unshift(st, val) SKM_sk_unshift(ASN1_INTEGER, (st), (val))
 #define sk_ASN1_INTEGER_find(st, val) SKM_sk_find(ASN1_INTEGER, (st), (val))
+#define sk_ASN1_INTEGER_find_ex(st, val) SKM_sk_find_ex(ASN1_INTEGER, (st), (val))
 #define sk_ASN1_INTEGER_delete(st, i) SKM_sk_delete(ASN1_INTEGER, (st), (i))
 #define sk_ASN1_INTEGER_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_INTEGER, (st), (ptr))
 #define sk_ASN1_INTEGER_insert(st, val, i) SKM_sk_insert(ASN1_INTEGER, (st), (val), (i))
@@ -284,6 +314,7 @@ STACK_OF(type) \
 #define sk_ASN1_OBJECT_push(st, val) SKM_sk_push(ASN1_OBJECT, (st), (val))
 #define sk_ASN1_OBJECT_unshift(st, val) SKM_sk_unshift(ASN1_OBJECT, (st), (val))
 #define sk_ASN1_OBJECT_find(st, val) SKM_sk_find(ASN1_OBJECT, (st), (val))
+#define sk_ASN1_OBJECT_find_ex(st, val) SKM_sk_find_ex(ASN1_OBJECT, (st), (val))
 #define sk_ASN1_OBJECT_delete(st, i) SKM_sk_delete(ASN1_OBJECT, (st), (i))
 #define sk_ASN1_OBJECT_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_OBJECT, (st), (ptr))
 #define sk_ASN1_OBJECT_insert(st, val, i) SKM_sk_insert(ASN1_OBJECT, (st), (val), (i))
@@ -305,6 +336,7 @@ STACK_OF(type) \
 #define sk_ASN1_STRING_TABLE_push(st, val) SKM_sk_push(ASN1_STRING_TABLE, (st), (val))
 #define sk_ASN1_STRING_TABLE_unshift(st, val) SKM_sk_unshift(ASN1_STRING_TABLE, (st), (val))
 #define sk_ASN1_STRING_TABLE_find(st, val) SKM_sk_find(ASN1_STRING_TABLE, (st), (val))
+#define sk_ASN1_STRING_TABLE_find_ex(st, val) SKM_sk_find_ex(ASN1_STRING_TABLE, (st), (val))
 #define sk_ASN1_STRING_TABLE_delete(st, i) SKM_sk_delete(ASN1_STRING_TABLE, (st), (i))
 #define sk_ASN1_STRING_TABLE_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_STRING_TABLE, (st), (ptr))
 #define sk_ASN1_STRING_TABLE_insert(st, val, i) SKM_sk_insert(ASN1_STRING_TABLE, (st), (val), (i))
@@ -326,6 +358,7 @@ STACK_OF(type) \
 #define sk_ASN1_TYPE_push(st, val) SKM_sk_push(ASN1_TYPE, (st), (val))
 #define sk_ASN1_TYPE_unshift(st, val) SKM_sk_unshift(ASN1_TYPE, (st), (val))
 #define sk_ASN1_TYPE_find(st, val) SKM_sk_find(ASN1_TYPE, (st), (val))
+#define sk_ASN1_TYPE_find_ex(st, val) SKM_sk_find_ex(ASN1_TYPE, (st), (val))
 #define sk_ASN1_TYPE_delete(st, i) SKM_sk_delete(ASN1_TYPE, (st), (i))
 #define sk_ASN1_TYPE_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_TYPE, (st), (ptr))
 #define sk_ASN1_TYPE_insert(st, val, i) SKM_sk_insert(ASN1_TYPE, (st), (val), (i))
@@ -347,6 +380,7 @@ STACK_OF(type) \
 #define sk_ASN1_VALUE_push(st, val) SKM_sk_push(ASN1_VALUE, (st), (val))
 #define sk_ASN1_VALUE_unshift(st, val) SKM_sk_unshift(ASN1_VALUE, (st), (val))
 #define sk_ASN1_VALUE_find(st, val) SKM_sk_find(ASN1_VALUE, (st), (val))
+#define sk_ASN1_VALUE_find_ex(st, val) SKM_sk_find_ex(ASN1_VALUE, (st), (val))
 #define sk_ASN1_VALUE_delete(st, i) SKM_sk_delete(ASN1_VALUE, (st), (i))
 #define sk_ASN1_VALUE_delete_ptr(st, ptr) SKM_sk_delete_ptr(ASN1_VALUE, (st), (ptr))
 #define sk_ASN1_VALUE_insert(st, val, i) SKM_sk_insert(ASN1_VALUE, (st), (val), (i))
@@ -368,6 +402,7 @@ STACK_OF(type) \
 #define sk_BIO_push(st, val) SKM_sk_push(BIO, (st), (val))
 #define sk_BIO_unshift(st, val) SKM_sk_unshift(BIO, (st), (val))
 #define sk_BIO_find(st, val) SKM_sk_find(BIO, (st), (val))
+#define sk_BIO_find_ex(st, val) SKM_sk_find_ex(BIO, (st), (val))
 #define sk_BIO_delete(st, i) SKM_sk_delete(BIO, (st), (i))
 #define sk_BIO_delete_ptr(st, ptr) SKM_sk_delete_ptr(BIO, (st), (ptr))
 #define sk_BIO_insert(st, val, i) SKM_sk_insert(BIO, (st), (val), (i))
@@ -379,6 +414,94 @@ STACK_OF(type) \
 #define sk_BIO_sort(st) SKM_sk_sort(BIO, (st))
 #define sk_BIO_is_sorted(st) SKM_sk_is_sorted(BIO, (st))
 
+#define sk_CMS_CertificateChoices_new(st) SKM_sk_new(CMS_CertificateChoices, (st))
+#define sk_CMS_CertificateChoices_new_null() SKM_sk_new_null(CMS_CertificateChoices)
+#define sk_CMS_CertificateChoices_free(st) SKM_sk_free(CMS_CertificateChoices, (st))
+#define sk_CMS_CertificateChoices_num(st) SKM_sk_num(CMS_CertificateChoices, (st))
+#define sk_CMS_CertificateChoices_value(st, i) SKM_sk_value(CMS_CertificateChoices, (st), (i))
+#define sk_CMS_CertificateChoices_set(st, i, val) SKM_sk_set(CMS_CertificateChoices, (st), (i), (val))
+#define sk_CMS_CertificateChoices_zero(st) SKM_sk_zero(CMS_CertificateChoices, (st))
+#define sk_CMS_CertificateChoices_push(st, val) SKM_sk_push(CMS_CertificateChoices, (st), (val))
+#define sk_CMS_CertificateChoices_unshift(st, val) SKM_sk_unshift(CMS_CertificateChoices, (st), (val))
+#define sk_CMS_CertificateChoices_find(st, val) SKM_sk_find(CMS_CertificateChoices, (st), (val))
+#define sk_CMS_CertificateChoices_find_ex(st, val) SKM_sk_find_ex(CMS_CertificateChoices, (st), (val))
+#define sk_CMS_CertificateChoices_delete(st, i) SKM_sk_delete(CMS_CertificateChoices, (st), (i))
+#define sk_CMS_CertificateChoices_delete_ptr(st, ptr) SKM_sk_delete_ptr(CMS_CertificateChoices, (st), (ptr))
+#define sk_CMS_CertificateChoices_insert(st, val, i) SKM_sk_insert(CMS_CertificateChoices, (st), (val), (i))
+#define sk_CMS_CertificateChoices_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CMS_CertificateChoices, (st), (cmp))
+#define sk_CMS_CertificateChoices_dup(st) SKM_sk_dup(CMS_CertificateChoices, st)
+#define sk_CMS_CertificateChoices_pop_free(st, free_func) SKM_sk_pop_free(CMS_CertificateChoices, (st), (free_func))
+#define sk_CMS_CertificateChoices_shift(st) SKM_sk_shift(CMS_CertificateChoices, (st))
+#define sk_CMS_CertificateChoices_pop(st) SKM_sk_pop(CMS_CertificateChoices, (st))
+#define sk_CMS_CertificateChoices_sort(st) SKM_sk_sort(CMS_CertificateChoices, (st))
+#define sk_CMS_CertificateChoices_is_sorted(st) SKM_sk_is_sorted(CMS_CertificateChoices, (st))
+
+#define sk_CMS_RecipientInfo_new(st) SKM_sk_new(CMS_RecipientInfo, (st))
+#define sk_CMS_RecipientInfo_new_null() SKM_sk_new_null(CMS_RecipientInfo)
+#define sk_CMS_RecipientInfo_free(st) SKM_sk_free(CMS_RecipientInfo, (st))
+#define sk_CMS_RecipientInfo_num(st) SKM_sk_num(CMS_RecipientInfo, (st))
+#define sk_CMS_RecipientInfo_value(st, i) SKM_sk_value(CMS_RecipientInfo, (st), (i))
+#define sk_CMS_RecipientInfo_set(st, i, val) SKM_sk_set(CMS_RecipientInfo, (st), (i), (val))
+#define sk_CMS_RecipientInfo_zero(st) SKM_sk_zero(CMS_RecipientInfo, (st))
+#define sk_CMS_RecipientInfo_push(st, val) SKM_sk_push(CMS_RecipientInfo, (st), (val))
+#define sk_CMS_RecipientInfo_unshift(st, val) SKM_sk_unshift(CMS_RecipientInfo, (st), (val))
+#define sk_CMS_RecipientInfo_find(st, val) SKM_sk_find(CMS_RecipientInfo, (st), (val))
+#define sk_CMS_RecipientInfo_find_ex(st, val) SKM_sk_find_ex(CMS_RecipientInfo, (st), (val))
+#define sk_CMS_RecipientInfo_delete(st, i) SKM_sk_delete(CMS_RecipientInfo, (st), (i))
+#define sk_CMS_RecipientInfo_delete_ptr(st, ptr) SKM_sk_delete_ptr(CMS_RecipientInfo, (st), (ptr))
+#define sk_CMS_RecipientInfo_insert(st, val, i) SKM_sk_insert(CMS_RecipientInfo, (st), (val), (i))
+#define sk_CMS_RecipientInfo_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CMS_RecipientInfo, (st), (cmp))
+#define sk_CMS_RecipientInfo_dup(st) SKM_sk_dup(CMS_RecipientInfo, st)
+#define sk_CMS_RecipientInfo_pop_free(st, free_func) SKM_sk_pop_free(CMS_RecipientInfo, (st), (free_func))
+#define sk_CMS_RecipientInfo_shift(st) SKM_sk_shift(CMS_RecipientInfo, (st))
+#define sk_CMS_RecipientInfo_pop(st) SKM_sk_pop(CMS_RecipientInfo, (st))
+#define sk_CMS_RecipientInfo_sort(st) SKM_sk_sort(CMS_RecipientInfo, (st))
+#define sk_CMS_RecipientInfo_is_sorted(st) SKM_sk_is_sorted(CMS_RecipientInfo, (st))
+
+#define sk_CMS_RevocationInfoChoice_new(st) SKM_sk_new(CMS_RevocationInfoChoice, (st))
+#define sk_CMS_RevocationInfoChoice_new_null() SKM_sk_new_null(CMS_RevocationInfoChoice)
+#define sk_CMS_RevocationInfoChoice_free(st) SKM_sk_free(CMS_RevocationInfoChoice, (st))
+#define sk_CMS_RevocationInfoChoice_num(st) SKM_sk_num(CMS_RevocationInfoChoice, (st))
+#define sk_CMS_RevocationInfoChoice_value(st, i) SKM_sk_value(CMS_RevocationInfoChoice, (st), (i))
+#define sk_CMS_RevocationInfoChoice_set(st, i, val) SKM_sk_set(CMS_RevocationInfoChoice, (st), (i), (val))
+#define sk_CMS_RevocationInfoChoice_zero(st) SKM_sk_zero(CMS_RevocationInfoChoice, (st))
+#define sk_CMS_RevocationInfoChoice_push(st, val) SKM_sk_push(CMS_RevocationInfoChoice, (st), (val))
+#define sk_CMS_RevocationInfoChoice_unshift(st, val) SKM_sk_unshift(CMS_RevocationInfoChoice, (st), (val))
+#define sk_CMS_RevocationInfoChoice_find(st, val) SKM_sk_find(CMS_RevocationInfoChoice, (st), (val))
+#define sk_CMS_RevocationInfoChoice_find_ex(st, val) SKM_sk_find_ex(CMS_RevocationInfoChoice, (st), (val))
+#define sk_CMS_RevocationInfoChoice_delete(st, i) SKM_sk_delete(CMS_RevocationInfoChoice, (st), (i))
+#define sk_CMS_RevocationInfoChoice_delete_ptr(st, ptr) SKM_sk_delete_ptr(CMS_RevocationInfoChoice, (st), (ptr))
+#define sk_CMS_RevocationInfoChoice_insert(st, val, i) SKM_sk_insert(CMS_RevocationInfoChoice, (st), (val), (i))
+#define sk_CMS_RevocationInfoChoice_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CMS_RevocationInfoChoice, (st), (cmp))
+#define sk_CMS_RevocationInfoChoice_dup(st) SKM_sk_dup(CMS_RevocationInfoChoice, st)
+#define sk_CMS_RevocationInfoChoice_pop_free(st, free_func) SKM_sk_pop_free(CMS_RevocationInfoChoice, (st), (free_func))
+#define sk_CMS_RevocationInfoChoice_shift(st) SKM_sk_shift(CMS_RevocationInfoChoice, (st))
+#define sk_CMS_RevocationInfoChoice_pop(st) SKM_sk_pop(CMS_RevocationInfoChoice, (st))
+#define sk_CMS_RevocationInfoChoice_sort(st) SKM_sk_sort(CMS_RevocationInfoChoice, (st))
+#define sk_CMS_RevocationInfoChoice_is_sorted(st) SKM_sk_is_sorted(CMS_RevocationInfoChoice, (st))
+
+#define sk_CMS_SignerInfo_new(st) SKM_sk_new(CMS_SignerInfo, (st))
+#define sk_CMS_SignerInfo_new_null() SKM_sk_new_null(CMS_SignerInfo)
+#define sk_CMS_SignerInfo_free(st) SKM_sk_free(CMS_SignerInfo, (st))
+#define sk_CMS_SignerInfo_num(st) SKM_sk_num(CMS_SignerInfo, (st))
+#define sk_CMS_SignerInfo_value(st, i) SKM_sk_value(CMS_SignerInfo, (st), (i))
+#define sk_CMS_SignerInfo_set(st, i, val) SKM_sk_set(CMS_SignerInfo, (st), (i), (val))
+#define sk_CMS_SignerInfo_zero(st) SKM_sk_zero(CMS_SignerInfo, (st))
+#define sk_CMS_SignerInfo_push(st, val) SKM_sk_push(CMS_SignerInfo, (st), (val))
+#define sk_CMS_SignerInfo_unshift(st, val) SKM_sk_unshift(CMS_SignerInfo, (st), (val))
+#define sk_CMS_SignerInfo_find(st, val) SKM_sk_find(CMS_SignerInfo, (st), (val))
+#define sk_CMS_SignerInfo_find_ex(st, val) SKM_sk_find_ex(CMS_SignerInfo, (st), (val))
+#define sk_CMS_SignerInfo_delete(st, i) SKM_sk_delete(CMS_SignerInfo, (st), (i))
+#define sk_CMS_SignerInfo_delete_ptr(st, ptr) SKM_sk_delete_ptr(CMS_SignerInfo, (st), (ptr))
+#define sk_CMS_SignerInfo_insert(st, val, i) SKM_sk_insert(CMS_SignerInfo, (st), (val), (i))
+#define sk_CMS_SignerInfo_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(CMS_SignerInfo, (st), (cmp))
+#define sk_CMS_SignerInfo_dup(st) SKM_sk_dup(CMS_SignerInfo, st)
+#define sk_CMS_SignerInfo_pop_free(st, free_func) SKM_sk_pop_free(CMS_SignerInfo, (st), (free_func))
+#define sk_CMS_SignerInfo_shift(st) SKM_sk_shift(CMS_SignerInfo, (st))
+#define sk_CMS_SignerInfo_pop(st) SKM_sk_pop(CMS_SignerInfo, (st))
+#define sk_CMS_SignerInfo_sort(st) SKM_sk_sort(CMS_SignerInfo, (st))
+#define sk_CMS_SignerInfo_is_sorted(st) SKM_sk_is_sorted(CMS_SignerInfo, (st))
+
 #define sk_CONF_IMODULE_new(st) SKM_sk_new(CONF_IMODULE, (st))
 #define sk_CONF_IMODULE_new_null() SKM_sk_new_null(CONF_IMODULE)
 #define sk_CONF_IMODULE_free(st) SKM_sk_free(CONF_IMODULE, (st))
@@ -389,6 +512,7 @@ STACK_OF(type) \
 #define sk_CONF_IMODULE_push(st, val) SKM_sk_push(CONF_IMODULE, (st), (val))
 #define sk_CONF_IMODULE_unshift(st, val) SKM_sk_unshift(CONF_IMODULE, (st), (val))
 #define sk_CONF_IMODULE_find(st, val) SKM_sk_find(CONF_IMODULE, (st), (val))
+#define sk_CONF_IMODULE_find_ex(st, val) SKM_sk_find_ex(CONF_IMODULE, (st), (val))
 #define sk_CONF_IMODULE_delete(st, i) SKM_sk_delete(CONF_IMODULE, (st), (i))
 #define sk_CONF_IMODULE_delete_ptr(st, ptr) SKM_sk_delete_ptr(CONF_IMODULE, (st), (ptr))
 #define sk_CONF_IMODULE_insert(st, val, i) SKM_sk_insert(CONF_IMODULE, (st), (val), (i))
@@ -410,6 +534,7 @@ STACK_OF(type) \
 #define sk_CONF_MODULE_push(st, val) SKM_sk_push(CONF_MODULE, (st), (val))
 #define sk_CONF_MODULE_unshift(st, val) SKM_sk_unshift(CONF_MODULE, (st), (val))
 #define sk_CONF_MODULE_find(st, val) SKM_sk_find(CONF_MODULE, (st), (val))
+#define sk_CONF_MODULE_find_ex(st, val) SKM_sk_find_ex(CONF_MODULE, (st), (val))
 #define sk_CONF_MODULE_delete(st, i) SKM_sk_delete(CONF_MODULE, (st), (i))
 #define sk_CONF_MODULE_delete_ptr(st, ptr) SKM_sk_delete_ptr(CONF_MODULE, (st), (ptr))
 #define sk_CONF_MODULE_insert(st, val, i) SKM_sk_insert(CONF_MODULE, (st), (val), (i))
@@ -431,6 +556,7 @@ STACK_OF(type) \
 #define sk_CONF_VALUE_push(st, val) SKM_sk_push(CONF_VALUE, (st), (val))
 #define sk_CONF_VALUE_unshift(st, val) SKM_sk_unshift(CONF_VALUE, (st), (val))
 #define sk_CONF_VALUE_find(st, val) SKM_sk_find(CONF_VALUE, (st), (val))
+#define sk_CONF_VALUE_find_ex(st, val) SKM_sk_find_ex(CONF_VALUE, (st), (val))
 #define sk_CONF_VALUE_delete(st, i) SKM_sk_delete(CONF_VALUE, (st), (i))
 #define sk_CONF_VALUE_delete_ptr(st, ptr) SKM_sk_delete_ptr(CONF_VALUE, (st), (ptr))
 #define sk_CONF_VALUE_insert(st, val, i) SKM_sk_insert(CONF_VALUE, (st), (val), (i))
@@ -452,6 +578,7 @@ STACK_OF(type) \
 #define sk_CRYPTO_EX_DATA_FUNCS_push(st, val) SKM_sk_push(CRYPTO_EX_DATA_FUNCS, (st), (val))
 #define sk_CRYPTO_EX_DATA_FUNCS_unshift(st, val) SKM_sk_unshift(CRYPTO_EX_DATA_FUNCS, (st), (val))
 #define sk_CRYPTO_EX_DATA_FUNCS_find(st, val) SKM_sk_find(CRYPTO_EX_DATA_FUNCS, (st), (val))
+#define sk_CRYPTO_EX_DATA_FUNCS_find_ex(st, val) SKM_sk_find_ex(CRYPTO_EX_DATA_FUNCS, (st), (val))
 #define sk_CRYPTO_EX_DATA_FUNCS_delete(st, i) SKM_sk_delete(CRYPTO_EX_DATA_FUNCS, (st), (i))
 #define sk_CRYPTO_EX_DATA_FUNCS_delete_ptr(st, ptr) SKM_sk_delete_ptr(CRYPTO_EX_DATA_FUNCS, (st), (ptr))
 #define sk_CRYPTO_EX_DATA_FUNCS_insert(st, val, i) SKM_sk_insert(CRYPTO_EX_DATA_FUNCS, (st), (val), (i))
@@ -473,6 +600,7 @@ STACK_OF(type) \
 #define sk_CRYPTO_dynlock_push(st, val) SKM_sk_push(CRYPTO_dynlock, (st), (val))
 #define sk_CRYPTO_dynlock_unshift(st, val) SKM_sk_unshift(CRYPTO_dynlock, (st), (val))
 #define sk_CRYPTO_dynlock_find(st, val) SKM_sk_find(CRYPTO_dynlock, (st), (val))
+#define sk_CRYPTO_dynlock_find_ex(st, val) SKM_sk_find_ex(CRYPTO_dynlock, (st), (val))
 #define sk_CRYPTO_dynlock_delete(st, i) SKM_sk_delete(CRYPTO_dynlock, (st), (i))
 #define sk_CRYPTO_dynlock_delete_ptr(st, ptr) SKM_sk_delete_ptr(CRYPTO_dynlock, (st), (ptr))
 #define sk_CRYPTO_dynlock_insert(st, val, i) SKM_sk_insert(CRYPTO_dynlock, (st), (val), (i))
@@ -494,6 +622,7 @@ STACK_OF(type) \
 #define sk_DIST_POINT_push(st, val) SKM_sk_push(DIST_POINT, (st), (val))
 #define sk_DIST_POINT_unshift(st, val) SKM_sk_unshift(DIST_POINT, (st), (val))
 #define sk_DIST_POINT_find(st, val) SKM_sk_find(DIST_POINT, (st), (val))
+#define sk_DIST_POINT_find_ex(st, val) SKM_sk_find_ex(DIST_POINT, (st), (val))
 #define sk_DIST_POINT_delete(st, i) SKM_sk_delete(DIST_POINT, (st), (i))
 #define sk_DIST_POINT_delete_ptr(st, ptr) SKM_sk_delete_ptr(DIST_POINT, (st), (ptr))
 #define sk_DIST_POINT_insert(st, val, i) SKM_sk_insert(DIST_POINT, (st), (val), (i))
@@ -515,6 +644,7 @@ STACK_OF(type) \
 #define sk_ENGINE_push(st, val) SKM_sk_push(ENGINE, (st), (val))
 #define sk_ENGINE_unshift(st, val) SKM_sk_unshift(ENGINE, (st), (val))
 #define sk_ENGINE_find(st, val) SKM_sk_find(ENGINE, (st), (val))
+#define sk_ENGINE_find_ex(st, val) SKM_sk_find_ex(ENGINE, (st), (val))
 #define sk_ENGINE_delete(st, i) SKM_sk_delete(ENGINE, (st), (i))
 #define sk_ENGINE_delete_ptr(st, ptr) SKM_sk_delete_ptr(ENGINE, (st), (ptr))
 #define sk_ENGINE_insert(st, val, i) SKM_sk_insert(ENGINE, (st), (val), (i))
@@ -536,6 +666,7 @@ STACK_OF(type) \
 #define sk_ENGINE_CLEANUP_ITEM_push(st, val) SKM_sk_push(ENGINE_CLEANUP_ITEM, (st), (val))
 #define sk_ENGINE_CLEANUP_ITEM_unshift(st, val) SKM_sk_unshift(ENGINE_CLEANUP_ITEM, (st), (val))
 #define sk_ENGINE_CLEANUP_ITEM_find(st, val) SKM_sk_find(ENGINE_CLEANUP_ITEM, (st), (val))
+#define sk_ENGINE_CLEANUP_ITEM_find_ex(st, val) SKM_sk_find_ex(ENGINE_CLEANUP_ITEM, (st), (val))
 #define sk_ENGINE_CLEANUP_ITEM_delete(st, i) SKM_sk_delete(ENGINE_CLEANUP_ITEM, (st), (i))
 #define sk_ENGINE_CLEANUP_ITEM_delete_ptr(st, ptr) SKM_sk_delete_ptr(ENGINE_CLEANUP_ITEM, (st), (ptr))
 #define sk_ENGINE_CLEANUP_ITEM_insert(st, val, i) SKM_sk_insert(ENGINE_CLEANUP_ITEM, (st), (val), (i))
@@ -557,6 +688,7 @@ STACK_OF(type) \
 #define sk_GENERAL_NAME_push(st, val) SKM_sk_push(GENERAL_NAME, (st), (val))
 #define sk_GENERAL_NAME_unshift(st, val) SKM_sk_unshift(GENERAL_NAME, (st), (val))
 #define sk_GENERAL_NAME_find(st, val) SKM_sk_find(GENERAL_NAME, (st), (val))
+#define sk_GENERAL_NAME_find_ex(st, val) SKM_sk_find_ex(GENERAL_NAME, (st), (val))
 #define sk_GENERAL_NAME_delete(st, i) SKM_sk_delete(GENERAL_NAME, (st), (i))
 #define sk_GENERAL_NAME_delete_ptr(st, ptr) SKM_sk_delete_ptr(GENERAL_NAME, (st), (ptr))
 #define sk_GENERAL_NAME_insert(st, val, i) SKM_sk_insert(GENERAL_NAME, (st), (val), (i))
@@ -568,6 +700,94 @@ STACK_OF(type) \
 #define sk_GENERAL_NAME_sort(st) SKM_sk_sort(GENERAL_NAME, (st))
 #define sk_GENERAL_NAME_is_sorted(st) SKM_sk_is_sorted(GENERAL_NAME, (st))
 
+#define sk_GENERAL_NAMES_new(st) SKM_sk_new(GENERAL_NAMES, (st))
+#define sk_GENERAL_NAMES_new_null() SKM_sk_new_null(GENERAL_NAMES)
+#define sk_GENERAL_NAMES_free(st) SKM_sk_free(GENERAL_NAMES, (st))
+#define sk_GENERAL_NAMES_num(st) SKM_sk_num(GENERAL_NAMES, (st))
+#define sk_GENERAL_NAMES_value(st, i) SKM_sk_value(GENERAL_NAMES, (st), (i))
+#define sk_GENERAL_NAMES_set(st, i, val) SKM_sk_set(GENERAL_NAMES, (st), (i), (val))
+#define sk_GENERAL_NAMES_zero(st) SKM_sk_zero(GENERAL_NAMES, (st))
+#define sk_GENERAL_NAMES_push(st, val) SKM_sk_push(GENERAL_NAMES, (st), (val))
+#define sk_GENERAL_NAMES_unshift(st, val) SKM_sk_unshift(GENERAL_NAMES, (st), (val))
+#define sk_GENERAL_NAMES_find(st, val) SKM_sk_find(GENERAL_NAMES, (st), (val))
+#define sk_GENERAL_NAMES_find_ex(st, val) SKM_sk_find_ex(GENERAL_NAMES, (st), (val))
+#define sk_GENERAL_NAMES_delete(st, i) SKM_sk_delete(GENERAL_NAMES, (st), (i))
+#define sk_GENERAL_NAMES_delete_ptr(st, ptr) SKM_sk_delete_ptr(GENERAL_NAMES, (st), (ptr))
+#define sk_GENERAL_NAMES_insert(st, val, i) SKM_sk_insert(GENERAL_NAMES, (st), (val), (i))
+#define sk_GENERAL_NAMES_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(GENERAL_NAMES, (st), (cmp))
+#define sk_GENERAL_NAMES_dup(st) SKM_sk_dup(GENERAL_NAMES, st)
+#define sk_GENERAL_NAMES_pop_free(st, free_func) SKM_sk_pop_free(GENERAL_NAMES, (st), (free_func))
+#define sk_GENERAL_NAMES_shift(st) SKM_sk_shift(GENERAL_NAMES, (st))
+#define sk_GENERAL_NAMES_pop(st) SKM_sk_pop(GENERAL_NAMES, (st))
+#define sk_GENERAL_NAMES_sort(st) SKM_sk_sort(GENERAL_NAMES, (st))
+#define sk_GENERAL_NAMES_is_sorted(st) SKM_sk_is_sorted(GENERAL_NAMES, (st))
+
+#define sk_GENERAL_SUBTREE_new(st) SKM_sk_new(GENERAL_SUBTREE, (st))
+#define sk_GENERAL_SUBTREE_new_null() SKM_sk_new_null(GENERAL_SUBTREE)
+#define sk_GENERAL_SUBTREE_free(st) SKM_sk_free(GENERAL_SUBTREE, (st))
+#define sk_GENERAL_SUBTREE_num(st) SKM_sk_num(GENERAL_SUBTREE, (st))
+#define sk_GENERAL_SUBTREE_value(st, i) SKM_sk_value(GENERAL_SUBTREE, (st), (i))
+#define sk_GENERAL_SUBTREE_set(st, i, val) SKM_sk_set(GENERAL_SUBTREE, (st), (i), (val))
+#define sk_GENERAL_SUBTREE_zero(st) SKM_sk_zero(GENERAL_SUBTREE, (st))
+#define sk_GENERAL_SUBTREE_push(st, val) SKM_sk_push(GENERAL_SUBTREE, (st), (val))
+#define sk_GENERAL_SUBTREE_unshift(st, val) SKM_sk_unshift(GENERAL_SUBTREE, (st), (val))
+#define sk_GENERAL_SUBTREE_find(st, val) SKM_sk_find(GENERAL_SUBTREE, (st), (val))
+#define sk_GENERAL_SUBTREE_find_ex(st, val) SKM_sk_find_ex(GENERAL_SUBTREE, (st), (val))
+#define sk_GENERAL_SUBTREE_delete(st, i) SKM_sk_delete(GENERAL_SUBTREE, (st), (i))
+#define sk_GENERAL_SUBTREE_delete_ptr(st, ptr) SKM_sk_delete_ptr(GENERAL_SUBTREE, (st), (ptr))
+#define sk_GENERAL_SUBTREE_insert(st, val, i) SKM_sk_insert(GENERAL_SUBTREE, (st), (val), (i))
+#define sk_GENERAL_SUBTREE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(GENERAL_SUBTREE, (st), (cmp))
+#define sk_GENERAL_SUBTREE_dup(st) SKM_sk_dup(GENERAL_SUBTREE, st)
+#define sk_GENERAL_SUBTREE_pop_free(st, free_func) SKM_sk_pop_free(GENERAL_SUBTREE, (st), (free_func))
+#define sk_GENERAL_SUBTREE_shift(st) SKM_sk_shift(GENERAL_SUBTREE, (st))
+#define sk_GENERAL_SUBTREE_pop(st) SKM_sk_pop(GENERAL_SUBTREE, (st))
+#define sk_GENERAL_SUBTREE_sort(st) SKM_sk_sort(GENERAL_SUBTREE, (st))
+#define sk_GENERAL_SUBTREE_is_sorted(st) SKM_sk_is_sorted(GENERAL_SUBTREE, (st))
+
+#define sk_IPAddressFamily_new(st) SKM_sk_new(IPAddressFamily, (st))
+#define sk_IPAddressFamily_new_null() SKM_sk_new_null(IPAddressFamily)
+#define sk_IPAddressFamily_free(st) SKM_sk_free(IPAddressFamily, (st))
+#define sk_IPAddressFamily_num(st) SKM_sk_num(IPAddressFamily, (st))
+#define sk_IPAddressFamily_value(st, i) SKM_sk_value(IPAddressFamily, (st), (i))
+#define sk_IPAddressFamily_set(st, i, val) SKM_sk_set(IPAddressFamily, (st), (i), (val))
+#define sk_IPAddressFamily_zero(st) SKM_sk_zero(IPAddressFamily, (st))
+#define sk_IPAddressFamily_push(st, val) SKM_sk_push(IPAddressFamily, (st), (val))
+#define sk_IPAddressFamily_unshift(st, val) SKM_sk_unshift(IPAddressFamily, (st), (val))
+#define sk_IPAddressFamily_find(st, val) SKM_sk_find(IPAddressFamily, (st), (val))
+#define sk_IPAddressFamily_find_ex(st, val) SKM_sk_find_ex(IPAddressFamily, (st), (val))
+#define sk_IPAddressFamily_delete(st, i) SKM_sk_delete(IPAddressFamily, (st), (i))
+#define sk_IPAddressFamily_delete_ptr(st, ptr) SKM_sk_delete_ptr(IPAddressFamily, (st), (ptr))
+#define sk_IPAddressFamily_insert(st, val, i) SKM_sk_insert(IPAddressFamily, (st), (val), (i))
+#define sk_IPAddressFamily_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(IPAddressFamily, (st), (cmp))
+#define sk_IPAddressFamily_dup(st) SKM_sk_dup(IPAddressFamily, st)
+#define sk_IPAddressFamily_pop_free(st, free_func) SKM_sk_pop_free(IPAddressFamily, (st), (free_func))
+#define sk_IPAddressFamily_shift(st) SKM_sk_shift(IPAddressFamily, (st))
+#define sk_IPAddressFamily_pop(st) SKM_sk_pop(IPAddressFamily, (st))
+#define sk_IPAddressFamily_sort(st) SKM_sk_sort(IPAddressFamily, (st))
+#define sk_IPAddressFamily_is_sorted(st) SKM_sk_is_sorted(IPAddressFamily, (st))
+
+#define sk_IPAddressOrRange_new(st) SKM_sk_new(IPAddressOrRange, (st))
+#define sk_IPAddressOrRange_new_null() SKM_sk_new_null(IPAddressOrRange)
+#define sk_IPAddressOrRange_free(st) SKM_sk_free(IPAddressOrRange, (st))
+#define sk_IPAddressOrRange_num(st) SKM_sk_num(IPAddressOrRange, (st))
+#define sk_IPAddressOrRange_value(st, i) SKM_sk_value(IPAddressOrRange, (st), (i))
+#define sk_IPAddressOrRange_set(st, i, val) SKM_sk_set(IPAddressOrRange, (st), (i), (val))
+#define sk_IPAddressOrRange_zero(st) SKM_sk_zero(IPAddressOrRange, (st))
+#define sk_IPAddressOrRange_push(st, val) SKM_sk_push(IPAddressOrRange, (st), (val))
+#define sk_IPAddressOrRange_unshift(st, val) SKM_sk_unshift(IPAddressOrRange, (st), (val))
+#define sk_IPAddressOrRange_find(st, val) SKM_sk_find(IPAddressOrRange, (st), (val))
+#define sk_IPAddressOrRange_find_ex(st, val) SKM_sk_find_ex(IPAddressOrRange, (st), (val))
+#define sk_IPAddressOrRange_delete(st, i) SKM_sk_delete(IPAddressOrRange, (st), (i))
+#define sk_IPAddressOrRange_delete_ptr(st, ptr) SKM_sk_delete_ptr(IPAddressOrRange, (st), (ptr))
+#define sk_IPAddressOrRange_insert(st, val, i) SKM_sk_insert(IPAddressOrRange, (st), (val), (i))
+#define sk_IPAddressOrRange_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(IPAddressOrRange, (st), (cmp))
+#define sk_IPAddressOrRange_dup(st) SKM_sk_dup(IPAddressOrRange, st)
+#define sk_IPAddressOrRange_pop_free(st, free_func) SKM_sk_pop_free(IPAddressOrRange, (st), (free_func))
+#define sk_IPAddressOrRange_shift(st) SKM_sk_shift(IPAddressOrRange, (st))
+#define sk_IPAddressOrRange_pop(st) SKM_sk_pop(IPAddressOrRange, (st))
+#define sk_IPAddressOrRange_sort(st) SKM_sk_sort(IPAddressOrRange, (st))
+#define sk_IPAddressOrRange_is_sorted(st) SKM_sk_is_sorted(IPAddressOrRange, (st))
+
 #define sk_KRB5_APREQBODY_new(st) SKM_sk_new(KRB5_APREQBODY, (st))
 #define sk_KRB5_APREQBODY_new_null() SKM_sk_new_null(KRB5_APREQBODY)
 #define sk_KRB5_APREQBODY_free(st) SKM_sk_free(KRB5_APREQBODY, (st))
@@ -578,6 +798,7 @@ STACK_OF(type) \
 #define sk_KRB5_APREQBODY_push(st, val) SKM_sk_push(KRB5_APREQBODY, (st), (val))
 #define sk_KRB5_APREQBODY_unshift(st, val) SKM_sk_unshift(KRB5_APREQBODY, (st), (val))
 #define sk_KRB5_APREQBODY_find(st, val) SKM_sk_find(KRB5_APREQBODY, (st), (val))
+#define sk_KRB5_APREQBODY_find_ex(st, val) SKM_sk_find_ex(KRB5_APREQBODY, (st), (val))
 #define sk_KRB5_APREQBODY_delete(st, i) SKM_sk_delete(KRB5_APREQBODY, (st), (i))
 #define sk_KRB5_APREQBODY_delete_ptr(st, ptr) SKM_sk_delete_ptr(KRB5_APREQBODY, (st), (ptr))
 #define sk_KRB5_APREQBODY_insert(st, val, i) SKM_sk_insert(KRB5_APREQBODY, (st), (val), (i))
@@ -599,6 +820,7 @@ STACK_OF(type) \
 #define sk_KRB5_AUTHDATA_push(st, val) SKM_sk_push(KRB5_AUTHDATA, (st), (val))
 #define sk_KRB5_AUTHDATA_unshift(st, val) SKM_sk_unshift(KRB5_AUTHDATA, (st), (val))
 #define sk_KRB5_AUTHDATA_find(st, val) SKM_sk_find(KRB5_AUTHDATA, (st), (val))
+#define sk_KRB5_AUTHDATA_find_ex(st, val) SKM_sk_find_ex(KRB5_AUTHDATA, (st), (val))
 #define sk_KRB5_AUTHDATA_delete(st, i) SKM_sk_delete(KRB5_AUTHDATA, (st), (i))
 #define sk_KRB5_AUTHDATA_delete_ptr(st, ptr) SKM_sk_delete_ptr(KRB5_AUTHDATA, (st), (ptr))
 #define sk_KRB5_AUTHDATA_insert(st, val, i) SKM_sk_insert(KRB5_AUTHDATA, (st), (val), (i))
@@ -620,6 +842,7 @@ STACK_OF(type) \
 #define sk_KRB5_AUTHENTBODY_push(st, val) SKM_sk_push(KRB5_AUTHENTBODY, (st), (val))
 #define sk_KRB5_AUTHENTBODY_unshift(st, val) SKM_sk_unshift(KRB5_AUTHENTBODY, (st), (val))
 #define sk_KRB5_AUTHENTBODY_find(st, val) SKM_sk_find(KRB5_AUTHENTBODY, (st), (val))
+#define sk_KRB5_AUTHENTBODY_find_ex(st, val) SKM_sk_find_ex(KRB5_AUTHENTBODY, (st), (val))
 #define sk_KRB5_AUTHENTBODY_delete(st, i) SKM_sk_delete(KRB5_AUTHENTBODY, (st), (i))
 #define sk_KRB5_AUTHENTBODY_delete_ptr(st, ptr) SKM_sk_delete_ptr(KRB5_AUTHENTBODY, (st), (ptr))
 #define sk_KRB5_AUTHENTBODY_insert(st, val, i) SKM_sk_insert(KRB5_AUTHENTBODY, (st), (val), (i))
@@ -641,6 +864,7 @@ STACK_OF(type) \
 #define sk_KRB5_CHECKSUM_push(st, val) SKM_sk_push(KRB5_CHECKSUM, (st), (val))
 #define sk_KRB5_CHECKSUM_unshift(st, val) SKM_sk_unshift(KRB5_CHECKSUM, (st), (val))
 #define sk_KRB5_CHECKSUM_find(st, val) SKM_sk_find(KRB5_CHECKSUM, (st), (val))
+#define sk_KRB5_CHECKSUM_find_ex(st, val) SKM_sk_find_ex(KRB5_CHECKSUM, (st), (val))
 #define sk_KRB5_CHECKSUM_delete(st, i) SKM_sk_delete(KRB5_CHECKSUM, (st), (i))
 #define sk_KRB5_CHECKSUM_delete_ptr(st, ptr) SKM_sk_delete_ptr(KRB5_CHECKSUM, (st), (ptr))
 #define sk_KRB5_CHECKSUM_insert(st, val, i) SKM_sk_insert(KRB5_CHECKSUM, (st), (val), (i))
@@ -662,6 +886,7 @@ STACK_OF(type) \
 #define sk_KRB5_ENCDATA_push(st, val) SKM_sk_push(KRB5_ENCDATA, (st), (val))
 #define sk_KRB5_ENCDATA_unshift(st, val) SKM_sk_unshift(KRB5_ENCDATA, (st), (val))
 #define sk_KRB5_ENCDATA_find(st, val) SKM_sk_find(KRB5_ENCDATA, (st), (val))
+#define sk_KRB5_ENCDATA_find_ex(st, val) SKM_sk_find_ex(KRB5_ENCDATA, (st), (val))
 #define sk_KRB5_ENCDATA_delete(st, i) SKM_sk_delete(KRB5_ENCDATA, (st), (i))
 #define sk_KRB5_ENCDATA_delete_ptr(st, ptr) SKM_sk_delete_ptr(KRB5_ENCDATA, (st), (ptr))
 #define sk_KRB5_ENCDATA_insert(st, val, i) SKM_sk_insert(KRB5_ENCDATA, (st), (val), (i))
@@ -683,6 +908,7 @@ STACK_OF(type) \
 #define sk_KRB5_ENCKEY_push(st, val) SKM_sk_push(KRB5_ENCKEY, (st), (val))
 #define sk_KRB5_ENCKEY_unshift(st, val) SKM_sk_unshift(KRB5_ENCKEY, (st), (val))
 #define sk_KRB5_ENCKEY_find(st, val) SKM_sk_find(KRB5_ENCKEY, (st), (val))
+#define sk_KRB5_ENCKEY_find_ex(st, val) SKM_sk_find_ex(KRB5_ENCKEY, (st), (val))
 #define sk_KRB5_ENCKEY_delete(st, i) SKM_sk_delete(KRB5_ENCKEY, (st), (i))
 #define sk_KRB5_ENCKEY_delete_ptr(st, ptr) SKM_sk_delete_ptr(KRB5_ENCKEY, (st), (ptr))
 #define sk_KRB5_ENCKEY_insert(st, val, i) SKM_sk_insert(KRB5_ENCKEY, (st), (val), (i))
@@ -704,6 +930,7 @@ STACK_OF(type) \
 #define sk_KRB5_PRINCNAME_push(st, val) SKM_sk_push(KRB5_PRINCNAME, (st), (val))
 #define sk_KRB5_PRINCNAME_unshift(st, val) SKM_sk_unshift(KRB5_PRINCNAME, (st), (val))
 #define sk_KRB5_PRINCNAME_find(st, val) SKM_sk_find(KRB5_PRINCNAME, (st), (val))
+#define sk_KRB5_PRINCNAME_find_ex(st, val) SKM_sk_find_ex(KRB5_PRINCNAME, (st), (val))
 #define sk_KRB5_PRINCNAME_delete(st, i) SKM_sk_delete(KRB5_PRINCNAME, (st), (i))
 #define sk_KRB5_PRINCNAME_delete_ptr(st, ptr) SKM_sk_delete_ptr(KRB5_PRINCNAME, (st), (ptr))
 #define sk_KRB5_PRINCNAME_insert(st, val, i) SKM_sk_insert(KRB5_PRINCNAME, (st), (val), (i))
@@ -725,6 +952,7 @@ STACK_OF(type) \
 #define sk_KRB5_TKTBODY_push(st, val) SKM_sk_push(KRB5_TKTBODY, (st), (val))
 #define sk_KRB5_TKTBODY_unshift(st, val) SKM_sk_unshift(KRB5_TKTBODY, (st), (val))
 #define sk_KRB5_TKTBODY_find(st, val) SKM_sk_find(KRB5_TKTBODY, (st), (val))
+#define sk_KRB5_TKTBODY_find_ex(st, val) SKM_sk_find_ex(KRB5_TKTBODY, (st), (val))
 #define sk_KRB5_TKTBODY_delete(st, i) SKM_sk_delete(KRB5_TKTBODY, (st), (i))
 #define sk_KRB5_TKTBODY_delete_ptr(st, ptr) SKM_sk_delete_ptr(KRB5_TKTBODY, (st), (ptr))
 #define sk_KRB5_TKTBODY_insert(st, val, i) SKM_sk_insert(KRB5_TKTBODY, (st), (val), (i))
@@ -746,6 +974,7 @@ STACK_OF(type) \
 #define sk_MIME_HEADER_push(st, val) SKM_sk_push(MIME_HEADER, (st), (val))
 #define sk_MIME_HEADER_unshift(st, val) SKM_sk_unshift(MIME_HEADER, (st), (val))
 #define sk_MIME_HEADER_find(st, val) SKM_sk_find(MIME_HEADER, (st), (val))
+#define sk_MIME_HEADER_find_ex(st, val) SKM_sk_find_ex(MIME_HEADER, (st), (val))
 #define sk_MIME_HEADER_delete(st, i) SKM_sk_delete(MIME_HEADER, (st), (i))
 #define sk_MIME_HEADER_delete_ptr(st, ptr) SKM_sk_delete_ptr(MIME_HEADER, (st), (ptr))
 #define sk_MIME_HEADER_insert(st, val, i) SKM_sk_insert(MIME_HEADER, (st), (val), (i))
@@ -767,6 +996,7 @@ STACK_OF(type) \
 #define sk_MIME_PARAM_push(st, val) SKM_sk_push(MIME_PARAM, (st), (val))
 #define sk_MIME_PARAM_unshift(st, val) SKM_sk_unshift(MIME_PARAM, (st), (val))
 #define sk_MIME_PARAM_find(st, val) SKM_sk_find(MIME_PARAM, (st), (val))
+#define sk_MIME_PARAM_find_ex(st, val) SKM_sk_find_ex(MIME_PARAM, (st), (val))
 #define sk_MIME_PARAM_delete(st, i) SKM_sk_delete(MIME_PARAM, (st), (i))
 #define sk_MIME_PARAM_delete_ptr(st, ptr) SKM_sk_delete_ptr(MIME_PARAM, (st), (ptr))
 #define sk_MIME_PARAM_insert(st, val, i) SKM_sk_insert(MIME_PARAM, (st), (val), (i))
@@ -788,6 +1018,7 @@ STACK_OF(type) \
 #define sk_NAME_FUNCS_push(st, val) SKM_sk_push(NAME_FUNCS, (st), (val))
 #define sk_NAME_FUNCS_unshift(st, val) SKM_sk_unshift(NAME_FUNCS, (st), (val))
 #define sk_NAME_FUNCS_find(st, val) SKM_sk_find(NAME_FUNCS, (st), (val))
+#define sk_NAME_FUNCS_find_ex(st, val) SKM_sk_find_ex(NAME_FUNCS, (st), (val))
 #define sk_NAME_FUNCS_delete(st, i) SKM_sk_delete(NAME_FUNCS, (st), (i))
 #define sk_NAME_FUNCS_delete_ptr(st, ptr) SKM_sk_delete_ptr(NAME_FUNCS, (st), (ptr))
 #define sk_NAME_FUNCS_insert(st, val, i) SKM_sk_insert(NAME_FUNCS, (st), (val), (i))
@@ -809,6 +1040,7 @@ STACK_OF(type) \
 #define sk_OCSP_CERTID_push(st, val) SKM_sk_push(OCSP_CERTID, (st), (val))
 #define sk_OCSP_CERTID_unshift(st, val) SKM_sk_unshift(OCSP_CERTID, (st), (val))
 #define sk_OCSP_CERTID_find(st, val) SKM_sk_find(OCSP_CERTID, (st), (val))
+#define sk_OCSP_CERTID_find_ex(st, val) SKM_sk_find_ex(OCSP_CERTID, (st), (val))
 #define sk_OCSP_CERTID_delete(st, i) SKM_sk_delete(OCSP_CERTID, (st), (i))
 #define sk_OCSP_CERTID_delete_ptr(st, ptr) SKM_sk_delete_ptr(OCSP_CERTID, (st), (ptr))
 #define sk_OCSP_CERTID_insert(st, val, i) SKM_sk_insert(OCSP_CERTID, (st), (val), (i))
@@ -830,6 +1062,7 @@ STACK_OF(type) \
 #define sk_OCSP_ONEREQ_push(st, val) SKM_sk_push(OCSP_ONEREQ, (st), (val))
 #define sk_OCSP_ONEREQ_unshift(st, val) SKM_sk_unshift(OCSP_ONEREQ, (st), (val))
 #define sk_OCSP_ONEREQ_find(st, val) SKM_sk_find(OCSP_ONEREQ, (st), (val))
+#define sk_OCSP_ONEREQ_find_ex(st, val) SKM_sk_find_ex(OCSP_ONEREQ, (st), (val))
 #define sk_OCSP_ONEREQ_delete(st, i) SKM_sk_delete(OCSP_ONEREQ, (st), (i))
 #define sk_OCSP_ONEREQ_delete_ptr(st, ptr) SKM_sk_delete_ptr(OCSP_ONEREQ, (st), (ptr))
 #define sk_OCSP_ONEREQ_insert(st, val, i) SKM_sk_insert(OCSP_ONEREQ, (st), (val), (i))
@@ -841,6 +1074,28 @@ STACK_OF(type) \
 #define sk_OCSP_ONEREQ_sort(st) SKM_sk_sort(OCSP_ONEREQ, (st))
 #define sk_OCSP_ONEREQ_is_sorted(st) SKM_sk_is_sorted(OCSP_ONEREQ, (st))
 
+#define sk_OCSP_RESPID_new(st) SKM_sk_new(OCSP_RESPID, (st))
+#define sk_OCSP_RESPID_new_null() SKM_sk_new_null(OCSP_RESPID)
+#define sk_OCSP_RESPID_free(st) SKM_sk_free(OCSP_RESPID, (st))
+#define sk_OCSP_RESPID_num(st) SKM_sk_num(OCSP_RESPID, (st))
+#define sk_OCSP_RESPID_value(st, i) SKM_sk_value(OCSP_RESPID, (st), (i))
+#define sk_OCSP_RESPID_set(st, i, val) SKM_sk_set(OCSP_RESPID, (st), (i), (val))
+#define sk_OCSP_RESPID_zero(st) SKM_sk_zero(OCSP_RESPID, (st))
+#define sk_OCSP_RESPID_push(st, val) SKM_sk_push(OCSP_RESPID, (st), (val))
+#define sk_OCSP_RESPID_unshift(st, val) SKM_sk_unshift(OCSP_RESPID, (st), (val))
+#define sk_OCSP_RESPID_find(st, val) SKM_sk_find(OCSP_RESPID, (st), (val))
+#define sk_OCSP_RESPID_find_ex(st, val) SKM_sk_find_ex(OCSP_RESPID, (st), (val))
+#define sk_OCSP_RESPID_delete(st, i) SKM_sk_delete(OCSP_RESPID, (st), (i))
+#define sk_OCSP_RESPID_delete_ptr(st, ptr) SKM_sk_delete_ptr(OCSP_RESPID, (st), (ptr))
+#define sk_OCSP_RESPID_insert(st, val, i) SKM_sk_insert(OCSP_RESPID, (st), (val), (i))
+#define sk_OCSP_RESPID_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(OCSP_RESPID, (st), (cmp))
+#define sk_OCSP_RESPID_dup(st) SKM_sk_dup(OCSP_RESPID, st)
+#define sk_OCSP_RESPID_pop_free(st, free_func) SKM_sk_pop_free(OCSP_RESPID, (st), (free_func))
+#define sk_OCSP_RESPID_shift(st) SKM_sk_shift(OCSP_RESPID, (st))
+#define sk_OCSP_RESPID_pop(st) SKM_sk_pop(OCSP_RESPID, (st))
+#define sk_OCSP_RESPID_sort(st) SKM_sk_sort(OCSP_RESPID, (st))
+#define sk_OCSP_RESPID_is_sorted(st) SKM_sk_is_sorted(OCSP_RESPID, (st))
+
 #define sk_OCSP_SINGLERESP_new(st) SKM_sk_new(OCSP_SINGLERESP, (st))
 #define sk_OCSP_SINGLERESP_new_null() SKM_sk_new_null(OCSP_SINGLERESP)
 #define sk_OCSP_SINGLERESP_free(st) SKM_sk_free(OCSP_SINGLERESP, (st))
@@ -851,6 +1106,7 @@ STACK_OF(type) \
 #define sk_OCSP_SINGLERESP_push(st, val) SKM_sk_push(OCSP_SINGLERESP, (st), (val))
 #define sk_OCSP_SINGLERESP_unshift(st, val) SKM_sk_unshift(OCSP_SINGLERESP, (st), (val))
 #define sk_OCSP_SINGLERESP_find(st, val) SKM_sk_find(OCSP_SINGLERESP, (st), (val))
+#define sk_OCSP_SINGLERESP_find_ex(st, val) SKM_sk_find_ex(OCSP_SINGLERESP, (st), (val))
 #define sk_OCSP_SINGLERESP_delete(st, i) SKM_sk_delete(OCSP_SINGLERESP, (st), (i))
 #define sk_OCSP_SINGLERESP_delete_ptr(st, ptr) SKM_sk_delete_ptr(OCSP_SINGLERESP, (st), (ptr))
 #define sk_OCSP_SINGLERESP_insert(st, val, i) SKM_sk_insert(OCSP_SINGLERESP, (st), (val), (i))
@@ -872,6 +1128,7 @@ STACK_OF(type) \
 #define sk_PKCS12_SAFEBAG_push(st, val) SKM_sk_push(PKCS12_SAFEBAG, (st), (val))
 #define sk_PKCS12_SAFEBAG_unshift(st, val) SKM_sk_unshift(PKCS12_SAFEBAG, (st), (val))
 #define sk_PKCS12_SAFEBAG_find(st, val) SKM_sk_find(PKCS12_SAFEBAG, (st), (val))
+#define sk_PKCS12_SAFEBAG_find_ex(st, val) SKM_sk_find_ex(PKCS12_SAFEBAG, (st), (val))
 #define sk_PKCS12_SAFEBAG_delete(st, i) SKM_sk_delete(PKCS12_SAFEBAG, (st), (i))
 #define sk_PKCS12_SAFEBAG_delete_ptr(st, ptr) SKM_sk_delete_ptr(PKCS12_SAFEBAG, (st), (ptr))
 #define sk_PKCS12_SAFEBAG_insert(st, val, i) SKM_sk_insert(PKCS12_SAFEBAG, (st), (val), (i))
@@ -893,6 +1150,7 @@ STACK_OF(type) \
 #define sk_PKCS7_push(st, val) SKM_sk_push(PKCS7, (st), (val))
 #define sk_PKCS7_unshift(st, val) SKM_sk_unshift(PKCS7, (st), (val))
 #define sk_PKCS7_find(st, val) SKM_sk_find(PKCS7, (st), (val))
+#define sk_PKCS7_find_ex(st, val) SKM_sk_find_ex(PKCS7, (st), (val))
 #define sk_PKCS7_delete(st, i) SKM_sk_delete(PKCS7, (st), (i))
 #define sk_PKCS7_delete_ptr(st, ptr) SKM_sk_delete_ptr(PKCS7, (st), (ptr))
 #define sk_PKCS7_insert(st, val, i) SKM_sk_insert(PKCS7, (st), (val), (i))
@@ -914,6 +1172,7 @@ STACK_OF(type) \
 #define sk_PKCS7_RECIP_INFO_push(st, val) SKM_sk_push(PKCS7_RECIP_INFO, (st), (val))
 #define sk_PKCS7_RECIP_INFO_unshift(st, val) SKM_sk_unshift(PKCS7_RECIP_INFO, (st), (val))
 #define sk_PKCS7_RECIP_INFO_find(st, val) SKM_sk_find(PKCS7_RECIP_INFO, (st), (val))
+#define sk_PKCS7_RECIP_INFO_find_ex(st, val) SKM_sk_find_ex(PKCS7_RECIP_INFO, (st), (val))
 #define sk_PKCS7_RECIP_INFO_delete(st, i) SKM_sk_delete(PKCS7_RECIP_INFO, (st), (i))
 #define sk_PKCS7_RECIP_INFO_delete_ptr(st, ptr) SKM_sk_delete_ptr(PKCS7_RECIP_INFO, (st), (ptr))
 #define sk_PKCS7_RECIP_INFO_insert(st, val, i) SKM_sk_insert(PKCS7_RECIP_INFO, (st), (val), (i))
@@ -935,6 +1194,7 @@ STACK_OF(type) \
 #define sk_PKCS7_SIGNER_INFO_push(st, val) SKM_sk_push(PKCS7_SIGNER_INFO, (st), (val))
 #define sk_PKCS7_SIGNER_INFO_unshift(st, val) SKM_sk_unshift(PKCS7_SIGNER_INFO, (st), (val))
 #define sk_PKCS7_SIGNER_INFO_find(st, val) SKM_sk_find(PKCS7_SIGNER_INFO, (st), (val))
+#define sk_PKCS7_SIGNER_INFO_find_ex(st, val) SKM_sk_find_ex(PKCS7_SIGNER_INFO, (st), (val))
 #define sk_PKCS7_SIGNER_INFO_delete(st, i) SKM_sk_delete(PKCS7_SIGNER_INFO, (st), (i))
 #define sk_PKCS7_SIGNER_INFO_delete_ptr(st, ptr) SKM_sk_delete_ptr(PKCS7_SIGNER_INFO, (st), (ptr))
 #define sk_PKCS7_SIGNER_INFO_insert(st, val, i) SKM_sk_insert(PKCS7_SIGNER_INFO, (st), (val), (i))
@@ -956,6 +1216,7 @@ STACK_OF(type) \
 #define sk_POLICYINFO_push(st, val) SKM_sk_push(POLICYINFO, (st), (val))
 #define sk_POLICYINFO_unshift(st, val) SKM_sk_unshift(POLICYINFO, (st), (val))
 #define sk_POLICYINFO_find(st, val) SKM_sk_find(POLICYINFO, (st), (val))
+#define sk_POLICYINFO_find_ex(st, val) SKM_sk_find_ex(POLICYINFO, (st), (val))
 #define sk_POLICYINFO_delete(st, i) SKM_sk_delete(POLICYINFO, (st), (i))
 #define sk_POLICYINFO_delete_ptr(st, ptr) SKM_sk_delete_ptr(POLICYINFO, (st), (ptr))
 #define sk_POLICYINFO_insert(st, val, i) SKM_sk_insert(POLICYINFO, (st), (val), (i))
@@ -977,6 +1238,7 @@ STACK_OF(type) \
 #define sk_POLICYQUALINFO_push(st, val) SKM_sk_push(POLICYQUALINFO, (st), (val))
 #define sk_POLICYQUALINFO_unshift(st, val) SKM_sk_unshift(POLICYQUALINFO, (st), (val))
 #define sk_POLICYQUALINFO_find(st, val) SKM_sk_find(POLICYQUALINFO, (st), (val))
+#define sk_POLICYQUALINFO_find_ex(st, val) SKM_sk_find_ex(POLICYQUALINFO, (st), (val))
 #define sk_POLICYQUALINFO_delete(st, i) SKM_sk_delete(POLICYQUALINFO, (st), (i))
 #define sk_POLICYQUALINFO_delete_ptr(st, ptr) SKM_sk_delete_ptr(POLICYQUALINFO, (st), (ptr))
 #define sk_POLICYQUALINFO_insert(st, val, i) SKM_sk_insert(POLICYQUALINFO, (st), (val), (i))
@@ -988,6 +1250,28 @@ STACK_OF(type) \
 #define sk_POLICYQUALINFO_sort(st) SKM_sk_sort(POLICYQUALINFO, (st))
 #define sk_POLICYQUALINFO_is_sorted(st) SKM_sk_is_sorted(POLICYQUALINFO, (st))
 
+#define sk_POLICY_MAPPING_new(st) SKM_sk_new(POLICY_MAPPING, (st))
+#define sk_POLICY_MAPPING_new_null() SKM_sk_new_null(POLICY_MAPPING)
+#define sk_POLICY_MAPPING_free(st) SKM_sk_free(POLICY_MAPPING, (st))
+#define sk_POLICY_MAPPING_num(st) SKM_sk_num(POLICY_MAPPING, (st))
+#define sk_POLICY_MAPPING_value(st, i) SKM_sk_value(POLICY_MAPPING, (st), (i))
+#define sk_POLICY_MAPPING_set(st, i, val) SKM_sk_set(POLICY_MAPPING, (st), (i), (val))
+#define sk_POLICY_MAPPING_zero(st) SKM_sk_zero(POLICY_MAPPING, (st))
+#define sk_POLICY_MAPPING_push(st, val) SKM_sk_push(POLICY_MAPPING, (st), (val))
+#define sk_POLICY_MAPPING_unshift(st, val) SKM_sk_unshift(POLICY_MAPPING, (st), (val))
+#define sk_POLICY_MAPPING_find(st, val) SKM_sk_find(POLICY_MAPPING, (st), (val))
+#define sk_POLICY_MAPPING_find_ex(st, val) SKM_sk_find_ex(POLICY_MAPPING, (st), (val))
+#define sk_POLICY_MAPPING_delete(st, i) SKM_sk_delete(POLICY_MAPPING, (st), (i))
+#define sk_POLICY_MAPPING_delete_ptr(st, ptr) SKM_sk_delete_ptr(POLICY_MAPPING, (st), (ptr))
+#define sk_POLICY_MAPPING_insert(st, val, i) SKM_sk_insert(POLICY_MAPPING, (st), (val), (i))
+#define sk_POLICY_MAPPING_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(POLICY_MAPPING, (st), (cmp))
+#define sk_POLICY_MAPPING_dup(st) SKM_sk_dup(POLICY_MAPPING, st)
+#define sk_POLICY_MAPPING_pop_free(st, free_func) SKM_sk_pop_free(POLICY_MAPPING, (st), (free_func))
+#define sk_POLICY_MAPPING_shift(st) SKM_sk_shift(POLICY_MAPPING, (st))
+#define sk_POLICY_MAPPING_pop(st) SKM_sk_pop(POLICY_MAPPING, (st))
+#define sk_POLICY_MAPPING_sort(st) SKM_sk_sort(POLICY_MAPPING, (st))
+#define sk_POLICY_MAPPING_is_sorted(st) SKM_sk_is_sorted(POLICY_MAPPING, (st))
+
 #define sk_SSL_CIPHER_new(st) SKM_sk_new(SSL_CIPHER, (st))
 #define sk_SSL_CIPHER_new_null() SKM_sk_new_null(SSL_CIPHER)
 #define sk_SSL_CIPHER_free(st) SKM_sk_free(SSL_CIPHER, (st))
@@ -998,6 +1282,7 @@ STACK_OF(type) \
 #define sk_SSL_CIPHER_push(st, val) SKM_sk_push(SSL_CIPHER, (st), (val))
 #define sk_SSL_CIPHER_unshift(st, val) SKM_sk_unshift(SSL_CIPHER, (st), (val))
 #define sk_SSL_CIPHER_find(st, val) SKM_sk_find(SSL_CIPHER, (st), (val))
+#define sk_SSL_CIPHER_find_ex(st, val) SKM_sk_find_ex(SSL_CIPHER, (st), (val))
 #define sk_SSL_CIPHER_delete(st, i) SKM_sk_delete(SSL_CIPHER, (st), (i))
 #define sk_SSL_CIPHER_delete_ptr(st, ptr) SKM_sk_delete_ptr(SSL_CIPHER, (st), (ptr))
 #define sk_SSL_CIPHER_insert(st, val, i) SKM_sk_insert(SSL_CIPHER, (st), (val), (i))
@@ -1019,6 +1304,7 @@ STACK_OF(type) \
 #define sk_SSL_COMP_push(st, val) SKM_sk_push(SSL_COMP, (st), (val))
 #define sk_SSL_COMP_unshift(st, val) SKM_sk_unshift(SSL_COMP, (st), (val))
 #define sk_SSL_COMP_find(st, val) SKM_sk_find(SSL_COMP, (st), (val))
+#define sk_SSL_COMP_find_ex(st, val) SKM_sk_find_ex(SSL_COMP, (st), (val))
 #define sk_SSL_COMP_delete(st, i) SKM_sk_delete(SSL_COMP, (st), (i))
 #define sk_SSL_COMP_delete_ptr(st, ptr) SKM_sk_delete_ptr(SSL_COMP, (st), (ptr))
 #define sk_SSL_COMP_insert(st, val, i) SKM_sk_insert(SSL_COMP, (st), (val), (i))
@@ -1030,6 +1316,28 @@ STACK_OF(type) \
 #define sk_SSL_COMP_sort(st) SKM_sk_sort(SSL_COMP, (st))
 #define sk_SSL_COMP_is_sorted(st) SKM_sk_is_sorted(SSL_COMP, (st))
 
+#define sk_STORE_OBJECT_new(st) SKM_sk_new(STORE_OBJECT, (st))
+#define sk_STORE_OBJECT_new_null() SKM_sk_new_null(STORE_OBJECT)
+#define sk_STORE_OBJECT_free(st) SKM_sk_free(STORE_OBJECT, (st))
+#define sk_STORE_OBJECT_num(st) SKM_sk_num(STORE_OBJECT, (st))
+#define sk_STORE_OBJECT_value(st, i) SKM_sk_value(STORE_OBJECT, (st), (i))
+#define sk_STORE_OBJECT_set(st, i, val) SKM_sk_set(STORE_OBJECT, (st), (i), (val))
+#define sk_STORE_OBJECT_zero(st) SKM_sk_zero(STORE_OBJECT, (st))
+#define sk_STORE_OBJECT_push(st, val) SKM_sk_push(STORE_OBJECT, (st), (val))
+#define sk_STORE_OBJECT_unshift(st, val) SKM_sk_unshift(STORE_OBJECT, (st), (val))
+#define sk_STORE_OBJECT_find(st, val) SKM_sk_find(STORE_OBJECT, (st), (val))
+#define sk_STORE_OBJECT_find_ex(st, val) SKM_sk_find_ex(STORE_OBJECT, (st), (val))
+#define sk_STORE_OBJECT_delete(st, i) SKM_sk_delete(STORE_OBJECT, (st), (i))
+#define sk_STORE_OBJECT_delete_ptr(st, ptr) SKM_sk_delete_ptr(STORE_OBJECT, (st), (ptr))
+#define sk_STORE_OBJECT_insert(st, val, i) SKM_sk_insert(STORE_OBJECT, (st), (val), (i))
+#define sk_STORE_OBJECT_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(STORE_OBJECT, (st), (cmp))
+#define sk_STORE_OBJECT_dup(st) SKM_sk_dup(STORE_OBJECT, st)
+#define sk_STORE_OBJECT_pop_free(st, free_func) SKM_sk_pop_free(STORE_OBJECT, (st), (free_func))
+#define sk_STORE_OBJECT_shift(st) SKM_sk_shift(STORE_OBJECT, (st))
+#define sk_STORE_OBJECT_pop(st) SKM_sk_pop(STORE_OBJECT, (st))
+#define sk_STORE_OBJECT_sort(st) SKM_sk_sort(STORE_OBJECT, (st))
+#define sk_STORE_OBJECT_is_sorted(st) SKM_sk_is_sorted(STORE_OBJECT, (st))
+
 #define sk_SXNETID_new(st) SKM_sk_new(SXNETID, (st))
 #define sk_SXNETID_new_null() SKM_sk_new_null(SXNETID)
 #define sk_SXNETID_free(st) SKM_sk_free(SXNETID, (st))
@@ -1040,6 +1348,7 @@ STACK_OF(type) \
 #define sk_SXNETID_push(st, val) SKM_sk_push(SXNETID, (st), (val))
 #define sk_SXNETID_unshift(st, val) SKM_sk_unshift(SXNETID, (st), (val))
 #define sk_SXNETID_find(st, val) SKM_sk_find(SXNETID, (st), (val))
+#define sk_SXNETID_find_ex(st, val) SKM_sk_find_ex(SXNETID, (st), (val))
 #define sk_SXNETID_delete(st, i) SKM_sk_delete(SXNETID, (st), (i))
 #define sk_SXNETID_delete_ptr(st, ptr) SKM_sk_delete_ptr(SXNETID, (st), (ptr))
 #define sk_SXNETID_insert(st, val, i) SKM_sk_insert(SXNETID, (st), (val), (i))
@@ -1061,6 +1370,7 @@ STACK_OF(type) \
 #define sk_UI_STRING_push(st, val) SKM_sk_push(UI_STRING, (st), (val))
 #define sk_UI_STRING_unshift(st, val) SKM_sk_unshift(UI_STRING, (st), (val))
 #define sk_UI_STRING_find(st, val) SKM_sk_find(UI_STRING, (st), (val))
+#define sk_UI_STRING_find_ex(st, val) SKM_sk_find_ex(UI_STRING, (st), (val))
 #define sk_UI_STRING_delete(st, i) SKM_sk_delete(UI_STRING, (st), (i))
 #define sk_UI_STRING_delete_ptr(st, ptr) SKM_sk_delete_ptr(UI_STRING, (st), (ptr))
 #define sk_UI_STRING_insert(st, val, i) SKM_sk_insert(UI_STRING, (st), (val), (i))
@@ -1082,6 +1392,7 @@ STACK_OF(type) \
 #define sk_X509_push(st, val) SKM_sk_push(X509, (st), (val))
 #define sk_X509_unshift(st, val) SKM_sk_unshift(X509, (st), (val))
 #define sk_X509_find(st, val) SKM_sk_find(X509, (st), (val))
+#define sk_X509_find_ex(st, val) SKM_sk_find_ex(X509, (st), (val))
 #define sk_X509_delete(st, i) SKM_sk_delete(X509, (st), (i))
 #define sk_X509_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509, (st), (ptr))
 #define sk_X509_insert(st, val, i) SKM_sk_insert(X509, (st), (val), (i))
@@ -1103,6 +1414,7 @@ STACK_OF(type) \
 #define sk_X509V3_EXT_METHOD_push(st, val) SKM_sk_push(X509V3_EXT_METHOD, (st), (val))
 #define sk_X509V3_EXT_METHOD_unshift(st, val) SKM_sk_unshift(X509V3_EXT_METHOD, (st), (val))
 #define sk_X509V3_EXT_METHOD_find(st, val) SKM_sk_find(X509V3_EXT_METHOD, (st), (val))
+#define sk_X509V3_EXT_METHOD_find_ex(st, val) SKM_sk_find_ex(X509V3_EXT_METHOD, (st), (val))
 #define sk_X509V3_EXT_METHOD_delete(st, i) SKM_sk_delete(X509V3_EXT_METHOD, (st), (i))
 #define sk_X509V3_EXT_METHOD_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509V3_EXT_METHOD, (st), (ptr))
 #define sk_X509V3_EXT_METHOD_insert(st, val, i) SKM_sk_insert(X509V3_EXT_METHOD, (st), (val), (i))
@@ -1124,6 +1436,7 @@ STACK_OF(type) \
 #define sk_X509_ALGOR_push(st, val) SKM_sk_push(X509_ALGOR, (st), (val))
 #define sk_X509_ALGOR_unshift(st, val) SKM_sk_unshift(X509_ALGOR, (st), (val))
 #define sk_X509_ALGOR_find(st, val) SKM_sk_find(X509_ALGOR, (st), (val))
+#define sk_X509_ALGOR_find_ex(st, val) SKM_sk_find_ex(X509_ALGOR, (st), (val))
 #define sk_X509_ALGOR_delete(st, i) SKM_sk_delete(X509_ALGOR, (st), (i))
 #define sk_X509_ALGOR_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_ALGOR, (st), (ptr))
 #define sk_X509_ALGOR_insert(st, val, i) SKM_sk_insert(X509_ALGOR, (st), (val), (i))
@@ -1145,6 +1458,7 @@ STACK_OF(type) \
 #define sk_X509_ATTRIBUTE_push(st, val) SKM_sk_push(X509_ATTRIBUTE, (st), (val))
 #define sk_X509_ATTRIBUTE_unshift(st, val) SKM_sk_unshift(X509_ATTRIBUTE, (st), (val))
 #define sk_X509_ATTRIBUTE_find(st, val) SKM_sk_find(X509_ATTRIBUTE, (st), (val))
+#define sk_X509_ATTRIBUTE_find_ex(st, val) SKM_sk_find_ex(X509_ATTRIBUTE, (st), (val))
 #define sk_X509_ATTRIBUTE_delete(st, i) SKM_sk_delete(X509_ATTRIBUTE, (st), (i))
 #define sk_X509_ATTRIBUTE_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_ATTRIBUTE, (st), (ptr))
 #define sk_X509_ATTRIBUTE_insert(st, val, i) SKM_sk_insert(X509_ATTRIBUTE, (st), (val), (i))
@@ -1166,6 +1480,7 @@ STACK_OF(type) \
 #define sk_X509_CRL_push(st, val) SKM_sk_push(X509_CRL, (st), (val))
 #define sk_X509_CRL_unshift(st, val) SKM_sk_unshift(X509_CRL, (st), (val))
 #define sk_X509_CRL_find(st, val) SKM_sk_find(X509_CRL, (st), (val))
+#define sk_X509_CRL_find_ex(st, val) SKM_sk_find_ex(X509_CRL, (st), (val))
 #define sk_X509_CRL_delete(st, i) SKM_sk_delete(X509_CRL, (st), (i))
 #define sk_X509_CRL_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_CRL, (st), (ptr))
 #define sk_X509_CRL_insert(st, val, i) SKM_sk_insert(X509_CRL, (st), (val), (i))
@@ -1187,6 +1502,7 @@ STACK_OF(type) \
 #define sk_X509_EXTENSION_push(st, val) SKM_sk_push(X509_EXTENSION, (st), (val))
 #define sk_X509_EXTENSION_unshift(st, val) SKM_sk_unshift(X509_EXTENSION, (st), (val))
 #define sk_X509_EXTENSION_find(st, val) SKM_sk_find(X509_EXTENSION, (st), (val))
+#define sk_X509_EXTENSION_find_ex(st, val) SKM_sk_find_ex(X509_EXTENSION, (st), (val))
 #define sk_X509_EXTENSION_delete(st, i) SKM_sk_delete(X509_EXTENSION, (st), (i))
 #define sk_X509_EXTENSION_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_EXTENSION, (st), (ptr))
 #define sk_X509_EXTENSION_insert(st, val, i) SKM_sk_insert(X509_EXTENSION, (st), (val), (i))
@@ -1208,6 +1524,7 @@ STACK_OF(type) \
 #define sk_X509_INFO_push(st, val) SKM_sk_push(X509_INFO, (st), (val))
 #define sk_X509_INFO_unshift(st, val) SKM_sk_unshift(X509_INFO, (st), (val))
 #define sk_X509_INFO_find(st, val) SKM_sk_find(X509_INFO, (st), (val))
+#define sk_X509_INFO_find_ex(st, val) SKM_sk_find_ex(X509_INFO, (st), (val))
 #define sk_X509_INFO_delete(st, i) SKM_sk_delete(X509_INFO, (st), (i))
 #define sk_X509_INFO_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_INFO, (st), (ptr))
 #define sk_X509_INFO_insert(st, val, i) SKM_sk_insert(X509_INFO, (st), (val), (i))
@@ -1229,6 +1546,7 @@ STACK_OF(type) \
 #define sk_X509_LOOKUP_push(st, val) SKM_sk_push(X509_LOOKUP, (st), (val))
 #define sk_X509_LOOKUP_unshift(st, val) SKM_sk_unshift(X509_LOOKUP, (st), (val))
 #define sk_X509_LOOKUP_find(st, val) SKM_sk_find(X509_LOOKUP, (st), (val))
+#define sk_X509_LOOKUP_find_ex(st, val) SKM_sk_find_ex(X509_LOOKUP, (st), (val))
 #define sk_X509_LOOKUP_delete(st, i) SKM_sk_delete(X509_LOOKUP, (st), (i))
 #define sk_X509_LOOKUP_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_LOOKUP, (st), (ptr))
 #define sk_X509_LOOKUP_insert(st, val, i) SKM_sk_insert(X509_LOOKUP, (st), (val), (i))
@@ -1250,6 +1568,7 @@ STACK_OF(type) \
 #define sk_X509_NAME_push(st, val) SKM_sk_push(X509_NAME, (st), (val))
 #define sk_X509_NAME_unshift(st, val) SKM_sk_unshift(X509_NAME, (st), (val))
 #define sk_X509_NAME_find(st, val) SKM_sk_find(X509_NAME, (st), (val))
+#define sk_X509_NAME_find_ex(st, val) SKM_sk_find_ex(X509_NAME, (st), (val))
 #define sk_X509_NAME_delete(st, i) SKM_sk_delete(X509_NAME, (st), (i))
 #define sk_X509_NAME_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_NAME, (st), (ptr))
 #define sk_X509_NAME_insert(st, val, i) SKM_sk_insert(X509_NAME, (st), (val), (i))
@@ -1271,6 +1590,7 @@ STACK_OF(type) \
 #define sk_X509_NAME_ENTRY_push(st, val) SKM_sk_push(X509_NAME_ENTRY, (st), (val))
 #define sk_X509_NAME_ENTRY_unshift(st, val) SKM_sk_unshift(X509_NAME_ENTRY, (st), (val))
 #define sk_X509_NAME_ENTRY_find(st, val) SKM_sk_find(X509_NAME_ENTRY, (st), (val))
+#define sk_X509_NAME_ENTRY_find_ex(st, val) SKM_sk_find_ex(X509_NAME_ENTRY, (st), (val))
 #define sk_X509_NAME_ENTRY_delete(st, i) SKM_sk_delete(X509_NAME_ENTRY, (st), (i))
 #define sk_X509_NAME_ENTRY_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_NAME_ENTRY, (st), (ptr))
 #define sk_X509_NAME_ENTRY_insert(st, val, i) SKM_sk_insert(X509_NAME_ENTRY, (st), (val), (i))
@@ -1292,6 +1612,7 @@ STACK_OF(type) \
 #define sk_X509_OBJECT_push(st, val) SKM_sk_push(X509_OBJECT, (st), (val))
 #define sk_X509_OBJECT_unshift(st, val) SKM_sk_unshift(X509_OBJECT, (st), (val))
 #define sk_X509_OBJECT_find(st, val) SKM_sk_find(X509_OBJECT, (st), (val))
+#define sk_X509_OBJECT_find_ex(st, val) SKM_sk_find_ex(X509_OBJECT, (st), (val))
 #define sk_X509_OBJECT_delete(st, i) SKM_sk_delete(X509_OBJECT, (st), (i))
 #define sk_X509_OBJECT_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_OBJECT, (st), (ptr))
 #define sk_X509_OBJECT_insert(st, val, i) SKM_sk_insert(X509_OBJECT, (st), (val), (i))
@@ -1303,6 +1624,72 @@ STACK_OF(type) \
 #define sk_X509_OBJECT_sort(st) SKM_sk_sort(X509_OBJECT, (st))
 #define sk_X509_OBJECT_is_sorted(st) SKM_sk_is_sorted(X509_OBJECT, (st))
 
+#define sk_X509_POLICY_DATA_new(st) SKM_sk_new(X509_POLICY_DATA, (st))
+#define sk_X509_POLICY_DATA_new_null() SKM_sk_new_null(X509_POLICY_DATA)
+#define sk_X509_POLICY_DATA_free(st) SKM_sk_free(X509_POLICY_DATA, (st))
+#define sk_X509_POLICY_DATA_num(st) SKM_sk_num(X509_POLICY_DATA, (st))
+#define sk_X509_POLICY_DATA_value(st, i) SKM_sk_value(X509_POLICY_DATA, (st), (i))
+#define sk_X509_POLICY_DATA_set(st, i, val) SKM_sk_set(X509_POLICY_DATA, (st), (i), (val))
+#define sk_X509_POLICY_DATA_zero(st) SKM_sk_zero(X509_POLICY_DATA, (st))
+#define sk_X509_POLICY_DATA_push(st, val) SKM_sk_push(X509_POLICY_DATA, (st), (val))
+#define sk_X509_POLICY_DATA_unshift(st, val) SKM_sk_unshift(X509_POLICY_DATA, (st), (val))
+#define sk_X509_POLICY_DATA_find(st, val) SKM_sk_find(X509_POLICY_DATA, (st), (val))
+#define sk_X509_POLICY_DATA_find_ex(st, val) SKM_sk_find_ex(X509_POLICY_DATA, (st), (val))
+#define sk_X509_POLICY_DATA_delete(st, i) SKM_sk_delete(X509_POLICY_DATA, (st), (i))
+#define sk_X509_POLICY_DATA_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_POLICY_DATA, (st), (ptr))
+#define sk_X509_POLICY_DATA_insert(st, val, i) SKM_sk_insert(X509_POLICY_DATA, (st), (val), (i))
+#define sk_X509_POLICY_DATA_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_POLICY_DATA, (st), (cmp))
+#define sk_X509_POLICY_DATA_dup(st) SKM_sk_dup(X509_POLICY_DATA, st)
+#define sk_X509_POLICY_DATA_pop_free(st, free_func) SKM_sk_pop_free(X509_POLICY_DATA, (st), (free_func))
+#define sk_X509_POLICY_DATA_shift(st) SKM_sk_shift(X509_POLICY_DATA, (st))
+#define sk_X509_POLICY_DATA_pop(st) SKM_sk_pop(X509_POLICY_DATA, (st))
+#define sk_X509_POLICY_DATA_sort(st) SKM_sk_sort(X509_POLICY_DATA, (st))
+#define sk_X509_POLICY_DATA_is_sorted(st) SKM_sk_is_sorted(X509_POLICY_DATA, (st))
+
+#define sk_X509_POLICY_NODE_new(st) SKM_sk_new(X509_POLICY_NODE, (st))
+#define sk_X509_POLICY_NODE_new_null() SKM_sk_new_null(X509_POLICY_NODE)
+#define sk_X509_POLICY_NODE_free(st) SKM_sk_free(X509_POLICY_NODE, (st))
+#define sk_X509_POLICY_NODE_num(st) SKM_sk_num(X509_POLICY_NODE, (st))
+#define sk_X509_POLICY_NODE_value(st, i) SKM_sk_value(X509_POLICY_NODE, (st), (i))
+#define sk_X509_POLICY_NODE_set(st, i, val) SKM_sk_set(X509_POLICY_NODE, (st), (i), (val))
+#define sk_X509_POLICY_NODE_zero(st) SKM_sk_zero(X509_POLICY_NODE, (st))
+#define sk_X509_POLICY_NODE_push(st, val) SKM_sk_push(X509_POLICY_NODE, (st), (val))
+#define sk_X509_POLICY_NODE_unshift(st, val) SKM_sk_unshift(X509_POLICY_NODE, (st), (val))
+#define sk_X509_POLICY_NODE_find(st, val) SKM_sk_find(X509_POLICY_NODE, (st), (val))
+#define sk_X509_POLICY_NODE_find_ex(st, val) SKM_sk_find_ex(X509_POLICY_NODE, (st), (val))
+#define sk_X509_POLICY_NODE_delete(st, i) SKM_sk_delete(X509_POLICY_NODE, (st), (i))
+#define sk_X509_POLICY_NODE_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_POLICY_NODE, (st), (ptr))
+#define sk_X509_POLICY_NODE_insert(st, val, i) SKM_sk_insert(X509_POLICY_NODE, (st), (val), (i))
+#define sk_X509_POLICY_NODE_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_POLICY_NODE, (st), (cmp))
+#define sk_X509_POLICY_NODE_dup(st) SKM_sk_dup(X509_POLICY_NODE, st)
+#define sk_X509_POLICY_NODE_pop_free(st, free_func) SKM_sk_pop_free(X509_POLICY_NODE, (st), (free_func))
+#define sk_X509_POLICY_NODE_shift(st) SKM_sk_shift(X509_POLICY_NODE, (st))
+#define sk_X509_POLICY_NODE_pop(st) SKM_sk_pop(X509_POLICY_NODE, (st))
+#define sk_X509_POLICY_NODE_sort(st) SKM_sk_sort(X509_POLICY_NODE, (st))
+#define sk_X509_POLICY_NODE_is_sorted(st) SKM_sk_is_sorted(X509_POLICY_NODE, (st))
+
+#define sk_X509_POLICY_REF_new(st) SKM_sk_new(X509_POLICY_REF, (st))
+#define sk_X509_POLICY_REF_new_null() SKM_sk_new_null(X509_POLICY_REF)
+#define sk_X509_POLICY_REF_free(st) SKM_sk_free(X509_POLICY_REF, (st))
+#define sk_X509_POLICY_REF_num(st) SKM_sk_num(X509_POLICY_REF, (st))
+#define sk_X509_POLICY_REF_value(st, i) SKM_sk_value(X509_POLICY_REF, (st), (i))
+#define sk_X509_POLICY_REF_set(st, i, val) SKM_sk_set(X509_POLICY_REF, (st), (i), (val))
+#define sk_X509_POLICY_REF_zero(st) SKM_sk_zero(X509_POLICY_REF, (st))
+#define sk_X509_POLICY_REF_push(st, val) SKM_sk_push(X509_POLICY_REF, (st), (val))
+#define sk_X509_POLICY_REF_unshift(st, val) SKM_sk_unshift(X509_POLICY_REF, (st), (val))
+#define sk_X509_POLICY_REF_find(st, val) SKM_sk_find(X509_POLICY_REF, (st), (val))
+#define sk_X509_POLICY_REF_find_ex(st, val) SKM_sk_find_ex(X509_POLICY_REF, (st), (val))
+#define sk_X509_POLICY_REF_delete(st, i) SKM_sk_delete(X509_POLICY_REF, (st), (i))
+#define sk_X509_POLICY_REF_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_POLICY_REF, (st), (ptr))
+#define sk_X509_POLICY_REF_insert(st, val, i) SKM_sk_insert(X509_POLICY_REF, (st), (val), (i))
+#define sk_X509_POLICY_REF_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_POLICY_REF, (st), (cmp))
+#define sk_X509_POLICY_REF_dup(st) SKM_sk_dup(X509_POLICY_REF, st)
+#define sk_X509_POLICY_REF_pop_free(st, free_func) SKM_sk_pop_free(X509_POLICY_REF, (st), (free_func))
+#define sk_X509_POLICY_REF_shift(st) SKM_sk_shift(X509_POLICY_REF, (st))
+#define sk_X509_POLICY_REF_pop(st) SKM_sk_pop(X509_POLICY_REF, (st))
+#define sk_X509_POLICY_REF_sort(st) SKM_sk_sort(X509_POLICY_REF, (st))
+#define sk_X509_POLICY_REF_is_sorted(st) SKM_sk_is_sorted(X509_POLICY_REF, (st))
+
 #define sk_X509_PURPOSE_new(st) SKM_sk_new(X509_PURPOSE, (st))
 #define sk_X509_PURPOSE_new_null() SKM_sk_new_null(X509_PURPOSE)
 #define sk_X509_PURPOSE_free(st) SKM_sk_free(X509_PURPOSE, (st))
@@ -1313,6 +1700,7 @@ STACK_OF(type) \
 #define sk_X509_PURPOSE_push(st, val) SKM_sk_push(X509_PURPOSE, (st), (val))
 #define sk_X509_PURPOSE_unshift(st, val) SKM_sk_unshift(X509_PURPOSE, (st), (val))
 #define sk_X509_PURPOSE_find(st, val) SKM_sk_find(X509_PURPOSE, (st), (val))
+#define sk_X509_PURPOSE_find_ex(st, val) SKM_sk_find_ex(X509_PURPOSE, (st), (val))
 #define sk_X509_PURPOSE_delete(st, i) SKM_sk_delete(X509_PURPOSE, (st), (i))
 #define sk_X509_PURPOSE_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_PURPOSE, (st), (ptr))
 #define sk_X509_PURPOSE_insert(st, val, i) SKM_sk_insert(X509_PURPOSE, (st), (val), (i))
@@ -1334,6 +1722,7 @@ STACK_OF(type) \
 #define sk_X509_REVOKED_push(st, val) SKM_sk_push(X509_REVOKED, (st), (val))
 #define sk_X509_REVOKED_unshift(st, val) SKM_sk_unshift(X509_REVOKED, (st), (val))
 #define sk_X509_REVOKED_find(st, val) SKM_sk_find(X509_REVOKED, (st), (val))
+#define sk_X509_REVOKED_find_ex(st, val) SKM_sk_find_ex(X509_REVOKED, (st), (val))
 #define sk_X509_REVOKED_delete(st, i) SKM_sk_delete(X509_REVOKED, (st), (i))
 #define sk_X509_REVOKED_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_REVOKED, (st), (ptr))
 #define sk_X509_REVOKED_insert(st, val, i) SKM_sk_insert(X509_REVOKED, (st), (val), (i))
@@ -1355,6 +1744,7 @@ STACK_OF(type) \
 #define sk_X509_TRUST_push(st, val) SKM_sk_push(X509_TRUST, (st), (val))
 #define sk_X509_TRUST_unshift(st, val) SKM_sk_unshift(X509_TRUST, (st), (val))
 #define sk_X509_TRUST_find(st, val) SKM_sk_find(X509_TRUST, (st), (val))
+#define sk_X509_TRUST_find_ex(st, val) SKM_sk_find_ex(X509_TRUST, (st), (val))
 #define sk_X509_TRUST_delete(st, i) SKM_sk_delete(X509_TRUST, (st), (i))
 #define sk_X509_TRUST_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_TRUST, (st), (ptr))
 #define sk_X509_TRUST_insert(st, val, i) SKM_sk_insert(X509_TRUST, (st), (val), (i))
@@ -1366,6 +1756,28 @@ STACK_OF(type) \
 #define sk_X509_TRUST_sort(st) SKM_sk_sort(X509_TRUST, (st))
 #define sk_X509_TRUST_is_sorted(st) SKM_sk_is_sorted(X509_TRUST, (st))
 
+#define sk_X509_VERIFY_PARAM_new(st) SKM_sk_new(X509_VERIFY_PARAM, (st))
+#define sk_X509_VERIFY_PARAM_new_null() SKM_sk_new_null(X509_VERIFY_PARAM)
+#define sk_X509_VERIFY_PARAM_free(st) SKM_sk_free(X509_VERIFY_PARAM, (st))
+#define sk_X509_VERIFY_PARAM_num(st) SKM_sk_num(X509_VERIFY_PARAM, (st))
+#define sk_X509_VERIFY_PARAM_value(st, i) SKM_sk_value(X509_VERIFY_PARAM, (st), (i))
+#define sk_X509_VERIFY_PARAM_set(st, i, val) SKM_sk_set(X509_VERIFY_PARAM, (st), (i), (val))
+#define sk_X509_VERIFY_PARAM_zero(st) SKM_sk_zero(X509_VERIFY_PARAM, (st))
+#define sk_X509_VERIFY_PARAM_push(st, val) SKM_sk_push(X509_VERIFY_PARAM, (st), (val))
+#define sk_X509_VERIFY_PARAM_unshift(st, val) SKM_sk_unshift(X509_VERIFY_PARAM, (st), (val))
+#define sk_X509_VERIFY_PARAM_find(st, val) SKM_sk_find(X509_VERIFY_PARAM, (st), (val))
+#define sk_X509_VERIFY_PARAM_find_ex(st, val) SKM_sk_find_ex(X509_VERIFY_PARAM, (st), (val))
+#define sk_X509_VERIFY_PARAM_delete(st, i) SKM_sk_delete(X509_VERIFY_PARAM, (st), (i))
+#define sk_X509_VERIFY_PARAM_delete_ptr(st, ptr) SKM_sk_delete_ptr(X509_VERIFY_PARAM, (st), (ptr))
+#define sk_X509_VERIFY_PARAM_insert(st, val, i) SKM_sk_insert(X509_VERIFY_PARAM, (st), (val), (i))
+#define sk_X509_VERIFY_PARAM_set_cmp_func(st, cmp) SKM_sk_set_cmp_func(X509_VERIFY_PARAM, (st), (cmp))
+#define sk_X509_VERIFY_PARAM_dup(st) SKM_sk_dup(X509_VERIFY_PARAM, st)
+#define sk_X509_VERIFY_PARAM_pop_free(st, free_func) SKM_sk_pop_free(X509_VERIFY_PARAM, (st), (free_func))
+#define sk_X509_VERIFY_PARAM_shift(st) SKM_sk_shift(X509_VERIFY_PARAM, (st))
+#define sk_X509_VERIFY_PARAM_pop(st) SKM_sk_pop(X509_VERIFY_PARAM, (st))
+#define sk_X509_VERIFY_PARAM_sort(st) SKM_sk_sort(X509_VERIFY_PARAM, (st))
+#define sk_X509_VERIFY_PARAM_is_sorted(st) SKM_sk_is_sorted(X509_VERIFY_PARAM, (st))
+
 #define d2i_ASN1_SET_OF_ACCESS_DESCRIPTION(st, pp, length, d2i_func, free_func, ex_tag, ex_class) \
         SKM_ASN1_SET_OF_d2i(ACCESS_DESCRIPTION, (st), (pp), (length), (d2i_func), (free_func), (ex_tag), (ex_class)) 
 #define i2d_ASN1_SET_OF_ACCESS_DESCRIPTION(st, pp, i2d_func, ex_tag, ex_class, is_set) \
diff --git a/src/lib/libssl/src/crypto/stack/stack.c b/src/lib/libssl/src/crypto/stack/stack.c
index c7173eb6ab..378bd7c796 100644
--- a/src/lib/libssl/src/crypto/stack/stack.c
+++ b/src/lib/libssl/src/crypto/stack/stack.c
@@ -68,11 +68,12 @@
 #include <stdio.h>
 #include "cryptlib.h"
 #include <openssl/stack.h>
+#include <openssl/objects.h>
 
 #undef MIN_NODES
 #define MIN_NODES       4
 
-const char *STACK_version="Stack" OPENSSL_VERSION_PTEXT;
+const char STACK_version[]="Stack" OPENSSL_VERSION_PTEXT;
 
 #include <errno.h>
 
@@ -209,7 +210,7 @@ char *sk_delete(STACK *st, int loc)
         return(ret);
         }
 
-int sk_find(STACK *st, char *data)
+static int internal_find(STACK *st, char *data, int ret_val_options)
         {
         char **r;
         int i;
@@ -232,19 +233,19 @@ int sk_find(STACK *st, char *data)
          * not (type *) pointers, but the *pointers* to (type *) pointers,
          * so we get our extra level of pointer dereferencing that way. */
         comp_func=(int (*)(const void *,const void *))(st->comp);
-        r=(char **)bsearch(&data,(char *)st->data,
-                st->num,sizeof(char *), comp_func);
+        r=(char **)OBJ_bsearch_ex((char *)&data,(char *)st->data,
+                st->num,sizeof(char *),comp_func,ret_val_options);
         if (r == NULL) return(-1);
-        i=(int)(r-st->data);
-        for ( ; i>0; i--)
-                /* This needs a cast because the type being pointed to from
-                 * the "&" expressions are (char *) rather than (const char *).
-                 * For an explanation, read:
-                 * http://www.eskimo.com/~scs/C-faq/q11.10.html :-) */
-                if ((*st->comp)((const char * const *)&(st->data[i-1]),
-                                (const char * const *)&data) < 0)
-                        break;
-        return(i);
+        return((int)(r-st->data));
+        }
+
+int sk_find(STACK *st, char *data)
+        {
+        return internal_find(st, data, OBJ_BSEARCH_FIRST_VALUE_ON_MATCH);
+        }
+int sk_find_ex(STACK *st, char *data)
+        {
+        return internal_find(st, data, OBJ_BSEARCH_VALUE_ON_NOMATCH);
         }
 
 int sk_push(STACK *st, char *data)
diff --git a/src/lib/libssl/src/crypto/stack/stack.h b/src/lib/libssl/src/crypto/stack/stack.h
index 7570b85fe8..5cbb116a8b 100644
--- a/src/lib/libssl/src/crypto/stack/stack.h
+++ b/src/lib/libssl/src/crypto/stack/stack.h
@@ -89,6 +89,7 @@ int sk_insert(STACK *sk,char *data,int where);
 char *sk_delete(STACK *st,int loc);
 char *sk_delete_ptr(STACK *st, char *p);
 int sk_find(STACK *st,char *data);
+int sk_find_ex(STACK *st,char *data);
 int sk_push(STACK *st,char *data);
 int sk_unshift(STACK *st,char *data);
 char *sk_shift(STACK *st);
diff --git a/src/lib/libssl/src/crypto/symhacks.h b/src/lib/libssl/src/crypto/symhacks.h
index 774162fec9..64528ad5c2 100644
--- a/src/lib/libssl/src/crypto/symhacks.h
+++ b/src/lib/libssl/src/crypto/symhacks.h
@@ -127,6 +127,12 @@
 /* Hack some long X509 names */
 #undef X509_REVOKED_get_ext_by_critical
 #define X509_REVOKED_get_ext_by_critical        X509_REVOKED_get_ext_by_critic
+#undef X509_policy_tree_get0_user_policies
+#define X509_policy_tree_get0_user_policies     X509_pcy_tree_get0_usr_policies
+#undef X509_policy_node_get0_qualifiers
+#define X509_policy_node_get0_qualifiers        X509_pcy_node_get0_qualifiers
+#undef X509_STORE_CTX_get_explicit_policy
+#define X509_STORE_CTX_get_explicit_policy      X509_STORE_CTX_get_expl_policy
 
 /* Hack some long CRYPTO names */
 #undef CRYPTO_set_dynlock_destroy_callback
@@ -153,16 +159,16 @@
 #define SSL_get_ex_data_X509_STORE_CTX_idx      SSL_get_ex_d_X509_STORE_CTX_idx
 #undef SSL_add_file_cert_subjects_to_stack
 #define SSL_add_file_cert_subjects_to_stack     SSL_add_file_cert_subjs_to_stk
-#if 0 /* This function is not defined i VMS. */
 #undef SSL_add_dir_cert_subjects_to_stack
 #define SSL_add_dir_cert_subjects_to_stack      SSL_add_dir_cert_subjs_to_stk
-#endif
 #undef SSL_CTX_use_certificate_chain_file
 #define SSL_CTX_use_certificate_chain_file      SSL_CTX_use_cert_chain_file
 #undef SSL_CTX_set_cert_verify_callback
 #define SSL_CTX_set_cert_verify_callback        SSL_CTX_set_cert_verify_cb
 #undef SSL_CTX_set_default_passwd_cb_userdata
 #define SSL_CTX_set_default_passwd_cb_userdata  SSL_CTX_set_def_passwd_cb_ud
+#undef SSL_COMP_get_compression_methods
+#define SSL_COMP_get_compression_methods        SSL_COMP_get_compress_methods
 
 /* Hack some long ENGINE names */
 #undef ENGINE_get_default_BN_mod_exp_crt
@@ -195,6 +201,12 @@
 #define OPENSSL_add_all_algorithms_conf         OPENSSL_add_all_algo_conf
 
 /* Hack some long EC names */
+#undef EC_GROUP_set_point_conversion_form
+#define EC_GROUP_set_point_conversion_form      EC_GROUP_set_point_conv_form
+#undef EC_GROUP_get_point_conversion_form
+#define EC_GROUP_get_point_conversion_form      EC_GROUP_get_point_conv_form
+#undef EC_GROUP_clear_free_all_extra_data
+#define EC_GROUP_clear_free_all_extra_data      EC_GROUP_clr_free_all_xtra_data
 #undef EC_POINT_set_Jprojective_coordinates_GFp
 #define EC_POINT_set_Jprojective_coordinates_GFp \
                                                 EC_POINT_set_Jproj_coords_GFp
@@ -207,6 +219,32 @@
 #define EC_POINT_get_affine_coordinates_GFp     EC_POINT_get_affine_coords_GFp
 #undef EC_POINT_set_compressed_coordinates_GFp
 #define EC_POINT_set_compressed_coordinates_GFp EC_POINT_set_compr_coords_GFp
+#undef EC_POINT_set_affine_coordinates_GF2m
+#define EC_POINT_set_affine_coordinates_GF2m    EC_POINT_set_affine_coords_GF2m
+#undef EC_POINT_get_affine_coordinates_GF2m
+#define EC_POINT_get_affine_coordinates_GF2m    EC_POINT_get_affine_coords_GF2m
+#undef EC_POINT_set_compressed_coordinates_GF2m
+#define EC_POINT_set_compressed_coordinates_GF2m \
+                                                EC_POINT_set_compr_coords_GF2m
+#undef ec_GF2m_simple_group_clear_finish
+#define ec_GF2m_simple_group_clear_finish        ec_GF2m_simple_grp_clr_finish
+#undef ec_GF2m_simple_group_check_discriminant
+#define ec_GF2m_simple_group_check_discriminant ec_GF2m_simple_grp_chk_discrim
+#undef ec_GF2m_simple_point_clear_finish
+#define ec_GF2m_simple_point_clear_finish        ec_GF2m_simple_pt_clr_finish
+#undef ec_GF2m_simple_point_set_to_infinity
+#define ec_GF2m_simple_point_set_to_infinity     ec_GF2m_simple_pt_set_to_inf
+#undef ec_GF2m_simple_points_make_affine
+#define ec_GF2m_simple_points_make_affine        ec_GF2m_simple_pts_make_affine
+#undef ec_GF2m_simple_point_set_affine_coordinates
+#define ec_GF2m_simple_point_set_affine_coordinates \
+                                                ec_GF2m_smp_pt_set_af_coords
+#undef ec_GF2m_simple_point_get_affine_coordinates
+#define ec_GF2m_simple_point_get_affine_coordinates \
+                                                ec_GF2m_smp_pt_get_af_coords
+#undef ec_GF2m_simple_set_compressed_coordinates
+#define ec_GF2m_simple_set_compressed_coordinates \
+                                                ec_GF2m_smp_set_compr_coords
 #undef ec_GFp_simple_group_set_curve_GFp
 #define ec_GFp_simple_group_set_curve_GFp       ec_GFp_simple_grp_set_curve_GFp
 #undef ec_GFp_simple_group_get_curve_GFp
@@ -242,6 +280,81 @@
 #undef ec_GFp_simple_set_compressed_coordinates_GFp
 #define ec_GFp_simple_set_compressed_coordinates_GFp \
                                                 ec_GFp_smp_set_compr_coords_GFp
+#undef ec_GFp_simple_point_set_affine_coordinates
+#define ec_GFp_simple_point_set_affine_coordinates \
+                                                ec_GFp_smp_pt_set_af_coords
+#undef ec_GFp_simple_point_get_affine_coordinates
+#define ec_GFp_simple_point_get_affine_coordinates \
+                                                ec_GFp_smp_pt_get_af_coords
+#undef ec_GFp_simple_set_compressed_coordinates
+#define ec_GFp_simple_set_compressed_coordinates \
+                                                ec_GFp_smp_set_compr_coords
+#undef ec_GFp_simple_group_check_discriminant
+#define ec_GFp_simple_group_check_discriminant  ec_GFp_simple_grp_chk_discrim
+
+/* Hack som long STORE names */
+#undef STORE_method_set_initialise_function
+#define STORE_method_set_initialise_function    STORE_meth_set_initialise_fn
+#undef STORE_method_set_cleanup_function
+#define STORE_method_set_cleanup_function       STORE_meth_set_cleanup_fn
+#undef STORE_method_set_generate_function
+#define STORE_method_set_generate_function      STORE_meth_set_generate_fn
+#undef STORE_method_set_modify_function
+#define STORE_method_set_modify_function        STORE_meth_set_modify_fn
+#undef STORE_method_set_revoke_function
+#define STORE_method_set_revoke_function        STORE_meth_set_revoke_fn
+#undef STORE_method_set_delete_function
+#define STORE_method_set_delete_function        STORE_meth_set_delete_fn
+#undef STORE_method_set_list_start_function
+#define STORE_method_set_list_start_function    STORE_meth_set_list_start_fn
+#undef STORE_method_set_list_next_function
+#define STORE_method_set_list_next_function     STORE_meth_set_list_next_fn
+#undef STORE_method_set_list_end_function
+#define STORE_method_set_list_end_function      STORE_meth_set_list_end_fn
+#undef STORE_method_set_update_store_function
+#define STORE_method_set_update_store_function  STORE_meth_set_update_store_fn
+#undef STORE_method_set_lock_store_function
+#define STORE_method_set_lock_store_function    STORE_meth_set_lock_store_fn
+#undef STORE_method_set_unlock_store_function
+#define STORE_method_set_unlock_store_function  STORE_meth_set_unlock_store_fn
+#undef STORE_method_get_initialise_function
+#define STORE_method_get_initialise_function    STORE_meth_get_initialise_fn
+#undef STORE_method_get_cleanup_function
+#define STORE_method_get_cleanup_function       STORE_meth_get_cleanup_fn
+#undef STORE_method_get_generate_function
+#define STORE_method_get_generate_function      STORE_meth_get_generate_fn
+#undef STORE_method_get_modify_function
+#define STORE_method_get_modify_function        STORE_meth_get_modify_fn
+#undef STORE_method_get_revoke_function
+#define STORE_method_get_revoke_function        STORE_meth_get_revoke_fn
+#undef STORE_method_get_delete_function
+#define STORE_method_get_delete_function        STORE_meth_get_delete_fn
+#undef STORE_method_get_list_start_function
+#define STORE_method_get_list_start_function    STORE_meth_get_list_start_fn
+#undef STORE_method_get_list_next_function
+#define STORE_method_get_list_next_function     STORE_meth_get_list_next_fn
+#undef STORE_method_get_list_end_function
+#define STORE_method_get_list_end_function      STORE_meth_get_list_end_fn
+#undef STORE_method_get_update_store_function
+#define STORE_method_get_update_store_function  STORE_meth_get_update_store_fn
+#undef STORE_method_get_lock_store_function
+#define STORE_method_get_lock_store_function    STORE_meth_get_lock_store_fn
+#undef STORE_method_get_unlock_store_function
+#define STORE_method_get_unlock_store_function  STORE_meth_get_unlock_store_fn
+
+/* Hack some long CMS names */
+#undef CMS_RecipientInfo_ktri_get0_algs
+#define CMS_RecipientInfo_ktri_get0_algs        CMS_RecipInfo_ktri_get0_algs
+#undef CMS_RecipientInfo_ktri_get0_signer_id
+#define CMS_RecipientInfo_ktri_get0_signer_id   CMS_RecipInfo_ktri_get0_sigr_id
+#undef CMS_OtherRevocationInfoFormat_it
+#define CMS_OtherRevocationInfoFormat_it        CMS_OtherRevocInfoFormat_it
+#undef CMS_KeyAgreeRecipientIdentifier_it
+#define CMS_KeyAgreeRecipientIdentifier_it      CMS_KeyAgreeRecipIdentifier_it
+#undef CMS_OriginatorIdentifierOrKey_it
+#define CMS_OriginatorIdentifierOrKey_it        CMS_OriginatorIdOrKey_it
+#undef cms_SignerIdentifier_get0_signer_id
+#define cms_SignerIdentifier_get0_signer_id     cms_SignerId_get0_signer_id
 
 #endif /* defined OPENSSL_SYS_VMS */
 
@@ -253,6 +366,15 @@
 #undef OCSP_crlID_new
 #define OCSP_crlID_new                          OCSP_crlID2_new
 
+#undef d2i_ECPARAMETERS
+#define d2i_ECPARAMETERS                        d2i_UC_ECPARAMETERS
+#undef i2d_ECPARAMETERS
+#define i2d_ECPARAMETERS                        i2d_UC_ECPARAMETERS
+#undef d2i_ECPKPARAMETERS
+#define d2i_ECPKPARAMETERS                      d2i_UC_ECPKPARAMETERS
+#undef i2d_ECPKPARAMETERS
+#define i2d_ECPKPARAMETERS                      i2d_UC_ECPKPARAMETERS
+
 /* These functions do not seem to exist!  However, I'm paranoid...
    Original command in x509v3.h:
    These functions are being redefined in another directory,
@@ -273,3 +395,6 @@
 
 
 #endif /* ! defined HEADER_VMS_IDHACKS_H */
+/* This one clashes with CMS_data_create */
+#undef cms_Data_create
+#define cms_Data_create                         priv_cms_Data_create
diff --git a/src/lib/libssl/src/crypto/threads/mttest.c b/src/lib/libssl/src/crypto/threads/mttest.c
index 7588966cb2..f6f3df4b6a 100644
--- a/src/lib/libssl/src/crypto/threads/mttest.c
+++ b/src/lib/libssl/src/crypto/threads/mttest.c
@@ -77,6 +77,12 @@
 #ifdef PTHREADS
 #include <pthread.h>
 #endif
+#ifdef OPENSSL_SYS_NETWARE
+#if !defined __int64
+#  define __int64 long long
+#endif   
+#include <nwmpk.h>
+#endif
 #include <openssl/lhash.h>
 #include <openssl/crypto.h>
 #include <openssl/buffer.h>
@@ -86,8 +92,18 @@
 #include <openssl/err.h>
 #include <openssl/rand.h>
 
+#ifdef OPENSSL_NO_FP_API
+#define APPS_WIN16
+#include "../buffer/bss_file.c"
+#endif
+
+#ifdef OPENSSL_SYS_NETWARE
+#define TEST_SERVER_CERT "/openssl/apps/server.pem"
+#define TEST_CLIENT_CERT "/openssl/apps/client.pem"
+#else
 #define TEST_SERVER_CERT "../../apps/server.pem"
 #define TEST_CLIENT_CERT "../../apps/client.pem"
+#endif
 
 #define MAX_THREAD_NUMBER       100
 
@@ -100,10 +116,18 @@ void irix_locking_callback(int mode,int type,char *file,int line);
 void solaris_locking_callback(int mode,int type,char *file,int line);
 void win32_locking_callback(int mode,int type,char *file,int line);
 void pthreads_locking_callback(int mode,int type,char *file,int line);
+void netware_locking_callback(int mode,int type,char *file,int line);
 
 unsigned long irix_thread_id(void );
 unsigned long solaris_thread_id(void );
 unsigned long pthreads_thread_id(void );
+unsigned long netware_thread_id(void );
+
+#if defined(OPENSSL_SYS_NETWARE)
+static MPKMutex *lock_cs;
+static MPKSema ThreadSem;
+static long *lock_count;
+#endif
 
 BIO *bio_err=NULL;
 BIO *bio_stdout=NULL;
@@ -384,6 +408,9 @@ int ndoit(SSL_CTX *ssl_ctx[2])
                 SSL_free((SSL *)ctx[2]);
                 SSL_free((SSL *)ctx[3]);
                 }
+#   ifdef OPENSSL_SYS_NETWARE
+        MPKSemaphoreSignal(ThreadSem);
+#   endif
         return(0);
         }
 
@@ -627,6 +654,9 @@ int doit(char *ctx[4])
                         }
 
                 if ((done & S_DONE) && (done & C_DONE)) break;
+#   if defined(OPENSSL_SYS_NETWARE)
+        ThreadSwitchWithDelay();
+#   endif
                 }
 
         SSL_set_shutdown(c_ssl,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
@@ -1094,3 +1124,88 @@ unsigned long pthreads_thread_id(void)
 
 
 
+#ifdef OPENSSL_SYS_NETWARE
+
+void thread_setup(void)
+{
+   int i;
+
+   lock_cs=OPENSSL_malloc(CRYPTO_num_locks() * sizeof(MPKMutex));
+   lock_count=OPENSSL_malloc(CRYPTO_num_locks() * sizeof(long));
+   for (i=0; i<CRYPTO_num_locks(); i++)
+   {
+      lock_count[i]=0;
+      lock_cs[i]=MPKMutexAlloc("OpenSSL mutex");
+   }
+
+   ThreadSem = MPKSemaphoreAlloc("OpenSSL mttest semaphore", 0 );
+
+   CRYPTO_set_id_callback((unsigned long (*)())netware_thread_id);
+   CRYPTO_set_locking_callback((void (*)())netware_locking_callback);
+}
+
+void thread_cleanup(void)
+{
+   int i;
+
+   CRYPTO_set_locking_callback(NULL);
+
+   fprintf(stdout,"thread_cleanup\n");
+
+   for (i=0; i<CRYPTO_num_locks(); i++)
+   {
+      MPKMutexFree(lock_cs[i]);
+      fprintf(stdout,"%8ld:%s\n",lock_count[i],CRYPTO_get_lock_name(i));
+   }
+   OPENSSL_free(lock_cs);
+   OPENSSL_free(lock_count);
+
+   MPKSemaphoreFree(ThreadSem);
+
+   fprintf(stdout,"done cleanup\n");
+}
+
+void netware_locking_callback(int mode, int type, char *file, int line)
+{
+   if (mode & CRYPTO_LOCK)
+   {
+      MPKMutexLock(lock_cs[type]);
+      lock_count[type]++;
+   }
+   else
+      MPKMutexUnlock(lock_cs[type]);
+}
+
+void do_threads(SSL_CTX *s_ctx, SSL_CTX *c_ctx)
+{
+   SSL_CTX *ssl_ctx[2];
+   int i;
+   ssl_ctx[0]=s_ctx;
+   ssl_ctx[1]=c_ctx;
+
+   for (i=0; i<thread_number; i++)
+   {
+      BeginThread( (void(*)(void*))ndoit, NULL, THREAD_STACK_SIZE, 
+                   (void*)ssl_ctx);
+      ThreadSwitchWithDelay();
+   }
+
+   printf("reaping\n");
+
+      /* loop until all threads have signaled the semaphore */
+   for (i=0; i<thread_number; i++)
+   {
+      MPKSemaphoreWait(ThreadSem);
+   }
+   printf("netware threads done (%d,%d)\n",
+         s_ctx->references,c_ctx->references);
+}
+
+unsigned long netware_thread_id(void)
+{
+   unsigned long ret;
+
+   ret=(unsigned long)GetThreadID();
+   return(ret);
+}
+#endif /* NETWARE */
diff --git a/src/lib/libssl/src/crypto/threads/th-lock.c b/src/lib/libssl/src/crypto/threads/th-lock.c
index a6a79b9f45..14aae5f912 100644
--- a/src/lib/libssl/src/crypto/threads/th-lock.c
+++ b/src/lib/libssl/src/crypto/threads/th-lock.c
@@ -80,7 +80,7 @@
 #include <openssl/lhash.h>
 #include <openssl/crypto.h>
 #include <openssl/buffer.h>
-#include <openssl/e_os.h>
+#include "../../e_os.h"
 #include <openssl/x509.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
diff --git a/src/lib/libssl/src/crypto/tmdiff.c b/src/lib/libssl/src/crypto/tmdiff.c
index 307523ebba..1c6e052ac9 100644
--- a/src/lib/libssl/src/crypto/tmdiff.c
+++ b/src/lib/libssl/src/crypto/tmdiff.c
@@ -72,7 +72,11 @@
 # define TIMES
 #endif
 
-#ifndef _IRIX
+#ifdef OPENSSL_SYS_NETWARE
+#undef TIMES
+#endif
+
+#if !defined(_IRIX) || defined (OPENSSL_SYS_NETWARE)
 #  include <time.h>
 #endif
 #ifdef TIMES
@@ -94,7 +98,7 @@
 #include <sys/param.h>
 #endif
 
-#if !defined(TIMES) && !defined(OPENSSL_SYS_VXWORKS)
+#if !defined(TIMES) && !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_NETWARE)
 #include <sys/timeb.h>
 #endif
 
@@ -106,7 +110,8 @@
 #ifndef HZ
 # if defined(_SC_CLK_TCK) \
      && (!defined(OPENSSL_SYS_VMS) || __CTRL_VER >= 70000000)
-#  define HZ ((double)sysconf(_SC_CLK_TCK))
+/* #  define HZ ((double)sysconf(_SC_CLK_TCK)) */
+#  define HZ sysconf(_SC_CLK_TCK)
 # else
 #  ifndef CLK_TCK
 #   ifndef _BSD_CLK_TCK_ /* FreeBSD hack */
@@ -120,7 +125,7 @@
 # endif
 #endif
 
-typedef struct ms_tm
+struct ms_tm
         {
 #ifdef TIMES
         struct tms ms_tms;
@@ -128,6 +133,8 @@ typedef struct ms_tm
 #  ifdef OPENSSL_SYS_WIN32
         HANDLE thread_id;
         FILETIME ms_win32;
+#  elif defined (OPENSSL_SYS_NETWARE)
+   clock_t ms_clock;
 #  else
 #    ifdef OPENSSL_SYS_VXWORKS
           unsigned long ticks;
@@ -136,9 +143,9 @@ typedef struct ms_tm
 #    endif
 #  endif
 #endif
-        } MS_TM;
+        };
 
-char *ms_time_new(void)
+MS_TM *ms_time_new(void)
         {
         MS_TM *ret;
 
@@ -149,18 +156,17 @@ char *ms_time_new(void)
 #ifdef OPENSSL_SYS_WIN32
         ret->thread_id=GetCurrentThread();
 #endif
-        return((char *)ret);
+        return ret;
         }
 
-void ms_time_free(char *a)
+void ms_time_free(MS_TM *a)
         {
         if (a != NULL)
                 OPENSSL_free(a);
         }
 
-void ms_time_get(char *a)
+void ms_time_get(MS_TM *tm)
         {
-        MS_TM *tm=(MS_TM *)a;
 #ifdef OPENSSL_SYS_WIN32
         FILETIME tmpa,tmpb,tmpc;
 #endif
@@ -170,6 +176,8 @@ void ms_time_get(char *a)
 #else
 #  ifdef OPENSSL_SYS_WIN32
         GetThreadTimes(tm->thread_id,&tmpa,&tmpb,&tmpc,&(tm->ms_win32));
+#  elif defined (OPENSSL_SYS_NETWARE)
+   tm->ms_clock = clock();
 #  else
 #    ifdef OPENSSL_SYS_VXWORKS
         tm->ticks = tickGet();
@@ -180,14 +188,13 @@ void ms_time_get(char *a)
 #endif
         }
 
-double ms_time_diff(char *ap, char *bp)
+double ms_time_diff(MS_TM *a, MS_TM *b)
         {
-        MS_TM *a=(MS_TM *)ap;
-        MS_TM *b=(MS_TM *)bp;
         double ret;
 
 #ifdef TIMES
-        ret=(b->ms_tms.tms_utime-a->ms_tms.tms_utime)/HZ;
+        ret = HZ;
+        ret = (b->ms_tms.tms_utime-a->ms_tms.tms_utime) / ret;
 #else
 # ifdef OPENSSL_SYS_WIN32
         {
@@ -204,6 +211,8 @@ double ms_time_diff(char *ap, char *bp)
         lb+=b->ms_win32.dwLowDateTime;
         ret=((double)(lb-la))/1e7;
         }
+# elif defined (OPENSSL_SYS_NETWARE)
+    ret= (double)(b->ms_clock - a->ms_clock);
 # else
 #  ifdef OPENSSL_SYS_VXWORKS
         ret = (double)(b->ticks - a->ticks) / (double)sysClkRateGet();
@@ -217,18 +226,20 @@ double ms_time_diff(char *ap, char *bp)
         return((ret < 0.0000001)?0.0000001:ret);
         }
 
-int ms_time_cmp(char *ap, char *bp)
+int ms_time_cmp(const MS_TM *a, const MS_TM *b)
         {
-        MS_TM *a=(MS_TM *)ap,*b=(MS_TM *)bp;
         double d;
         int ret;
 
 #ifdef TIMES
-        d=(b->ms_tms.tms_utime-a->ms_tms.tms_utime)/HZ;
+        d = HZ;
+        d = (b->ms_tms.tms_utime-a->ms_tms.tms_utime) / d;
 #else
 # ifdef OPENSSL_SYS_WIN32
         d =(b->ms_win32.dwHighDateTime&0x000fffff)*10+b->ms_win32.dwLowDateTime/1e7;
         d-=(a->ms_win32.dwHighDateTime&0x000fffff)*10+a->ms_win32.dwLowDateTime/1e7;
+# elif defined (OPENSSL_SYS_NETWARE)
+    d= (double)(b->ms_clock - a->ms_clock);
 # else
 #  ifdef OPENSSL_SYS_VXWORKS
         d = (b->ticks - a->ticks);
diff --git a/src/lib/libssl/src/crypto/tmdiff.h b/src/lib/libssl/src/crypto/tmdiff.h
index 41a8a1e0e0..af5c41c649 100644
--- a/src/lib/libssl/src/crypto/tmdiff.h
+++ b/src/lib/libssl/src/crypto/tmdiff.h
@@ -59,6 +59,16 @@
 /* Header for dynamic hash table routines
  * Author - Eric Young
  */
+/* ... erm yeah, "dynamic hash tables" you say?
+ * 
+ * And what would dynamic hash tables have to do with any of this code *now*?
+ * AFAICS, this code is only referenced by crypto/bn/exp.c which is an unused
+ * file that I doubt compiles any more. speed.c is the only thing that could
+ * use this (and it has nothing to do with hash tables), yet it instead has its
+ * own duplication of all this stuff and looks, if anything, more complete. See
+ * the corresponding note in apps/speed.c.
+ * The Bemused - Geoff
+ */
 
 #ifndef HEADER_TMDIFF_H
 #define HEADER_TMDIFF_H
@@ -67,11 +77,13 @@
 extern "C" {
 #endif
 
-char *ms_time_new(void );
-void ms_time_free(char *a);
-void ms_time_get(char *a);
-double ms_time_diff(char *start,char *end);
-int ms_time_cmp(char *ap,char *bp);
+typedef struct ms_tm MS_TM;
+
+MS_TM *ms_time_new(void );
+void ms_time_free(MS_TM *a);
+void ms_time_get(MS_TM *a);
+double ms_time_diff(MS_TM *start, MS_TM *end);
+int ms_time_cmp(const MS_TM *ap, const MS_TM *bp);
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/txt_db/txt_db.c b/src/lib/libssl/src/crypto/txt_db/txt_db.c
index 58b300b00b..3ed5f72ee9 100644
--- a/src/lib/libssl/src/crypto/txt_db/txt_db.c
+++ b/src/lib/libssl/src/crypto/txt_db/txt_db.c
@@ -66,7 +66,7 @@
 #undef BUFSIZE
 #define BUFSIZE 512
 
-const char *TXT_DB_version="TXT_DB" OPENSSL_VERSION_PTEXT;
+const char TXT_DB_version[]="TXT_DB" OPENSSL_VERSION_PTEXT;
 
 TXT_DB *TXT_DB_read(BIO *in, int num)
         {
@@ -92,7 +92,7 @@ TXT_DB *TXT_DB_read(BIO *in, int num)
                 goto err;
         if ((ret->index=(LHASH **)OPENSSL_malloc(sizeof(LHASH *)*num)) == NULL)
                 goto err;
-        if ((ret->qual=(int (**)())OPENSSL_malloc(sizeof(int (**)())*num)) == NULL)
+        if ((ret->qual=(int (**)(char **))OPENSSL_malloc(sizeof(int (**)(char **))*num)) == NULL)
                 goto err;
         for (i=0; i<num; i++)
                 {
@@ -179,10 +179,13 @@ err:
 #if !defined(OPENSSL_NO_STDIO) && !defined(OPENSSL_SYS_WIN16)
                 if (er == 1) fprintf(stderr,"OPENSSL_malloc failure\n");
 #endif
-                if (ret->data != NULL) sk_free(ret->data);
-                if (ret->index != NULL) OPENSSL_free(ret->index);
-                if (ret->qual != NULL) OPENSSL_free(ret->qual);
-                if (ret != NULL) OPENSSL_free(ret);
+                if (ret != NULL)
+                        {
+                        if (ret->data != NULL) sk_free(ret->data);
+                        if (ret->index != NULL) OPENSSL_free(ret->index);
+                        if (ret->qual != NULL) OPENSSL_free(ret->qual);
+                        if (ret != NULL) OPENSSL_free(ret);
+                        }
                 return(NULL);
                 }
         else
@@ -210,11 +213,11 @@ char **TXT_DB_get_by_index(TXT_DB *db, int idx, char **value)
         return(ret);
         }
 
-int TXT_DB_create_index(TXT_DB *db, int field, int (*qual)(),
+int TXT_DB_create_index(TXT_DB *db, int field, int (*qual)(char **),
                 LHASH_HASH_FN_TYPE hash, LHASH_COMP_FN_TYPE cmp)
         {
         LHASH *idx;
-        char *r;
+        char **r;
         int i,n;
 
         if (field >= db->num_fields)
@@ -230,12 +233,12 @@ int TXT_DB_create_index(TXT_DB *db, int field, int (*qual)(),
         n=sk_num(db->data);
         for (i=0; i<n; i++)
                 {
-                r=(char *)sk_value(db->data,i);
+                r=(char **)sk_value(db->data,i);
                 if ((qual != NULL) && (qual(r) == 0)) continue;
                 if ((r=lh_insert(idx,r)) != NULL)
                         {
                         db->error=DB_ERROR_INDEX_CLASH;
-                        db->arg1=sk_find(db->data,r);
+                        db->arg1=sk_find(db->data,(char *)r);
                         db->arg2=i;
                         lh_free(idx);
                         return(0);
diff --git a/src/lib/libssl/src/crypto/txt_db/txt_db.h b/src/lib/libssl/src/crypto/txt_db/txt_db.h
index 563392aeff..307e1ba23f 100644
--- a/src/lib/libssl/src/crypto/txt_db/txt_db.h
+++ b/src/lib/libssl/src/crypto/txt_db/txt_db.h
@@ -59,6 +59,7 @@
 #ifndef HEADER_TXT_DB_H
 #define HEADER_TXT_DB_H
 
+#include <openssl/opensslconf.h>
 #ifndef OPENSSL_NO_BIO
 #include <openssl/bio.h>
 #endif
@@ -81,7 +82,7 @@ typedef struct txt_db_st
         int num_fields;
         STACK /* char ** */ *data;
         LHASH **index;
-        int (**qual)();
+        int (**qual)(char **);
         long error;
         long arg1;
         long arg2;
@@ -95,7 +96,7 @@ long TXT_DB_write(BIO *out, TXT_DB *db);
 TXT_DB *TXT_DB_read(char *in, int num);
 long TXT_DB_write(char *out, TXT_DB *db);
 #endif
-int TXT_DB_create_index(TXT_DB *db,int field,int (*qual)(),
+int TXT_DB_create_index(TXT_DB *db,int field,int (*qual)(char **),
                 LHASH_HASH_FN_TYPE hash, LHASH_COMP_FN_TYPE cmp);
 void TXT_DB_free(TXT_DB *db);
 char **TXT_DB_get_by_index(TXT_DB *db, int idx, char **value);
diff --git a/src/lib/libssl/src/crypto/ui/ui.h b/src/lib/libssl/src/crypto/ui/ui.h
index 735a2d988e..018296412b 100644
--- a/src/lib/libssl/src/crypto/ui/ui.h
+++ b/src/lib/libssl/src/crypto/ui/ui.h
@@ -59,25 +59,19 @@
 #ifndef HEADER_UI_H
 #define HEADER_UI_H
 
+#ifndef OPENSSL_NO_DEPRECATED
 #include <openssl/crypto.h>
+#endif
 #include <openssl/safestack.h>
+#include <openssl/ossl_typ.h>
 
 #ifdef  __cplusplus
 extern "C" {
 #endif
 
-/* The UI type is a holder for a specific user interface session.  It can
-   contain an illimited number of informational or error strings as well
-   as things to prompt for, both passwords (noecho mode) and others (echo
-   mode), and verification of the same.  All of these are called strings,
-   and are further described below. */
-typedef struct ui_st UI;
-
-/* All instances of UI have a reference to a method structure, which is a
-   ordered vector of functions that implement the lower level things to do.
-   There is an instruction on the implementation further down, in the section
-   for method implementors. */
-typedef struct ui_method_st UI_METHOD;
+/* Declared already in ossl_typ.h */
+/* typedef struct ui_st UI; */
+/* typedef struct ui_method_st UI_METHOD; */
 
 
 /* All the following functions return -1 or NULL on error and in some cases
@@ -217,7 +211,7 @@ int UI_process(UI *ui);
 /* Give a user interface parametrised control commands.  This can be used to
    send down an integer, a data pointer or a function pointer, as well as
    be used to get information from a UI. */
-int UI_ctrl(UI *ui, int cmd, long i, void *p, void (*f)());
+int UI_ctrl(UI *ui, int cmd, long i, void *p, void (*f)(void));
 
 /* The commands */
 /* Use UI_CONTROL_PRINT_ERRORS with the value 1 to have UI_process print the
diff --git a/src/lib/libssl/src/crypto/ui/ui_err.c b/src/lib/libssl/src/crypto/ui/ui_err.c
index d983cdd66f..786bd0dbc3 100644
--- a/src/lib/libssl/src/crypto/ui/ui_err.c
+++ b/src/lib/libssl/src/crypto/ui/ui_err.c
@@ -101,15 +101,12 @@ static ERR_STRING_DATA UI_str_reasons[]=
 
 void ERR_load_UI_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(UI_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,UI_str_functs);
                 ERR_load_strings(0,UI_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/ui/ui_lib.c b/src/lib/libssl/src/crypto/ui/ui_lib.c
index dbc9711a2d..7ab249c3be 100644
--- a/src/lib/libssl/src/crypto/ui/ui_lib.c
+++ b/src/lib/libssl/src/crypto/ui/ui_lib.c
@@ -57,12 +57,12 @@
  */
 
 #include <string.h>
+#include "cryptlib.h"
 #include <openssl/e_os2.h>
 #include <openssl/buffer.h>
 #include <openssl/ui.h>
 #include <openssl/err.h>
 #include "ui_locl.h"
-#include "cryptlib.h"
 
 IMPLEMENT_STACK_OF(UI_STRING_ST)
 
@@ -545,7 +545,7 @@ int UI_process(UI *ui)
         return ok;
         }
 
-int UI_ctrl(UI *ui, int cmd, long i, void *p, void (*f)())
+int UI_ctrl(UI *ui, int cmd, long i, void *p, void (*f)(void))
         {
         if (ui == NULL)
                 {
@@ -620,8 +620,10 @@ UI_METHOD *UI_create_method(char *name)
         UI_METHOD *ui_method = (UI_METHOD *)OPENSSL_malloc(sizeof(UI_METHOD));
 
         if (ui_method)
+                {
                 memset(ui_method, 0, sizeof(*ui_method));
-        ui_method->name = BUF_strdup(name);
+                ui_method->name = BUF_strdup(name);
+                }
         return ui_method;
         }
 
diff --git a/src/lib/libssl/src/crypto/ui/ui_locl.h b/src/lib/libssl/src/crypto/ui/ui_locl.h
index 7d3a75a619..aa4a55637d 100644
--- a/src/lib/libssl/src/crypto/ui/ui_locl.h
+++ b/src/lib/libssl/src/crypto/ui/ui_locl.h
@@ -60,6 +60,11 @@
 #define HEADER_UI_LOCL_H
 
 #include <openssl/ui.h>
+#include <openssl/crypto.h>
+
+#ifdef _
+#undef _
+#endif
 
 struct ui_method_st
         {
diff --git a/src/lib/libssl/src/crypto/ui/ui_openssl.c b/src/lib/libssl/src/crypto/ui/ui_openssl.c
index d03aeba91a..8446673ed4 100644
--- a/src/lib/libssl/src/crypto/ui/ui_openssl.c
+++ b/src/lib/libssl/src/crypto/ui/ui_openssl.c
@@ -117,6 +117,17 @@
 
 #include <openssl/e_os2.h>
 
+/* need for #define _POSIX_C_SOURCE arises whenever you pass -ansi to gcc
+ * [maybe others?], because it masks interfaces not discussed in standard,
+ * sigaction and fileno included. -pedantic would be more appropriate for
+ * the intended purposes, but we can't prevent users from adding -ansi.
+ */
+#define _POSIX_C_SOURCE 1
+#include <signal.h>
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+
 #if !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_VMS)
 # ifdef OPENSSL_UNISTD
 #  include OPENSSL_UNISTD
@@ -145,10 +156,6 @@
 /* 06-Apr-92 Luke Brennan    Support for VMS */
 #include "ui_locl.h"
 #include "cryptlib.h"
-#include <signal.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
 
 #ifdef OPENSSL_SYS_VMS          /* prototypes for sys$whatever */
 # include <starlet.h>
@@ -199,6 +206,12 @@
 #undef SGTTY
 #endif
 
+#if defined(OPENSSL_SYS_NETWARE)
+#undef TERMIOS
+#undef TERMIO
+#undef SGTTY
+#endif
+
 #ifdef TERMIOS
 # include <termios.h>
 # define TTY_STRUCT             struct termios
@@ -247,7 +260,7 @@ struct IOSB {
         typedef int sig_atomic_t;
 #endif
 
-#if defined(OPENSSL_SYS_MACINTOSH_CLASSIC) || defined(MAC_OS_GUSI_SOURCE)
+#if defined(OPENSSL_SYS_MACINTOSH_CLASSIC) || defined(MAC_OS_GUSI_SOURCE) || defined(OPENSSL_SYS_NETWARE)
 /*
  * This one needs work. As a matter of fact the code is unoperational
  * and this is only a trick to get it compiled.
@@ -461,7 +474,7 @@ static int open_console(UI *ui)
         CRYPTO_w_lock(CRYPTO_LOCK_UI);
         is_a_tty = 1;
 
-#if defined(OPENSSL_SYS_MACINTOSH_CLASSIC) || defined(OPENSSL_SYS_VXWORKS)
+#if defined(OPENSSL_SYS_MACINTOSH_CLASSIC) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_NETWARE)
         tty_in=stdin;
         tty_out=stderr;
 #else
@@ -477,7 +490,7 @@ static int open_console(UI *ui)
 #endif
 
 #if defined(TTY_get) && !defined(OPENSSL_SYS_VMS)
-        if (TTY_get(fileno(tty_in),&tty_orig) == -1)
+        if (TTY_get(fileno(tty_in),&tty_orig) == -1)
                 {
 #ifdef ENOTTY
                 if (errno == ENOTTY)
@@ -566,7 +579,9 @@ static int close_console(UI *ui)
 /* Internal functions to handle signals and act on them */
 static void pushsig(void)
         {
+#ifndef OPENSSL_SYS_WIN32
         int i;
+#endif
 #ifdef SIGACTION
         struct sigaction sa;
 
@@ -574,6 +589,14 @@ static void pushsig(void)
         sa.sa_handler=recsig;
 #endif
 
+#ifdef OPENSSL_SYS_WIN32
+        savsig[SIGABRT]=signal(SIGABRT,recsig);
+        savsig[SIGFPE]=signal(SIGFPE,recsig);
+        savsig[SIGILL]=signal(SIGILL,recsig);
+        savsig[SIGINT]=signal(SIGINT,recsig);
+        savsig[SIGSEGV]=signal(SIGSEGV,recsig);
+        savsig[SIGTERM]=signal(SIGTERM,recsig);
+#else
         for (i=1; i<NX509_SIG; i++)
                 {
 #ifdef SIGUSR1
@@ -594,6 +617,7 @@ static void pushsig(void)
                 savsig[i]=signal(i,recsig);
 #endif
                 }
+#endif
 
 #ifdef SIGWINCH
         signal(SIGWINCH,SIG_DFL);
@@ -602,8 +626,15 @@ static void pushsig(void)
 
 static void popsig(void)
         {
+#ifdef OPENSSL_SYS_WIN32
+        signal(SIGABRT,savsig[SIGABRT]);
+        signal(SIGFPE,savsig[SIGFPE]);
+        signal(SIGILL,savsig[SIGILL]);
+        signal(SIGINT,savsig[SIGINT]);
+        signal(SIGSEGV,savsig[SIGSEGV]);
+        signal(SIGTERM,savsig[SIGTERM]);
+#else
         int i;
-
         for (i=1; i<NX509_SIG; i++)
                 {
 #ifdef SIGUSR1
@@ -620,6 +651,7 @@ static void popsig(void)
                 signal(i,savsig[i]);
 #endif
                 }
+#endif
         }
 
 static void recsig(int i)
diff --git a/src/lib/libssl/src/crypto/ui/ui_util.c b/src/lib/libssl/src/crypto/ui/ui_util.c
index 46bc8c1a9a..5d9760bb7b 100644
--- a/src/lib/libssl/src/crypto/ui/ui_util.c
+++ b/src/lib/libssl/src/crypto/ui/ui_util.c
@@ -54,7 +54,7 @@
  */
 
 #include <string.h>
-#include <openssl/ui.h>
+#include "ui_locl.h"
 
 int UI_UTIL_read_pw_string(char *buf,int length,const char *prompt,int verify)
         {
diff --git a/src/lib/libssl/src/crypto/uid.c b/src/lib/libssl/src/crypto/uid.c
index 73205a4baa..b1fd52bada 100644
--- a/src/lib/libssl/src/crypto/uid.c
+++ b/src/lib/libssl/src/crypto/uid.c
@@ -65,7 +65,7 @@ int OPENSSL_issetugid(void)
         return issetugid();
         }
 
-#elif defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VXWORKS)
+#elif defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_VXWORKS) || defined(OPENSSL_SYS_NETWARE)
 
 int OPENSSL_issetugid(void)
         {
diff --git a/src/lib/libssl/src/crypto/x509/by_dir.c b/src/lib/libssl/src/crypto/x509/by_dir.c
index ea689aed1a..37f9a48206 100644
--- a/src/lib/libssl/src/crypto/x509/by_dir.c
+++ b/src/lib/libssl/src/crypto/x509/by_dir.c
@@ -189,7 +189,7 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type)
 
         s=dir;
         p=s;
-        for (;;)
+        for (;;p++)
                 {
                 if ((*p == LIST_SEPARATOR_CHAR) || (*p == '\0'))
                         {
@@ -198,8 +198,11 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type)
                         len=(int)(p-ss);
                         if (len == 0) continue;
                         for (j=0; j<ctx->num_dirs; j++)
-                                if (strncmp(ctx->dirs[j],ss,(unsigned int)len) == 0)
-                                        continue;
+                                if (strlen(ctx->dirs[j]) == (size_t)len &&
+                                    strncmp(ctx->dirs[j],ss,(unsigned int)len) == 0)
+                                        break;
+                        if (j<ctx->num_dirs)
+                                continue;
                         if (ctx->num_dirs_alloced < (ctx->num_dirs+1))
                                 {
                                 ctx->num_dirs_alloced+=10;
@@ -231,7 +234,6 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type)
                         ctx->num_dirs++;
                         }
                 if (*p == '\0') break;
-                p++;
                 }
         return(1);
         }
diff --git a/src/lib/libssl/src/crypto/x509/x509.h b/src/lib/libssl/src/crypto/x509/x509.h
index e8c1a59cf2..e71b5257e5 100644
--- a/src/lib/libssl/src/crypto/x509/x509.h
+++ b/src/lib/libssl/src/crypto/x509/x509.h
@@ -55,10 +55,16 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECDH support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #ifndef HEADER_X509_H
 #define HEADER_X509_H
 
+#include <openssl/e_os2.h>
 #include <openssl/symhacks.h>
 #ifndef OPENSSL_NO_BUFFER
 #include <openssl/buffer.h>
@@ -73,21 +79,33 @@
 #include <openssl/asn1.h>
 #include <openssl/safestack.h>
 
+#ifndef OPENSSL_NO_EC
+#include <openssl/ec.h>
+#endif
+
+#ifndef OPENSSL_NO_ECDSA
+#include <openssl/ecdsa.h>
+#endif
+
+#ifndef OPENSSL_NO_ECDH
+#include <openssl/ecdh.h>
+#endif
+
+#ifndef OPENSSL_NO_DEPRECATED
 #ifndef OPENSSL_NO_RSA
 #include <openssl/rsa.h>
 #endif
-
 #ifndef OPENSSL_NO_DSA
 #include <openssl/dsa.h>
 #endif
-
 #ifndef OPENSSL_NO_DH
 #include <openssl/dh.h>
 #endif
+#endif
+
 #ifndef OPENSSL_NO_SHA
 #include <openssl/sha.h>
 #endif
-#include <openssl/e_os2.h>
 #include <openssl/ossl_typ.h>
 
 #ifdef  __cplusplus
@@ -95,8 +113,9 @@ extern "C" {
 #endif
 
 #ifdef OPENSSL_SYS_WIN32
-/* Under Win32 this is defined in wincrypt.h */
+/* Under Win32 these are defined in wincrypt.h */
 #undef X509_NAME
+#undef X509_CERT_PAIR
 #endif
 
 #define X509_FILETYPE_PEM       1
@@ -117,8 +136,8 @@ extern "C" {
 typedef struct X509_objects_st
         {
         int nid;
-        int (*a2i)();
-        int (*i2a)();
+        int (*a2i)(void);
+        int (*i2a)(void);
         } X509_OBJECTS;
 
 struct X509_algor_st
@@ -127,9 +146,10 @@ struct X509_algor_st
         ASN1_TYPE *parameter;
         } /* X509_ALGOR */;
 
-DECLARE_STACK_OF(X509_ALGOR)
 DECLARE_ASN1_SET_OF(X509_ALGOR)
 
+typedef STACK_OF(X509_ALGOR) X509_ALGORS;
+
 typedef struct X509_val_st
         {
         ASN1_TIME *notBefore;
@@ -184,6 +204,8 @@ typedef struct X509_extension_st
         ASN1_OCTET_STRING *value;
         } X509_EXTENSION;
 
+typedef STACK_OF(X509_EXTENSION) X509_EXTENSIONS;
+
 DECLARE_STACK_OF(X509_EXTENSION)
 DECLARE_ASN1_SET_OF(X509_EXTENSION)
 
@@ -261,12 +283,18 @@ struct x509_st
         CRYPTO_EX_DATA ex_data;
         /* These contain copies of various extension values */
         long ex_pathlen;
+        long ex_pcpathlen;
         unsigned long ex_flags;
         unsigned long ex_kusage;
         unsigned long ex_xkusage;
         unsigned long ex_nscert;
         ASN1_OCTET_STRING *skid;
         struct AUTHORITY_KEYID_st *akid;
+        X509_POLICY_CACHE *policy_cache;
+#ifndef OPENSSL_NO_RFC3779
+        STACK_OF(IPAddressFamily) *rfc3779_addr;
+        struct ASIdentifiers_st *rfc3779_asid;
+#endif
 #ifndef OPENSSL_NO_SHA
         unsigned char sha1_hash[SHA_DIGEST_LENGTH];
 #endif
@@ -289,6 +317,11 @@ typedef struct x509_trust_st {
 
 DECLARE_STACK_OF(X509_TRUST)
 
+typedef struct x509_cert_pair_st {
+        X509 *forward;
+        X509 *reverse;
+} X509_CERT_PAIR;
+
 /* standard trust ids */
 
 #define X509_TRUST_DEFAULT      -1      /* Only valid in purpose settings */
@@ -655,6 +688,17 @@ extern "C" {
 #define i2d_DSAPrivateKey_bio(bp,dsa) ASN1_i2d_bio(i2d_DSAPrivateKey,bp, \
                 (unsigned char *)dsa)
 
+#define d2i_ECPrivateKey_fp(fp,ecdsa) (EC_KEY *)ASN1_d2i_fp((char *(*)())\
+                EC_KEY_new,(char *(*)())d2i_ECPrivateKey, (fp), \
+                (unsigned char **)(ecdsa))
+#define i2d_ECPrivateKey_fp(fp,ecdsa) ASN1_i2d_fp(i2d_ECPrivateKey,fp, \
+                (unsigned char *)ecdsa)
+#define d2i_ECPrivateKey_bio(bp,ecdsa) (EC_KEY *)ASN1_d2i_bio((char *(*)())\
+                EC_KEY_new,(char *(*)())d2i_ECPrivateKey, (bp), \
+                (unsigned char **)(ecdsa))
+#define i2d_ECPrivateKey_bio(bp,ecdsa) ASN1_i2d_bio(i2d_ECPrivateKey,bp, \
+                (unsigned char *)ecdsa)
+
 #define X509_ALGOR_dup(xn) (X509_ALGOR *)ASN1_dup((int (*)())i2d_X509_ALGOR,\
                 (char *(*)())d2i_X509_ALGOR,(char *)xn)
 
@@ -758,6 +802,12 @@ int i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa);
 DSA *d2i_DSAPrivateKey_fp(FILE *fp, DSA **dsa);
 int i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa);
 #endif
+#ifndef OPENSSL_NO_EC
+EC_KEY *d2i_EC_PUBKEY_fp(FILE *fp, EC_KEY **eckey);
+int   i2d_EC_PUBKEY_fp(FILE *fp, EC_KEY *eckey);
+EC_KEY *d2i_ECPrivateKey_fp(FILE *fp, EC_KEY **eckey);
+int   i2d_ECPrivateKey_fp(FILE *fp, EC_KEY *eckey);
+#endif
 X509_SIG *d2i_PKCS8_fp(FILE *fp,X509_SIG **p8);
 int i2d_PKCS8_fp(FILE *fp,X509_SIG *p8);
 PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,
@@ -791,6 +841,12 @@ int i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa);
 DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa);
 int i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa);
 #endif
+#ifndef OPENSSL_NO_EC
+EC_KEY *d2i_EC_PUBKEY_bio(BIO *bp, EC_KEY **eckey);
+int   i2d_EC_PUBKEY_bio(BIO *bp, EC_KEY *eckey);
+EC_KEY *d2i_ECPrivateKey_bio(BIO *bp, EC_KEY **eckey);
+int   i2d_ECPrivateKey_bio(BIO *bp, EC_KEY *eckey);
+#endif
 X509_SIG *d2i_PKCS8_bio(BIO *bp,X509_SIG **p8);
 int i2d_PKCS8_bio(BIO *bp,X509_SIG *p8);
 PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,
@@ -809,6 +865,10 @@ X509_EXTENSION *X509_EXTENSION_dup(X509_EXTENSION *ex);
 X509_CRL *X509_CRL_dup(X509_CRL *crl);
 X509_REQ *X509_REQ_dup(X509_REQ *req);
 X509_ALGOR *X509_ALGOR_dup(X509_ALGOR *xn);
+int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval);
+void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,
+                                                X509_ALGOR *algor);
+
 X509_NAME *X509_NAME_dup(X509_NAME *xn);
 X509_NAME_ENTRY *X509_NAME_ENTRY_dup(X509_NAME_ENTRY *ne);
 
@@ -830,6 +890,7 @@ X509_REQ *	X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md);
 X509 *          X509_REQ_to_X509(X509_REQ *r, int days,EVP_PKEY *pkey);
 
 DECLARE_ASN1_FUNCTIONS(X509_ALGOR)
+DECLARE_ASN1_ENCODE_FUNCTIONS(X509_ALGORS, X509_ALGORS, X509_ALGORS)
 DECLARE_ASN1_FUNCTIONS(X509_VAL)
 
 DECLARE_ASN1_FUNCTIONS(X509_PUBKEY)
@@ -839,16 +900,21 @@ EVP_PKEY *	X509_PUBKEY_get(X509_PUBKEY *key);
 int             X509_get_pubkey_parameters(EVP_PKEY *pkey,
                                            STACK_OF(X509) *chain);
 int             i2d_PUBKEY(EVP_PKEY *a,unsigned char **pp);
-EVP_PKEY *      d2i_PUBKEY(EVP_PKEY **a,unsigned char **pp,
+EVP_PKEY *      d2i_PUBKEY(EVP_PKEY **a,const unsigned char **pp,
                         long length);
 #ifndef OPENSSL_NO_RSA
 int             i2d_RSA_PUBKEY(RSA *a,unsigned char **pp);
-RSA *           d2i_RSA_PUBKEY(RSA **a,unsigned char **pp,
+RSA *           d2i_RSA_PUBKEY(RSA **a,const unsigned char **pp,
                         long length);
 #endif
 #ifndef OPENSSL_NO_DSA
 int             i2d_DSA_PUBKEY(DSA *a,unsigned char **pp);
-DSA *           d2i_DSA_PUBKEY(DSA **a,unsigned char **pp,
+DSA *           d2i_DSA_PUBKEY(DSA **a,const unsigned char **pp,
+                        long length);
+#endif
+#ifndef OPENSSL_NO_EC
+int             i2d_EC_PUBKEY(EC_KEY *a, unsigned char **pp);
+EC_KEY          *d2i_EC_PUBKEY(EC_KEY **a, const unsigned char **pp,
                         long length);
 #endif
 
@@ -860,6 +926,7 @@ DECLARE_ASN1_FUNCTIONS(X509_ATTRIBUTE)
 X509_ATTRIBUTE *X509_ATTRIBUTE_create(int nid, int atrtype, void *value);
 
 DECLARE_ASN1_FUNCTIONS(X509_EXTENSION)
+DECLARE_ASN1_ENCODE_FUNCTIONS(X509_EXTENSIONS, X509_EXTENSIONS, X509_EXTENSIONS)
 
 DECLARE_ASN1_FUNCTIONS(X509_NAME_ENTRY)
 
@@ -872,16 +939,19 @@ DECLARE_ASN1_FUNCTIONS(X509_CINF)
 DECLARE_ASN1_FUNCTIONS(X509)
 DECLARE_ASN1_FUNCTIONS(X509_CERT_AUX)
 
+DECLARE_ASN1_FUNCTIONS(X509_CERT_PAIR)
+
 int X509_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
              CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
 int X509_set_ex_data(X509 *r, int idx, void *arg);
 void *X509_get_ex_data(X509 *r, int idx);
 int             i2d_X509_AUX(X509 *a,unsigned char **pp);
-X509 *          d2i_X509_AUX(X509 **a,unsigned char **pp,long length);
+X509 *          d2i_X509_AUX(X509 **a,const unsigned char **pp,long length);
 
 int X509_alias_set1(X509 *x, unsigned char *name, int len);
 int X509_keyid_set1(X509 *x, unsigned char *id, int len);
 unsigned char * X509_alias_get0(X509 *x, int *len);
+unsigned char * X509_keyid_get0(X509 *x, int *len);
 int (*X509_TRUST_set_default(int (*trust)(int , X509 *, int)))(int, X509 *, int);
 int X509_TRUST_set(int *t, int trust);
 int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj);
@@ -898,7 +968,7 @@ int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev);
 X509_PKEY *     X509_PKEY_new(void );
 void            X509_PKEY_free(X509_PKEY *a);
 int             i2d_X509_PKEY(X509_PKEY *a,unsigned char **pp);
-X509_PKEY *     d2i_X509_PKEY(X509_PKEY **a,unsigned char **pp,long length);
+X509_PKEY *     d2i_X509_PKEY(X509_PKEY **a,const unsigned char **pp,long length);
 
 DECLARE_ASN1_FUNCTIONS(NETSCAPE_SPKI)
 DECLARE_ASN1_FUNCTIONS(NETSCAPE_SPKAC)
@@ -909,15 +979,15 @@ X509_INFO *	X509_INFO_new(void);
 void            X509_INFO_free(X509_INFO *a);
 char *          X509_NAME_oneline(X509_NAME *a,char *buf,int size);
 
-int ASN1_verify(int (*i2d)(), X509_ALGOR *algor1,
-        ASN1_BIT_STRING *signature,char *data,EVP_PKEY *pkey);
+int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *algor1,
+                ASN1_BIT_STRING *signature,char *data,EVP_PKEY *pkey);
 
-int ASN1_digest(int (*i2d)(),const EVP_MD *type,char *data,
-        unsigned char *md,unsigned int *len);
+int ASN1_digest(i2d_of_void *i2d,const EVP_MD *type,char *data,
+                unsigned char *md,unsigned int *len);
 
-int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
-        ASN1_BIT_STRING *signature,
-        char *data,EVP_PKEY *pkey, const EVP_MD *type);
+int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1,
+              X509_ALGOR *algor2, ASN1_BIT_STRING *signature,
+              char *data,EVP_PKEY *pkey, const EVP_MD *type);
 
 int ASN1_item_digest(const ASN1_ITEM *it,const EVP_MD *type,void *data,
         unsigned char *md,unsigned int *len);
@@ -982,6 +1052,8 @@ int X509_CRL_sort(X509_CRL *crl);
 int X509_REVOKED_set_serialNumber(X509_REVOKED *x, ASN1_INTEGER *serial);
 int X509_REVOKED_set_revocationDate(X509_REVOKED *r, ASN1_TIME *tm);
 
+int             X509_REQ_check_private_key(X509_REQ *x509,EVP_PKEY *pkey);
+
 int             X509_check_private_key(X509 *x509,EVP_PKEY *pkey);
 
 int             X509_issuer_and_serial_cmp(const X509 *a, const X509 *b);
@@ -1128,6 +1200,8 @@ STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_NID(STACK_OF(X509_ATTRIBUTE) **x,
 STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_txt(STACK_OF(X509_ATTRIBUTE) **x,
                         const char *attrname, int type,
                         const unsigned char *bytes, int len);
+void *X509at_get0_data_by_OBJ(STACK_OF(X509_ATTRIBUTE) *x,
+                                ASN1_OBJECT *obj, int lastpos, int type);
 X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_NID(X509_ATTRIBUTE **attr, int nid,
              int atrtype, const void *data, int len);
 X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_OBJ(X509_ATTRIBUTE **attr,
@@ -1142,6 +1216,24 @@ int X509_ATTRIBUTE_count(X509_ATTRIBUTE *attr);
 ASN1_OBJECT *X509_ATTRIBUTE_get0_object(X509_ATTRIBUTE *attr);
 ASN1_TYPE *X509_ATTRIBUTE_get0_type(X509_ATTRIBUTE *attr, int idx);
 
+int EVP_PKEY_get_attr_count(const EVP_PKEY *key);
+int EVP_PKEY_get_attr_by_NID(const EVP_PKEY *key, int nid,
+                          int lastpos);
+int EVP_PKEY_get_attr_by_OBJ(const EVP_PKEY *key, ASN1_OBJECT *obj,
+                          int lastpos);
+X509_ATTRIBUTE *EVP_PKEY_get_attr(const EVP_PKEY *key, int loc);
+X509_ATTRIBUTE *EVP_PKEY_delete_attr(EVP_PKEY *key, int loc);
+int EVP_PKEY_add1_attr(EVP_PKEY *key, X509_ATTRIBUTE *attr);
+int EVP_PKEY_add1_attr_by_OBJ(EVP_PKEY *key,
+                        const ASN1_OBJECT *obj, int type,
+                        const unsigned char *bytes, int len);
+int EVP_PKEY_add1_attr_by_NID(EVP_PKEY *key,
+                        int nid, int type,
+                        const unsigned char *bytes, int len);
+int EVP_PKEY_add1_attr_by_txt(EVP_PKEY *key,
+                        const char *attrname, int type,
+                        const unsigned char *bytes, int len);
+
 int             X509_verify_cert(X509_STORE_CTX *ctx);
 
 /* lookup a cert from a X509 STACK */
@@ -1188,18 +1280,20 @@ void ERR_load_X509_strings(void);
 /* Function codes. */
 #define X509_F_ADD_CERT_DIR                              100
 #define X509_F_BY_FILE_CTRL                              101
+#define X509_F_CHECK_POLICY                              145
 #define X509_F_DIR_CTRL                                  102
 #define X509_F_GET_CERT_BY_SUBJECT                       103
 #define X509_F_NETSCAPE_SPKI_B64_DECODE                  129
 #define X509_F_NETSCAPE_SPKI_B64_ENCODE                  130
+#define X509_F_X509AT_ADD1_ATTR                          135
 #define X509_F_X509V3_ADD_EXT                            104
-#define X509_F_X509_ADD_ATTR                             135
 #define X509_F_X509_ATTRIBUTE_CREATE_BY_NID              136
 #define X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ              137
 #define X509_F_X509_ATTRIBUTE_CREATE_BY_TXT              140
 #define X509_F_X509_ATTRIBUTE_GET0_DATA                  139
 #define X509_F_X509_ATTRIBUTE_SET1_DATA                  138
 #define X509_F_X509_CHECK_PRIVATE_KEY                    128
+#define X509_F_X509_CRL_PRINT_FP                         147
 #define X509_F_X509_EXTENSION_CREATE_BY_NID              108
 #define X509_F_X509_EXTENSION_CREATE_BY_OBJ              109
 #define X509_F_X509_GET_PUBKEY_PARAMETERS                110
@@ -1212,14 +1306,16 @@ void ERR_load_X509_strings(void);
 #define X509_F_X509_NAME_ENTRY_SET_OBJECT                115
 #define X509_F_X509_NAME_ONELINE                         116
 #define X509_F_X509_NAME_PRINT                           117
-#define X509_F_X509_PRINT_FP                             118
+#define X509_F_X509_PRINT_EX_FP                          118
 #define X509_F_X509_PUBKEY_GET                           119
 #define X509_F_X509_PUBKEY_SET                           120
-#define X509_F_X509_REQ_PRINT                            121
+#define X509_F_X509_REQ_CHECK_PRIVATE_KEY                144
+#define X509_F_X509_REQ_PRINT_EX                         121
 #define X509_F_X509_REQ_PRINT_FP                         122
 #define X509_F_X509_REQ_TO_X509                          123
 #define X509_F_X509_STORE_ADD_CERT                       124
 #define X509_F_X509_STORE_ADD_CRL                        125
+#define X509_F_X509_STORE_CTX_GET1_ISSUER                146
 #define X509_F_X509_STORE_CTX_INIT                       143
 #define X509_F_X509_STORE_CTX_NEW                        142
 #define X509_F_X509_STORE_CTX_PURPOSE_INHERIT            134
diff --git a/src/lib/libssl/src/crypto/x509/x509_att.c b/src/lib/libssl/src/crypto/x509/x509_att.c
index 0bae3d32a1..511b49d589 100644
--- a/src/lib/libssl/src/crypto/x509/x509_att.c
+++ b/src/lib/libssl/src/crypto/x509/x509_att.c
@@ -67,8 +67,7 @@
 
 int X509at_get_attr_count(const STACK_OF(X509_ATTRIBUTE) *x)
 {
-        if (!x) return 0;
-        return(sk_X509_ATTRIBUTE_num(x));
+        return sk_X509_ATTRIBUTE_num(x);
 }
 
 int X509at_get_attr_by_NID(const STACK_OF(X509_ATTRIBUTE) *x, int nid,
@@ -125,7 +124,13 @@ STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x,
         X509_ATTRIBUTE *new_attr=NULL;
         STACK_OF(X509_ATTRIBUTE) *sk=NULL;
 
-        if ((x != NULL) && (*x == NULL))
+        if (x == NULL)
+                {
+                X509err(X509_F_X509AT_ADD1_ATTR, ERR_R_PASSED_NULL_PARAMETER);
+                goto err2;
+                } 
+
+        if (*x == NULL)
                 {
                 if ((sk=sk_X509_ATTRIBUTE_new_null()) == NULL)
                         goto err;
@@ -137,11 +142,11 @@ STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x,
                 goto err2;
         if (!sk_X509_ATTRIBUTE_push(sk,new_attr))
                 goto err;
-        if ((x != NULL) && (*x == NULL))
+        if (*x == NULL)
                 *x=sk;
         return(sk);
 err:
-        X509err(X509_F_X509_ADD_ATTR,ERR_R_MALLOC_FAILURE);
+        X509err(X509_F_X509AT_ADD1_ATTR,ERR_R_MALLOC_FAILURE);
 err2:
         if (new_attr != NULL) X509_ATTRIBUTE_free(new_attr);
         if (sk != NULL) sk_X509_ATTRIBUTE_free(sk);
@@ -187,6 +192,22 @@ STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr_by_txt(STACK_OF(X509_ATTRIBUTE) **x,
         return ret;
 }
 
+void *X509at_get0_data_by_OBJ(STACK_OF(X509_ATTRIBUTE) *x,
+                                ASN1_OBJECT *obj, int lastpos, int type)
+{
+        int i;
+        X509_ATTRIBUTE *at;
+        i = X509at_get_attr_by_OBJ(x, obj, lastpos);
+        if (i == -1)
+                return NULL;
+        if ((lastpos <= -2) && (X509at_get_attr_by_OBJ(x, obj, i) != -1))
+                return NULL;
+        at = X509at_get_attr(x, i);
+        if (lastpos <= -3 && (X509_ATTRIBUTE_count(at) != 1))
+                return NULL;
+        return X509_ATTRIBUTE_get0_data(at, 0, type, NULL);
+}
+
 X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_NID(X509_ATTRIBUTE **attr, int nid,
              int atrtype, const void *data, int len)
 {
@@ -264,8 +285,8 @@ int X509_ATTRIBUTE_set1_object(X509_ATTRIBUTE *attr, const ASN1_OBJECT *obj)
 int X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype, const void *data, int len)
 {
         ASN1_TYPE *ttmp;
-        ASN1_STRING *stmp;
-        int atype;
+        ASN1_STRING *stmp = NULL;
+        int atype = 0;
         if (!attr) return 0;
         if(attrtype & MBSTRING_FLAG) {
                 stmp = ASN1_STRING_set_by_NID(NULL, data, len, attrtype,
@@ -275,16 +296,22 @@ int X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype, const void *dat
                         return 0;
                 }
                 atype = stmp->type;
-        } else {
+        } else if (len != -1){
                 if(!(stmp = ASN1_STRING_type_new(attrtype))) goto err;
                 if(!ASN1_STRING_set(stmp, data, len)) goto err;
                 atype = attrtype;
         }
         if(!(attr->value.set = sk_ASN1_TYPE_new_null())) goto err;
         if(!(ttmp = ASN1_TYPE_new())) goto err;
+        if (len == -1)
+                {
+                if (!ASN1_TYPE_set1(ttmp, attrtype, data))
+                        goto err;
+                }
+        else
+                ASN1_TYPE_set(ttmp, atype, stmp);
         if(!sk_ASN1_TYPE_push(attr->value.set, ttmp)) goto err;
         attr->single = 0;
-        ASN1_TYPE_set(ttmp, atype, stmp);
         return 1;
         err:
         X509err(X509_F_X509_ATTRIBUTE_SET1_DATA, ERR_R_MALLOC_FAILURE);
diff --git a/src/lib/libssl/src/crypto/x509/x509_cmp.c b/src/lib/libssl/src/crypto/x509/x509_cmp.c
index 030d0966fc..0d6bc653b2 100644
--- a/src/lib/libssl/src/crypto/x509/x509_cmp.c
+++ b/src/lib/libssl/src/crypto/x509/x509_cmp.c
@@ -322,16 +322,10 @@ unsigned long X509_NAME_hash(X509_NAME *x)
         {
         unsigned long ret=0;
         unsigned char md[16];
-        EVP_MD_CTX md_ctx;
 
         /* Make sure X509_NAME structure contains valid cached encoding */
         i2d_X509_NAME(x,NULL);
-        EVP_MD_CTX_init(&md_ctx);
-        EVP_MD_CTX_set_flags(&md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-        EVP_DigestInit_ex(&md_ctx, EVP_md5(), NULL);
-        EVP_DigestUpdate(&md_ctx, x->bytes->data, x->bytes->length);
-        EVP_DigestFinal_ex(&md_ctx,md,NULL);
-        EVP_MD_CTX_cleanup(&md_ctx);
+        EVP_Digest(x->bytes->data, x->bytes->length, md, NULL, EVP_md5(), NULL);
 
         ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                 ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
@@ -396,45 +390,36 @@ int X509_check_private_key(X509 *x, EVP_PKEY *k)
         int ok=0;
 
         xk=X509_get_pubkey(x);
-        if (xk->type != k->type)
-            {
-            X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_TYPE_MISMATCH);
-            goto err;
-            }
-        switch (k->type)
+        switch (EVP_PKEY_cmp(xk, k))
                 {
-#ifndef OPENSSL_NO_RSA
-        case EVP_PKEY_RSA:
-                if (BN_cmp(xk->pkey.rsa->n,k->pkey.rsa->n) != 0
-                    || BN_cmp(xk->pkey.rsa->e,k->pkey.rsa->e) != 0)
-                    {
-                    X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH);
-                    goto err;
-                    }
+        case 1:
+                ok=1;
                 break;
-#endif
-#ifndef OPENSSL_NO_DSA
-        case EVP_PKEY_DSA:
-                if (BN_cmp(xk->pkey.dsa->pub_key,k->pkey.dsa->pub_key) != 0)
-                    {
-                    X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH);
-                    goto err;
-                    }
+        case 0:
+                X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH);
+                break;
+        case -1:
+                X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_KEY_TYPE_MISMATCH);
                 break;
+        case -2:
+#ifndef OPENSSL_NO_EC
+                if (k->type == EVP_PKEY_EC)
+                        {
+                        X509err(X509_F_X509_CHECK_PRIVATE_KEY, ERR_R_EC_LIB);
+                        break;
+                        }
 #endif
 #ifndef OPENSSL_NO_DH
-        case EVP_PKEY_DH:
-                /* No idea */
-                X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_CANT_CHECK_DH_KEY);
-                goto err;
+                if (k->type == EVP_PKEY_DH)
+                        {
+                        /* No idea */
+                        X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_CANT_CHECK_DH_KEY);
+                        break;
+                        }
 #endif
-        default:
                 X509err(X509_F_X509_CHECK_PRIVATE_KEY,X509_R_UNKNOWN_KEY_TYPE);
-                goto err;
                 }
 
-        ok=1;
-err:
         EVP_PKEY_free(xk);
         return(ok);
         }
diff --git a/src/lib/libssl/src/crypto/x509/x509_err.c b/src/lib/libssl/src/crypto/x509/x509_err.c
index d44d046027..fb377292da 100644
--- a/src/lib/libssl/src/crypto/x509/x509_err.c
+++ b/src/lib/libssl/src/crypto/x509/x509_err.c
@@ -72,18 +72,20 @@ static ERR_STRING_DATA X509_str_functs[]=
         {
 {ERR_FUNC(X509_F_ADD_CERT_DIR), "ADD_CERT_DIR"},
 {ERR_FUNC(X509_F_BY_FILE_CTRL), "BY_FILE_CTRL"},
+{ERR_FUNC(X509_F_CHECK_POLICY), "CHECK_POLICY"},
 {ERR_FUNC(X509_F_DIR_CTRL),     "DIR_CTRL"},
 {ERR_FUNC(X509_F_GET_CERT_BY_SUBJECT),  "GET_CERT_BY_SUBJECT"},
 {ERR_FUNC(X509_F_NETSCAPE_SPKI_B64_DECODE),     "NETSCAPE_SPKI_b64_decode"},
 {ERR_FUNC(X509_F_NETSCAPE_SPKI_B64_ENCODE),     "NETSCAPE_SPKI_b64_encode"},
+{ERR_FUNC(X509_F_X509AT_ADD1_ATTR),     "X509at_add1_attr"},
 {ERR_FUNC(X509_F_X509V3_ADD_EXT),       "X509v3_add_ext"},
-{ERR_FUNC(X509_F_X509_ADD_ATTR),        "X509_ADD_ATTR"},
 {ERR_FUNC(X509_F_X509_ATTRIBUTE_CREATE_BY_NID), "X509_ATTRIBUTE_create_by_NID"},
 {ERR_FUNC(X509_F_X509_ATTRIBUTE_CREATE_BY_OBJ), "X509_ATTRIBUTE_create_by_OBJ"},
 {ERR_FUNC(X509_F_X509_ATTRIBUTE_CREATE_BY_TXT), "X509_ATTRIBUTE_create_by_txt"},
 {ERR_FUNC(X509_F_X509_ATTRIBUTE_GET0_DATA),     "X509_ATTRIBUTE_get0_data"},
 {ERR_FUNC(X509_F_X509_ATTRIBUTE_SET1_DATA),     "X509_ATTRIBUTE_set1_data"},
 {ERR_FUNC(X509_F_X509_CHECK_PRIVATE_KEY),       "X509_check_private_key"},
+{ERR_FUNC(X509_F_X509_CRL_PRINT_FP),    "X509_CRL_print_fp"},
 {ERR_FUNC(X509_F_X509_EXTENSION_CREATE_BY_NID), "X509_EXTENSION_create_by_NID"},
 {ERR_FUNC(X509_F_X509_EXTENSION_CREATE_BY_OBJ), "X509_EXTENSION_create_by_OBJ"},
 {ERR_FUNC(X509_F_X509_GET_PUBKEY_PARAMETERS),   "X509_get_pubkey_parameters"},
@@ -96,14 +98,16 @@ static ERR_STRING_DATA X509_str_functs[]=
 {ERR_FUNC(X509_F_X509_NAME_ENTRY_SET_OBJECT),   "X509_NAME_ENTRY_set_object"},
 {ERR_FUNC(X509_F_X509_NAME_ONELINE),    "X509_NAME_oneline"},
 {ERR_FUNC(X509_F_X509_NAME_PRINT),      "X509_NAME_print"},
-{ERR_FUNC(X509_F_X509_PRINT_FP),        "X509_print_fp"},
+{ERR_FUNC(X509_F_X509_PRINT_EX_FP),     "X509_print_ex_fp"},
 {ERR_FUNC(X509_F_X509_PUBKEY_GET),      "X509_PUBKEY_get"},
 {ERR_FUNC(X509_F_X509_PUBKEY_SET),      "X509_PUBKEY_set"},
-{ERR_FUNC(X509_F_X509_REQ_PRINT),       "X509_REQ_print"},
+{ERR_FUNC(X509_F_X509_REQ_CHECK_PRIVATE_KEY),   "X509_REQ_check_private_key"},
+{ERR_FUNC(X509_F_X509_REQ_PRINT_EX),    "X509_REQ_print_ex"},
 {ERR_FUNC(X509_F_X509_REQ_PRINT_FP),    "X509_REQ_print_fp"},
 {ERR_FUNC(X509_F_X509_REQ_TO_X509),     "X509_REQ_to_X509"},
 {ERR_FUNC(X509_F_X509_STORE_ADD_CERT),  "X509_STORE_add_cert"},
 {ERR_FUNC(X509_F_X509_STORE_ADD_CRL),   "X509_STORE_add_crl"},
+{ERR_FUNC(X509_F_X509_STORE_CTX_GET1_ISSUER),   "X509_STORE_CTX_get1_issuer"},
 {ERR_FUNC(X509_F_X509_STORE_CTX_INIT),  "X509_STORE_CTX_init"},
 {ERR_FUNC(X509_F_X509_STORE_CTX_NEW),   "X509_STORE_CTX_new"},
 {ERR_FUNC(X509_F_X509_STORE_CTX_PURPOSE_INHERIT),       "X509_STORE_CTX_purpose_inherit"},
@@ -146,15 +150,12 @@ static ERR_STRING_DATA X509_str_reasons[]=
 
 void ERR_load_X509_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(X509_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,X509_str_functs);
                 ERR_load_strings(0,X509_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/x509/x509_lu.c b/src/lib/libssl/src/crypto/x509/x509_lu.c
index b780dae5e2..cd2cfb6d85 100644
--- a/src/lib/libssl/src/crypto/x509/x509_lu.c
+++ b/src/lib/libssl/src/crypto/x509/x509_lu.c
@@ -187,10 +187,8 @@ X509_STORE *X509_STORE_new(void)
         ret->verify=0;
         ret->verify_cb=0;
 
-        ret->purpose = 0;
-        ret->trust = 0;
-
-        ret->flags = 0;
+        if ((ret->param = X509_VERIFY_PARAM_new()) == NULL)
+                return NULL;
 
         ret->get_issuer = 0;
         ret->check_issued = 0;
@@ -202,7 +200,6 @@ X509_STORE *X509_STORE_new(void)
 
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509_STORE, ret, &ret->ex_data);
         ret->references=1;
-        ret->depth=0;
         return ret;
         }
 
@@ -244,6 +241,8 @@ void X509_STORE_free(X509_STORE *vfy)
         sk_X509_OBJECT_pop_free(vfy->objs, cleanup);
 
         CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509_STORE, vfy, &vfy->ex_data);
+        if (vfy->param)
+                X509_VERIFY_PARAM_free(vfy->param);
         OPENSSL_free(vfy);
         }
 
@@ -498,7 +497,7 @@ int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
                 if (ok == X509_LU_RETRY)
                         {
                         X509_OBJECT_free_contents(&obj);
-                        X509err(X509_F_X509_VERIFY_CERT,X509_R_SHOULD_RETRY);
+                        X509err(X509_F_X509_STORE_CTX_GET1_ISSUER,X509_R_SHOULD_RETRY);
                         return -1;
                         }
                 else if (ok != X509_LU_FAIL)
@@ -538,19 +537,30 @@ int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
         return 0;
 }
 
-void X509_STORE_set_flags(X509_STORE *ctx, long flags)
+int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags)
         {
-        ctx->flags |= flags;
+        return X509_VERIFY_PARAM_set_flags(ctx->param, flags);
+        }
+
+int X509_STORE_set_depth(X509_STORE *ctx, int depth)
+        {
+        X509_VERIFY_PARAM_set_depth(ctx->param, depth);
+        return 1;
         }
 
 int X509_STORE_set_purpose(X509_STORE *ctx, int purpose)
         {
-        return X509_PURPOSE_set(&ctx->purpose, purpose);
+        return X509_VERIFY_PARAM_set_purpose(ctx->param, purpose);
         }
 
 int X509_STORE_set_trust(X509_STORE *ctx, int trust)
         {
-        return X509_TRUST_set(&ctx->trust, trust);
+        return X509_VERIFY_PARAM_set_trust(ctx->param, trust);
+        }
+
+int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *param)
+        {
+        return X509_VERIFY_PARAM_set1(ctx->param, param);
         }
 
 IMPLEMENT_STACK_OF(X509_LOOKUP)
diff --git a/src/lib/libssl/src/crypto/x509/x509_r2x.c b/src/lib/libssl/src/crypto/x509/x509_r2x.c
index fb8a78dabe..254a14693d 100644
--- a/src/lib/libssl/src/crypto/x509/x509_r2x.c
+++ b/src/lib/libssl/src/crypto/x509/x509_r2x.c
@@ -89,8 +89,10 @@ X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
                 }
 
         xn=X509_REQ_get_subject_name(r);
-        X509_set_subject_name(ret,X509_NAME_dup(xn));
-        X509_set_issuer_name(ret,X509_NAME_dup(xn));
+        if (X509_set_subject_name(ret,X509_NAME_dup(xn)) == 0)
+                goto err;
+        if (X509_set_issuer_name(ret,X509_NAME_dup(xn)) == 0)
+                goto err;
 
         if (X509_gmtime_adj(xi->validity->notBefore,0) == NULL)
                 goto err;
diff --git a/src/lib/libssl/src/crypto/x509/x509_req.c b/src/lib/libssl/src/crypto/x509/x509_req.c
index 59fc6ca548..3872e1fb64 100644
--- a/src/lib/libssl/src/crypto/x509/x509_req.c
+++ b/src/lib/libssl/src/crypto/x509/x509_req.c
@@ -113,6 +113,46 @@ EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
         return(X509_PUBKEY_get(req->req_info->pubkey));
         }
 
+int X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
+        {
+        EVP_PKEY *xk=NULL;
+        int ok=0;
+
+        xk=X509_REQ_get_pubkey(x);
+        switch (EVP_PKEY_cmp(xk, k))
+                {
+        case 1:
+                ok=1;
+                break;
+        case 0:
+                X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,X509_R_KEY_VALUES_MISMATCH);
+                break;
+        case -1:
+                X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,X509_R_KEY_TYPE_MISMATCH);
+                break;
+        case -2:
+#ifndef OPENSSL_NO_EC
+                if (k->type == EVP_PKEY_EC)
+                        {
+                        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY, ERR_R_EC_LIB);
+                        break;
+                        }
+#endif
+#ifndef OPENSSL_NO_DH
+                if (k->type == EVP_PKEY_DH)
+                        {
+                        /* No idea */
+                        X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,X509_R_CANT_CHECK_DH_KEY);
+                        break;
+                        }
+#endif
+                X509err(X509_F_X509_REQ_CHECK_PRIVATE_KEY,X509_R_UNKNOWN_KEY_TYPE);
+                }
+
+        EVP_PKEY_free(xk);
+        return(ok);
+        }
+
 /* It seems several organisations had the same idea of including a list of
  * extensions in a certificate request. There are at least two OIDs that are
  * used and there may be more: so the list is configurable.
@@ -147,7 +187,7 @@ STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
         X509_ATTRIBUTE *attr;
         ASN1_TYPE *ext = NULL;
         int idx, *pnid;
-        unsigned char *p;
+        const unsigned char *p;
 
         if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
                 return(NULL);
@@ -169,7 +209,7 @@ STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
                         ext->value.sequence->length,
                         d2i_X509_EXTENSION, X509_EXTENSION_free,
                         V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
-        }
+}
 
 /* Add a STACK_OF extensions to a certificate request: allow alternative OIDs
  * in case we want to create a non standard one.
@@ -202,6 +242,11 @@ int X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
         at = NULL;
         attr->single = 0;
         attr->object = OBJ_nid2obj(nid);
+        if (!req->req_info->attributes)
+                {
+                if (!(req->req_info->attributes = sk_X509_ATTRIBUTE_new_null()))
+                        goto err;
+                }
         if(!sk_X509_ATTRIBUTE_push(req->req_info->attributes, attr)) goto err;
         return 1;
         err:
diff --git a/src/lib/libssl/src/crypto/x509/x509_trs.c b/src/lib/libssl/src/crypto/x509/x509_trs.c
index 881252608d..9c84a59d52 100644
--- a/src/lib/libssl/src/crypto/x509/x509_trs.c
+++ b/src/lib/libssl/src/crypto/x509/x509_trs.c
@@ -128,7 +128,7 @@ int X509_TRUST_get_count(void)
 X509_TRUST * X509_TRUST_get0(int idx)
 {
         if(idx < 0) return NULL;
-        if(idx < X509_TRUST_COUNT) return trstandard + idx;
+        if(idx < (int)X509_TRUST_COUNT) return trstandard + idx;
         return sk_X509_TRUST_value(trtable, idx - X509_TRUST_COUNT);
 }
 
@@ -219,7 +219,7 @@ static void trtable_free(X509_TRUST *p)
 
 void X509_TRUST_cleanup(void)
 {
-        int i;
+        unsigned int i;
         for(i = 0; i < X509_TRUST_COUNT; i++) trtable_free(trstandard + i);
         sk_X509_TRUST_pop_free(trtable, trtable_free);
         trtable = NULL;
diff --git a/src/lib/libssl/src/crypto/x509/x509_txt.c b/src/lib/libssl/src/crypto/x509/x509_txt.c
index f19e66a238..73a8ec726f 100644
--- a/src/lib/libssl/src/crypto/x509/x509_txt.c
+++ b/src/lib/libssl/src/crypto/x509/x509_txt.c
@@ -129,7 +129,7 @@ const char *X509_verify_cert_error_string(long n)
         case X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED:
                 return("proxy path length constraint exceeded");
         case X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED:
-                return("proxy cerificates not allowed, please set the appropriate flag");
+                return("proxy certificates not allowed, please set the appropriate flag");
         case X509_V_ERR_INVALID_PURPOSE:
                 return ("unsupported certificate purpose");
         case X509_V_ERR_CERT_UNTRUSTED:
@@ -156,6 +156,14 @@ const char *X509_verify_cert_error_string(long n)
                 return("key usage does not include digital signature");
         case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
                 return("unhandled critical CRL extension");
+        case X509_V_ERR_INVALID_EXTENSION:
+                return("invalid or inconsistent certificate extension");
+        case X509_V_ERR_INVALID_POLICY_EXTENSION:
+                return("invalid or inconsistent certificate policy extension");
+        case X509_V_ERR_NO_EXPLICIT_POLICY:
+                return("no explicit policy");
+        case X509_V_ERR_UNNESTED_RESOURCE:
+                return("RFC 3779 resource not subset of parent's resources");
         default:
                 BIO_snprintf(buf,sizeof buf,"error number %ld",n);
                 return(buf);
diff --git a/src/lib/libssl/src/crypto/x509/x509_v3.c b/src/lib/libssl/src/crypto/x509/x509_v3.c
index 67b1796a92..42e6f0ab05 100644
--- a/src/lib/libssl/src/crypto/x509/x509_v3.c
+++ b/src/lib/libssl/src/crypto/x509/x509_v3.c
@@ -147,7 +147,13 @@ STACK_OF(X509_EXTENSION) *X509v3_add_ext(STACK_OF(X509_EXTENSION) **x,
         int n;
         STACK_OF(X509_EXTENSION) *sk=NULL;
 
-        if ((x != NULL) && (*x == NULL))
+        if (x == NULL)
+                {
+                X509err(X509_F_X509V3_ADD_EXT,ERR_R_PASSED_NULL_PARAMETER);
+                goto err2;
+                }
+
+        if (*x == NULL)
                 {
                 if ((sk=sk_X509_EXTENSION_new_null()) == NULL)
                         goto err;
@@ -163,7 +169,7 @@ STACK_OF(X509_EXTENSION) *X509v3_add_ext(STACK_OF(X509_EXTENSION) **x,
                 goto err2;
         if (!sk_X509_EXTENSION_insert(sk,new_ex,loc))
                 goto err;
-        if ((x != NULL) && (*x == NULL))
+        if (*x == NULL)
                 *x=sk;
         return(sk);
 err:
diff --git a/src/lib/libssl/src/crypto/x509/x509_vfy.c b/src/lib/libssl/src/crypto/x509/x509_vfy.c
index 383e082aba..9a62ebcf67 100644
--- a/src/lib/libssl/src/crypto/x509/x509_vfy.c
+++ b/src/lib/libssl/src/crypto/x509/x509_vfy.c
@@ -77,8 +77,9 @@ static int check_chain_extensions(X509_STORE_CTX *ctx);
 static int check_trust(X509_STORE_CTX *ctx);
 static int check_revocation(X509_STORE_CTX *ctx);
 static int check_cert(X509_STORE_CTX *ctx);
+static int check_policy(X509_STORE_CTX *ctx);
 static int internal_verify(X509_STORE_CTX *ctx);
-const char *X509_version="X.509" OPENSSL_VERSION_PTEXT;
+const char X509_version[]="X.509" OPENSSL_VERSION_PTEXT;
 
 
 static int null_callback(int ok, X509_STORE_CTX *e)
@@ -97,11 +98,12 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
         {
         X509 *x,*xtmp,*chain_ss=NULL;
         X509_NAME *xn;
+        int bad_chain = 0;
+        X509_VERIFY_PARAM *param = ctx->param;
         int depth,i,ok=0;
         int num;
-        int (*cb)();
+        int (*cb)(int xok,X509_STORE_CTX *xctx);
         STACK_OF(X509) *sktmp=NULL;
-
         if (ctx->cert == NULL)
                 {
                 X509err(X509_F_X509_VERIFY_CERT,X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);
@@ -134,7 +136,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
 
         num=sk_X509_num(ctx->chain);
         x=sk_X509_value(ctx->chain,num-1);
-        depth=ctx->depth;
+        depth=param->depth;
 
 
         for (;;)
@@ -162,7 +164,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                                         goto end;
                                         }
                                 CRYPTO_add(&xtmp->references,1,CRYPTO_LOCK_X509);
-                                sk_X509_delete_ptr(sktmp,xtmp);
+                                (void)sk_X509_delete_ptr(sktmp,xtmp);
                                 ctx->last_untrusted++;
                                 x=xtmp;
                                 num++;
@@ -201,6 +203,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                                 ctx->current_cert=x;
                                 ctx->error_depth=i-1;
                                 if (ok == 1) X509_free(xtmp);
+                                bad_chain = 1;
                                 ok=cb(0,ctx);
                                 if (!ok) goto end;
                                 }
@@ -211,7 +214,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                                  */
                                 X509_free(x);
                                 x = xtmp;
-                                sk_X509_set(ctx->chain, i - 1, x);
+                                (void)sk_X509_set(ctx->chain, i - 1, x);
                                 ctx->last_untrusted=0;
                                 }
                         }
@@ -276,6 +279,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                         }
 
                 ctx->error_depth=num-1;
+                bad_chain = 1;
                 ok=cb(0,ctx);
                 if (!ok) goto end;
                 }
@@ -287,7 +291,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
 
         /* The chain extensions are OK: check trust */
 
-        if (ctx->trust > 0) ok = check_trust(ctx);
+        if (param->trust > 0) ok = check_trust(ctx);
 
         if (!ok) goto end;
 
@@ -301,11 +305,25 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
         ok = ctx->check_revocation(ctx);
         if(!ok) goto end;
 
-        /* At this point, we have a chain and just need to verify it */
+        /* At this point, we have a chain and need to verify it */
         if (ctx->verify != NULL)
                 ok=ctx->verify(ctx);
         else
                 ok=internal_verify(ctx);
+        if(!ok) goto end;
+
+#ifndef OPENSSL_NO_RFC3779
+        /* RFC 3779 path validation, now that CRL check has been done */
+        ok = v3_asid_validate_path(ctx);
+        if (!ok) goto end;
+        ok = v3_addr_validate_path(ctx);
+        if (!ok) goto end;
+#endif
+
+        /* If we get this far evaluate policies */
+        if (!bad_chain && (ctx->param->flags & X509_V_FLAG_POLICY_CHECK))
+                ok = ctx->check_policy(ctx);
+        if(!ok) goto end;
         if (0)
                 {
 end:
@@ -342,7 +360,7 @@ static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer)
         if (ret == X509_V_OK)
                 return 1;
         /* If we haven't asked for issuer errors don't set ctx */
-        if (!(ctx->flags & X509_V_FLAG_CB_ISSUER_CHECK))
+        if (!(ctx->param->flags & X509_V_FLAG_CB_ISSUER_CHECK))
                 return 0;
 
         ctx->error = ret;
@@ -365,7 +383,7 @@ static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
         else
                 return 0;
 }
-
+        
 
 /* Check a certificate chains extensions for consistency
  * with the supplied purpose
@@ -378,9 +396,10 @@ static int check_chain_extensions(X509_STORE_CTX *ctx)
 #else
         int i, ok=0, must_be_ca;
         X509 *x;
-        int (*cb)();
+        int (*cb)(int xok,X509_STORE_CTX *xctx);
         int proxy_path_length = 0;
-        int allow_proxy_certs = !!(ctx->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
+        int allow_proxy_certs =
+                !!(ctx->param->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
         cb=ctx->verify_cb;
 
         /* must_be_ca can have 1 of 3 values:
@@ -403,7 +422,7 @@ static int check_chain_extensions(X509_STORE_CTX *ctx)
                 {
                 int ret;
                 x = sk_X509_value(ctx->chain, i);
-                if (!(ctx->flags & X509_V_FLAG_IGNORE_CRITICAL)
+                if (!(ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
                         && (x->ex_flags & EXFLAG_CRITICAL))
                         {
                         ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;
@@ -424,7 +443,7 @@ static int check_chain_extensions(X509_STORE_CTX *ctx)
                 switch(must_be_ca)
                         {
                 case -1:
-                        if ((ctx->flags & X509_V_FLAG_X509_STRICT)
+                        if ((ctx->param->flags & X509_V_FLAG_X509_STRICT)
                                 && (ret != 1) && (ret != 0))
                                 {
                                 ret = 0;
@@ -444,7 +463,7 @@ static int check_chain_extensions(X509_STORE_CTX *ctx)
                         break;
                 default:
                         if ((ret == 0)
-                                || ((ctx->flags & X509_V_FLAG_X509_STRICT)
+                                || ((ctx->param->flags & X509_V_FLAG_X509_STRICT)
                                         && (ret != 1)))
                                 {
                                 ret = 0;
@@ -461,12 +480,12 @@ static int check_chain_extensions(X509_STORE_CTX *ctx)
                         ok=cb(0,ctx);
                         if (!ok) goto end;
                         }
-                if (ctx->purpose > 0)
+                if (ctx->param->purpose > 0)
                         {
-                        ret = X509_check_purpose(x, ctx->purpose,
+                        ret = X509_check_purpose(x, ctx->param->purpose,
                                 must_be_ca > 0);
                         if ((ret == 0)
-                                || ((ctx->flags & X509_V_FLAG_X509_STRICT)
+                                || ((ctx->param->flags & X509_V_FLAG_X509_STRICT)
                                         && (ret != 1)))
                                 {
                                 ctx->error = X509_V_ERR_INVALID_PURPOSE;
@@ -492,21 +511,15 @@ static int check_chain_extensions(X509_STORE_CTX *ctx)
                    CA certificate.  */
                 if (x->ex_flags & EXFLAG_PROXY)
                         {
-                        PROXY_CERT_INFO_EXTENSION *pci =
-                                X509_get_ext_d2i(x, NID_proxyCertInfo,
-                                        NULL, NULL);
-                        if (pci->pcPathLengthConstraint &&
-                                ASN1_INTEGER_get(pci->pcPathLengthConstraint)
-                                < i)
+                        if (x->ex_pcpathlen != -1 && i > x->ex_pcpathlen)
                                 {
-                                PROXY_CERT_INFO_EXTENSION_free(pci);
-                                ctx->error = X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED;
+                                ctx->error =
+                                        X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED;
                                 ctx->error_depth = i;
                                 ctx->current_cert = x;
                                 ok=cb(0,ctx);
                                 if (!ok) goto end;
                                 }
-                        PROXY_CERT_INFO_EXTENSION_free(pci);
                         proxy_path_length++;
                         must_be_ca = 0;
                         }
@@ -526,12 +539,12 @@ static int check_trust(X509_STORE_CTX *ctx)
 #else
         int i, ok;
         X509 *x;
-        int (*cb)();
+        int (*cb)(int xok,X509_STORE_CTX *xctx);
         cb=ctx->verify_cb;
 /* For now just check the last certificate in the chain */
         i = sk_X509_num(ctx->chain) - 1;
         x = sk_X509_value(ctx->chain, i);
-        ok = X509_check_trust(x, ctx->trust, 0);
+        ok = X509_check_trust(x, ctx->param->trust, 0);
         if (ok == X509_TRUST_TRUSTED)
                 return 1;
         ctx->error_depth = i;
@@ -548,9 +561,9 @@ static int check_trust(X509_STORE_CTX *ctx)
 static int check_revocation(X509_STORE_CTX *ctx)
         {
         int i, last, ok;
-        if (!(ctx->flags & X509_V_FLAG_CRL_CHECK))
+        if (!(ctx->param->flags & X509_V_FLAG_CRL_CHECK))
                 return 1;
-        if (ctx->flags & X509_V_FLAG_CRL_CHECK_ALL)
+        if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL)
                 last = sk_X509_num(ctx->chain) - 1;
         else
                 last = 0;
@@ -593,17 +606,124 @@ static int check_cert(X509_STORE_CTX *ctx)
 
         }
 
+/* Check CRL times against values in X509_STORE_CTX */
+
+static int check_crl_time(X509_STORE_CTX *ctx, X509_CRL *crl, int notify)
+        {
+        time_t *ptime;
+        int i;
+        ctx->current_crl = crl;
+        if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)
+                ptime = &ctx->param->check_time;
+        else
+                ptime = NULL;
+
+        i=X509_cmp_time(X509_CRL_get_lastUpdate(crl), ptime);
+        if (i == 0)
+                {
+                ctx->error=X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD;
+                if (!notify || !ctx->verify_cb(0, ctx))
+                        return 0;
+                }
+
+        if (i > 0)
+                {
+                ctx->error=X509_V_ERR_CRL_NOT_YET_VALID;
+                if (!notify || !ctx->verify_cb(0, ctx))
+                        return 0;
+                }
+
+        if(X509_CRL_get_nextUpdate(crl))
+                {
+                i=X509_cmp_time(X509_CRL_get_nextUpdate(crl), ptime);
+
+                if (i == 0)
+                        {
+                        ctx->error=X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD;
+                        if (!notify || !ctx->verify_cb(0, ctx))
+                                return 0;
+                        }
+
+                if (i < 0)
+                        {
+                        ctx->error=X509_V_ERR_CRL_HAS_EXPIRED;
+                        if (!notify || !ctx->verify_cb(0, ctx))
+                                return 0;
+                        }
+                }
+
+        ctx->current_crl = NULL;
+
+        return 1;
+        }
+
+/* Lookup CRLs from the supplied list. Look for matching isser name
+ * and validity. If we can't find a valid CRL return the last one
+ * with matching name. This gives more meaningful error codes. Otherwise
+ * we'd get a CRL not found error if a CRL existed with matching name but
+ * was invalid.
+ */
+
+static int get_crl_sk(X509_STORE_CTX *ctx, X509_CRL **pcrl,
+                        X509_NAME *nm, STACK_OF(X509_CRL) *crls)
+        {
+        int i;
+        X509_CRL *crl, *best_crl = NULL;
+        for (i = 0; i < sk_X509_CRL_num(crls); i++)
+                {
+                crl = sk_X509_CRL_value(crls, i);
+                if (X509_NAME_cmp(nm, X509_CRL_get_issuer(crl)))
+                        continue;
+                if (check_crl_time(ctx, crl, 0))
+                        {
+                        *pcrl = crl;
+                        CRYPTO_add(&crl->references, 1, CRYPTO_LOCK_X509);
+                        return 1;
+                        }
+                best_crl = crl;
+                }
+        if (best_crl)
+                {
+                *pcrl = best_crl;
+                CRYPTO_add(&best_crl->references, 1, CRYPTO_LOCK_X509);
+                }
+                
+        return 0;
+        }
+
 /* Retrieve CRL corresponding to certificate: currently just a
  * subject lookup: maybe use AKID later...
- * Also might look up any included CRLs too (e.g PKCS#7 signedData).
  */
-static int get_crl(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x)
+static int get_crl(X509_STORE_CTX *ctx, X509_CRL **pcrl, X509 *x)
         {
         int ok;
+        X509_CRL *crl = NULL;
         X509_OBJECT xobj;
-        ok = X509_STORE_get_by_subject(ctx, X509_LU_CRL, X509_get_issuer_name(x), &xobj);
-        if (!ok) return 0;
-        *crl = xobj.data.crl;
+        X509_NAME *nm;
+        nm = X509_get_issuer_name(x);
+        ok = get_crl_sk(ctx, &crl, nm, ctx->crls);
+        if (ok)
+                {
+                *pcrl = crl;
+                return 1;
+                }
+
+        ok = X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj);
+
+        if (!ok)
+                {
+                /* If we got a near match from get_crl_sk use that */
+                if (crl)
+                        {
+                        *pcrl = crl;
+                        return 1;
+                        }
+                return 0;
+                }
+
+        *pcrl = xobj.data.crl;
+        if (crl)
+                X509_CRL_free(crl);
         return 1;
         }
 
@@ -612,8 +732,7 @@ static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
         {
         X509 *issuer = NULL;
         EVP_PKEY *ikey = NULL;
-        int ok = 0, chnum, cnum, i;
-        time_t *ptime;
+        int ok = 0, chnum, cnum;
         cnum = ctx->error_depth;
         chnum = sk_X509_num(ctx->chain) - 1;
         /* Find CRL issuer: if not last certificate then issuer
@@ -665,45 +784,9 @@ static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl)
                         }
                 }
 
-        /* OK, CRL signature valid check times */
-        if (ctx->flags & X509_V_FLAG_USE_CHECK_TIME)
-                ptime = &ctx->check_time;
-        else
-                ptime = NULL;
-
-        i=X509_cmp_time(X509_CRL_get_lastUpdate(crl), ptime);
-        if (i == 0)
-                {
-                ctx->error=X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD;
-                ok = ctx->verify_cb(0, ctx);
-                if (!ok) goto err;
-                }
-
-        if (i > 0)
-                {
-                ctx->error=X509_V_ERR_CRL_NOT_YET_VALID;
-                ok = ctx->verify_cb(0, ctx);
-                if (!ok) goto err;
-                }
-
-        if(X509_CRL_get_nextUpdate(crl))
-                {
-                i=X509_cmp_time(X509_CRL_get_nextUpdate(crl), ptime);
-
-                if (i == 0)
-                        {
-                        ctx->error=X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD;
-                        ok = ctx->verify_cb(0, ctx);
-                        if (!ok) goto err;
-                        }
-
-                if (i < 0)
-                        {
-                        ctx->error=X509_V_ERR_CRL_HAS_EXPIRED;
-                        ok = ctx->verify_cb(0, ctx);
-                        if (!ok) goto err;
-                        }
-                }
+        ok = check_crl_time(ctx, crl, 1);
+        if (!ok)
+                goto err;
 
         ok = 1;
 
@@ -741,7 +824,7 @@ static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
                 if (!ok) return 0;
                 }
 
-        if (ctx->flags & X509_V_FLAG_IGNORE_CRITICAL)
+        if (ctx->param->flags & X509_V_FLAG_IGNORE_CRITICAL)
                 return 1;
 
         /* See if we have any critical CRL extensions: since we
@@ -768,13 +851,106 @@ static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
         return 1;
         }
 
+static int check_policy(X509_STORE_CTX *ctx)
+        {
+        int ret;
+        ret = X509_policy_check(&ctx->tree, &ctx->explicit_policy, ctx->chain,
+                                ctx->param->policies, ctx->param->flags);
+        if (ret == 0)
+                {
+                X509err(X509_F_CHECK_POLICY,ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
+        /* Invalid or inconsistent extensions */
+        if (ret == -1)
+                {
+                /* Locate certificates with bad extensions and notify
+                 * callback.
+                 */
+                X509 *x;
+                int i;
+                for (i = 1; i < sk_X509_num(ctx->chain); i++)
+                        {
+                        x = sk_X509_value(ctx->chain, i);
+                        if (!(x->ex_flags & EXFLAG_INVALID_POLICY))
+                                continue;
+                        ctx->current_cert = x;
+                        ctx->error = X509_V_ERR_INVALID_POLICY_EXTENSION;
+                        ret = ctx->verify_cb(0, ctx);
+                        }
+                return 1;
+                }
+        if (ret == -2)
+                {
+                ctx->current_cert = NULL;
+                ctx->error = X509_V_ERR_NO_EXPLICIT_POLICY;
+                return ctx->verify_cb(0, ctx);
+                }
+
+        if (ctx->param->flags & X509_V_FLAG_NOTIFY_POLICY)
+                {
+                ctx->current_cert = NULL;
+                ctx->error = X509_V_OK;
+                if (!ctx->verify_cb(2, ctx))
+                        return 0;
+                }
+
+        return 1;
+        }
+
+static int check_cert_time(X509_STORE_CTX *ctx, X509 *x)
+        {
+        time_t *ptime;
+        int i;
+
+        if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME)
+                ptime = &ctx->param->check_time;
+        else
+                ptime = NULL;
+
+        i=X509_cmp_time(X509_get_notBefore(x), ptime);
+        if (i == 0)
+                {
+                ctx->error=X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD;
+                ctx->current_cert=x;
+                if (!ctx->verify_cb(0, ctx))
+                        return 0;
+                }
+
+        if (i > 0)
+                {
+                ctx->error=X509_V_ERR_CERT_NOT_YET_VALID;
+                ctx->current_cert=x;
+                if (!ctx->verify_cb(0, ctx))
+                        return 0;
+                }
+
+        i=X509_cmp_time(X509_get_notAfter(x), ptime);
+        if (i == 0)
+                {
+                ctx->error=X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD;
+                ctx->current_cert=x;
+                if (!ctx->verify_cb(0, ctx))
+                        return 0;
+                }
+
+        if (i < 0)
+                {
+                ctx->error=X509_V_ERR_CERT_HAS_EXPIRED;
+                ctx->current_cert=x;
+                if (!ctx->verify_cb(0, ctx))
+                        return 0;
+                }
+
+        return 1;
+        }
+
 static int internal_verify(X509_STORE_CTX *ctx)
         {
-        int i,ok=0,n;
+        int ok=0,n;
         X509 *xs,*xi;
         EVP_PKEY *pkey=NULL;
-        time_t *ptime;
-        int (*cb)();
+        int (*cb)(int xok,X509_STORE_CTX *xctx);
 
         cb=ctx->verify_cb;
 
@@ -782,10 +958,7 @@ static int internal_verify(X509_STORE_CTX *ctx)
         ctx->error_depth=n-1;
         n--;
         xi=sk_X509_value(ctx->chain,n);
-        if (ctx->flags & X509_V_FLAG_USE_CHECK_TIME)
-                ptime = &ctx->check_time;
-        else
-                ptime = NULL;
+
         if (ctx->check_issued(ctx, xi, xi))
                 xs=xi;
         else
@@ -838,41 +1011,13 @@ static int internal_verify(X509_STORE_CTX *ctx)
                                 }
                         EVP_PKEY_free(pkey);
                         pkey=NULL;
-
-                        i=X509_cmp_time(X509_get_notBefore(xs), ptime);
-                        if (i == 0)
-                                {
-                                ctx->error=X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD;
-                                ctx->current_cert=xs;
-                                ok=(*cb)(0,ctx);
-                                if (!ok) goto end;
-                                }
-                        if (i > 0)
-                                {
-                                ctx->error=X509_V_ERR_CERT_NOT_YET_VALID;
-                                ctx->current_cert=xs;
-                                ok=(*cb)(0,ctx);
-                                if (!ok) goto end;
-                                }
-                        xs->valid=1;
                         }
 
-                i=X509_cmp_time(X509_get_notAfter(xs), ptime);
-                if (i == 0)
-                        {
-                        ctx->error=X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD;
-                        ctx->current_cert=xs;
-                        ok=(*cb)(0,ctx);
-                        if (!ok) goto end;
-                        }
+                xs->valid = 1;
 
-                if (i < 0)
-                        {
-                        ctx->error=X509_V_ERR_CERT_HAS_EXPIRED;
-                        ctx->current_cert=xs;
-                        ok=(*cb)(0,ctx);
-                        if (!ok) goto end;
-                        }
+                ok = check_cert_time(ctx, xs);
+                if (!ok)
+                        goto end;
 
                 /* The last error (if any) is still in the error value */
                 ctx->current_issuer=xi;
@@ -1105,6 +1250,11 @@ void X509_STORE_CTX_set_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
         ctx->untrusted=sk;
         }
 
+void X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk)
+        {
+        ctx->crls=sk;
+        }
+
 int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose)
         {
         return X509_STORE_CTX_purpose_inherit(ctx, 0, purpose, 0);
@@ -1168,8 +1318,8 @@ int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
                         }
                 }
 
-        if (purpose && !ctx->purpose) ctx->purpose = purpose;
-        if (trust && !ctx->trust) ctx->trust = trust;
+        if (purpose && !ctx->param->purpose) ctx->param->purpose = purpose;
+        if (trust && !ctx->param->trust) ctx->param->trust = trust;
         return 1;
 }
 
@@ -1195,20 +1345,30 @@ void X509_STORE_CTX_free(X509_STORE_CTX *ctx)
 int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
              STACK_OF(X509) *chain)
         {
+        int ret = 1;
         ctx->ctx=store;
         ctx->current_method=0;
         ctx->cert=x509;
         ctx->untrusted=chain;
+        ctx->crls = NULL;
         ctx->last_untrusted=0;
-        ctx->check_time=0;
         ctx->other_ctx=NULL;
         ctx->valid=0;
         ctx->chain=NULL;
-        ctx->depth=9;
         ctx->error=0;
+        ctx->explicit_policy=0;
         ctx->error_depth=0;
         ctx->current_cert=NULL;
         ctx->current_issuer=NULL;
+        ctx->tree = NULL;
+
+        ctx->param = X509_VERIFY_PARAM_new();
+
+        if (!ctx->param)
+                {
+                X509err(X509_F_X509_STORE_CTX_INIT,ERR_R_MALLOC_FAILURE);
+                return 0;
+                }
 
         /* Inherit callbacks and flags from X509_STORE if not set
          * use defaults.
@@ -1216,18 +1376,26 @@ int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
 
 
         if (store)
+                ret = X509_VERIFY_PARAM_inherit(ctx->param, store->param);
+        else
+                ctx->param->flags |= X509_VP_FLAG_DEFAULT|X509_VP_FLAG_ONCE;
+
+        if (store)
                 {
-                ctx->purpose=store->purpose;
-                ctx->trust=store->trust;
-                ctx->flags = store->flags;
+                ctx->verify_cb = store->verify_cb;
                 ctx->cleanup = store->cleanup;
                 }
         else
-                {
-                ctx->purpose = 0;
-                ctx->trust = 0;
-                ctx->flags = 0;
                 ctx->cleanup = 0;
+
+        if (ret)
+                ret = X509_VERIFY_PARAM_inherit(ctx->param,
+                                        X509_VERIFY_PARAM_lookup("default"));
+
+        if (ret == 0)
+                {
+                X509err(X509_F_X509_STORE_CTX_INIT,ERR_R_MALLOC_FAILURE);
+                return 0;
                 }
 
         if (store && store->check_issued)
@@ -1270,6 +1438,8 @@ int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *store, X509 *x509,
         else
                 ctx->cert_crl = cert_crl;
 
+        ctx->check_policy = check_policy;
+
 
         /* This memset() can't make any sense anyway, so it's removed. As
          * X509_STORE_CTX_cleanup does a proper "free" on the ex_data, we put a
@@ -1298,6 +1468,16 @@ void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk)
 void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx)
         {
         if (ctx->cleanup) ctx->cleanup(ctx);
+        if (ctx->param != NULL)
+                {
+                X509_VERIFY_PARAM_free(ctx->param);
+                ctx->param=NULL;
+                }
+        if (ctx->tree != NULL)
+                {
+                X509_policy_tree_free(ctx->tree);
+                ctx->tree=NULL;
+                }
         if (ctx->chain != NULL)
                 {
                 sk_X509_pop_free(ctx->chain,X509_free);
@@ -1307,15 +1487,19 @@ void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx)
         memset(&ctx->ex_data,0,sizeof(CRYPTO_EX_DATA));
         }
 
-void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, long flags)
+void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth)
         {
-        ctx->flags |= flags;
+        X509_VERIFY_PARAM_set_depth(ctx->param, depth);
         }
 
-void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, long flags, time_t t)
+void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags)
         {
-        ctx->check_time = t;
-        ctx->flags |= X509_V_FLAG_USE_CHECK_TIME;
+        X509_VERIFY_PARAM_set_flags(ctx->param, flags);
+        }
+
+void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags, time_t t)
+        {
+        X509_VERIFY_PARAM_set_time(ctx->param, t);
         }
 
 void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx,
@@ -1324,6 +1508,37 @@ void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx,
         ctx->verify_cb=verify_cb;
         }
 
+X509_POLICY_TREE *X509_STORE_CTX_get0_policy_tree(X509_STORE_CTX *ctx)
+        {
+        return ctx->tree;
+        }
+
+int X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx)
+        {
+        return ctx->explicit_policy;
+        }
+
+int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name)
+        {
+        const X509_VERIFY_PARAM *param;
+        param = X509_VERIFY_PARAM_lookup(name);
+        if (!param)
+                return 0;
+        return X509_VERIFY_PARAM_inherit(ctx->param, param);
+        }
+
+X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx)
+        {
+        return ctx->param;
+        }
+
+void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param)
+        {
+        if (ctx->param)
+                X509_VERIFY_PARAM_free(ctx->param);
+        ctx->param = param;
+        }
+
 IMPLEMENT_STACK_OF(X509)
 IMPLEMENT_ASN1_SET_OF(X509)
 
diff --git a/src/lib/libssl/src/crypto/x509/x509_vfy.h b/src/lib/libssl/src/crypto/x509/x509_vfy.h
index 7fd1f0bc4d..76c76e1719 100644
--- a/src/lib/libssl/src/crypto/x509/x509_vfy.h
+++ b/src/lib/libssl/src/crypto/x509/x509_vfy.h
@@ -65,6 +65,7 @@
 #ifndef HEADER_X509_VFY_H
 #define HEADER_X509_VFY_H
 
+#include <openssl/opensslconf.h>
 #ifndef OPENSSL_NO_LHASH
 #include <openssl/lhash.h>
 #endif
@@ -155,6 +156,25 @@ typedef struct x509_lookup_method_st
                             X509_OBJECT *ret);
         } X509_LOOKUP_METHOD;
 
+/* This structure hold all parameters associated with a verify operation
+ * by including an X509_VERIFY_PARAM structure in related structures the
+ * parameters used can be customized
+ */
+
+typedef struct X509_VERIFY_PARAM_st
+        {
+        char *name;
+        time_t check_time;      /* Time to use */
+        unsigned long inh_flags; /* Inheritance flags */
+        unsigned long flags;    /* Various verify flags */
+        int purpose;            /* purpose to check untrusted certificates */
+        int trust;              /* trust setting to check */
+        int depth;              /* Verify depth */
+        STACK_OF(ASN1_OBJECT) *policies;        /* Permissible policies */
+        } X509_VERIFY_PARAM;
+
+DECLARE_STACK_OF(X509_VERIFY_PARAM)
+
 /* This is used to hold everything.  It is used for all certificate
  * validation.  Once we have a certificate chain, the 'verify'
  * function is then called to actually check the cert chain. */
@@ -167,13 +187,8 @@ struct x509_store_st
         /* These are external lookup methods */
         STACK_OF(X509_LOOKUP) *get_cert_methods;
 
-        /* The following fields are not used by X509_STORE but are
-         * inherited by X509_STORE_CTX when it is initialised.
-         */
+        X509_VERIFY_PARAM *param;
 
-        unsigned long flags;    /* Various verify flags */
-        int purpose;
-        int trust;
         /* Callbacks for various operations */
         int (*verify)(X509_STORE_CTX *ctx);     /* called to verify a certificate */
         int (*verify_cb)(int ok,X509_STORE_CTX *ctx);   /* error callback */
@@ -187,10 +202,9 @@ struct x509_store_st
 
         CRYPTO_EX_DATA ex_data;
         int references;
-        int depth;              /* how deep to look (still unused -- X509_STORE_CTX's depth is used) */
         } /* X509_STORE */;
 
-#define X509_STORE_set_depth(ctx,d)       ((ctx)->depth=(d))
+int X509_STORE_set_depth(X509_STORE *store, int depth);
 
 #define X509_STORE_set_verify_cb_func(ctx,func) ((ctx)->verify_cb=(func))
 #define X509_STORE_set_verify_func(ctx,func)    ((ctx)->verify=(func))
@@ -217,10 +231,9 @@ struct x509_store_ctx_st      /* X509_STORE_CTX */
         /* The following are set by the caller */
         X509 *cert;             /* The cert to check */
         STACK_OF(X509) *untrusted;      /* chain of X509s - untrusted - passed in */
-        int purpose;            /* purpose to check untrusted certificates */
-        int trust;              /* trust setting to check */
-        time_t  check_time;     /* time to make verify at */
-        unsigned long flags;    /* Various verify flags */
+        STACK_OF(X509_CRL) *crls;       /* set of CRLs passed in */
+
+        X509_VERIFY_PARAM *param;
         void *other_ctx;        /* Other info for use with get_issuer() */
 
         /* Callbacks for various operations */
@@ -232,13 +245,16 @@ struct x509_store_ctx_st      /* X509_STORE_CTX */
         int (*get_crl)(X509_STORE_CTX *ctx, X509_CRL **crl, X509 *x); /* retrieve CRL */
         int (*check_crl)(X509_STORE_CTX *ctx, X509_CRL *crl); /* Check CRL validity */
         int (*cert_crl)(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x); /* Check certificate against CRL */
+        int (*check_policy)(X509_STORE_CTX *ctx);
         int (*cleanup)(X509_STORE_CTX *ctx);
 
         /* The following is built up */
-        int depth;              /* how far to go looking up certs */
         int valid;              /* if 0, rebuild chain */
         int last_untrusted;     /* index of last untrusted cert */
         STACK_OF(X509) *chain;          /* chain of X509s - built up and trusted */
+        X509_POLICY_TREE *tree; /* Valid policy tree */
+
+        int explicit_policy;    /* Require explicit policy value */
 
         /* When something goes wrong, this is why */
         int error_depth;
@@ -250,7 +266,7 @@ struct x509_store_ctx_st      /* X509_STORE_CTX */
         CRYPTO_EX_DATA ex_data;
         } /* X509_STORE_CTX */;
 
-#define X509_STORE_CTX_set_depth(ctx,d)       ((ctx)->depth=(d))
+void X509_STORE_CTX_set_depth(X509_STORE_CTX *ctx, int depth);
 
 #define X509_STORE_CTX_set_app_data(ctx,data) \
         X509_STORE_CTX_set_ex_data(ctx,0,data)
@@ -311,6 +327,12 @@ struct x509_store_ctx_st      /* X509_STORE_CTX */
 #define         X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE        39
 #define         X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED       40
 
+#define         X509_V_ERR_INVALID_EXTENSION                    41
+#define         X509_V_ERR_INVALID_POLICY_EXTENSION             42
+#define         X509_V_ERR_NO_EXPLICIT_POLICY                   43
+
+#define         X509_V_ERR_UNNESTED_RESOURCE                    44
+
 /* The application is not happy */
 #define         X509_V_ERR_APPLICATION_VERIFICATION             50
 
@@ -330,6 +352,28 @@ struct x509_store_ctx_st      /* X509_STORE_CTX */
 #define X509_V_FLAG_X509_STRICT                 0x20
 /* Enable proxy certificate validation */
 #define X509_V_FLAG_ALLOW_PROXY_CERTS           0x40
+/* Enable policy checking */
+#define X509_V_FLAG_POLICY_CHECK                0x80
+/* Policy variable require-explicit-policy */
+#define X509_V_FLAG_EXPLICIT_POLICY             0x100
+/* Policy variable inhibit-any-policy */
+#define X509_V_FLAG_INHIBIT_ANY                 0x200
+/* Policy variable inhibit-policy-mapping */
+#define X509_V_FLAG_INHIBIT_MAP                 0x400
+/* Notify callback that policy is OK */
+#define X509_V_FLAG_NOTIFY_POLICY               0x800
+
+#define X509_VP_FLAG_DEFAULT                    0x1
+#define X509_VP_FLAG_OVERWRITE                  0x2
+#define X509_VP_FLAG_RESET_FLAGS                0x4
+#define X509_VP_FLAG_LOCKED                     0x8
+#define X509_VP_FLAG_ONCE                       0x10
+
+/* Internal use: mask of policy related options */
+#define X509_V_FLAG_POLICY_MASK (X509_V_FLAG_POLICY_CHECK \
+                                | X509_V_FLAG_EXPLICIT_POLICY \
+                                | X509_V_FLAG_INHIBIT_ANY \
+                                | X509_V_FLAG_INHIBIT_MAP)
 
 int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
              X509_NAME *name);
@@ -340,9 +384,10 @@ void X509_OBJECT_free_contents(X509_OBJECT *a);
 X509_STORE *X509_STORE_new(void );
 void X509_STORE_free(X509_STORE *v);
 
-void X509_STORE_set_flags(X509_STORE *ctx, long flags);
+int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags);
 int X509_STORE_set_purpose(X509_STORE *ctx, int purpose);
 int X509_STORE_set_trust(X509_STORE *ctx, int trust);
+int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *pm);
 
 X509_STORE_CTX *X509_STORE_CTX_new(void);
 
@@ -406,14 +451,78 @@ STACK_OF(X509) *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx);
 STACK_OF(X509) *X509_STORE_CTX_get1_chain(X509_STORE_CTX *ctx);
 void    X509_STORE_CTX_set_cert(X509_STORE_CTX *c,X509 *x);
 void    X509_STORE_CTX_set_chain(X509_STORE_CTX *c,STACK_OF(X509) *sk);
+void    X509_STORE_CTX_set0_crls(X509_STORE_CTX *c,STACK_OF(X509_CRL) *sk);
 int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose);
 int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust);
 int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,
                                 int purpose, int trust);
-void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, long flags);
-void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, long flags, time_t t);
+void X509_STORE_CTX_set_flags(X509_STORE_CTX *ctx, unsigned long flags);
+void X509_STORE_CTX_set_time(X509_STORE_CTX *ctx, unsigned long flags,
+                                                                time_t t);
 void X509_STORE_CTX_set_verify_cb(X509_STORE_CTX *ctx,
                                   int (*verify_cb)(int, X509_STORE_CTX *));
+  
+X509_POLICY_TREE *X509_STORE_CTX_get0_policy_tree(X509_STORE_CTX *ctx);
+int X509_STORE_CTX_get_explicit_policy(X509_STORE_CTX *ctx);
+
+X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx);
+void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param);
+int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name);
+
+/* X509_VERIFY_PARAM functions */
+
+X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void);
+void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param);
+int X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *to,
+                                                const X509_VERIFY_PARAM *from);
+int X509_VERIFY_PARAM_set1(X509_VERIFY_PARAM *to, 
+                                                const X509_VERIFY_PARAM *from);
+int X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name);
+int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags);
+int X509_VERIFY_PARAM_clear_flags(X509_VERIFY_PARAM *param,
+                                                        unsigned long flags);
+unsigned long X509_VERIFY_PARAM_get_flags(X509_VERIFY_PARAM *param);
+int X509_VERIFY_PARAM_set_purpose(X509_VERIFY_PARAM *param, int purpose);
+int X509_VERIFY_PARAM_set_trust(X509_VERIFY_PARAM *param, int trust);
+void X509_VERIFY_PARAM_set_depth(X509_VERIFY_PARAM *param, int depth);
+void X509_VERIFY_PARAM_set_time(X509_VERIFY_PARAM *param, time_t t);
+int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param,
+                                                ASN1_OBJECT *policy);
+int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param, 
+                                        STACK_OF(ASN1_OBJECT) *policies);
+int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param);
+
+int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param);
+const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name);
+void X509_VERIFY_PARAM_table_cleanup(void);
+
+int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy,
+                        STACK_OF(X509) *certs,
+                        STACK_OF(ASN1_OBJECT) *policy_oids,
+                        unsigned int flags);
+
+void X509_policy_tree_free(X509_POLICY_TREE *tree);
+
+int X509_policy_tree_level_count(const X509_POLICY_TREE *tree);
+X509_POLICY_LEVEL *
+        X509_policy_tree_get0_level(const X509_POLICY_TREE *tree, int i);
+
+STACK_OF(X509_POLICY_NODE) *
+        X509_policy_tree_get0_policies(const X509_POLICY_TREE *tree);
+
+STACK_OF(X509_POLICY_NODE) *
+        X509_policy_tree_get0_user_policies(const X509_POLICY_TREE *tree);
+
+int X509_policy_level_node_count(X509_POLICY_LEVEL *level);
+
+X509_POLICY_NODE *X509_policy_level_get0_node(X509_POLICY_LEVEL *level, int i);
+
+const ASN1_OBJECT *X509_policy_node_get0_policy(const X509_POLICY_NODE *node);
+
+STACK_OF(POLICYQUALINFO) *
+        X509_policy_node_get0_qualifiers(const X509_POLICY_NODE *node);
+const X509_POLICY_NODE *
+        X509_policy_node_get0_parent(const X509_POLICY_NODE *node);
 
 #ifdef  __cplusplus
 }
diff --git a/src/lib/libssl/src/crypto/x509/x509spki.c b/src/lib/libssl/src/crypto/x509/x509spki.c
index 4c3af946ec..ed868b838e 100644
--- a/src/lib/libssl/src/crypto/x509/x509spki.c
+++ b/src/lib/libssl/src/crypto/x509/x509spki.c
@@ -77,7 +77,8 @@ EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x)
 
 NETSCAPE_SPKI * NETSCAPE_SPKI_b64_decode(const char *str, int len)
 {
-        unsigned char *spki_der, *p;
+        unsigned char *spki_der;
+        const unsigned char *p;
         int spki_len;
         NETSCAPE_SPKI *spki;
         if(len <= 0) len = strlen(str);
diff --git a/src/lib/libssl/src/crypto/x509/x509type.c b/src/lib/libssl/src/crypto/x509/x509type.c
index c25959a742..2cd994c5b0 100644
--- a/src/lib/libssl/src/crypto/x509/x509type.c
+++ b/src/lib/libssl/src/crypto/x509/x509type.c
@@ -86,6 +86,9 @@ int X509_certificate_type(X509 *x, EVP_PKEY *pkey)
         case EVP_PKEY_DSA:
                 ret=EVP_PK_DSA|EVP_PKT_SIGN;
                 break;
+        case EVP_PKEY_EC:
+                ret=EVP_PK_EC|EVP_PKT_SIGN|EVP_PKT_EXCH;
+                break;
         case EVP_PKEY_DH:
                 ret=EVP_PK_DH|EVP_PKT_EXCH;
                 break;
@@ -102,6 +105,9 @@ int X509_certificate_type(X509 *x, EVP_PKEY *pkey)
         case EVP_PKEY_DSA:
                 ret|=EVP_PKS_DSA;
                 break;
+        case EVP_PKEY_EC:
+                ret|=EVP_PKS_EC;
+                break;
         default:
                 break;
                 }
diff --git a/src/lib/libssl/src/crypto/x509/x_all.c b/src/lib/libssl/src/crypto/x509/x_all.c
index ac6dea493a..9039caad60 100644
--- a/src/lib/libssl/src/crypto/x509/x_all.c
+++ b/src/lib/libssl/src/crypto/x509/x_all.c
@@ -64,6 +64,12 @@
 #include <openssl/asn1.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
 
 int X509_verify(X509 *a, EVP_PKEY *r)
         {
@@ -223,9 +229,9 @@ RSA *d2i_RSAPublicKey_fp(FILE *fp, RSA **rsa)
 
 RSA *d2i_RSA_PUBKEY_fp(FILE *fp, RSA **rsa)
         {
-        return((RSA *)ASN1_d2i_fp((char *(*)())
-                RSA_new,(char *(*)())d2i_RSA_PUBKEY, (fp),
-                (unsigned char **)(rsa)));
+        return ASN1_d2i_fp((void *(*)(void))
+                           RSA_new,(D2I_OF(void))d2i_RSA_PUBKEY, fp,
+                           (void **)rsa);
         }
 
 int i2d_RSAPublicKey_fp(FILE *fp, RSA *rsa)
@@ -235,7 +241,7 @@ int i2d_RSAPublicKey_fp(FILE *fp, RSA *rsa)
 
 int i2d_RSA_PUBKEY_fp(FILE *fp, RSA *rsa)
         {
-        return(ASN1_i2d_fp(i2d_RSA_PUBKEY,fp,(unsigned char *)rsa));
+        return ASN1_i2d_fp((I2D_OF(void))i2d_RSA_PUBKEY,fp,rsa);
         }
 #endif
 
@@ -257,9 +263,7 @@ RSA *d2i_RSAPublicKey_bio(BIO *bp, RSA **rsa)
 
 RSA *d2i_RSA_PUBKEY_bio(BIO *bp, RSA **rsa)
         {
-        return((RSA *)ASN1_d2i_bio((char *(*)())
-                RSA_new,(char *(*)())d2i_RSA_PUBKEY, (bp),
-                (unsigned char **)(rsa)));
+        return ASN1_d2i_bio_of(RSA,RSA_new,d2i_RSA_PUBKEY,bp,rsa);
         }
 
 int i2d_RSAPublicKey_bio(BIO *bp, RSA *rsa)
@@ -269,7 +273,7 @@ int i2d_RSAPublicKey_bio(BIO *bp, RSA *rsa)
 
 int i2d_RSA_PUBKEY_bio(BIO *bp, RSA *rsa)
         {
-        return(ASN1_i2d_bio(i2d_RSA_PUBKEY,bp,(unsigned char *)rsa));
+        return ASN1_i2d_bio_of(RSA,i2d_RSA_PUBKEY,bp,rsa);
         }
 #endif
 
@@ -277,55 +281,92 @@ int i2d_RSA_PUBKEY_bio(BIO *bp, RSA *rsa)
 #ifndef OPENSSL_NO_FP_API
 DSA *d2i_DSAPrivateKey_fp(FILE *fp, DSA **dsa)
         {
-        return((DSA *)ASN1_d2i_fp((char *(*)())
-                DSA_new,(char *(*)())d2i_DSAPrivateKey, (fp),
-                (unsigned char **)(dsa)));
+        return ASN1_d2i_fp_of(DSA,DSA_new,d2i_DSAPrivateKey,fp,dsa);
         }
 
 int i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa)
         {
-        return(ASN1_i2d_fp(i2d_DSAPrivateKey,fp,(unsigned char *)dsa));
+        return ASN1_i2d_fp_of_const(DSA,i2d_DSAPrivateKey,fp,dsa);
         }
 
 DSA *d2i_DSA_PUBKEY_fp(FILE *fp, DSA **dsa)
         {
-        return((DSA *)ASN1_d2i_fp((char *(*)())
-                DSA_new,(char *(*)())d2i_DSA_PUBKEY, (fp),
-                (unsigned char **)(dsa)));
+        return ASN1_d2i_fp_of(DSA,DSA_new,d2i_DSA_PUBKEY,fp,dsa);
         }
 
 int i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa)
         {
-        return(ASN1_i2d_fp(i2d_DSA_PUBKEY,fp,(unsigned char *)dsa));
+        return ASN1_i2d_fp_of(DSA,i2d_DSA_PUBKEY,fp,dsa);
         }
 #endif
 
 DSA *d2i_DSAPrivateKey_bio(BIO *bp, DSA **dsa)
         {
-        return((DSA *)ASN1_d2i_bio((char *(*)())
-                DSA_new,(char *(*)())d2i_DSAPrivateKey, (bp),
-                (unsigned char **)(dsa)));
+        return ASN1_d2i_bio_of(DSA,DSA_new,d2i_DSAPrivateKey,bp,dsa
+);
         }
 
 int i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa)
         {
-        return(ASN1_i2d_bio(i2d_DSAPrivateKey,bp,(unsigned char *)dsa));
+        return ASN1_i2d_bio_of_const(DSA,i2d_DSAPrivateKey,bp,dsa);
         }
 
 DSA *d2i_DSA_PUBKEY_bio(BIO *bp, DSA **dsa)
         {
-        return((DSA *)ASN1_d2i_bio((char *(*)())
-                DSA_new,(char *(*)())d2i_DSA_PUBKEY, (bp),
-                (unsigned char **)(dsa)));
+        return ASN1_d2i_bio_of(DSA,DSA_new,d2i_DSA_PUBKEY,bp,dsa);
         }
 
 int i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa)
         {
-        return(ASN1_i2d_bio(i2d_DSA_PUBKEY,bp,(unsigned char *)dsa));
+        return ASN1_i2d_bio_of(DSA,i2d_DSA_PUBKEY,bp,dsa);
         }
 
 #endif
 
+#ifndef OPENSSL_NO_EC
+#ifndef OPENSSL_NO_FP_API
+EC_KEY *d2i_EC_PUBKEY_fp(FILE *fp, EC_KEY **eckey)
+        {
+        return ASN1_d2i_fp_of(EC_KEY,EC_KEY_new,d2i_EC_PUBKEY,fp,eckey);
+        }
+  
+int i2d_EC_PUBKEY_fp(FILE *fp, EC_KEY *eckey)
+        {
+        return ASN1_i2d_fp_of(EC_KEY,i2d_EC_PUBKEY,fp,eckey);
+        }
+
+EC_KEY *d2i_ECPrivateKey_fp(FILE *fp, EC_KEY **eckey)
+        {
+        return ASN1_d2i_fp_of(EC_KEY,EC_KEY_new,d2i_ECPrivateKey,fp,eckey);
+        }
+  
+int i2d_ECPrivateKey_fp(FILE *fp, EC_KEY *eckey)
+        {
+        return ASN1_i2d_fp_of(EC_KEY,i2d_ECPrivateKey,fp,eckey);
+        }
+#endif
+EC_KEY *d2i_EC_PUBKEY_bio(BIO *bp, EC_KEY **eckey)
+        {
+        return ASN1_d2i_bio_of(EC_KEY,EC_KEY_new,d2i_EC_PUBKEY,bp,eckey);
+        }
+  
+int i2d_EC_PUBKEY_bio(BIO *bp, EC_KEY *ecdsa)
+        {
+        return ASN1_i2d_bio_of(EC_KEY,i2d_EC_PUBKEY,bp,ecdsa);
+        }
+
+EC_KEY *d2i_ECPrivateKey_bio(BIO *bp, EC_KEY **eckey)
+        {
+        return ASN1_d2i_bio_of(EC_KEY,EC_KEY_new,d2i_ECPrivateKey,bp,eckey);
+        }
+  
+int i2d_ECPrivateKey_bio(BIO *bp, EC_KEY *eckey)
+        {
+        return ASN1_i2d_bio_of(EC_KEY,i2d_ECPrivateKey,bp,eckey);
+        }
+#endif
+
+
 int X509_pubkey_digest(const X509 *data, const EVP_MD *type, unsigned char *md,
              unsigned int *len)
         {
@@ -370,40 +411,37 @@ int PKCS7_ISSUER_AND_SERIAL_digest(PKCS7_ISSUER_AND_SERIAL *data, const EVP_MD *
 #ifndef OPENSSL_NO_FP_API
 X509_SIG *d2i_PKCS8_fp(FILE *fp, X509_SIG **p8)
         {
-        return((X509_SIG *)ASN1_d2i_fp((char *(*)())X509_SIG_new,
-                (char *(*)())d2i_X509_SIG, (fp),(unsigned char **)(p8)));
+        return ASN1_d2i_fp_of(X509_SIG,X509_SIG_new,d2i_X509_SIG,fp,p8);
         }
 
 int i2d_PKCS8_fp(FILE *fp, X509_SIG *p8)
         {
-        return(ASN1_i2d_fp(i2d_X509_SIG,fp,(unsigned char *)p8));
+        return ASN1_i2d_fp_of(X509_SIG,i2d_X509_SIG,fp,p8);
         }
 #endif
 
 X509_SIG *d2i_PKCS8_bio(BIO *bp, X509_SIG **p8)
         {
-        return((X509_SIG *)ASN1_d2i_bio((char *(*)())X509_SIG_new,
-                (char *(*)())d2i_X509_SIG, (bp),(unsigned char **)(p8)));
+        return ASN1_d2i_bio_of(X509_SIG,X509_SIG_new,d2i_X509_SIG,bp,p8);
         }
 
 int i2d_PKCS8_bio(BIO *bp, X509_SIG *p8)
         {
-        return(ASN1_i2d_bio(i2d_X509_SIG,bp,(unsigned char *)p8));
+        return ASN1_i2d_bio_of(X509_SIG,i2d_X509_SIG,bp,p8);
         }
 
 #ifndef OPENSSL_NO_FP_API
 PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_fp(FILE *fp,
                                                  PKCS8_PRIV_KEY_INFO **p8inf)
         {
-        return((PKCS8_PRIV_KEY_INFO *)ASN1_d2i_fp(
-                (char *(*)())PKCS8_PRIV_KEY_INFO_new,
-                (char *(*)())d2i_PKCS8_PRIV_KEY_INFO, (fp),
-                                (unsigned char **)(p8inf)));
+        return ASN1_d2i_fp_of(PKCS8_PRIV_KEY_INFO,PKCS8_PRIV_KEY_INFO_new,
+                              d2i_PKCS8_PRIV_KEY_INFO,fp,p8inf);
         }
 
 int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, PKCS8_PRIV_KEY_INFO *p8inf)
         {
-        return(ASN1_i2d_fp(i2d_PKCS8_PRIV_KEY_INFO,fp,(unsigned char *)p8inf));
+        return ASN1_i2d_fp_of(PKCS8_PRIV_KEY_INFO,i2d_PKCS8_PRIV_KEY_INFO,fp,
+                              p8inf);
         }
 
 int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key)
@@ -419,24 +457,22 @@ int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key)
 
 int i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey)
         {
-        return(ASN1_i2d_fp(i2d_PrivateKey,fp,(unsigned char *)pkey));
+        return ASN1_i2d_fp_of(EVP_PKEY,i2d_PrivateKey,fp,pkey);
         }
 
 EVP_PKEY *d2i_PrivateKey_fp(FILE *fp, EVP_PKEY **a)
 {
-        return((EVP_PKEY *)ASN1_d2i_fp((char *(*)())EVP_PKEY_new,
-                (char *(*)())d2i_AutoPrivateKey, (fp),(unsigned char **)(a)));
+        return ASN1_d2i_fp_of(EVP_PKEY,EVP_PKEY_new,d2i_AutoPrivateKey,fp,a);
 }
 
 int i2d_PUBKEY_fp(FILE *fp, EVP_PKEY *pkey)
         {
-        return(ASN1_i2d_fp(i2d_PUBKEY,fp,(unsigned char *)pkey));
+        return ASN1_i2d_fp_of(EVP_PKEY,i2d_PUBKEY,fp,pkey);
         }
 
 EVP_PKEY *d2i_PUBKEY_fp(FILE *fp, EVP_PKEY **a)
 {
-        return((EVP_PKEY *)ASN1_d2i_fp((char *(*)())EVP_PKEY_new,
-                (char *(*)())d2i_PUBKEY, (fp),(unsigned char **)(a)));
+        return ASN1_d2i_fp_of(EVP_PKEY,EVP_PKEY_new,d2i_PUBKEY,fp,a);
 }
 
 #endif
@@ -444,15 +480,14 @@ EVP_PKEY *d2i_PUBKEY_fp(FILE *fp, EVP_PKEY **a)
 PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO_bio(BIO *bp,
                                                  PKCS8_PRIV_KEY_INFO **p8inf)
         {
-        return((PKCS8_PRIV_KEY_INFO *)ASN1_d2i_bio(
-                (char *(*)())PKCS8_PRIV_KEY_INFO_new,
-                (char *(*)())d2i_PKCS8_PRIV_KEY_INFO, (bp),
-                                (unsigned char **)(p8inf)));
+        return ASN1_d2i_bio_of(PKCS8_PRIV_KEY_INFO,PKCS8_PRIV_KEY_INFO_new,
+                            d2i_PKCS8_PRIV_KEY_INFO,bp,p8inf);
         }
 
 int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, PKCS8_PRIV_KEY_INFO *p8inf)
         {
-        return(ASN1_i2d_bio(i2d_PKCS8_PRIV_KEY_INFO,bp,(unsigned char *)p8inf));
+        return ASN1_i2d_bio_of(PKCS8_PRIV_KEY_INFO,i2d_PKCS8_PRIV_KEY_INFO,bp,
+                               p8inf);
         }
 
 int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key)
@@ -468,22 +503,20 @@ int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key)
 
 int i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey)
         {
-        return(ASN1_i2d_bio(i2d_PrivateKey,bp,(unsigned char *)pkey));
+        return ASN1_i2d_bio_of(EVP_PKEY,i2d_PrivateKey,bp,pkey);
         }
 
 EVP_PKEY *d2i_PrivateKey_bio(BIO *bp, EVP_PKEY **a)
         {
-        return((EVP_PKEY *)ASN1_d2i_bio((char *(*)())EVP_PKEY_new,
-                (char *(*)())d2i_AutoPrivateKey, (bp),(unsigned char **)(a)));
+        return ASN1_d2i_bio_of(EVP_PKEY,EVP_PKEY_new,d2i_AutoPrivateKey,bp,a);
         }
 
 int i2d_PUBKEY_bio(BIO *bp, EVP_PKEY *pkey)
         {
-        return(ASN1_i2d_bio(i2d_PUBKEY,bp,(unsigned char *)pkey));
+        return ASN1_i2d_bio_of(EVP_PKEY,i2d_PUBKEY,bp,pkey);
         }
 
 EVP_PKEY *d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a)
         {
-        return((EVP_PKEY *)ASN1_d2i_bio((char *(*)())EVP_PKEY_new,
-                (char *(*)())d2i_PUBKEY, (bp),(unsigned char **)(a)));
+        return ASN1_d2i_bio_of(EVP_PKEY,EVP_PKEY_new,d2i_PUBKEY,bp,a);
         }
diff --git a/src/lib/libssl/src/crypto/x509v3/ext_dat.h b/src/lib/libssl/src/crypto/x509v3/ext_dat.h
index d8328ac468..5c063ac65d 100644
--- a/src/lib/libssl/src/crypto/x509v3/ext_dat.h
+++ b/src/lib/libssl/src/crypto/x509v3/ext_dat.h
@@ -65,6 +65,11 @@ extern X509V3_EXT_METHOD v3_delta_crl, v3_cpols, v3_crld;
 extern X509V3_EXT_METHOD v3_ocsp_nonce, v3_ocsp_accresp, v3_ocsp_acutoff;
 extern X509V3_EXT_METHOD v3_ocsp_crlid, v3_ocsp_nocheck, v3_ocsp_serviceloc;
 extern X509V3_EXT_METHOD v3_crl_hold, v3_pci;
+extern X509V3_EXT_METHOD v3_policy_mappings, v3_policy_constraints;
+extern X509V3_EXT_METHOD v3_name_constraints, v3_inhibit_anyp;
+#ifndef OPENSSL_NO_RFC3779
+extern X509V3_EXT_METHOD v3_addr, v3_asid;
+#endif
 
 /* This table will be searched using OBJ_bsearch so it *must* kept in
  * order of the ext_nid values.
@@ -97,6 +102,10 @@ static X509V3_EXT_METHOD *standard_exts[] = {
 #endif
 &v3_sxnet,
 &v3_info,
+#ifndef OPENSSL_NO_RFC3779
+&v3_addr,
+&v3_asid,
+#endif
 #ifndef OPENSSL_NO_OCSP
 &v3_ocsp_nonce,
 &v3_ocsp_crlid,
@@ -106,10 +115,14 @@ static X509V3_EXT_METHOD *standard_exts[] = {
 &v3_ocsp_serviceloc,
 #endif
 &v3_sinfo,
+&v3_policy_constraints,
 #ifndef OPENSSL_NO_OCSP
 &v3_crl_hold,
 #endif
 &v3_pci,
+&v3_name_constraints,
+&v3_policy_mappings,
+&v3_inhibit_anyp
 };
 
 /* Number of standard extensions */
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_akey.c b/src/lib/libssl/src/crypto/x509v3/v3_akey.c
index 97e686f97a..ac0548b775 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_akey.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_akey.c
@@ -68,15 +68,17 @@ static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
 static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
                         X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
 
-X509V3_EXT_METHOD v3_akey_id = {
-NID_authority_key_identifier, X509V3_EXT_MULTILINE, ASN1_ITEM_ref(AUTHORITY_KEYID),
-0,0,0,0,
-0,0,
-(X509V3_EXT_I2V)i2v_AUTHORITY_KEYID,
-(X509V3_EXT_V2I)v2i_AUTHORITY_KEYID,
-0,0,
-NULL
-};
+const X509V3_EXT_METHOD v3_akey_id =
+        {
+        NID_authority_key_identifier,
+        X509V3_EXT_MULTILINE, ASN1_ITEM_ref(AUTHORITY_KEYID),
+        0,0,0,0,
+        0,0,
+        (X509V3_EXT_I2V)i2v_AUTHORITY_KEYID,
+        (X509V3_EXT_V2I)v2i_AUTHORITY_KEYID,
+        0,0,
+        NULL
+        };
 
 static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
              AUTHORITY_KEYID *akeyid, STACK_OF(CONF_VALUE) *extlist)
@@ -108,83 +110,99 @@ static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
 
 static AUTHORITY_KEYID *v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
              X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values)
-{
-char keyid=0, issuer=0;
-int i;
-CONF_VALUE *cnf;
-ASN1_OCTET_STRING *ikeyid = NULL;
-X509_NAME *isname = NULL;
-GENERAL_NAMES * gens = NULL;
-GENERAL_NAME *gen = NULL;
-ASN1_INTEGER *serial = NULL;
-X509_EXTENSION *ext;
-X509 *cert;
-AUTHORITY_KEYID *akeyid;
-for(i = 0; i < sk_CONF_VALUE_num(values); i++) {
-        cnf = sk_CONF_VALUE_value(values, i);
-        if(!strcmp(cnf->name, "keyid")) {
-                keyid = 1;
-                if(cnf->value && !strcmp(cnf->value, "always")) keyid = 2;
-        } else if(!strcmp(cnf->name, "issuer")) {
-                issuer = 1;
-                if(cnf->value && !strcmp(cnf->value, "always")) issuer = 2;
-        } else {
-                X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNKNOWN_OPTION);
-                ERR_add_error_data(2, "name=", cnf->name);
+        {
+        char keyid=0, issuer=0;
+        int i;
+        CONF_VALUE *cnf;
+        ASN1_OCTET_STRING *ikeyid = NULL;
+        X509_NAME *isname = NULL;
+        GENERAL_NAMES * gens = NULL;
+        GENERAL_NAME *gen = NULL;
+        ASN1_INTEGER *serial = NULL;
+        X509_EXTENSION *ext;
+        X509 *cert;
+        AUTHORITY_KEYID *akeyid;
+
+        for(i = 0; i < sk_CONF_VALUE_num(values); i++)
+                {
+                cnf = sk_CONF_VALUE_value(values, i);
+                if(!strcmp(cnf->name, "keyid"))
+                        {
+                        keyid = 1;
+                        if(cnf->value && !strcmp(cnf->value, "always"))
+                                keyid = 2;
+                        }
+                else if(!strcmp(cnf->name, "issuer"))
+                        {
+                        issuer = 1;
+                        if(cnf->value && !strcmp(cnf->value, "always"))
+                                issuer = 2;
+                        }
+                else
+                        {
+                        X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNKNOWN_OPTION);
+                        ERR_add_error_data(2, "name=", cnf->name);
+                        return NULL;
+                        }
+                }
+
+        if(!ctx || !ctx->issuer_cert)
+                {
+                if(ctx && (ctx->flags==CTX_TEST))
+                        return AUTHORITY_KEYID_new();
+                X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_NO_ISSUER_CERTIFICATE);
                 return NULL;
-        }
-}
-
-if(!ctx || !ctx->issuer_cert) {
-        if(ctx && (ctx->flags==CTX_TEST)) return AUTHORITY_KEYID_new();
-        X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_NO_ISSUER_CERTIFICATE);
+                }
+
+        cert = ctx->issuer_cert;
+
+        if(keyid)
+                {
+                i = X509_get_ext_by_NID(cert, NID_subject_key_identifier, -1);
+                if((i >= 0)  && (ext = X509_get_ext(cert, i)))
+                        ikeyid = X509V3_EXT_d2i(ext);
+                if(keyid==2 && !ikeyid)
+                        {
+                        X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNABLE_TO_GET_ISSUER_KEYID);
+                        return NULL;
+                        }
+                }
+
+        if((issuer && !ikeyid) || (issuer == 2))
+                {
+                isname = X509_NAME_dup(X509_get_issuer_name(cert));
+                serial = M_ASN1_INTEGER_dup(X509_get_serialNumber(cert));
+                if(!isname || !serial)
+                        {
+                        X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS);
+                        goto err;
+                        }
+                }
+
+        if(!(akeyid = AUTHORITY_KEYID_new())) goto err;
+
+        if(isname)
+                {
+                if(!(gens = sk_GENERAL_NAME_new_null())
+                        || !(gen = GENERAL_NAME_new())
+                        || !sk_GENERAL_NAME_push(gens, gen))
+                        {
+                        X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                gen->type = GEN_DIRNAME;
+                gen->d.dirn = isname;
+                }
+
+        akeyid->issuer = gens;
+        akeyid->serial = serial;
+        akeyid->keyid = ikeyid;
+
+        return akeyid;
+
+ err:
+        X509_NAME_free(isname);
+        M_ASN1_INTEGER_free(serial);
+        M_ASN1_OCTET_STRING_free(ikeyid);
         return NULL;
-}
-
-cert = ctx->issuer_cert;
-
-if(keyid) {
-        i = X509_get_ext_by_NID(cert, NID_subject_key_identifier, -1);
-        if((i >= 0)  && (ext = X509_get_ext(cert, i)))
-                                                 ikeyid = X509V3_EXT_d2i(ext);
-        if(keyid==2 && !ikeyid) {
-                X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNABLE_TO_GET_ISSUER_KEYID);
-                return NULL;
-        }
-}
-
-if((issuer && !ikeyid) || (issuer == 2)) {
-        isname = X509_NAME_dup(X509_get_issuer_name(cert));
-        serial = M_ASN1_INTEGER_dup(X509_get_serialNumber(cert));
-        if(!isname || !serial) {
-                X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS);
-                goto err;
         }
-}
-
-if(!(akeyid = AUTHORITY_KEYID_new())) goto err;
-
-if(isname) {
-        if(!(gens = sk_GENERAL_NAME_new_null()) || !(gen = GENERAL_NAME_new())
-                || !sk_GENERAL_NAME_push(gens, gen)) {
-                X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-        gen->type = GEN_DIRNAME;
-        gen->d.dirn = isname;
-}
-
-akeyid->issuer = gens;
-akeyid->serial = serial;
-akeyid->keyid = ikeyid;
-
-return akeyid;
-
-err:
-X509_NAME_free(isname);
-M_ASN1_INTEGER_free(serial);
-M_ASN1_OCTET_STRING_free(ikeyid);
-return NULL;
-
-}
-
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_alt.c b/src/lib/libssl/src/crypto/x509v3/v3_alt.c
index 58b935a3b6..bb2f5bc54e 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_alt.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_alt.c
@@ -1,9 +1,9 @@
 /* v3_alt.c */
 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
- * project 1999.
+ * project.
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2003 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -65,7 +65,10 @@ static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx
 static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
 static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p);
 static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens);
-X509V3_EXT_METHOD v3_alt[] = {
+static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
+static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx);
+
+const X509V3_EXT_METHOD v3_alt[] = {
 { NID_subject_alt_name, 0, ASN1_ITEM_ref(GENERAL_NAMES),
 0,0,0,0,
 0,0,
@@ -98,7 +101,8 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
                                 GENERAL_NAME *gen, STACK_OF(CONF_VALUE) *ret)
 {
         unsigned char *p;
-        char oline[256];
+        char oline[256], htmp[5];
+        int i;
         switch (gen->type)
         {
                 case GEN_OTHERNAME:
@@ -132,13 +136,27 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
 
                 case GEN_IPADD:
                 p = gen->d.ip->data;
-                /* BUG: doesn't support IPV6 */
-                if(gen->d.ip->length != 4) {
+                if(gen->d.ip->length == 4)
+                        BIO_snprintf(oline, sizeof oline,
+                                     "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
+                else if(gen->d.ip->length == 16)
+                        {
+                        oline[0] = 0;
+                        for (i = 0; i < 8; i++)
+                                {
+                                BIO_snprintf(htmp, sizeof htmp,
+                                             "%X", p[0] << 8 | p[1]);
+                                p += 2;
+                                strcat(oline, htmp);
+                                if (i != 7)
+                                        strcat(oline, ":");
+                                }
+                        }
+                else
+                        {
                         X509V3_add_value("IP Address","<invalid>", &ret);
                         break;
-                }
-                BIO_snprintf(oline, sizeof oline,
-                             "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
+                        }
                 X509V3_add_value("IP Address",oline, &ret);
                 break;
 
@@ -153,6 +171,7 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
 int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
 {
         unsigned char *p;
+        int i;
         switch (gen->type)
         {
                 case GEN_OTHERNAME:
@@ -187,12 +206,24 @@ int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen)
 
                 case GEN_IPADD:
                 p = gen->d.ip->data;
-                /* BUG: doesn't support IPV6 */
-                if(gen->d.ip->length != 4) {
+                if(gen->d.ip->length == 4)
+                        BIO_printf(out, "IP Address:%d.%d.%d.%d",
+                                                p[0], p[1], p[2], p[3]);
+                else if(gen->d.ip->length == 16)
+                        {
+                        BIO_printf(out, "IP Address");
+                        for (i = 0; i < 8; i++)
+                                {
+                                BIO_printf(out, ":%X", p[0] << 8 | p[1]);
+                                p += 2;
+                                }
+                        BIO_puts(out, "\n");
+                        }
+                else
+                        {
                         BIO_printf(out,"IP Address:<invalid>");
                         break;
-                }
-                BIO_printf(out, "IP Address:%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
+                        }
                 break;
 
                 case GEN_RID:
@@ -210,7 +241,7 @@ static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method,
         CONF_VALUE *cnf;
         int i;
         if(!(gens = sk_GENERAL_NAME_new_null())) {
-                X509V3err(X509V3_F_V2I_GENERAL_NAMES,ERR_R_MALLOC_FAILURE);
+                X509V3err(X509V3_F_V2I_ISSUER_ALT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         for(i = 0; i < sk_CONF_VALUE_num(nval); i++) {
@@ -275,7 +306,7 @@ static GENERAL_NAMES *v2i_subject_alt(X509V3_EXT_METHOD *method,
         CONF_VALUE *cnf;
         int i;
         if(!(gens = sk_GENERAL_NAME_new_null())) {
-                X509V3err(X509V3_F_V2I_GENERAL_NAMES,ERR_R_MALLOC_FAILURE);
+                X509V3err(X509V3_F_V2I_SUBJECT_ALT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         for(i = 0; i < sk_CONF_VALUE_num(nval); i++) {
@@ -310,7 +341,8 @@ static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p)
         X509_NAME_ENTRY *ne;
         GENERAL_NAME *gen = NULL;
         int i;
-        if(ctx->flags == CTX_TEST) return 1;
+        if(ctx != NULL && ctx->flags == CTX_TEST)
+                return 1;
         if(!ctx || (!ctx->subject_cert && !ctx->subject_req)) {
                 X509V3err(X509V3_F_COPY_EMAIL,X509V3_R_NO_SUBJECT_DETAILS);
                 goto err;
@@ -378,81 +410,172 @@ GENERAL_NAMES *v2i_GENERAL_NAMES(X509V3_EXT_METHOD *method,
 
 GENERAL_NAME *v2i_GENERAL_NAME(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
                                                          CONF_VALUE *cnf)
-{
-char is_string = 0;
-int type;
-GENERAL_NAME *gen = NULL;
+        {
+        return v2i_GENERAL_NAME_ex(NULL, method, ctx, cnf, 0);
+        }
 
-char *name, *value;
+GENERAL_NAME *v2i_GENERAL_NAME_ex(GENERAL_NAME *out,
+                                X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
+                                                 CONF_VALUE *cnf, int is_nc)
+        {
+        char is_string = 0;
+        int type;
+        GENERAL_NAME *gen = NULL;
 
-name = cnf->name;
-value = cnf->value;
+        char *name, *value;
 
-if(!value) {
-        X509V3err(X509V3_F_V2I_GENERAL_NAME,X509V3_R_MISSING_VALUE);
-        return NULL;
-}
+        name = cnf->name;
+        value = cnf->value;
 
-if(!(gen = GENERAL_NAME_new())) {
-        X509V3err(X509V3_F_V2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE);
-        return NULL;
-}
+        if(!value)
+                {
+                X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,X509V3_R_MISSING_VALUE);
+                return NULL;
+                }
 
-if(!name_cmp(name, "email")) {
-        is_string = 1;
-        type = GEN_EMAIL;
-} else if(!name_cmp(name, "URI")) {
-        is_string = 1;
-        type = GEN_URI;
-} else if(!name_cmp(name, "DNS")) {
-        is_string = 1;
-        type = GEN_DNS;
-} else if(!name_cmp(name, "RID")) {
-        ASN1_OBJECT *obj;
-        if(!(obj = OBJ_txt2obj(value,0))) {
-                X509V3err(X509V3_F_V2I_GENERAL_NAME,X509V3_R_BAD_OBJECT);
-                ERR_add_error_data(2, "value=", value);
-                goto err;
-        }
-        gen->d.rid = obj;
-        type = GEN_RID;
-} else if(!name_cmp(name, "IP")) {
-        int i1,i2,i3,i4;
-        unsigned char ip[4];
-        if((sscanf(value, "%d.%d.%d.%d",&i1,&i2,&i3,&i4) != 4) ||
-            (i1 < 0) || (i1 > 255) || (i2 < 0) || (i2 > 255) ||
-            (i3 < 0) || (i3 > 255) || (i4 < 0) || (i4 > 255) ) {
-                X509V3err(X509V3_F_V2I_GENERAL_NAME,X509V3_R_BAD_IP_ADDRESS);
-                ERR_add_error_data(2, "value=", value);
+        if (out)
+                gen = out;
+        else
+                {
+                gen = GENERAL_NAME_new();
+                if(gen == NULL)
+                        {
+                        X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,ERR_R_MALLOC_FAILURE);
+                        return NULL;
+                        }
+                }
+
+        if(!name_cmp(name, "email"))
+                {
+                is_string = 1;
+                type = GEN_EMAIL;
+                }
+        else if(!name_cmp(name, "URI"))
+                {
+                is_string = 1;
+                type = GEN_URI;
+                }
+        else if(!name_cmp(name, "DNS"))
+                {
+                is_string = 1;
+                type = GEN_DNS;
+                }
+        else if(!name_cmp(name, "RID"))
+                {
+                ASN1_OBJECT *obj;
+                if(!(obj = OBJ_txt2obj(value,0)))
+                        {
+                        X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,X509V3_R_BAD_OBJECT);
+                        ERR_add_error_data(2, "value=", value);
+                        goto err;
+                        }
+                gen->d.rid = obj;
+                type = GEN_RID;
+                }
+        else if(!name_cmp(name, "IP"))
+                {
+                if (is_nc)
+                        gen->d.ip = a2i_IPADDRESS_NC(value);
+                else
+                        gen->d.ip = a2i_IPADDRESS(value);
+                if(gen->d.ip == NULL)
+                        {
+                        X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,X509V3_R_BAD_IP_ADDRESS);
+                        ERR_add_error_data(2, "value=", value);
+                        goto err;
+                        }
+                type = GEN_IPADD;
+                }
+        else if(!name_cmp(name, "dirName"))
+                {
+                type = GEN_DIRNAME;
+                if (!do_dirname(gen, value, ctx))
+                        {
+                        X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,X509V3_R_DIRNAME_ERROR);
+                        goto err;
+                        }
+                }
+        else if(!name_cmp(name, "otherName"))
+                {
+                if (!do_othername(gen, value, ctx))
+                        {
+                        X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,X509V3_R_OTHERNAME_ERROR);
+                        goto err;
+                        }
+                type = GEN_OTHERNAME;
+                }
+        else
+                {
+                X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,X509V3_R_UNSUPPORTED_OPTION);
+                ERR_add_error_data(2, "name=", name);
                 goto err;
-        }
-        ip[0] = i1; ip[1] = i2 ; ip[2] = i3 ; ip[3] = i4;
-        if(!(gen->d.ip = M_ASN1_OCTET_STRING_new()) ||
-                !ASN1_STRING_set(gen->d.ip, ip, 4)) {
-                        X509V3err(X509V3_F_V2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE);
+                }
+
+        if(is_string)
+                {
+                if(!(gen->d.ia5 = M_ASN1_IA5STRING_new()) ||
+                              !ASN1_STRING_set(gen->d.ia5, (unsigned char*)value,
+                                               strlen(value)))
+                        {
+                        X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,ERR_R_MALLOC_FAILURE);
                         goto err;
-        }
-        type = GEN_IPADD;
-} else {
-        X509V3err(X509V3_F_V2I_GENERAL_NAME,X509V3_R_UNSUPPORTED_OPTION);
-        ERR_add_error_data(2, "name=", name);
-        goto err;
-}
+                        }
+                }
 
-if(is_string) {
-        if(!(gen->d.ia5 = M_ASN1_IA5STRING_new()) ||
-                      !ASN1_STRING_set(gen->d.ia5, (unsigned char*)value,
-                                       strlen(value))) {
-                X509V3err(X509V3_F_V2I_GENERAL_NAME,ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-}
+        gen->type = type;
+
+        return gen;
 
-gen->type = type;
+        err:
+        GENERAL_NAME_free(gen);
+        return NULL;
+        }
 
-return gen;
+static int do_othername(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
+        {
+        char *objtmp = NULL, *p;
+        int objlen;
+        if (!(p = strchr(value, ';')))
+                return 0;
+        if (!(gen->d.otherName = OTHERNAME_new()))
+                return 0;
+        /* Free this up because we will overwrite it.
+         * no need to free type_id because it is static
+         */
+        ASN1_TYPE_free(gen->d.otherName->value);
+        if (!(gen->d.otherName->value = ASN1_generate_v3(p + 1, ctx)))
+                return 0;
+        objlen = p - value;
+        objtmp = OPENSSL_malloc(objlen + 1);
+        strncpy(objtmp, value, objlen);
+        objtmp[objlen] = 0;
+        gen->d.otherName->type_id = OBJ_txt2obj(objtmp, 0);
+        OPENSSL_free(objtmp);   
+        if (!gen->d.otherName->type_id)
+                return 0;
+        return 1;
+        }
 
-err:
-GENERAL_NAME_free(gen);
-return NULL;
-}
+static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
+        {
+        int ret;
+        STACK_OF(CONF_VALUE) *sk;
+        X509_NAME *nm;
+        if (!(nm = X509_NAME_new()))
+                return 0;
+        sk = X509V3_get_section(ctx, value);
+        if (!sk)
+                {
+                X509V3err(X509V3_F_DO_DIRNAME,X509V3_R_SECTION_NOT_FOUND);
+                ERR_add_error_data(2, "section=", value);
+                X509_NAME_free(nm);
+                return 0;
+                }
+        /* FIXME: should allow other character types... */
+        ret = X509V3_NAME_from_section(nm, sk, MBSTRING_ASC);
+        if (!ret)
+                X509_NAME_free(nm);
+        gen->d.dirn = nm;
+                
+        return ret;
+        }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_bcons.c b/src/lib/libssl/src/crypto/x509v3/v3_bcons.c
index cbb012715e..74b1233071 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_bcons.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_bcons.c
@@ -67,7 +67,7 @@
 static STACK_OF(CONF_VALUE) *i2v_BASIC_CONSTRAINTS(X509V3_EXT_METHOD *method, BASIC_CONSTRAINTS *bcons, STACK_OF(CONF_VALUE) *extlist);
 static BASIC_CONSTRAINTS *v2i_BASIC_CONSTRAINTS(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
 
-X509V3_EXT_METHOD v3_bcons = {
+const X509V3_EXT_METHOD v3_bcons = {
 NID_basic_constraints, 0,
 ASN1_ITEM_ref(BASIC_CONSTRAINTS),
 0,0,0,0,
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_bitst.c b/src/lib/libssl/src/crypto/x509v3/v3_bitst.c
index 274965306d..cf31f0816e 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_bitst.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_bitst.c
@@ -61,12 +61,6 @@
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
 
-static ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
-                                X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
-static STACK_OF(CONF_VALUE) *i2v_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
-                                ASN1_BIT_STRING *bits,
-                                STACK_OF(CONF_VALUE) *extlist);
-
 static BIT_STRING_BITNAME ns_cert_type_table[] = {
 {0, "SSL Client", "client"},
 {1, "SSL Server", "server"},
@@ -94,10 +88,10 @@ static BIT_STRING_BITNAME key_usage_type_table[] = {
 
 
 
-X509V3_EXT_METHOD v3_nscert = EXT_BITSTRING(NID_netscape_cert_type, ns_cert_type_table);
-X509V3_EXT_METHOD v3_key_usage = EXT_BITSTRING(NID_key_usage, key_usage_type_table);
+const X509V3_EXT_METHOD v3_nscert = EXT_BITSTRING(NID_netscape_cert_type, ns_cert_type_table);
+const X509V3_EXT_METHOD v3_key_usage = EXT_BITSTRING(NID_key_usage, key_usage_type_table);
 
-static STACK_OF(CONF_VALUE) *i2v_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
+STACK_OF(CONF_VALUE) *i2v_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
              ASN1_BIT_STRING *bits, STACK_OF(CONF_VALUE) *ret)
 {
         BIT_STRING_BITNAME *bnam;
@@ -108,7 +102,7 @@ static STACK_OF(CONF_VALUE) *i2v_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
         return ret;
 }
         
-static ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
+ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
              X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
 {
         CONF_VALUE *val;
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_conf.c b/src/lib/libssl/src/crypto/x509v3/v3_conf.c
index 1284d5aaa5..2b867305fb 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_conf.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_conf.c
@@ -3,7 +3,7 @@
  * project 1999.
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2002 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -69,11 +69,12 @@
 static int v3_check_critical(char **value);
 static int v3_check_generic(char **value);
 static X509_EXTENSION *do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid, int crit, char *value);
-static X509_EXTENSION *v3_generic_extension(const char *ext, char *value, int crit, int type);
+static X509_EXTENSION *v3_generic_extension(const char *ext, char *value, int crit, int type, X509V3_CTX *ctx);
 static char *conf_lhash_get_string(void *db, char *section, char *value);
 static STACK_OF(CONF_VALUE) *conf_lhash_get_section(void *db, char *section);
 static X509_EXTENSION *do_ext_i2d(X509V3_EXT_METHOD *method, int ext_nid,
                                                  int crit, void *ext_struc);
+static unsigned char *generic_asn1(char *value, X509V3_CTX *ctx, long *ext_len);
 /* CONF *conf:  Config file    */
 /* char *name:  Name    */
 /* char *value:  Value    */
@@ -85,11 +86,11 @@ X509_EXTENSION *X509V3_EXT_nconf(CONF *conf, X509V3_CTX *ctx, char *name,
         X509_EXTENSION *ret;
         crit = v3_check_critical(&value);
         if ((ext_type = v3_check_generic(&value))) 
-                return v3_generic_extension(name, value, crit, ext_type);
+                return v3_generic_extension(name, value, crit, ext_type, ctx);
         ret = do_ext_nconf(conf, ctx, OBJ_sn2nid(name), crit, value);
         if (!ret)
                 {
-                X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_ERROR_IN_EXTENSION);
+                X509V3err(X509V3_F_X509V3_EXT_NCONF,X509V3_R_ERROR_IN_EXTENSION);
                 ERR_add_error_data(4,"name=", name, ", value=", value);
                 }
         return ret;
@@ -105,7 +106,7 @@ X509_EXTENSION *X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid,
         crit = v3_check_critical(&value);
         if ((ext_type = v3_check_generic(&value))) 
                 return v3_generic_extension(OBJ_nid2sn(ext_nid),
-                                                         value, crit, ext_type);
+                                                 value, crit, ext_type, ctx);
         return do_ext_nconf(conf, ctx, ext_nid, crit, value);
         }
 
@@ -120,12 +121,12 @@ static X509_EXTENSION *do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid,
         void *ext_struc;
         if (ext_nid == NID_undef)
                 {
-                X509V3err(X509V3_F_DO_EXT_CONF,X509V3_R_UNKNOWN_EXTENSION_NAME);
+                X509V3err(X509V3_F_DO_EXT_NCONF,X509V3_R_UNKNOWN_EXTENSION_NAME);
                 return NULL;
                 }
         if (!(method = X509V3_EXT_get_nid(ext_nid)))
                 {
-                X509V3err(X509V3_F_DO_EXT_CONF,X509V3_R_UNKNOWN_EXTENSION);
+                X509V3err(X509V3_F_DO_EXT_NCONF,X509V3_R_UNKNOWN_EXTENSION);
                 return NULL;
                 }
         /* Now get internal extension representation based on type */
@@ -133,9 +134,9 @@ static X509_EXTENSION *do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid,
                 {
                 if(*value == '@') nval = NCONF_get_section(conf, value + 1);
                 else nval = X509V3_parse_list(value);
-                if(!nval)
+                if(sk_CONF_VALUE_num(nval) <= 0)
                         {
-                        X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_INVALID_EXTENSION_STRING);
+                        X509V3err(X509V3_F_DO_EXT_NCONF,X509V3_R_INVALID_EXTENSION_STRING);
                         ERR_add_error_data(4, "name=", OBJ_nid2sn(ext_nid), ",section=", value);
                         return NULL;
                         }
@@ -150,16 +151,16 @@ static X509_EXTENSION *do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid,
                 }
         else if(method->r2i)
                 {
-                if(!ctx->db)
+                if(!ctx->db || !ctx->db_meth)
                         {
-                        X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_NO_CONFIG_DATABASE);
+                        X509V3err(X509V3_F_DO_EXT_NCONF,X509V3_R_NO_CONFIG_DATABASE);
                         return NULL;
                         }
                 if(!(ext_struc = method->r2i(method, ctx, value))) return NULL;
                 }
         else
                 {
-                X509V3err(X509V3_F_X509V3_EXT_CONF,X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED);
+                X509V3err(X509V3_F_DO_EXT_NCONF,X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED);
                 ERR_add_error_data(2, "name=", OBJ_nid2sn(ext_nid));
                 return NULL;
                 }
@@ -235,17 +236,29 @@ static int v3_check_critical(char **value)
 /* Check extension string for generic extension and return the type */
 static int v3_check_generic(char **value)
 {
+        int gen_type = 0;
         char *p = *value;
-        if ((strlen(p) < 4) || strncmp(p, "DER:", 4)) return 0;
-        p+=4;
+        if ((strlen(p) >= 4) && !strncmp(p, "DER:", 4))
+                {
+                p+=4;
+                gen_type = 1;
+                }
+        else if ((strlen(p) >= 5) && !strncmp(p, "ASN1:", 5))
+                {
+                p+=5;
+                gen_type = 2;
+                }
+        else
+                return 0;
+
         while (isspace((unsigned char)*p)) p++;
         *value = p;
-        return 1;
+        return gen_type;
 }
 
 /* Create a generic extension: for now just handle DER type */
 static X509_EXTENSION *v3_generic_extension(const char *ext, char *value,
-             int crit, int type)
+             int crit, int gen_type, X509V3_CTX *ctx)
         {
         unsigned char *ext_der=NULL;
         long ext_len;
@@ -259,7 +272,12 @@ static X509_EXTENSION *v3_generic_extension(const char *ext, char *value,
                 goto err;
                 }
 
-        if (!(ext_der = string_to_hex(value, &ext_len)))
+        if (gen_type == 1)
+                ext_der = string_to_hex(value, &ext_len);
+        else if (gen_type == 2)
+                ext_der = generic_asn1(value, ctx, &ext_len);
+
+        if (ext_der == NULL)
                 {
                 X509V3err(X509V3_F_V3_GENERIC_EXTENSION,X509V3_R_EXTENSION_VALUE_ERROR);
                 ERR_add_error_data(2, "value=", value);
@@ -286,6 +304,17 @@ static X509_EXTENSION *v3_generic_extension(const char *ext, char *value,
 
         }
 
+static unsigned char *generic_asn1(char *value, X509V3_CTX *ctx, long *ext_len)
+        {
+        ASN1_TYPE *typ;
+        unsigned char *ext_der = NULL;
+        typ = ASN1_generate_v3(value, ctx);
+        if (typ == NULL)
+                return NULL;
+        *ext_len = i2d_ASN1_TYPE(typ, &ext_der);
+        ASN1_TYPE_free(typ);
+        return ext_der;
+        }
 
 /* This is the main function: add a bunch of extensions based on a config file
  * section to an extension STACK.
@@ -354,6 +383,11 @@ int X509V3_EXT_REQ_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section,
 
 char * X509V3_get_string(X509V3_CTX *ctx, char *name, char *section)
         {
+        if(!ctx->db || !ctx->db_meth || !ctx->db_meth->get_string)
+                {
+                X509V3err(X509V3_F_X509V3_GET_STRING,X509V3_R_OPERATION_NOT_DEFINED);
+                return NULL;
+                }
         if (ctx->db_meth->get_string)
                         return ctx->db_meth->get_string(ctx->db, name, section);
         return NULL;
@@ -361,6 +395,11 @@ char * X509V3_get_string(X509V3_CTX *ctx, char *name, char *section)
 
 STACK_OF(CONF_VALUE) * X509V3_get_section(X509V3_CTX *ctx, char *section)
         {
+        if(!ctx->db || !ctx->db_meth || !ctx->db_meth->get_section)
+                {
+                X509V3err(X509V3_F_X509V3_GET_SECTION,X509V3_R_OPERATION_NOT_DEFINED);
+                return NULL;
+                }
         if (ctx->db_meth->get_section)
                         return ctx->db_meth->get_section(ctx->db, section);
         return NULL;
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_cpols.c b/src/lib/libssl/src/crypto/x509v3/v3_cpols.c
index 867525f336..a40f490aa9 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_cpols.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_cpols.c
@@ -3,7 +3,7 @@
  * project 1999.
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -63,6 +63,8 @@
 #include <openssl/asn1t.h>
 #include <openssl/x509v3.h>
 
+#include "pcy_int.h"
+
 /* Certificate policies extension support: this one is a bit complex... */
 
 static int i2r_certpol(X509V3_EXT_METHOD *method, STACK_OF(POLICYINFO) *pol, BIO *out, int indent);
@@ -75,7 +77,7 @@ static POLICYQUALINFO *notice_section(X509V3_CTX *ctx,
                                         STACK_OF(CONF_VALUE) *unot, int ia5org);
 static int nref_nos(STACK_OF(ASN1_INTEGER) *nnums, STACK_OF(CONF_VALUE) *nos);
 
-X509V3_EXT_METHOD v3_cpols = {
+const X509V3_EXT_METHOD v3_cpols = {
 NID_certificate_policies, 0,ASN1_ITEM_ref(CERTIFICATEPOLICIES),
 0,0,0,0,
 0,0,
@@ -348,7 +350,7 @@ static int nref_nos(STACK_OF(ASN1_INTEGER) *nnums, STACK_OF(CONF_VALUE) *nos)
         return 1;
 
         merr:
-        X509V3err(X509V3_F_NOTICE_SECTION,ERR_R_MALLOC_FAILURE);
+        X509V3err(X509V3_F_NREF_NOS,ERR_R_MALLOC_FAILURE);
 
         err:
         sk_ASN1_INTEGER_pop_free(nnums, ASN1_STRING_free);
@@ -429,3 +431,19 @@ static void print_notice(BIO *out, USERNOTICE *notice, int indent)
                                                          notice->exptext->data);
 }
 
+void X509_POLICY_NODE_print(BIO *out, X509_POLICY_NODE *node, int indent)
+        {
+        const X509_POLICY_DATA *dat = node->data;
+
+        BIO_printf(out, "%*sPolicy: ", indent, "");
+                        
+        i2a_ASN1_OBJECT(out, dat->valid_policy);
+        BIO_puts(out, "\n");
+        BIO_printf(out, "%*s%s\n", indent + 2, "",
+                node_data_critical(dat) ? "Critical" : "Non Critical");
+        if (dat->qualifier_set)
+                print_qualifiers(out, dat->qualifier_set, indent + 2);
+        else
+                BIO_printf(out, "%*sNo Qualifiers\n", indent + 2, "");
+        }
+        
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_crld.c b/src/lib/libssl/src/crypto/x509v3/v3_crld.c
index f90829c574..c6e3ebae7b 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_crld.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_crld.c
@@ -68,7 +68,7 @@ static STACK_OF(CONF_VALUE) *i2v_crld(X509V3_EXT_METHOD *method,
 static STACK_OF(DIST_POINT) *v2i_crld(X509V3_EXT_METHOD *method,
                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
 
-X509V3_EXT_METHOD v3_crld = {
+const X509V3_EXT_METHOD v3_crld = {
 NID_crl_distribution_points, X509V3_EXT_MULTILINE, ASN1_ITEM_ref(CRL_DIST_POINTS),
 0,0,0,0,
 0,0,
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_enum.c b/src/lib/libssl/src/crypto/x509v3/v3_enum.c
index 010c9d6260..a236cb22e1 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_enum.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_enum.c
@@ -72,7 +72,7 @@ static ENUMERATED_NAMES crl_reasons[] = {
 {-1, NULL, NULL}
 };
 
-X509V3_EXT_METHOD v3_crl_reason = { 
+const X509V3_EXT_METHOD v3_crl_reason = { 
 NID_crl_reason, 0, ASN1_ITEM_ref(ASN1_ENUMERATED),
 0,0,0,0,
 (X509V3_EXT_I2S)i2s_ASN1_ENUMERATED_TABLE,
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_extku.c b/src/lib/libssl/src/crypto/x509v3/v3_extku.c
index b1cfaba1aa..a4efe0031e 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_extku.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_extku.c
@@ -68,7 +68,7 @@ static void *v2i_EXTENDED_KEY_USAGE(X509V3_EXT_METHOD *method,
 static STACK_OF(CONF_VALUE) *i2v_EXTENDED_KEY_USAGE(X509V3_EXT_METHOD *method,
                 void *eku, STACK_OF(CONF_VALUE) *extlist);
 
-X509V3_EXT_METHOD v3_ext_ku = {
+const X509V3_EXT_METHOD v3_ext_ku = {
         NID_ext_key_usage, 0,
         ASN1_ITEM_ref(EXTENDED_KEY_USAGE),
         0,0,0,0,
@@ -80,7 +80,7 @@ X509V3_EXT_METHOD v3_ext_ku = {
 };
 
 /* NB OCSP acceptable responses also is a SEQUENCE OF OBJECT */
-X509V3_EXT_METHOD v3_ocsp_accresp = {
+const X509V3_EXT_METHOD v3_ocsp_accresp = {
         NID_id_pkix_OCSP_acceptableResponses, 0,
         ASN1_ITEM_ref(EXTENDED_KEY_USAGE),
         0,0,0,0,
@@ -122,7 +122,7 @@ static void *v2i_EXTENDED_KEY_USAGE(X509V3_EXT_METHOD *method,
         int i;
 
         if(!(extku = sk_ASN1_OBJECT_new_null())) {
-                X509V3err(X509V3_F_V2I_EXT_KU,ERR_R_MALLOC_FAILURE);
+                X509V3err(X509V3_F_V2I_EXTENDED_KEY_USAGE,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
 
@@ -132,7 +132,7 @@ static void *v2i_EXTENDED_KEY_USAGE(X509V3_EXT_METHOD *method,
                 else extval = val->name;
                 if(!(objtmp = OBJ_txt2obj(extval, 0))) {
                         sk_ASN1_OBJECT_pop_free(extku, ASN1_OBJECT_free);
-                        X509V3err(X509V3_F_V2I_EXT_KU,X509V3_R_INVALID_OBJECT_IDENTIFIER);
+                        X509V3err(X509V3_F_V2I_EXTENDED_KEY_USAGE,X509V3_R_INVALID_OBJECT_IDENTIFIER);
                         X509V3_conf_err(val);
                         return NULL;
                 }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_ia5.c b/src/lib/libssl/src/crypto/x509v3/v3_ia5.c
index 9683afa47c..b739ccd036 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_ia5.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_ia5.c
@@ -65,7 +65,7 @@
 
 static char *i2s_ASN1_IA5STRING(X509V3_EXT_METHOD *method, ASN1_IA5STRING *ia5);
 static ASN1_IA5STRING *s2i_ASN1_IA5STRING(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str);
-X509V3_EXT_METHOD v3_ns_ia5_list[] = { 
+const X509V3_EXT_METHOD v3_ns_ia5_list[] = { 
 EXT_IA5STRING(NID_netscape_base_url),
 EXT_IA5STRING(NID_netscape_revocation_url),
 EXT_IA5STRING(NID_netscape_ca_revocation_url),
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_info.c b/src/lib/libssl/src/crypto/x509v3/v3_info.c
index 53e3f48859..e0ef69de42 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_info.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_info.c
@@ -69,7 +69,7 @@ static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method
 static AUTHORITY_INFO_ACCESS *v2i_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method,
                                  X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
 
-X509V3_EXT_METHOD v3_info =
+const X509V3_EXT_METHOD v3_info =
 { NID_info_access, X509V3_EXT_MULTILINE, ASN1_ITEM_ref(AUTHORITY_INFO_ACCESS),
 0,0,0,0,
 0,0,
@@ -78,7 +78,7 @@ X509V3_EXT_METHOD v3_info =
 0,0,
 NULL};
 
-X509V3_EXT_METHOD v3_sinfo =
+const X509V3_EXT_METHOD v3_sinfo =
 { NID_sinfo_access, X509V3_EXT_MULTILINE, ASN1_ITEM_ref(AUTHORITY_INFO_ACCESS),
 0,0,0,0,
 0,0,
@@ -141,36 +141,35 @@ static AUTHORITY_INFO_ACCESS *v2i_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *metho
         int i, objlen;
         char *objtmp, *ptmp;
         if(!(ainfo = sk_ACCESS_DESCRIPTION_new_null())) {
-                X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,ERR_R_MALLOC_FAILURE);
+                X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         for(i = 0; i < sk_CONF_VALUE_num(nval); i++) {
                 cnf = sk_CONF_VALUE_value(nval, i);
                 if(!(acc = ACCESS_DESCRIPTION_new())
                         || !sk_ACCESS_DESCRIPTION_push(ainfo, acc)) {
-                        X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,ERR_R_MALLOC_FAILURE);
+                        X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
                 ptmp = strchr(cnf->name, ';');
                 if(!ptmp) {
-                        X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,X509V3_R_INVALID_SYNTAX);
+                        X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,X509V3_R_INVALID_SYNTAX);
                         goto err;
                 }
                 objlen = ptmp - cnf->name;
                 ctmp.name = ptmp + 1;
                 ctmp.value = cnf->value;
-                GENERAL_NAME_free(acc->location);
-                if(!(acc->location = v2i_GENERAL_NAME(method, ctx, &ctmp)))
+                if(!v2i_GENERAL_NAME_ex(acc->location, method, ctx, &ctmp, 0))
                                                                  goto err; 
                 if(!(objtmp = OPENSSL_malloc(objlen + 1))) {
-                        X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,ERR_R_MALLOC_FAILURE);
+                        X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
                 strncpy(objtmp, cnf->name, objlen);
                 objtmp[objlen] = 0;
                 acc->method = OBJ_txt2obj(objtmp, 0);
                 if(!acc->method) {
-                        X509V3err(X509V3_F_V2I_ACCESS_DESCRIPTION,X509V3_R_BAD_OBJECT);
+                        X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,X509V3_R_BAD_OBJECT);
                         ERR_add_error_data(2, "value=", objtmp);
                         OPENSSL_free(objtmp);
                         goto err;
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_int.c b/src/lib/libssl/src/crypto/x509v3/v3_int.c
index 7a43b4717b..9a48dc1508 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_int.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_int.c
@@ -60,17 +60,30 @@
 #include "cryptlib.h"
 #include <openssl/x509v3.h>
 
-X509V3_EXT_METHOD v3_crl_num = { 
+const X509V3_EXT_METHOD v3_crl_num = { 
         NID_crl_number, 0, ASN1_ITEM_ref(ASN1_INTEGER),
         0,0,0,0,
         (X509V3_EXT_I2S)i2s_ASN1_INTEGER,
         0,
         0,0,0,0, NULL};
 
-X509V3_EXT_METHOD v3_delta_crl = { 
+const X509V3_EXT_METHOD v3_delta_crl = { 
         NID_delta_crl, 0, ASN1_ITEM_ref(ASN1_INTEGER),
         0,0,0,0,
         (X509V3_EXT_I2S)i2s_ASN1_INTEGER,
         0,
         0,0,0,0, NULL};
 
+static void * s2i_asn1_int(X509V3_EXT_METHOD *meth, X509V3_CTX *ctx, char *value)
+        {
+        return s2i_ASN1_INTEGER(meth, value);
+        }
+
+const X509V3_EXT_METHOD v3_inhibit_anyp = { 
+        NID_inhibit_any_policy, 0, ASN1_ITEM_ref(ASN1_INTEGER),
+        0,0,0,0,
+        (X509V3_EXT_I2S)i2s_ASN1_INTEGER,
+        (X509V3_EXT_S2I)s2i_asn1_int,
+        0,0,0,0, NULL};
+
+
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_lib.c b/src/lib/libssl/src/crypto/x509v3/v3_lib.c
index ca5a4a4a57..f3015ea610 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_lib.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_lib.c
@@ -162,7 +162,8 @@ int X509V3_add_standard_extensions(void)
 void *X509V3_EXT_d2i(X509_EXTENSION *ext)
 {
         X509V3_EXT_METHOD *method;
-        unsigned char *p;
+        const unsigned char *p;
+
         if(!(method = X509V3_EXT_get(ext))) return NULL;
         p = ext->value->data;
         if(method->it) return ASN1_item_d2i(NULL, &p, ext->value->length, ASN1_ITEM_ptr(method->it));
@@ -276,7 +277,7 @@ int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value,
         ext = X509V3_EXT_i2d(nid, crit, value);
 
         if(!ext) {
-                X509V3err(X509V3_F_X509V3_ADD_I2D, X509V3_R_ERROR_CREATING_EXTENSION);
+                X509V3err(X509V3_F_X509V3_ADD1_I2D, X509V3_R_ERROR_CREATING_EXTENSION);
                 return 0;
         }
 
@@ -295,7 +296,7 @@ int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value,
 
         err:
         if(!(flags & X509V3_ADD_SILENT))
-                X509V3err(X509V3_F_X509V3_ADD_I2D, errcode);
+                X509V3err(X509V3_F_X509V3_ADD1_I2D, errcode);
         return 0;
 }
 
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_ocsp.c b/src/lib/libssl/src/crypto/x509v3/v3_ocsp.c
index 21badc13f9..62aac06335 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_ocsp.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_ocsp.c
@@ -74,15 +74,15 @@ static int i2r_object(X509V3_EXT_METHOD *method, void *obj, BIO *out, int indent
 
 static void *ocsp_nonce_new(void);
 static int i2d_ocsp_nonce(void *a, unsigned char **pp);
-static void *d2i_ocsp_nonce(void *a, unsigned char **pp, long length);
+static void *d2i_ocsp_nonce(void *a, const unsigned char **pp, long length);
 static void ocsp_nonce_free(void *a);
 static int i2r_ocsp_nonce(X509V3_EXT_METHOD *method, void *nonce, BIO *out, int indent);
 
 static int i2r_ocsp_nocheck(X509V3_EXT_METHOD *method, void *nocheck, BIO *out, int indent);
-static void *s2i_ocsp_nocheck(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str);
+static void *s2i_ocsp_nocheck(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, const char *str);
 static int i2r_ocsp_serviceloc(X509V3_EXT_METHOD *method, void *in, BIO *bp, int ind);
 
-X509V3_EXT_METHOD v3_ocsp_crlid = {
+const X509V3_EXT_METHOD v3_ocsp_crlid = {
         NID_id_pkix_OCSP_CrlID, 0, ASN1_ITEM_ref(OCSP_CRLID),
         0,0,0,0,
         0,0,
@@ -91,7 +91,7 @@ X509V3_EXT_METHOD v3_ocsp_crlid = {
         NULL
 };
 
-X509V3_EXT_METHOD v3_ocsp_acutoff = {
+const X509V3_EXT_METHOD v3_ocsp_acutoff = {
         NID_id_pkix_OCSP_archiveCutoff, 0, ASN1_ITEM_ref(ASN1_GENERALIZEDTIME),
         0,0,0,0,
         0,0,
@@ -100,7 +100,7 @@ X509V3_EXT_METHOD v3_ocsp_acutoff = {
         NULL
 };
 
-X509V3_EXT_METHOD v3_crl_invdate = {
+const X509V3_EXT_METHOD v3_crl_invdate = {
         NID_invalidity_date, 0, ASN1_ITEM_ref(ASN1_GENERALIZEDTIME),
         0,0,0,0,
         0,0,
@@ -109,7 +109,7 @@ X509V3_EXT_METHOD v3_crl_invdate = {
         NULL
 };
 
-X509V3_EXT_METHOD v3_crl_hold = {
+const X509V3_EXT_METHOD v3_crl_hold = {
         NID_hold_instruction_code, 0, ASN1_ITEM_ref(ASN1_OBJECT),
         0,0,0,0,
         0,0,
@@ -118,7 +118,7 @@ X509V3_EXT_METHOD v3_crl_hold = {
         NULL
 };
 
-X509V3_EXT_METHOD v3_ocsp_nonce = {
+const X509V3_EXT_METHOD v3_ocsp_nonce = {
         NID_id_pkix_OCSP_Nonce, 0, NULL,
         ocsp_nonce_new,
         ocsp_nonce_free,
@@ -130,7 +130,7 @@ X509V3_EXT_METHOD v3_ocsp_nonce = {
         NULL
 };
 
-X509V3_EXT_METHOD v3_ocsp_nocheck = {
+const X509V3_EXT_METHOD v3_ocsp_nocheck = {
         NID_id_pkix_OCSP_noCheck, 0, ASN1_ITEM_ref(ASN1_NULL),
         0,0,0,0,
         0,s2i_ocsp_nocheck,
@@ -139,7 +139,7 @@ X509V3_EXT_METHOD v3_ocsp_nocheck = {
         NULL
 };
 
-X509V3_EXT_METHOD v3_ocsp_serviceloc = {
+const X509V3_EXT_METHOD v3_ocsp_serviceloc = {
         NID_id_pkix_OCSP_serviceLocator, 0, ASN1_ITEM_ref(OCSP_SERVICELOC),
         0,0,0,0,
         0,0,
@@ -208,7 +208,7 @@ static int i2d_ocsp_nonce(void *a, unsigned char **pp)
         return os->length;
 }
 
-static void *d2i_ocsp_nonce(void *a, unsigned char **pp, long length)
+static void *d2i_ocsp_nonce(void *a, const unsigned char **pp, long length)
 {
         ASN1_OCTET_STRING *os, **pos;
         pos = a;
@@ -246,7 +246,7 @@ static int i2r_ocsp_nocheck(X509V3_EXT_METHOD *method, void *nocheck, BIO *out,
         return 1;
 }
 
-static void *s2i_ocsp_nocheck(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str)
+static void *s2i_ocsp_nocheck(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, const char *str)
 {
         return ASN1_NULL_new();
 }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_pku.c b/src/lib/libssl/src/crypto/x509v3/v3_pku.c
index 49a2e4697a..5c4626e89b 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_pku.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_pku.c
@@ -66,7 +66,7 @@ static int i2r_PKEY_USAGE_PERIOD(X509V3_EXT_METHOD *method, PKEY_USAGE_PERIOD *u
 /*
 static PKEY_USAGE_PERIOD *v2i_PKEY_USAGE_PERIOD(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
 */
-X509V3_EXT_METHOD v3_pkey_usage_period = {
+const X509V3_EXT_METHOD v3_pkey_usage_period = {
 NID_private_key_usage_period, 0, ASN1_ITEM_ref(PKEY_USAGE_PERIOD),
 0,0,0,0,
 0,0,0,0,
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_prn.c b/src/lib/libssl/src/crypto/x509v3/v3_prn.c
index 5d268eb768..20bd9bda19 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_prn.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_prn.c
@@ -109,10 +109,11 @@ int X509V3_EXT_print(BIO *out, X509_EXTENSION *ext, unsigned long flag, int inde
 {
         void *ext_str = NULL;
         char *value = NULL;
-        unsigned char *p;
+        const unsigned char *p;
         X509V3_EXT_METHOD *method;      
         STACK_OF(CONF_VALUE) *nval = NULL;
         int ok = 1;
+
         if(!(method = X509V3_EXT_get(ext)))
                 return unknown_ext_print(out, ext, flag, indent, 0);
         p = ext->value->data;
@@ -182,7 +183,7 @@ int X509V3_extensions_print(BIO *bp, char *title, STACK_OF(X509_EXTENSION) *exts
                 obj=X509_EXTENSION_get_object(ex);
                 i2a_ASN1_OBJECT(bp,obj);
                 j=X509_EXTENSION_get_critical(ex);
-                if (BIO_printf(bp,": %s\n",j?"critical":"","") <= 0)
+                if (BIO_printf(bp,": %s\n",j?"critical":"") <= 0)
                         return 0;
                 if(!X509V3_EXT_print(bp, ex, flag, indent + 4))
                         {
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_purp.c b/src/lib/libssl/src/crypto/x509v3/v3_purp.c
index bbdf6da493..b2f5cdfa05 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_purp.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_purp.c
@@ -139,7 +139,7 @@ int X509_PURPOSE_get_count(void)
 X509_PURPOSE * X509_PURPOSE_get0(int idx)
 {
         if(idx < 0) return NULL;
-        if(idx < X509_PURPOSE_COUNT) return xstandard + idx;
+        if(idx < (int)X509_PURPOSE_COUNT) return xstandard + idx;
         return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);
 }
 
@@ -239,7 +239,7 @@ static void xptable_free(X509_PURPOSE *p)
 
 void X509_PURPOSE_cleanup(void)
 {
-        int i;
+        unsigned int i;
         sk_X509_PURPOSE_pop_free(xptable, xptable_free);
         for(i = 0; i < X509_PURPOSE_COUNT; i++) xptable_free(xstandard + i);
         xptable = NULL;
@@ -285,7 +285,12 @@ int X509_supported_extension(X509_EXTENSION *ex)
                 NID_key_usage,          /* 83 */
                 NID_subject_alt_name,   /* 85 */
                 NID_basic_constraints,  /* 87 */
+                NID_certificate_policies, /* 89 */
                 NID_ext_key_usage,      /* 126 */
+#ifndef OPENSSL_NO_RFC3779
+                NID_sbgp_ipAddrBlock,   /* 290 */
+                NID_sbgp_autonomousSysNum, /* 291 */
+#endif
                 NID_proxyCertInfo       /* 661 */
         };
 
@@ -343,6 +348,10 @@ static void x509v3_cache_extensions(X509 *x)
                     || X509_get_ext_by_NID(x, NID_issuer_alt_name, 0) >= 0) {
                         x->ex_flags |= EXFLAG_INVALID;
                 }
+                if (pci->pcPathLengthConstraint) {
+                        x->ex_pcpathlen =
+                                ASN1_INTEGER_get(pci->pcPathLengthConstraint);
+                } else x->ex_pcpathlen = -1;
                 PROXY_CERT_INFO_EXTENSION_free(pci);
                 x->ex_flags |= EXFLAG_PROXY;
         }
@@ -406,6 +415,11 @@ static void x509v3_cache_extensions(X509 *x)
         }
         x->skid =X509_get_ext_d2i(x, NID_subject_key_identifier, NULL, NULL);
         x->akid =X509_get_ext_d2i(x, NID_authority_key_identifier, NULL, NULL);
+#ifndef OPENSSL_NO_RFC3779
+        x->rfc3779_addr =X509_get_ext_d2i(x, NID_sbgp_ipAddrBlock, NULL, NULL);
+        x->rfc3779_asid =X509_get_ext_d2i(x, NID_sbgp_autonomousSysNum,
+                                          NULL, NULL);
+#endif
         for (i = 0; i < X509_get_ext_count(x); i++)
                 {
                 ex = X509_get_ext(x, i);
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_skey.c b/src/lib/libssl/src/crypto/x509v3/v3_skey.c
index c0f044ac1b..da0a3558f6 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_skey.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_skey.c
@@ -62,7 +62,7 @@
 #include <openssl/x509v3.h>
 
 static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *str);
-X509V3_EXT_METHOD v3_skey_id = { 
+const X509V3_EXT_METHOD v3_skey_id = { 
 NID_subject_key_identifier, 0, ASN1_ITEM_ref(ASN1_OCTET_STRING),
 0,0,0,0,
 (X509V3_EXT_I2S)i2s_ASN1_OCTET_STRING,
@@ -109,14 +109,14 @@ static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method,
         if(strcmp(str, "hash")) return s2i_ASN1_OCTET_STRING(method, ctx, str);
 
         if(!(oct = M_ASN1_OCTET_STRING_new())) {
-                X509V3err(X509V3_F_S2I_S2I_SKEY_ID,ERR_R_MALLOC_FAILURE);
+                X509V3err(X509V3_F_S2I_SKEY_ID,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
 
         if(ctx && (ctx->flags == CTX_TEST)) return oct;
 
         if(!ctx || (!ctx->subject_req && !ctx->subject_cert)) {
-                X509V3err(X509V3_F_S2I_ASN1_SKEY_ID,X509V3_R_NO_PUBLIC_KEY);
+                X509V3err(X509V3_F_S2I_SKEY_ID,X509V3_R_NO_PUBLIC_KEY);
                 goto err;
         }
 
@@ -125,14 +125,14 @@ static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method,
         else pk = ctx->subject_cert->cert_info->key->public_key;
 
         if(!pk) {
-                X509V3err(X509V3_F_S2I_ASN1_SKEY_ID,X509V3_R_NO_PUBLIC_KEY);
+                X509V3err(X509V3_F_S2I_SKEY_ID,X509V3_R_NO_PUBLIC_KEY);
                 goto err;
         }
 
         EVP_Digest(pk->data, pk->length, pkey_dig, &diglen, EVP_sha1(), NULL);
 
         if(!M_ASN1_OCTET_STRING_set(oct, pkey_dig, diglen)) {
-                X509V3err(X509V3_F_S2I_S2I_SKEY_ID,ERR_R_MALLOC_FAILURE);
+                X509V3err(X509V3_F_S2I_SKEY_ID,ERR_R_MALLOC_FAILURE);
                 goto err;
         }
 
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_sxnet.c b/src/lib/libssl/src/crypto/x509v3/v3_sxnet.c
index d3f4ba3a72..eaea9ea01b 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_sxnet.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_sxnet.c
@@ -72,7 +72,7 @@ static int sxnet_i2r(X509V3_EXT_METHOD *method, SXNET *sx, BIO *out, int indent)
 static SXNET * sxnet_v2i(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
                                                 STACK_OF(CONF_VALUE) *nval);
 #endif
-X509V3_EXT_METHOD v3_sxnet = {
+const X509V3_EXT_METHOD v3_sxnet = {
 NID_sxnet, X509V3_EXT_MULTILINE, ASN1_ITEM_ref(SXNET),
 0,0,0,0,
 0,0,
@@ -109,7 +109,7 @@ static int sxnet_i2r(X509V3_EXT_METHOD *method, SXNET *sx, BIO *out,
         SXNETID *id;
         int i;
         v = ASN1_INTEGER_get(sx->version);
-        BIO_printf(out, "%*sVersion: %d (0x%X)", indent, "", v + 1, v);
+        BIO_printf(out, "%*sVersion: %ld (0x%lX)", indent, "", v + 1, v);
         for(i = 0; i < sk_SXNETID_num(sx->ids); i++) {
                 id = sk_SXNETID_value(sx->ids, i);
                 tmp = i2s_ASN1_INTEGER(NULL, id->zone);
@@ -154,7 +154,7 @@ int SXNET_add_id_asc(SXNET **psx, char *zone, char *user,
 {
         ASN1_INTEGER *izone = NULL;
         if(!(izone = s2i_ASN1_INTEGER(NULL, zone))) {
-                X509V3err(X509V3_F_SXNET_ADD_ASC,X509V3_R_ERROR_CONVERTING_ZONE);
+                X509V3err(X509V3_F_SXNET_ADD_ID_ASC,X509V3_R_ERROR_CONVERTING_ZONE);
                 return 0;
         }
         return SXNET_add_id_INTEGER(psx, izone, user, userlen);
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_utl.c b/src/lib/libssl/src/crypto/x509v3/v3_utl.c
index f23a8d29a0..57be441399 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_utl.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_utl.c
@@ -1,9 +1,9 @@
 /* v3_utl.c */
 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
- * project 1999.
+ * project.
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2003 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -63,6 +63,7 @@
 #include "cryptlib.h"
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
+#include <openssl/bn.h>
 
 static char *strip_spaces(char *name);
 static int sk_strcmp(const char * const *a, const char * const *b);
@@ -70,6 +71,11 @@ static STACK *get_email(X509_NAME *name, GENERAL_NAMES *gens);
 static void str_free(void *str);
 static int append_ia5(STACK **sk, ASN1_IA5STRING *email);
 
+static int ipv4_from_asc(unsigned char *v4, const char *in);
+static int ipv6_from_asc(unsigned char *v6, const char *in);
+static int ipv6_cb(const char *elem, int len, void *usr);
+static int ipv6_hex(unsigned char *out, const char *in, int inlen);
+
 /* Add a CONF_VALUE name value pair to stack */
 
 int X509V3_add_value(const char *name, const char *value,
@@ -156,11 +162,11 @@ ASN1_INTEGER *s2i_ASN1_INTEGER(X509V3_EXT_METHOD *method, char *value)
         ASN1_INTEGER *aint;
         int isneg, ishex;
         int ret;
-        bn = BN_new();
         if (!value) {
                 X509V3err(X509V3_F_S2I_ASN1_INTEGER,X509V3_R_INVALID_NULL_VALUE);
                 return 0;
         }
+        bn = BN_new();
         if (value[0] == '-') {
                 value++;
                 isneg = 1;
@@ -174,7 +180,8 @@ ASN1_INTEGER *s2i_ASN1_INTEGER(X509V3_EXT_METHOD *method, char *value)
         if (ishex) ret = BN_hex2bn(&bn, value);
         else ret = BN_dec2bn(&bn, value);
 
-        if (!ret) {
+        if (!ret || value[ret]) {
+                BN_free(bn);
                 X509V3err(X509V3_F_S2I_ASN1_INTEGER,X509V3_R_BN_DEC2BN_ERROR);
                 return 0;
         }
@@ -358,7 +365,7 @@ char *hex_to_string(unsigned char *buffer, long len)
         char *tmp, *q;
         unsigned char *p;
         int i;
-        static char hexdig[] = "0123456789ABCDEF";
+        const static char hexdig[] = "0123456789ABCDEF";
         if(!buffer || !len) return NULL;
         if(!(tmp = OPENSSL_malloc(len * 3 + 1))) {
                 X509V3err(X509V3_F_HEX_TO_STRING,ERR_R_MALLOC_FAILURE);
@@ -466,6 +473,30 @@ STACK *X509_get1_email(X509 *x)
         return ret;
 }
 
+STACK *X509_get1_ocsp(X509 *x)
+{
+        AUTHORITY_INFO_ACCESS *info;
+        STACK *ret = NULL;
+        int i;
+        info = X509_get_ext_d2i(x, NID_info_access, NULL, NULL);
+        if (!info)
+                return NULL;
+        for (i = 0; i < sk_ACCESS_DESCRIPTION_num(info); i++)
+                {
+                ACCESS_DESCRIPTION *ad = sk_ACCESS_DESCRIPTION_value(info, i);
+                if (OBJ_obj2nid(ad->method) == NID_ad_OCSP)
+                        {
+                        if (ad->location->type == GEN_URI)
+                                {
+                                if (!append_ia5(&ret, ad->location->d.uniformResourceIdentifier))
+                                        break;
+                                }
+                        }
+                }
+        AUTHORITY_INFO_ACCESS_free(info);
+        return ret;
+}
+
 STACK *X509_REQ_get1_email(X509_REQ *x)
 {
         GENERAL_NAMES *gens;
@@ -533,3 +564,305 @@ void X509_email_free(STACK *sk)
 {
         sk_pop_free(sk, str_free);
 }
+
+/* Convert IP addresses both IPv4 and IPv6 into an 
+ * OCTET STRING compatible with RFC3280.
+ */
+
+ASN1_OCTET_STRING *a2i_IPADDRESS(const char *ipasc)
+        {
+        unsigned char ipout[16];
+        ASN1_OCTET_STRING *ret;
+        int iplen;
+
+        /* If string contains a ':' assume IPv6 */
+
+        iplen = a2i_ipadd(ipout, ipasc);
+
+        if (!iplen)
+                return NULL;
+
+        ret = ASN1_OCTET_STRING_new();
+        if (!ret)
+                return NULL;
+        if (!ASN1_OCTET_STRING_set(ret, ipout, iplen))
+                {
+                ASN1_OCTET_STRING_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+ASN1_OCTET_STRING *a2i_IPADDRESS_NC(const char *ipasc)
+        {
+        ASN1_OCTET_STRING *ret = NULL;
+        unsigned char ipout[32];
+        char *iptmp = NULL, *p;
+        int iplen1, iplen2;
+        p = strchr(ipasc,'/');
+        if (!p)
+                return NULL;
+        iptmp = BUF_strdup(ipasc);
+        if (!iptmp)
+                return NULL;
+        p = iptmp + (p - ipasc);
+        *p++ = 0;
+
+        iplen1 = a2i_ipadd(ipout, iptmp);
+
+        if (!iplen1)
+                goto err;
+
+        iplen2 = a2i_ipadd(ipout + iplen1, p);
+
+        OPENSSL_free(iptmp);
+        iptmp = NULL;
+
+        if (!iplen2 || (iplen1 != iplen2))
+                goto err;
+
+        ret = ASN1_OCTET_STRING_new();
+        if (!ret)
+                goto err;
+        if (!ASN1_OCTET_STRING_set(ret, ipout, iplen1 + iplen2))
+                goto err;
+
+        return ret;
+
+        err:
+        if (iptmp)
+                OPENSSL_free(iptmp);
+        if (ret)
+                ASN1_OCTET_STRING_free(ret);
+        return NULL;
+        }
+        
+
+int a2i_ipadd(unsigned char *ipout, const char *ipasc)
+        {
+        /* If string contains a ':' assume IPv6 */
+
+        if (strchr(ipasc, ':'))
+                {
+                if (!ipv6_from_asc(ipout, ipasc))
+                        return 0;
+                return 16;
+                }
+        else
+                {
+                if (!ipv4_from_asc(ipout, ipasc))
+                        return 0;
+                return 4;
+                }
+        }
+
+static int ipv4_from_asc(unsigned char *v4, const char *in)
+        {
+        int a0, a1, a2, a3;
+        if (sscanf(in, "%d.%d.%d.%d", &a0, &a1, &a2, &a3) != 4)
+                return 0;
+        if ((a0 < 0) || (a0 > 255) || (a1 < 0) || (a1 > 255)
+                || (a2 < 0) || (a2 > 255) || (a3 < 0) || (a3 > 255))
+                return 0;
+        v4[0] = a0;
+        v4[1] = a1;
+        v4[2] = a2;
+        v4[3] = a3;
+        return 1;
+        }
+
+typedef struct {
+                /* Temporary store for IPV6 output */
+                unsigned char tmp[16];
+                /* Total number of bytes in tmp */
+                int total;
+                /* The position of a zero (corresponding to '::') */
+                int zero_pos;
+                /* Number of zeroes */
+                int zero_cnt;
+        } IPV6_STAT;
+
+
+static int ipv6_from_asc(unsigned char *v6, const char *in)
+        {
+        IPV6_STAT v6stat;
+        v6stat.total = 0;
+        v6stat.zero_pos = -1;
+        v6stat.zero_cnt = 0;
+        /* Treat the IPv6 representation as a list of values
+         * separated by ':'. The presence of a '::' will parse
+         * as one, two or three zero length elements.
+         */
+        if (!CONF_parse_list(in, ':', 0, ipv6_cb, &v6stat))
+                return 0;
+
+        /* Now for some sanity checks */
+
+        if (v6stat.zero_pos == -1)
+                {
+                /* If no '::' must have exactly 16 bytes */
+                if (v6stat.total != 16)
+                        return 0;
+                }
+        else 
+                {
+                /* If '::' must have less than 16 bytes */
+                if (v6stat.total == 16)
+                        return 0;
+                /* More than three zeroes is an error */
+                if (v6stat.zero_cnt > 3)
+                        return 0;
+                /* Can only have three zeroes if nothing else present */
+                else if (v6stat.zero_cnt == 3)
+                        {
+                        if (v6stat.total > 0)
+                                return 0;
+                        }
+                /* Can only have two zeroes if at start or end */
+                else if (v6stat.zero_cnt == 2)
+                        {
+                        if ((v6stat.zero_pos != 0)
+                                && (v6stat.zero_pos != v6stat.total))
+                                return 0;
+                        }
+                else 
+                /* Can only have one zero if *not* start or end */
+                        {
+                        if ((v6stat.zero_pos == 0)
+                                || (v6stat.zero_pos == v6stat.total))
+                                return 0;
+                        }
+                }
+
+        /* Format result */
+
+        /* Copy initial part */
+        if (v6stat.zero_pos > 0)
+                memcpy(v6, v6stat.tmp, v6stat.zero_pos);
+        /* Zero middle */
+        if (v6stat.total != 16)
+                memset(v6 + v6stat.zero_pos, 0, 16 - v6stat.total);
+        /* Copy final part */
+        if (v6stat.total != v6stat.zero_pos)
+                memcpy(v6 + v6stat.zero_pos + 16 - v6stat.total,
+                        v6stat.tmp + v6stat.zero_pos,
+                        v6stat.total - v6stat.zero_pos);
+
+        return 1;
+        }
+
+static int ipv6_cb(const char *elem, int len, void *usr)
+        {
+        IPV6_STAT *s = usr;
+        /* Error if 16 bytes written */
+        if (s->total == 16)
+                return 0;
+        if (len == 0)
+                {
+                /* Zero length element, corresponds to '::' */
+                if (s->zero_pos == -1)
+                        s->zero_pos = s->total;
+                /* If we've already got a :: its an error */
+                else if (s->zero_pos != s->total)
+                        return 0;
+                s->zero_cnt++;
+                }
+        else 
+                {
+                /* If more than 4 characters could be final a.b.c.d form */
+                if (len > 4)
+                        {
+                        /* Need at least 4 bytes left */
+                        if (s->total > 12)
+                                return 0;
+                        /* Must be end of string */
+                        if (elem[len])
+                                return 0;
+                        if (!ipv4_from_asc(s->tmp + s->total, elem))
+                                return 0;
+                        s->total += 4;
+                        }
+                else
+                        {
+                        if (!ipv6_hex(s->tmp + s->total, elem, len))
+                                return 0;
+                        s->total += 2;
+                        }
+                }
+        return 1;
+        }
+
+/* Convert a string of up to 4 hex digits into the corresponding
+ * IPv6 form.
+ */
+
+static int ipv6_hex(unsigned char *out, const char *in, int inlen)
+        {
+        unsigned char c;
+        unsigned int num = 0;
+        if (inlen > 4)
+                return 0;
+        while(inlen--)
+                {
+                c = *in++;
+                num <<= 4;
+                if ((c >= '0') && (c <= '9'))
+                        num |= c - '0';
+                else if ((c >= 'A') && (c <= 'F'))
+                        num |= c - 'A' + 10;
+                else if ((c >= 'a') && (c <= 'f'))
+                        num |=  c - 'a' + 10;
+                else
+                        return 0;
+                }
+        out[0] = num >> 8;
+        out[1] = num & 0xff;
+        return 1;
+        }
+
+
+int X509V3_NAME_from_section(X509_NAME *nm, STACK_OF(CONF_VALUE)*dn_sk,
+                                                unsigned long chtype)
+        {
+        CONF_VALUE *v;
+        int i, mval;
+        char *p, *type;
+        if (!nm)
+                return 0;
+
+        for (i = 0; i < sk_CONF_VALUE_num(dn_sk); i++)
+                {
+                v=sk_CONF_VALUE_value(dn_sk,i);
+                type=v->name;
+                /* Skip past any leading X. X: X, etc to allow for
+                 * multiple instances 
+                 */
+                for(p = type; *p ; p++) 
+#ifndef CHARSET_EBCDIC
+                        if ((*p == ':') || (*p == ',') || (*p == '.'))
+#else
+                        if ((*p == os_toascii[':']) || (*p == os_toascii[',']) || (*p == os_toascii['.']))
+#endif
+                                {
+                                p++;
+                                if(*p) type = p;
+                                break;
+                                }
+#ifndef CHARSET_EBCDIC
+                if (*type == '+')
+#else
+                if (*type == os_toascii['+'])
+#endif
+                        {
+                        mval = -1;
+                        type++;
+                        }
+                else
+                        mval = 0;
+                if (!X509_NAME_add_entry_by_txt(nm,type, chtype,
+                                (unsigned char *) v->value,-1,-1,mval))
+                                        return 0;
+
+                }
+        return 1;
+        }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3err.c b/src/lib/libssl/src/crypto/x509v3/v3err.c
index e1edaf5248..d538ad8b80 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3err.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3err.c
@@ -70,10 +70,15 @@
 
 static ERR_STRING_DATA X509V3_str_functs[]=
         {
+{ERR_FUNC(X509V3_F_ASIDENTIFIERCHOICE_CANONIZE),        "ASIDENTIFIERCHOICE_CANONIZE"},
+{ERR_FUNC(X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL),    "ASIDENTIFIERCHOICE_IS_CANONICAL"},
 {ERR_FUNC(X509V3_F_COPY_EMAIL), "COPY_EMAIL"},
 {ERR_FUNC(X509V3_F_COPY_ISSUER),        "COPY_ISSUER"},
+{ERR_FUNC(X509V3_F_DO_DIRNAME), "DO_DIRNAME"},
 {ERR_FUNC(X509V3_F_DO_EXT_CONF),        "DO_EXT_CONF"},
 {ERR_FUNC(X509V3_F_DO_EXT_I2D), "DO_EXT_I2D"},
+{ERR_FUNC(X509V3_F_DO_EXT_NCONF),       "DO_EXT_NCONF"},
+{ERR_FUNC(X509V3_F_DO_I2V_NAME_CONSTRAINTS),    "DO_I2V_NAME_CONSTRAINTS"},
 {ERR_FUNC(X509V3_F_HEX_TO_STRING),      "hex_to_string"},
 {ERR_FUNC(X509V3_F_I2S_ASN1_ENUMERATED),        "i2s_ASN1_ENUMERATED"},
 {ERR_FUNC(X509V3_F_I2S_ASN1_IA5STRING), "I2S_ASN1_IA5STRING"},
@@ -82,34 +87,46 @@ static ERR_STRING_DATA X509V3_str_functs[]=
 {ERR_FUNC(X509V3_F_NOTICE_SECTION),     "NOTICE_SECTION"},
 {ERR_FUNC(X509V3_F_NREF_NOS),   "NREF_NOS"},
 {ERR_FUNC(X509V3_F_POLICY_SECTION),     "POLICY_SECTION"},
+{ERR_FUNC(X509V3_F_PROCESS_PCI_VALUE),  "PROCESS_PCI_VALUE"},
 {ERR_FUNC(X509V3_F_R2I_CERTPOL),        "R2I_CERTPOL"},
 {ERR_FUNC(X509V3_F_R2I_PCI),    "R2I_PCI"},
 {ERR_FUNC(X509V3_F_S2I_ASN1_IA5STRING), "S2I_ASN1_IA5STRING"},
 {ERR_FUNC(X509V3_F_S2I_ASN1_INTEGER),   "s2i_ASN1_INTEGER"},
 {ERR_FUNC(X509V3_F_S2I_ASN1_OCTET_STRING),      "s2i_ASN1_OCTET_STRING"},
 {ERR_FUNC(X509V3_F_S2I_ASN1_SKEY_ID),   "S2I_ASN1_SKEY_ID"},
-{ERR_FUNC(X509V3_F_S2I_S2I_SKEY_ID),    "S2I_S2I_SKEY_ID"},
+{ERR_FUNC(X509V3_F_S2I_SKEY_ID),        "S2I_SKEY_ID"},
 {ERR_FUNC(X509V3_F_STRING_TO_HEX),      "string_to_hex"},
-{ERR_FUNC(X509V3_F_SXNET_ADD_ASC),      "SXNET_ADD_ASC"},
+{ERR_FUNC(X509V3_F_SXNET_ADD_ID_ASC),   "SXNET_add_id_asc"},
 {ERR_FUNC(X509V3_F_SXNET_ADD_ID_INTEGER),       "SXNET_add_id_INTEGER"},
 {ERR_FUNC(X509V3_F_SXNET_ADD_ID_ULONG), "SXNET_add_id_ulong"},
 {ERR_FUNC(X509V3_F_SXNET_GET_ID_ASC),   "SXNET_get_id_asc"},
 {ERR_FUNC(X509V3_F_SXNET_GET_ID_ULONG), "SXNET_get_id_ulong"},
-{ERR_FUNC(X509V3_F_V2I_ACCESS_DESCRIPTION),     "V2I_ACCESS_DESCRIPTION"},
-{ERR_FUNC(X509V3_F_V2I_ASN1_BIT_STRING),        "V2I_ASN1_BIT_STRING"},
+{ERR_FUNC(X509V3_F_V2I_ASIDENTIFIERS),  "V2I_ASIDENTIFIERS"},
+{ERR_FUNC(X509V3_F_V2I_ASN1_BIT_STRING),        "v2i_ASN1_BIT_STRING"},
+{ERR_FUNC(X509V3_F_V2I_AUTHORITY_INFO_ACCESS),  "V2I_AUTHORITY_INFO_ACCESS"},
 {ERR_FUNC(X509V3_F_V2I_AUTHORITY_KEYID),        "V2I_AUTHORITY_KEYID"},
 {ERR_FUNC(X509V3_F_V2I_BASIC_CONSTRAINTS),      "V2I_BASIC_CONSTRAINTS"},
 {ERR_FUNC(X509V3_F_V2I_CRLD),   "V2I_CRLD"},
-{ERR_FUNC(X509V3_F_V2I_EXT_KU), "V2I_EXT_KU"},
-{ERR_FUNC(X509V3_F_V2I_GENERAL_NAME),   "v2i_GENERAL_NAME"},
+{ERR_FUNC(X509V3_F_V2I_EXTENDED_KEY_USAGE),     "V2I_EXTENDED_KEY_USAGE"},
 {ERR_FUNC(X509V3_F_V2I_GENERAL_NAMES),  "v2i_GENERAL_NAMES"},
+{ERR_FUNC(X509V3_F_V2I_GENERAL_NAME_EX),        "v2i_GENERAL_NAME_ex"},
+{ERR_FUNC(X509V3_F_V2I_IPADDRBLOCKS),   "V2I_IPADDRBLOCKS"},
+{ERR_FUNC(X509V3_F_V2I_ISSUER_ALT),     "V2I_ISSUER_ALT"},
+{ERR_FUNC(X509V3_F_V2I_NAME_CONSTRAINTS),       "V2I_NAME_CONSTRAINTS"},
+{ERR_FUNC(X509V3_F_V2I_POLICY_CONSTRAINTS),     "V2I_POLICY_CONSTRAINTS"},
+{ERR_FUNC(X509V3_F_V2I_POLICY_MAPPINGS),        "V2I_POLICY_MAPPINGS"},
+{ERR_FUNC(X509V3_F_V2I_SUBJECT_ALT),    "V2I_SUBJECT_ALT"},
+{ERR_FUNC(X509V3_F_V3_ADDR_VALIDATE_PATH_INTERNAL),     "V3_ADDR_VALIDATE_PATH_INTERNAL"},
 {ERR_FUNC(X509V3_F_V3_GENERIC_EXTENSION),       "V3_GENERIC_EXTENSION"},
-{ERR_FUNC(X509V3_F_X509V3_ADD_I2D),     "X509V3_ADD_I2D"},
+{ERR_FUNC(X509V3_F_X509V3_ADD1_I2D),    "X509V3_add1_i2d"},
 {ERR_FUNC(X509V3_F_X509V3_ADD_VALUE),   "X509V3_add_value"},
 {ERR_FUNC(X509V3_F_X509V3_EXT_ADD),     "X509V3_EXT_add"},
 {ERR_FUNC(X509V3_F_X509V3_EXT_ADD_ALIAS),       "X509V3_EXT_add_alias"},
 {ERR_FUNC(X509V3_F_X509V3_EXT_CONF),    "X509V3_EXT_conf"},
 {ERR_FUNC(X509V3_F_X509V3_EXT_I2D),     "X509V3_EXT_i2d"},
+{ERR_FUNC(X509V3_F_X509V3_EXT_NCONF),   "X509V3_EXT_nconf"},
+{ERR_FUNC(X509V3_F_X509V3_GET_SECTION), "X509V3_get_section"},
+{ERR_FUNC(X509V3_F_X509V3_GET_STRING),  "X509V3_get_string"},
 {ERR_FUNC(X509V3_F_X509V3_GET_VALUE_BOOL),      "X509V3_get_value_bool"},
 {ERR_FUNC(X509V3_F_X509V3_PARSE_LIST),  "X509V3_parse_list"},
 {ERR_FUNC(X509V3_F_X509_PURPOSE_ADD),   "X509_PURPOSE_add"},
@@ -123,6 +140,7 @@ static ERR_STRING_DATA X509V3_str_reasons[]=
 {ERR_REASON(X509V3_R_BAD_OBJECT)         ,"bad object"},
 {ERR_REASON(X509V3_R_BN_DEC2BN_ERROR)    ,"bn dec2bn error"},
 {ERR_REASON(X509V3_R_BN_TO_ASN1_INTEGER_ERROR),"bn to asn1 integer error"},
+{ERR_REASON(X509V3_R_DIRNAME_ERROR)      ,"dirname error"},
 {ERR_REASON(X509V3_R_DUPLICATE_ZONE_ID)  ,"duplicate zone id"},
 {ERR_REASON(X509V3_R_ERROR_CONVERTING_ZONE),"error converting zone"},
 {ERR_REASON(X509V3_R_ERROR_CREATING_EXTENSION),"error creating extension"},
@@ -133,10 +151,15 @@ static ERR_STRING_DATA X509V3_str_reasons[]=
 {ERR_REASON(X509V3_R_EXTENSION_NOT_FOUND),"extension not found"},
 {ERR_REASON(X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED),"extension setting not supported"},
 {ERR_REASON(X509V3_R_EXTENSION_VALUE_ERROR),"extension value error"},
+{ERR_REASON(X509V3_R_ILLEGAL_EMPTY_EXTENSION),"illegal empty extension"},
 {ERR_REASON(X509V3_R_ILLEGAL_HEX_DIGIT)  ,"illegal hex digit"},
 {ERR_REASON(X509V3_R_INCORRECT_POLICY_SYNTAX_TAG),"incorrect policy syntax tag"},
+{ERR_REASON(X509V3_R_INVALID_ASNUMBER)   ,"invalid asnumber"},
+{ERR_REASON(X509V3_R_INVALID_ASRANGE)    ,"invalid asrange"},
 {ERR_REASON(X509V3_R_INVALID_BOOLEAN_STRING),"invalid boolean string"},
 {ERR_REASON(X509V3_R_INVALID_EXTENSION_STRING),"invalid extension string"},
+{ERR_REASON(X509V3_R_INVALID_INHERITANCE),"invalid inheritance"},
+{ERR_REASON(X509V3_R_INVALID_IPADDRESS)  ,"invalid ipaddress"},
 {ERR_REASON(X509V3_R_INVALID_NAME)       ,"invalid name"},
 {ERR_REASON(X509V3_R_INVALID_NULL_ARGUMENT),"invalid null argument"},
 {ERR_REASON(X509V3_R_INVALID_NULL_NAME)  ,"invalid null name"},
@@ -146,9 +169,9 @@ static ERR_STRING_DATA X509V3_str_reasons[]=
 {ERR_REASON(X509V3_R_INVALID_OBJECT_IDENTIFIER),"invalid object identifier"},
 {ERR_REASON(X509V3_R_INVALID_OPTION)     ,"invalid option"},
 {ERR_REASON(X509V3_R_INVALID_POLICY_IDENTIFIER),"invalid policy identifier"},
-{ERR_REASON(X509V3_R_INVALID_PROXY_POLICY_IDENTIFIER),"invalid proxy policy identifier"},
 {ERR_REASON(X509V3_R_INVALID_PROXY_POLICY_SETTING),"invalid proxy policy setting"},
 {ERR_REASON(X509V3_R_INVALID_PURPOSE)    ,"invalid purpose"},
+{ERR_REASON(X509V3_R_INVALID_SAFI)       ,"invalid safi"},
 {ERR_REASON(X509V3_R_INVALID_SECTION)    ,"invalid section"},
 {ERR_REASON(X509V3_R_INVALID_SYNTAX)     ,"invalid syntax"},
 {ERR_REASON(X509V3_R_ISSUER_DECODE_ERROR),"issuer decode error"},
@@ -162,12 +185,14 @@ static ERR_STRING_DATA X509V3_str_reasons[]=
 {ERR_REASON(X509V3_R_NO_PUBLIC_KEY)      ,"no public key"},
 {ERR_REASON(X509V3_R_NO_SUBJECT_DETAILS) ,"no subject details"},
 {ERR_REASON(X509V3_R_ODD_NUMBER_OF_DIGITS),"odd number of digits"},
+{ERR_REASON(X509V3_R_OPERATION_NOT_DEFINED),"operation not defined"},
+{ERR_REASON(X509V3_R_OTHERNAME_ERROR)    ,"othername error"},
 {ERR_REASON(X509V3_R_POLICY_LANGUAGE_ALREADTY_DEFINED),"policy language alreadty defined"},
 {ERR_REASON(X509V3_R_POLICY_PATH_LENGTH) ,"policy path length"},
 {ERR_REASON(X509V3_R_POLICY_PATH_LENGTH_ALREADTY_DEFINED),"policy path length alreadty defined"},
-{ERR_REASON(X509V3_R_POLICY_SYNTAX_NOT)  ,"policy syntax not"},
 {ERR_REASON(X509V3_R_POLICY_SYNTAX_NOT_CURRENTLY_SUPPORTED),"policy syntax not currently supported"},
 {ERR_REASON(X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY),"policy when proxy language requires no policy"},
+{ERR_REASON(X509V3_R_SECTION_NOT_FOUND)  ,"section not found"},
 {ERR_REASON(X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS),"unable to get issuer details"},
 {ERR_REASON(X509V3_R_UNABLE_TO_GET_ISSUER_KEYID),"unable to get issuer keyid"},
 {ERR_REASON(X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT),"unknown bit string argument"},
@@ -183,15 +208,12 @@ static ERR_STRING_DATA X509V3_str_reasons[]=
 
 void ERR_load_X509V3_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(X509V3_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,X509V3_str_functs);
                 ERR_load_strings(0,X509V3_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/crypto/x509v3/x509v3.h b/src/lib/libssl/src/crypto/x509v3/x509v3.h
index e6d91251c2..db2b0482c1 100644
--- a/src/lib/libssl/src/crypto/x509v3/x509v3.h
+++ b/src/lib/libssl/src/crypto/x509v3/x509v3.h
@@ -3,7 +3,7 @@
  * project 1999.
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -74,14 +74,14 @@ struct v3_ext_ctx;
 
 typedef void * (*X509V3_EXT_NEW)(void);
 typedef void (*X509V3_EXT_FREE)(void *);
-typedef void * (*X509V3_EXT_D2I)(void *, unsigned char ** , long);
+typedef void * (*X509V3_EXT_D2I)(void *, const unsigned char ** , long);
 typedef int (*X509V3_EXT_I2D)(void *, unsigned char **);
 typedef STACK_OF(CONF_VALUE) * (*X509V3_EXT_I2V)(struct v3_ext_method *method, void *ext, STACK_OF(CONF_VALUE) *extlist);
 typedef void * (*X509V3_EXT_V2I)(struct v3_ext_method *method, struct v3_ext_ctx *ctx, STACK_OF(CONF_VALUE) *values);
 typedef char * (*X509V3_EXT_I2S)(struct v3_ext_method *method, void *ext);
-typedef void * (*X509V3_EXT_S2I)(struct v3_ext_method *method, struct v3_ext_ctx *ctx, char *str);
+typedef void * (*X509V3_EXT_S2I)(struct v3_ext_method *method, struct v3_ext_ctx *ctx, const char *str);
 typedef int (*X509V3_EXT_I2R)(struct v3_ext_method *method, void *ext, BIO *out, int indent);
-typedef void * (*X509V3_EXT_R2I)(struct v3_ext_method *method, struct v3_ext_ctx *ctx, char *str);
+typedef void * (*X509V3_EXT_R2I)(struct v3_ext_method *method, struct v3_ext_ctx *ctx, const char *str);
 
 /* V3 extension structure */
 
@@ -132,7 +132,6 @@ void *db;
 };
 
 typedef struct v3_ext_method X509V3_EXT_METHOD;
-typedef struct v3_ext_ctx X509V3_CTX;
 
 DECLARE_STACK_OF(X509V3_EXT_METHOD)
 
@@ -287,6 +286,33 @@ typedef STACK_OF(POLICYINFO) CERTIFICATEPOLICIES;
 DECLARE_STACK_OF(POLICYINFO)
 DECLARE_ASN1_SET_OF(POLICYINFO)
 
+typedef struct POLICY_MAPPING_st {
+        ASN1_OBJECT *issuerDomainPolicy;
+        ASN1_OBJECT *subjectDomainPolicy;
+} POLICY_MAPPING;
+
+DECLARE_STACK_OF(POLICY_MAPPING)
+
+typedef STACK_OF(POLICY_MAPPING) POLICY_MAPPINGS;
+
+typedef struct GENERAL_SUBTREE_st {
+        GENERAL_NAME *base;
+        ASN1_INTEGER *minimum;
+        ASN1_INTEGER *maximum;
+} GENERAL_SUBTREE;
+
+DECLARE_STACK_OF(GENERAL_SUBTREE)
+
+typedef struct NAME_CONSTRAINTS_st {
+        STACK_OF(GENERAL_SUBTREE) *permittedSubtrees;
+        STACK_OF(GENERAL_SUBTREE) *excludedSubtrees;
+} NAME_CONSTRAINTS;
+
+typedef struct POLICY_CONSTRAINTS_st {
+        ASN1_INTEGER *requireExplicitPolicy;
+        ASN1_INTEGER *inhibitPolicyMapping;
+} POLICY_CONSTRAINTS;
+
 /* Proxy certificate structures, see RFC 3820 */
 typedef struct PROXY_POLICY_st
         {
@@ -344,6 +370,8 @@ DECLARE_ASN1_FUNCTIONS(PROXY_CERT_INFO_EXTENSION)
 #define EXFLAG_CRITICAL         0x200
 #define EXFLAG_PROXY            0x400
 
+#define EXFLAG_INVALID_POLICY   0x400
+
 #define KU_DIGITAL_SIGNATURE    0x0080
 #define KU_NON_REPUDIATION      0x0040
 #define KU_KEY_ENCIPHERMENT     0x0020
@@ -442,6 +470,13 @@ DECLARE_ASN1_FUNCTIONS(PKEY_USAGE_PERIOD)
 
 DECLARE_ASN1_FUNCTIONS(GENERAL_NAME)
 
+
+ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
+                                X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
+STACK_OF(CONF_VALUE) *i2v_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
+                                ASN1_BIT_STRING *bits,
+                                STACK_OF(CONF_VALUE) *extlist);
+
 STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method, GENERAL_NAME *gen, STACK_OF(CONF_VALUE) *ret);
 int GENERAL_NAME_print(BIO *out, GENERAL_NAME *gen);
 
@@ -474,8 +509,24 @@ DECLARE_ASN1_FUNCTIONS(DIST_POINT_NAME)
 DECLARE_ASN1_FUNCTIONS(ACCESS_DESCRIPTION)
 DECLARE_ASN1_FUNCTIONS(AUTHORITY_INFO_ACCESS)
 
+DECLARE_ASN1_ITEM(POLICY_MAPPING)
+DECLARE_ASN1_ALLOC_FUNCTIONS(POLICY_MAPPING)
+DECLARE_ASN1_ITEM(POLICY_MAPPINGS)
+
+DECLARE_ASN1_ITEM(GENERAL_SUBTREE)
+DECLARE_ASN1_ALLOC_FUNCTIONS(GENERAL_SUBTREE)
+
+DECLARE_ASN1_ITEM(NAME_CONSTRAINTS)
+DECLARE_ASN1_ALLOC_FUNCTIONS(NAME_CONSTRAINTS)
+
+DECLARE_ASN1_ALLOC_FUNCTIONS(POLICY_CONSTRAINTS)
+DECLARE_ASN1_ITEM(POLICY_CONSTRAINTS)
+
 #ifdef HEADER_CONF_H
-GENERAL_NAME *v2i_GENERAL_NAME(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, CONF_VALUE *cnf);
+GENERAL_NAME *v2i_GENERAL_NAME(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
+                                                        CONF_VALUE *cnf);
+GENERAL_NAME *v2i_GENERAL_NAME_ex(GENERAL_NAME *out, X509V3_EXT_METHOD *method,
+                                X509V3_CTX *ctx, CONF_VALUE *cnf, int is_nc);
 void X509V3_conf_free(CONF_VALUE *val);
 
 X509_EXTENSION *X509V3_EXT_nconf_nid(CONF *conf, X509V3_CTX *ctx, int ext_nid, char *value);
@@ -566,7 +617,164 @@ int X509_PURPOSE_get_id(X509_PURPOSE *);
 STACK *X509_get1_email(X509 *x);
 STACK *X509_REQ_get1_email(X509_REQ *x);
 void X509_email_free(STACK *sk);
+STACK *X509_get1_ocsp(X509 *x);
+
+ASN1_OCTET_STRING *a2i_IPADDRESS(const char *ipasc);
+ASN1_OCTET_STRING *a2i_IPADDRESS_NC(const char *ipasc);
+int a2i_ipadd(unsigned char *ipout, const char *ipasc);
+int X509V3_NAME_from_section(X509_NAME *nm, STACK_OF(CONF_VALUE)*dn_sk,
+                                                unsigned long chtype);
+
+void X509_POLICY_NODE_print(BIO *out, X509_POLICY_NODE *node, int indent);
+
+#ifndef OPENSSL_NO_RFC3779
+
+typedef struct ASRange_st {
+  ASN1_INTEGER *min, *max;
+} ASRange;
+
+#define ASIdOrRange_id          0
+#define ASIdOrRange_range       1
+
+typedef struct ASIdOrRange_st {
+  int type;
+  union {
+    ASN1_INTEGER *id;
+    ASRange      *range;
+  } u;
+} ASIdOrRange;
+
+typedef STACK_OF(ASIdOrRange) ASIdOrRanges;
+DECLARE_STACK_OF(ASIdOrRange)
+
+#define ASIdentifierChoice_inherit              0
+#define ASIdentifierChoice_asIdsOrRanges        1
+
+typedef struct ASIdentifierChoice_st {
+  int type;
+  union {
+    ASN1_NULL    *inherit;
+    ASIdOrRanges *asIdsOrRanges;
+  } u;
+} ASIdentifierChoice;
+
+typedef struct ASIdentifiers_st {
+  ASIdentifierChoice *asnum, *rdi;
+} ASIdentifiers;
+
+DECLARE_ASN1_FUNCTIONS(ASRange)
+DECLARE_ASN1_FUNCTIONS(ASIdOrRange)
+DECLARE_ASN1_FUNCTIONS(ASIdentifierChoice)
+DECLARE_ASN1_FUNCTIONS(ASIdentifiers)
+
+
+typedef struct IPAddressRange_st {
+  ASN1_BIT_STRING       *min, *max;
+} IPAddressRange;
+
+#define IPAddressOrRange_addressPrefix  0
+#define IPAddressOrRange_addressRange   1
+
+typedef struct IPAddressOrRange_st {
+  int type;
+  union {
+    ASN1_BIT_STRING     *addressPrefix;
+    IPAddressRange      *addressRange;
+  } u;
+} IPAddressOrRange;
+
+typedef STACK_OF(IPAddressOrRange) IPAddressOrRanges;
+DECLARE_STACK_OF(IPAddressOrRange)
+
+#define IPAddressChoice_inherit                 0
+#define IPAddressChoice_addressesOrRanges       1
+
+typedef struct IPAddressChoice_st {
+  int type;
+  union {
+    ASN1_NULL           *inherit;
+    IPAddressOrRanges   *addressesOrRanges;
+  } u;
+} IPAddressChoice;
+
+typedef struct IPAddressFamily_st {
+  ASN1_OCTET_STRING     *addressFamily;
+  IPAddressChoice       *ipAddressChoice;
+} IPAddressFamily;
+
+typedef STACK_OF(IPAddressFamily) IPAddrBlocks;
+DECLARE_STACK_OF(IPAddressFamily)
+
+DECLARE_ASN1_FUNCTIONS(IPAddressRange)
+DECLARE_ASN1_FUNCTIONS(IPAddressOrRange)
+DECLARE_ASN1_FUNCTIONS(IPAddressChoice)
+DECLARE_ASN1_FUNCTIONS(IPAddressFamily)
+
+/*
+ * API tag for elements of the ASIdentifer SEQUENCE.
+ */
+#define V3_ASID_ASNUM   0
+#define V3_ASID_RDI     1
+
+/*
+ * AFI values, assigned by IANA.  It'd be nice to make the AFI
+ * handling code totally generic, but there are too many little things
+ * that would need to be defined for other address families for it to
+ * be worth the trouble.
+ */
+#define IANA_AFI_IPV4   1
+#define IANA_AFI_IPV6   2
+
+/*
+ * Utilities to construct and extract values from RFC3779 extensions,
+ * since some of the encodings (particularly for IP address prefixes
+ * and ranges) are a bit tedious to work with directly.
+ */
+int v3_asid_add_inherit(ASIdentifiers *asid, int which);
+int v3_asid_add_id_or_range(ASIdentifiers *asid, int which,
+                            ASN1_INTEGER *min, ASN1_INTEGER *max);
+int v3_addr_add_inherit(IPAddrBlocks *addr,
+                        const unsigned afi, const unsigned *safi);
+int v3_addr_add_prefix(IPAddrBlocks *addr,
+                       const unsigned afi, const unsigned *safi,
+                       unsigned char *a, const int prefixlen);
+int v3_addr_add_range(IPAddrBlocks *addr,
+                      const unsigned afi, const unsigned *safi,
+                      unsigned char *min, unsigned char *max);
+unsigned v3_addr_get_afi(const IPAddressFamily *f);
+int v3_addr_get_range(IPAddressOrRange *aor, const unsigned afi,
+                      unsigned char *min, unsigned char *max,
+                      const int length);
+
+/*
+ * Canonical forms.
+ */
+int v3_asid_is_canonical(ASIdentifiers *asid);
+int v3_addr_is_canonical(IPAddrBlocks *addr);
+int v3_asid_canonize(ASIdentifiers *asid);
+int v3_addr_canonize(IPAddrBlocks *addr);
+
+/*
+ * Tests for inheritance and containment.
+ */
+int v3_asid_inherits(ASIdentifiers *asid);
+int v3_addr_inherits(IPAddrBlocks *addr);
+int v3_asid_subset(ASIdentifiers *a, ASIdentifiers *b);
+int v3_addr_subset(IPAddrBlocks *a, IPAddrBlocks *b);
+
+/*
+ * Check whether RFC 3779 extensions nest properly in chains.
+ */
+int v3_asid_validate_path(X509_STORE_CTX *);
+int v3_addr_validate_path(X509_STORE_CTX *);
+int v3_asid_validate_resource_set(STACK_OF(X509) *chain,
+                                  ASIdentifiers *ext,
+                                  int allow_inheritance);
+int v3_addr_validate_resource_set(STACK_OF(X509) *chain,
+                                  IPAddrBlocks *ext,
+                                  int allow_inheritance);
 
+#endif /* OPENSSL_NO_RFC3779 */
 
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
@@ -577,46 +785,63 @@ void ERR_load_X509V3_strings(void);
 /* Error codes for the X509V3 functions. */
 
 /* Function codes. */
+#define X509V3_F_ASIDENTIFIERCHOICE_CANONIZE             156
+#define X509V3_F_ASIDENTIFIERCHOICE_IS_CANONICAL         157
 #define X509V3_F_COPY_EMAIL                              122
 #define X509V3_F_COPY_ISSUER                             123
+#define X509V3_F_DO_DIRNAME                              144
 #define X509V3_F_DO_EXT_CONF                             124
 #define X509V3_F_DO_EXT_I2D                              135
+#define X509V3_F_DO_EXT_NCONF                            151
+#define X509V3_F_DO_I2V_NAME_CONSTRAINTS                 148
 #define X509V3_F_HEX_TO_STRING                           111
 #define X509V3_F_I2S_ASN1_ENUMERATED                     121
-#define X509V3_F_I2S_ASN1_IA5STRING                      142
+#define X509V3_F_I2S_ASN1_IA5STRING                      149
 #define X509V3_F_I2S_ASN1_INTEGER                        120
 #define X509V3_F_I2V_AUTHORITY_INFO_ACCESS               138
 #define X509V3_F_NOTICE_SECTION                          132
 #define X509V3_F_NREF_NOS                                133
 #define X509V3_F_POLICY_SECTION                          131
+#define X509V3_F_PROCESS_PCI_VALUE                       150
 #define X509V3_F_R2I_CERTPOL                             130
-#define X509V3_F_R2I_PCI                                 142
+#define X509V3_F_R2I_PCI                                 155
 #define X509V3_F_S2I_ASN1_IA5STRING                      100
 #define X509V3_F_S2I_ASN1_INTEGER                        108
 #define X509V3_F_S2I_ASN1_OCTET_STRING                   112
 #define X509V3_F_S2I_ASN1_SKEY_ID                        114
-#define X509V3_F_S2I_S2I_SKEY_ID                         115
+#define X509V3_F_S2I_SKEY_ID                             115
 #define X509V3_F_STRING_TO_HEX                           113
-#define X509V3_F_SXNET_ADD_ASC                           125
+#define X509V3_F_SXNET_ADD_ID_ASC                        125
 #define X509V3_F_SXNET_ADD_ID_INTEGER                    126
 #define X509V3_F_SXNET_ADD_ID_ULONG                      127
 #define X509V3_F_SXNET_GET_ID_ASC                        128
 #define X509V3_F_SXNET_GET_ID_ULONG                      129
-#define X509V3_F_V2I_ACCESS_DESCRIPTION                  139
+#define X509V3_F_V2I_ASIDENTIFIERS                       158
 #define X509V3_F_V2I_ASN1_BIT_STRING                     101
+#define X509V3_F_V2I_AUTHORITY_INFO_ACCESS               139
 #define X509V3_F_V2I_AUTHORITY_KEYID                     119
 #define X509V3_F_V2I_BASIC_CONSTRAINTS                   102
 #define X509V3_F_V2I_CRLD                                134
-#define X509V3_F_V2I_EXT_KU                              103
-#define X509V3_F_V2I_GENERAL_NAME                        117
+#define X509V3_F_V2I_EXTENDED_KEY_USAGE                  103
 #define X509V3_F_V2I_GENERAL_NAMES                       118
+#define X509V3_F_V2I_GENERAL_NAME_EX                     117
+#define X509V3_F_V2I_IPADDRBLOCKS                        159
+#define X509V3_F_V2I_ISSUER_ALT                          153
+#define X509V3_F_V2I_NAME_CONSTRAINTS                    147
+#define X509V3_F_V2I_POLICY_CONSTRAINTS                  146
+#define X509V3_F_V2I_POLICY_MAPPINGS                     145
+#define X509V3_F_V2I_SUBJECT_ALT                         154
+#define X509V3_F_V3_ADDR_VALIDATE_PATH_INTERNAL          160
 #define X509V3_F_V3_GENERIC_EXTENSION                    116
-#define X509V3_F_X509V3_ADD_I2D                          140
+#define X509V3_F_X509V3_ADD1_I2D                         140
 #define X509V3_F_X509V3_ADD_VALUE                        105
 #define X509V3_F_X509V3_EXT_ADD                          104
 #define X509V3_F_X509V3_EXT_ADD_ALIAS                    106
 #define X509V3_F_X509V3_EXT_CONF                         107
 #define X509V3_F_X509V3_EXT_I2D                          136
+#define X509V3_F_X509V3_EXT_NCONF                        152
+#define X509V3_F_X509V3_GET_SECTION                      142
+#define X509V3_F_X509V3_GET_STRING                       143
 #define X509V3_F_X509V3_GET_VALUE_BOOL                   110
 #define X509V3_F_X509V3_PARSE_LIST                       109
 #define X509V3_F_X509_PURPOSE_ADD                        137
@@ -627,6 +852,7 @@ void ERR_load_X509V3_strings(void);
 #define X509V3_R_BAD_OBJECT                              119
 #define X509V3_R_BN_DEC2BN_ERROR                         100
 #define X509V3_R_BN_TO_ASN1_INTEGER_ERROR                101
+#define X509V3_R_DIRNAME_ERROR                           149
 #define X509V3_R_DUPLICATE_ZONE_ID                       133
 #define X509V3_R_ERROR_CONVERTING_ZONE                   131
 #define X509V3_R_ERROR_CREATING_EXTENSION                144
@@ -637,10 +863,15 @@ void ERR_load_X509V3_strings(void);
 #define X509V3_R_EXTENSION_NOT_FOUND                     102
 #define X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED         103
 #define X509V3_R_EXTENSION_VALUE_ERROR                   116
+#define X509V3_R_ILLEGAL_EMPTY_EXTENSION                 151
 #define X509V3_R_ILLEGAL_HEX_DIGIT                       113
-#define X509V3_R_INCORRECT_POLICY_SYNTAX_TAG             153
+#define X509V3_R_INCORRECT_POLICY_SYNTAX_TAG             152
+#define X509V3_R_INVALID_ASNUMBER                        160
+#define X509V3_R_INVALID_ASRANGE                         161
 #define X509V3_R_INVALID_BOOLEAN_STRING                  104
 #define X509V3_R_INVALID_EXTENSION_STRING                105
+#define X509V3_R_INVALID_INHERITANCE                     162
+#define X509V3_R_INVALID_IPADDRESS                       163
 #define X509V3_R_INVALID_NAME                            106
 #define X509V3_R_INVALID_NULL_ARGUMENT                   107
 #define X509V3_R_INVALID_NULL_NAME                       108
@@ -650,9 +881,9 @@ void ERR_load_X509V3_strings(void);
 #define X509V3_R_INVALID_OBJECT_IDENTIFIER               110
 #define X509V3_R_INVALID_OPTION                          138
 #define X509V3_R_INVALID_POLICY_IDENTIFIER               134
-#define X509V3_R_INVALID_PROXY_POLICY_IDENTIFIER         147
-#define X509V3_R_INVALID_PROXY_POLICY_SETTING            151
+#define X509V3_R_INVALID_PROXY_POLICY_SETTING            153
 #define X509V3_R_INVALID_PURPOSE                         146
+#define X509V3_R_INVALID_SAFI                            164
 #define X509V3_R_INVALID_SECTION                         135
 #define X509V3_R_INVALID_SYNTAX                          143
 #define X509V3_R_ISSUER_DECODE_ERROR                     126
@@ -662,16 +893,18 @@ void ERR_load_X509V3_strings(void);
 #define X509V3_R_NO_ISSUER_CERTIFICATE                   121
 #define X509V3_R_NO_ISSUER_DETAILS                       127
 #define X509V3_R_NO_POLICY_IDENTIFIER                    139
-#define X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED   148
+#define X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED   154
 #define X509V3_R_NO_PUBLIC_KEY                           114
 #define X509V3_R_NO_SUBJECT_DETAILS                      125
 #define X509V3_R_ODD_NUMBER_OF_DIGITS                    112
-#define X509V3_R_POLICY_LANGUAGE_ALREADTY_DEFINED        149
-#define X509V3_R_POLICY_PATH_LENGTH                      152
-#define X509V3_R_POLICY_PATH_LENGTH_ALREADTY_DEFINED     150
-#define X509V3_R_POLICY_SYNTAX_NOT                       154
-#define X509V3_R_POLICY_SYNTAX_NOT_CURRENTLY_SUPPORTED   155
-#define X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY 156
+#define X509V3_R_OPERATION_NOT_DEFINED                   148
+#define X509V3_R_OTHERNAME_ERROR                         147
+#define X509V3_R_POLICY_LANGUAGE_ALREADTY_DEFINED        155
+#define X509V3_R_POLICY_PATH_LENGTH                      156
+#define X509V3_R_POLICY_PATH_LENGTH_ALREADTY_DEFINED     157
+#define X509V3_R_POLICY_SYNTAX_NOT_CURRENTLY_SUPPORTED   158
+#define X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY 159
+#define X509V3_R_SECTION_NOT_FOUND                       150
 #define X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS            122
 #define X509V3_R_UNABLE_TO_GET_ISSUER_KEYID              123
 #define X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT             111
diff --git a/src/lib/libssl/src/demos/easy_tls/easy-tls.c b/src/lib/libssl/src/demos/easy_tls/easy-tls.c
index c958f4b609..b4c9f9e77b 100644
--- a/src/lib/libssl/src/demos/easy_tls/easy-tls.c
+++ b/src/lib/libssl/src/demos/easy_tls/easy-tls.c
@@ -1,7 +1,7 @@
 /* -*- Mode: C; c-file-style: "bsd" -*- */
 /*
  * easy-tls.c -- generic TLS proxy.
- * $Id: easy-tls.c,v 1.3 2002/09/10 16:31:56 markus Exp $
+ * $Id: easy-tls.c,v 1.4 2008/09/06 12:17:52 djm Exp $
  */
 /*
  (c) Copyright 1999 Bodo Moeller.  All rights reserved.
@@ -73,7 +73,7 @@
  */
 
 static char const rcsid[] =
-"$Id: easy-tls.c,v 1.3 2002/09/10 16:31:56 markus Exp $";
+"$Id: easy-tls.c,v 1.4 2008/09/06 12:17:52 djm Exp $";
 
 #include <assert.h>
 #include <errno.h>
diff --git a/src/lib/libssl/src/demos/tunala/autoungunk.sh b/src/lib/libssl/src/demos/tunala/autoungunk.sh
index 14d10790fd..0c9123b6cf 100644
--- a/src/lib/libssl/src/demos/tunala/autoungunk.sh
+++ b/src/lib/libssl/src/demos/tunala/autoungunk.sh
@@ -4,13 +4,13 @@
 # mess has been left in the directory thanks to autoconf, automake, and their
 # friends.
 
-if test -f Makefile; then
-        make distclean
-        rm -f Makefile
-fi
-
 if test -f Makefile.plain; then
+        if test -f Makefile; then
+                make distclean
+        fi
         mv Makefile.plain Makefile
+else
+        make clean
 fi
 
 rm -f aclocal.m4 config.* configure install-sh \
diff --git a/src/lib/libssl/src/demos/tunala/cb.c b/src/lib/libssl/src/demos/tunala/cb.c
index cd32f74c70..e64983896e 100644
--- a/src/lib/libssl/src/demos/tunala/cb.c
+++ b/src/lib/libssl/src/demos/tunala/cb.c
@@ -129,5 +129,15 @@ void cb_ssl_verify_set_level(unsigned int level)
                 cb_ssl_verify_level = level;
 }
 
+RSA *cb_generate_tmp_rsa(SSL *s, int is_export, int keylength)
+{
+        /* TODO: Perhaps make it so our global key can be generated on-the-fly
+         * after certain intervals? */
+        static RSA *rsa_tmp = NULL;
+        if(!rsa_tmp)
+                rsa_tmp = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
+        return rsa_tmp;
+}
+
 #endif /* !defined(NO_OPENSSL) */
 
diff --git a/src/lib/libssl/src/demos/tunala/configure.in b/src/lib/libssl/src/demos/tunala/configure.in
index b2a6ffc756..590cdbfd26 100644
--- a/src/lib/libssl/src/demos/tunala/configure.in
+++ b/src/lib/libssl/src/demos/tunala/configure.in
@@ -10,6 +10,7 @@ dnl AM_PROG_LIBTOOL
 
 dnl Checks for libraries.
 AC_CHECK_LIB(dl, dlopen)
+AC_CHECK_LIB(z, inflate)
 AC_CHECK_LIB(socket, socket)
 AC_CHECK_LIB(nsl, gethostbyname)
 
diff --git a/src/lib/libssl/src/demos/tunala/tunala.c b/src/lib/libssl/src/demos/tunala/tunala.c
index e802a6209f..e918cba2ce 100644
--- a/src/lib/libssl/src/demos/tunala/tunala.c
+++ b/src/lib/libssl/src/demos/tunala/tunala.c
@@ -69,8 +69,8 @@ typedef struct _tunala_world_t {
 static SSL_CTX *initialise_ssl_ctx(int server_mode, const char *engine_id,
                 const char *CAfile, const char *cert, const char *key,
                 const char *dcert, const char *dkey, const char *cipher_list,
-                const char *dh_file, const char *dh_special, int ctx_options,
-                int out_state, int out_verify, int verify_mode,
+                const char *dh_file, const char *dh_special, int tmp_rsa,
+                int ctx_options, int out_state, int out_verify, int verify_mode,
                 unsigned int verify_depth);
 static void selector_init(tunala_selector_t *selector);
 static void selector_add_listener(tunala_selector_t *selector, int fd);
@@ -102,6 +102,7 @@ static int def_flipped = 0;
 static const char *def_cipher_list = NULL;
 static const char *def_dh_file = NULL;
 static const char *def_dh_special = NULL;
+static int def_tmp_rsa = 1;
 static int def_ctx_options = 0;
 static int def_verify_mode = 0;
 static unsigned int def_verify_depth = 10;
@@ -127,6 +128,7 @@ static const char *helpstring =
 " -cipher <list>         (specifies cipher list to use)\n"
 " -dh_file <path>        (a PEM file containing DH parameters to use)\n"
 " -dh_special <NULL|generate|standard> (see below: def=NULL)\n"
+" -no_tmp_rsa            (don't generate temporary RSA keys)\n"
 " -no_ssl2               (disable SSLv2)\n"
 " -no_ssl3               (disable SSLv3)\n"
 " -no_tls1               (disable TLSv1)\n"
@@ -306,6 +308,7 @@ int main(int argc, char *argv[])
         const char *cipher_list = def_cipher_list;
         const char *dh_file = def_dh_file;
         const char *dh_special = def_dh_special;
+        int tmp_rsa = def_tmp_rsa;
         int ctx_options = def_ctx_options;
         int verify_mode = def_verify_mode;
         unsigned int verify_depth = def_verify_depth;
@@ -427,6 +430,9 @@ next_arg:
                         if(!parse_dh_special(*argv, &dh_special))
                                 return 1;
                         goto next_arg;
+                } else if(strcmp(*argv, "-no_tmp_rsa") == 0) {
+                        tmp_rsa = 0;
+                        goto next_arg;
                 } else if(strcmp(*argv, "-no_ssl2") == 0) {
                         ctx_options |= SSL_OP_NO_SSLv2;
                         goto next_arg;
@@ -487,7 +493,7 @@ next_arg:
         /* Create the SSL_CTX */
         if((world.ssl_ctx = initialise_ssl_ctx(server_mode, engine_id,
                         cacert, cert, key, dcert, dkey, cipher_list, dh_file,
-                        dh_special, ctx_options, out_state, out_verify,
+                        dh_special, tmp_rsa, ctx_options, out_state, out_verify,
                         verify_mode, verify_depth)) == NULL)
                 return err_str1("initialise_ssl_ctx(engine_id=%s) failed",
                         (engine_id == NULL) ? "NULL" : engine_id);
@@ -522,8 +528,13 @@ main_loop:
         /* Now do the select */
         switch(selector_select(&world.selector)) {
         case -1:
-                fprintf(stderr, "selector_select returned a badness error.\n");
-                goto shouldnt_happen;
+                if(errno != EINTR) {
+                        fprintf(stderr, "selector_select returned a "
+                                        "badness error.\n");
+                        goto shouldnt_happen;
+                }
+                fprintf(stderr, "Warn, selector interrupted by a signal\n");
+                goto main_loop;
         case 0:
                 fprintf(stderr, "Warn, selector_select returned 0 - signal?""?\n");
                 goto main_loop;
@@ -717,8 +728,8 @@ do_it:
 static SSL_CTX *initialise_ssl_ctx(int server_mode, const char *engine_id,
                 const char *CAfile, const char *cert, const char *key,
                 const char *dcert, const char *dkey, const char *cipher_list,
-                const char *dh_file, const char *dh_special, int ctx_options,
-                int out_state, int out_verify, int verify_mode,
+                const char *dh_file, const char *dh_special, int tmp_rsa,
+                int ctx_options, int out_state, int out_verify, int verify_mode,
                 unsigned int verify_depth)
 {
         SSL_CTX *ctx = NULL, *ret = NULL;
@@ -770,6 +781,9 @@ static SSL_CTX *initialise_ssl_ctx(int server_mode, const char *engine_id,
         /* dcert and dkey */
         if((dcert || dkey) && !ctx_set_cert(ctx, dcert, dkey))
                 goto err;
+        /* temporary RSA key generation */
+        if(tmp_rsa)
+                SSL_CTX_set_tmp_rsa_callback(ctx, cb_generate_tmp_rsa);
 
         /* cipher_list */
         if(cipher_list) {
diff --git a/src/lib/libssl/src/demos/tunala/tunala.h b/src/lib/libssl/src/demos/tunala/tunala.h
index b4c8ec78d8..3a752f259a 100644
--- a/src/lib/libssl/src/demos/tunala/tunala.h
+++ b/src/lib/libssl/src/demos/tunala/tunala.h
@@ -149,6 +149,7 @@ int cb_ssl_verify(int ok, X509_STORE_CTX *ctx);
 void cb_ssl_verify_set_output(FILE *fp);
 void cb_ssl_verify_set_depth(unsigned int verify_depth);
 void cb_ssl_verify_set_level(unsigned int level);
+RSA *cb_generate_tmp_rsa(SSL *s, int is_export, int keylength);
 #endif /* !defined(NO_OPENSSL) */
 #endif /* !defined(OPENSSL_NO_BUFFER) */
 
diff --git a/src/lib/libssl/src/doc/HOWTO/certificates.txt b/src/lib/libssl/src/doc/HOWTO/certificates.txt
index d3a62545ad..a8a34c7abc 100644
--- a/src/lib/libssl/src/doc/HOWTO/certificates.txt
+++ b/src/lib/libssl/src/doc/HOWTO/certificates.txt
@@ -66,14 +66,13 @@ Section 5 will tell you more on how to handle the certificate you
 received.
 
 
-4. Creating a self-signed certificate
+4. Creating a self-signed test certificate
 
 If you don't want to deal with another certificate authority, or just
-want to create a test certificate for yourself, or are setting up a
-certificate authority of your own, you may want to make the requested
-certificate a self-signed one.  This is similar to creating a
-certificate request, but creates a certificate instead of a
-certificate request (1095 is 3 years):
+want to create a test certificate for yourself.  This is similar to
+creating a certificate request, but creates a certificate instead of
+a certificate request.  This is NOT the recommended way to create a
+CA certificate, see ca.txt.
 
   openssl req -new -x509 -key privkey.pem -out cacert.pem -days 1095
 
diff --git a/src/lib/libssl/src/doc/apps/asn1parse.pod b/src/lib/libssl/src/doc/apps/asn1parse.pod
index 69ee4dfee6..542d969066 100644
--- a/src/lib/libssl/src/doc/apps/asn1parse.pod
+++ b/src/lib/libssl/src/doc/apps/asn1parse.pod
@@ -16,6 +16,8 @@ B<openssl> B<asn1parse>
 [B<-i>]
 [B<-oid filename>]
 [B<-strparse offset>]
+[B<-genstr string>]
+[B<-genconf file>]
 
 =head1 DESCRIPTION
 
@@ -67,6 +69,14 @@ file is described in the NOTES section below.
 parse the contents octets of the ASN.1 object starting at B<offset>. This
 option can be used multiple times to "drill down" into a nested structure.
 
+=item B<-genstr string>, B<-genconf file>
+
+generate encoded data based on B<string>, B<file> or both using
+ASN1_generate_nconf() format. If B<file> only is present then the string
+is obtained from the default section using the name B<asn1>. The encoded
+data is passed through the ASN1 parser and printed out as though it came
+from a file, the contents can thus be examined and written to a file
+using the B<out> option. 
 
 =back
 
@@ -121,6 +131,38 @@ by white space. The final column is the rest of the line and is the
 
 C<1.2.3.4       shortName       A long name>
 
+=head1 EXAMPLES
+
+Parse a file:
+
+ openssl asn1parse -in file.pem
+
+Parse a DER file:
+
+ openssl asn1parse -inform DER -in file.der
+
+Generate a simple UTF8String:
+
+ openssl asn1parse -genstr 'UTF8:Hello World'
+
+Generate and write out a UTF8String, don't print parsed output:
+
+ openssl asn1parse -genstr 'UTF8:Hello World' -noout -out utf8.der
+
+Generate using a config file:
+
+ openssl asn1parse -genconf asn1.cnf -noout -out asn1.der
+
+Example config file:
+
+ asn1=SEQUENCE:seq_sect
+
+ [seq_sect]
+
+ field1=BOOL:TRUE
+ field2=EXP:0, UTF8:some random string
+
+
 =head1 BUGS
 
 There should be options to change the format of output lines. The output of some
diff --git a/src/lib/libssl/src/doc/apps/ca.pod b/src/lib/libssl/src/doc/apps/ca.pod
index f15df49d4f..5618c2dc9d 100644
--- a/src/lib/libssl/src/doc/apps/ca.pod
+++ b/src/lib/libssl/src/doc/apps/ca.pod
@@ -17,7 +17,6 @@ B<openssl> B<ca>
 [B<-crl_hold instruction>]
 [B<-crl_compromise time>]
 [B<-crl_CA_compromise time>]
-[B<-subj arg>]
 [B<-crldays days>]
 [B<-crlhours hours>]
 [B<-crlexts section>]
@@ -30,6 +29,7 @@ B<openssl> B<ca>
 [B<-key arg>]
 [B<-passin arg>]
 [B<-cert file>]
+[B<-selfsign>]
 [B<-in file>]
 [B<-out file>]
 [B<-notext>]
@@ -44,6 +44,9 @@ B<openssl> B<ca>
 [B<-extensions section>]
 [B<-extfile section>]
 [B<-engine id>]
+[B<-subj arg>]
+[B<-utf8>]
+[B<-multivalue-rdn>]
 
 =head1 DESCRIPTION
 
@@ -113,6 +116,20 @@ the password used to encrypt the private key. Since on some
 systems the command line arguments are visible (e.g. Unix with
 the 'ps' utility) this option should be used with caution.
 
+=item B<-selfsign>
+
+indicates the issued certificates are to be signed with the key
+the certificate requests were signed with (given with B<-keyfile>).
+Cerificate requests signed with a different key are ignored.  If
+B<-spkac>, B<-ss_cert> or B<-gencrl> are given, B<-selfsign> is
+ignored.
+
+A consequence of using B<-selfsign> is that the self-signed
+certificate appears among the entries in the certificate database
+(see the configuration option B<database>), and uses the same
+serial number counter as all other certificates sign with the
+self-signed certificate.
+
 =item B<-passin arg>
 
 the key password source. For more information about the format of B<arg>
@@ -203,6 +220,28 @@ to attempt to obtain a functional reference to the specified engine,
 thus initialising it if needed. The engine will then be set as the default
 for all available algorithms.
 
+=item B<-subj arg>
+
+supersedes subject name given in the request.
+The arg must be formatted as I</type0=value0/type1=value1/type2=...>,
+characters may be escaped by \ (backslash), no spaces are skipped.
+
+=item B<-utf8>
+
+this option causes field values to be interpreted as UTF8 strings, by 
+default they are interpreted as ASCII. This means that the field
+values, whether prompted from a terminal or obtained from a
+configuration file, must be valid UTF8 strings.
+
+=item B<-multivalue-rdn>
+
+this option causes the -subj argument to be interpretedt with full
+support for multivalued RDNs. Example:
+
+I</DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe>
+
+If -multi-rdn is not used then the UID value is I<123456+CN=John Doe>.
+
 =back
 
 =head1 CRL OPTIONS
@@ -253,12 +292,6 @@ B<time>. B<time> should be in GeneralizedTime format that is B<YYYYMMDDHHMMSSZ>.
 This is the same as B<crl_compromise> except the revocation reason is set to
 B<CACompromise>.
 
-=item B<-subj arg>
-
-supersedes subject name given in the request.
-The arg must be formatted as I</type0=value0/type1=value1/type2=...>,
-characters may be escaped by \ (backslash), no spaces are skipped.
-
 =item B<-crlexts section>
 
 the section of the configuration file containing CRL extensions to
@@ -359,11 +392,27 @@ the same as the B<-md> option. The message digest to use. Mandatory.
 the text database file to use. Mandatory. This file must be present
 though initially it will be empty.
 
+=item B<unique_subject>
+
+if the value B<yes> is given, the valid certificate entries in the
+database must have unique subjects.  if the value B<no> is given,
+several valid certificate entries may have the exact same subject.
+The default value is B<yes>, to be compatible with older (pre 0.9.8)
+versions of OpenSSL.  However, to make CA certificate roll-over easier,
+it's recommended to use the value B<no>, especially if combined with
+the B<-selfsign> command line option.
+
 =item B<serial>
 
 a text file containing the next serial number to use in hex. Mandatory.
 This file must be present and contain a valid serial number.
 
+=item B<crlnumber>
+
+a text file containing the next CRL number to use in hex. The crl number
+will be inserted in the CRLs only if this file exists. If this file is
+present, it must contain a valid CRL number.
+
 =item B<x509_extensions>
 
 the same as B<-extensions>.
@@ -554,8 +603,7 @@ if corrupted it can be difficult to fix. It is theoretically possible
 to rebuild the index file from all the issued certificates and a current
 CRL: however there is no option to do this.
 
-V2 CRL features like delta CRL support and CRL numbers are not currently
-supported.
+V2 CRL features like delta CRLs are not currently supported.
 
 Although several requests can be input and handled at once it is only
 possible to include one SPKAC or self signed certificate.
@@ -566,12 +614,6 @@ The use of an in memory text database can cause problems when large
 numbers of certificates are present because, as the name implies
 the database has to be kept in memory.
 
-It is not possible to certify two certificates with the same DN: this
-is a side effect of how the text database is indexed and it cannot easily
-be fixed without introducing other problems. Some S/MIME clients can use
-two certificates with the same DN for separate signing and encryption
-keys.
-
 The B<ca> command really needs rewriting or the required functionality
 exposed at either a command or interface level so a more friendly utility
 (perl script or GUI) can handle things properly. The scripts B<CA.sh> and
diff --git a/src/lib/libssl/src/doc/apps/ciphers.pod b/src/lib/libssl/src/doc/apps/ciphers.pod
index 81a2c43893..694e433ef3 100644
--- a/src/lib/libssl/src/doc/apps/ciphers.pod
+++ b/src/lib/libssl/src/doc/apps/ciphers.pod
@@ -105,7 +105,7 @@ The following is a list of all permitted cipher strings and their meanings.
 =item B<DEFAULT>
 
 the default cipher list. This is determined at compile time and is normally
-B<ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH>. This must be the first cipher string
+B<AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH>. This must be the first cipher string
 specified.
 
 =item B<COMPLEMENTOFDEFAULT>
@@ -125,11 +125,11 @@ the cipher suites not enabled by B<ALL>, currently being B<eNULL>.
 =item B<HIGH>
 
 "high" encryption cipher suites. This currently means those with key lengths larger
-than 128 bits.
+than 128 bits, and some cipher suites with 128-bit keys.
 
 =item B<MEDIUM>
 
-"medium" encryption cipher suites, currently those using 128 bit encryption.
+"medium" encryption cipher suites, currently some of those using 128 bit encryption.
 
 =item B<LOW>
 
@@ -146,7 +146,9 @@ export encryption algorithms. Including 40 and 56 bits algorithms.
 
 =item B<EXPORT56>
 
-56 bit export encryption algorithms.
+56 bit export encryption algorithms. In OpenSSL 0.9.8c and later the set of
+56 bit export ciphers is empty unless OpenSSL has been explicitly configured
+with support for experimental ciphers.
 
 =item B<eNULL>, B<NULL>
 
@@ -207,6 +209,10 @@ anonymous DH cipher suites.
 
 cipher suites using AES.
 
+=item B<CAMELLIA>
+
+cipher suites using Camellia.
+
 =item B<3DES>
 
 cipher suites using triple DES.
@@ -227,6 +233,10 @@ cipher suites using RC2.
 
 cipher suites using IDEA.
 
+=item B<SEED>
+
+cipher suites using SEED.
+
 =item B<MD5>
 
 cipher suites using MD5.
@@ -317,10 +327,10 @@ e.g. DES-CBC3-SHA. In these cases, RSA authentication is used.
  TLS_RSA_WITH_AES_128_CBC_SHA            AES128-SHA
  TLS_RSA_WITH_AES_256_CBC_SHA            AES256-SHA
 
- TLS_DH_DSS_WITH_AES_128_CBC_SHA         DH-DSS-AES128-SHA
- TLS_DH_DSS_WITH_AES_256_CBC_SHA         DH-DSS-AES256-SHA
- TLS_DH_RSA_WITH_AES_128_CBC_SHA         DH-RSA-AES128-SHA
- TLS_DH_RSA_WITH_AES_256_CBC_SHA         DH-RSA-AES256-SHA
+ TLS_DH_DSS_WITH_AES_128_CBC_SHA         Not implemented.
+ TLS_DH_DSS_WITH_AES_256_CBC_SHA         Not implemented.
+ TLS_DH_RSA_WITH_AES_128_CBC_SHA         Not implemented.
+ TLS_DH_RSA_WITH_AES_256_CBC_SHA         Not implemented.
 
  TLS_DHE_DSS_WITH_AES_128_CBC_SHA        DHE-DSS-AES128-SHA
  TLS_DHE_DSS_WITH_AES_256_CBC_SHA        DHE-DSS-AES256-SHA
@@ -330,6 +340,36 @@ e.g. DES-CBC3-SHA. In these cases, RSA authentication is used.
  TLS_DH_anon_WITH_AES_128_CBC_SHA        ADH-AES128-SHA
  TLS_DH_anon_WITH_AES_256_CBC_SHA        ADH-AES256-SHA
 
+=head2 Camellia ciphersuites from RFC4132, extending TLS v1.0
+
+ TLS_RSA_WITH_CAMELLIA_128_CBC_SHA      CAMELLIA128-SHA
+ TLS_RSA_WITH_CAMELLIA_256_CBC_SHA      CAMELLIA256-SHA
+
+ TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA   Not implemented.
+ TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA   Not implemented.
+ TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA   Not implemented.
+ TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA   Not implemented.
+
+ TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA  DHE-DSS-CAMELLIA128-SHA
+ TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA  DHE-DSS-CAMELLIA256-SHA
+ TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA  DHE-RSA-CAMELLIA128-SHA
+ TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA  DHE-RSA-CAMELLIA256-SHA
+
+ TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA  ADH-CAMELLIA128-SHA
+ TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA  ADH-CAMELLIA256-SHA
+
+=head2 SEED ciphersuites from RFC4162, extending TLS v1.0
+
+ TLS_RSA_WITH_SEED_CBC_SHA              SEED-SHA
+
+ TLS_DH_DSS_WITH_SEED_CBC_SHA           Not implemented.
+ TLS_DH_RSA_WITH_SEED_CBC_SHA           Not implemented.
+
+ TLS_DHE_DSS_WITH_SEED_CBC_SHA          DHE-DSS-SEED-SHA
+ TLS_DHE_RSA_WITH_SEED_CBC_SHA          DHE-RSA-SEED-SHA
+
+ TLS_DH_anon_WITH_SEED_CBC_SHA          ADH-SEED-SHA
+
 =head2 Additional Export 1024 and other cipher suites
 
 Note: these ciphers can also be used in SSL v3.
diff --git a/src/lib/libssl/src/doc/apps/config.pod b/src/lib/libssl/src/doc/apps/config.pod
index 8f823fa6d6..ace34b62bd 100644
--- a/src/lib/libssl/src/doc/apps/config.pod
+++ b/src/lib/libssl/src/doc/apps/config.pod
@@ -1,6 +1,8 @@
 
 =pod
 
+=for comment openssl_manual_section:5
+
 =head1 NAME
 
 config - OpenSSL CONF library configuration files
@@ -105,6 +107,11 @@ as any compliant applications. For example:
  some_new_oid = 1.2.3.4
  some_other_oid = 1.2.3.5
 
+In OpenSSL 0.9.8 it is also possible to set the value to the long name followed
+by a comma and the numerical OID form. For example:
+
+ shortName = some object long name, 1.2.3.4
+
 =head2 ENGINE CONFIGURATION MODULE
 
 This ENGINE configuration module has the name B<engines>. The value of this
diff --git a/src/lib/libssl/src/doc/apps/dgst.pod b/src/lib/libssl/src/doc/apps/dgst.pod
index b0d198724c..908cd2a6d6 100644
--- a/src/lib/libssl/src/doc/apps/dgst.pod
+++ b/src/lib/libssl/src/doc/apps/dgst.pod
@@ -18,6 +18,7 @@ B<openssl> B<dgst>
 [B<-verify filename>]
 [B<-prverify filename>]
 [B<-signature filename>]
+[B<-hmac key>]
 [B<file...>]
 
 [B<md5|md4|md2|sha1|sha|mdc2|ripemd160>]
@@ -78,6 +79,10 @@ verify the signature using the  the private key in "filename".
 
 the actual signature to verify.
 
+=item B<-hmac key>
+
+create a hashed MAC using "key".
+
 =item B<-rand file(s)>
 
 a file or files containing random data used to seed the random number
diff --git a/src/lib/libssl/src/doc/apps/enc.pod b/src/lib/libssl/src/doc/apps/enc.pod
index c43da5b3f1..4391c93360 100644
--- a/src/lib/libssl/src/doc/apps/enc.pod
+++ b/src/lib/libssl/src/doc/apps/enc.pod
@@ -227,6 +227,14 @@ Blowfish and RC5 algorithms use a 128 bit key.
  rc5-ecb            RC5 cipher in ECB mode
  rc5-ofb            RC5 cipher in OFB mode
 
+ aes-[128|192|256]-cbc  128/192/256 bit AES in CBC mode
+ aes-[128|192|256]      Alias for aes-[128|192|256]-cbc
+ aes-[128|192|256]-cfb  128/192/256 bit AES in 128 bit CFB mode
+ aes-[128|192|256]-cfb1 128/192/256 bit AES in 1 bit CFB mode
+ aes-[128|192|256]-cfb8 128/192/256 bit AES in 8 bit CFB mode
+ aes-[128|192|256]-ecb  128/192/256 bit AES in ECB mode
+ aes-[128|192|256]-ofb  128/192/256 bit AES in OFB mode
+
 =head1 EXAMPLES
 
 Just base64 encode a binary file:
diff --git a/src/lib/libssl/src/doc/apps/ocsp.pod b/src/lib/libssl/src/doc/apps/ocsp.pod
index 4f266058e5..b58ddc1788 100644
--- a/src/lib/libssl/src/doc/apps/ocsp.pod
+++ b/src/lib/libssl/src/doc/apps/ocsp.pod
@@ -73,7 +73,7 @@ specify output filename, default is standard output.
 
 This specifies the current issuer certificate. This option can be used
 multiple times. The certificate specified in B<filename> must be in
-PEM format.
+PEM format. This option B<MUST> come before any B<-cert> options.
 
 =item B<-cert filename>
 
@@ -146,7 +146,7 @@ certificate in such cases.
 
 =item B<-trust_other>
 
-the certificates specified by the B<-verify_certs> option should be explicitly
+the certificates specified by the B<-verify_other> option should be explicitly
 trusted and no additional checks will be performed on them. This is useful
 when the complete responder certificate chain is not available or trusting a
 root CA is not appropriate.
@@ -154,7 +154,7 @@ root CA is not appropriate.
 =item B<-VAfile file>
 
 file containing explicitly trusted responder certificates. Equivalent to the
-B<-verify_certs> and B<-trust_other> options.
+B<-verify_other> and B<-trust_other> options.
 
 =item B<-noverify>
 
@@ -166,7 +166,7 @@ of the responders certificate.
 
 ignore certificates contained in the OCSP response when searching for the
 signers certificate. With this option the signers certificate must be specified
-with either the B<-verify_certs> or B<-VAfile> options.
+with either the B<-verify_other> or B<-VAfile> options.
 
 =item B<-no_signature_verify>
 
diff --git a/src/lib/libssl/src/doc/apps/openssl.pod b/src/lib/libssl/src/doc/apps/openssl.pod
index dc0f49ddca..964cdf0f02 100644
--- a/src/lib/libssl/src/doc/apps/openssl.pod
+++ b/src/lib/libssl/src/doc/apps/openssl.pod
@@ -227,6 +227,22 @@ SHA Digest
 
 SHA-1 Digest
 
+=item B<sha224>
+
+SHA-224 Digest
+
+=item B<sha256>
+
+SHA-256 Digest
+
+=item B<sha384>
+
+SHA-384 Digest
+
+=item B<sha512>
+
+SHA-512 Digest
+
 =back
 
 =head2 ENCODING AND CIPHER COMMANDS
diff --git a/src/lib/libssl/src/doc/apps/req.pod b/src/lib/libssl/src/doc/apps/req.pod
index e2b5d0d8ec..82b565c9d4 100644
--- a/src/lib/libssl/src/doc/apps/req.pod
+++ b/src/lib/libssl/src/doc/apps/req.pod
@@ -30,6 +30,7 @@ B<openssl> B<req>
 [B<-[md5|sha1|md2|mdc2]>]
 [B<-config filename>]
 [B<-subj arg>]
+[B<-multivalue-rdn>]
 [B<-x509>]
 [B<-days n>]
 [B<-set_serial n>]
@@ -173,6 +174,15 @@ when processing a request.
 The arg must be formatted as I</type0=value0/type1=value1/type2=...>,
 characters may be escaped by \ (backslash), no spaces are skipped.
 
+=item B<-multivalue-rdn>
+
+this option causes the -subj argument to be interpreted with full
+support for multivalued RDNs. Example:
+
+I</DC=org/DC=OpenSSL/DC=users/UID=123456+CN=John Doe>
+
+If -multi-rdn is not used then the UID value is I<123456+CN=John Doe>.
+
 =item B<-x509>
 
 this option outputs a self signed certificate instead of a certificate
diff --git a/src/lib/libssl/src/doc/apps/rsautl.pod b/src/lib/libssl/src/doc/apps/rsautl.pod
index a7c1681d98..1a498c2f62 100644
--- a/src/lib/libssl/src/doc/apps/rsautl.pod
+++ b/src/lib/libssl/src/doc/apps/rsautl.pod
@@ -152,7 +152,7 @@ The final BIT STRING contains the actual signature. It can be extracted with:
 
 The certificate public key can be extracted with:
  
- openssl x509 -in test/testx509.pem -pubout -noout >pubkey.pem
+ openssl x509 -in test/testx509.pem -pubkey -noout >pubkey.pem
 
 The signature can be analysed with:
 
diff --git a/src/lib/libssl/src/doc/apps/s_client.pod b/src/lib/libssl/src/doc/apps/s_client.pod
index 8d19079973..c44d357cf7 100644
--- a/src/lib/libssl/src/doc/apps/s_client.pod
+++ b/src/lib/libssl/src/doc/apps/s_client.pod
@@ -11,7 +11,10 @@ B<openssl> B<s_client>
 [B<-connect host:port>]
 [B<-verify depth>]
 [B<-cert filename>]
+[B<-certform DER|PEM>]
 [B<-key filename>]
+[B<-keyform DER|PEM>]
+[B<-pass arg>]
 [B<-CApath directory>]
 [B<-CAfile filename>]
 [B<-reconnect>]
@@ -35,6 +38,10 @@ B<openssl> B<s_client>
 [B<-cipher cipherlist>]
 [B<-starttls protocol>]
 [B<-engine id>]
+[B<-tlsextdebug>]
+[B<-no_ticket>]
+[B<-sess_out filename>]
+[B<-sess_in filename>]
 [B<-rand file(s)>]
 
 =head1 DESCRIPTION
@@ -57,11 +64,24 @@ then an attempt is made to connect to the local host on port 4433.
 The certificate to use, if one is requested by the server. The default is
 not to use a certificate.
 
+=item B<-certform format>
+
+The certificate format to use: DER or PEM. PEM is the default.
+
 =item B<-key keyfile>
 
 The private key to use. If not specified then the certificate file will
 be used.
 
+=item B<-keyform format>
+
+The private format to use: DER or PEM. PEM is the default.
+
+=item B<-pass arg>
+
+the private key password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
 =item B<-verify depth>
 
 The verify depth to use. This specifies the maximum length of the
@@ -168,7 +188,27 @@ command for more information.
 
 send the protocol-specific message(s) to switch to TLS for communication.
 B<protocol> is a keyword for the intended protocol.  Currently, the only
-supported keywords are "smtp" and "pop3".
+supported keywords are "smtp", "pop3", "imap", and "ftp".
+
+=item B<-tlsextdebug>
+
+print out a hex dump of any TLS extensions received from the server. Note: this
+option is only available if extension support is explicitly enabled at compile
+time
+
+=item B<-no_ticket>
+
+disable RFC4507bis session ticket support. Note: this option is only available
+if extension support is explicitly enabled at compile time
+
+=item B<-sess_out filename>
+
+output SSL session to B<filename>
+
+=item B<-sess_in sess.pem>
+
+load SSL session from B<filename>. The client will attempt to resume a
+connection from this session.
 
 =item B<-engine id>
 
@@ -230,6 +270,13 @@ on the command line is no guarantee that the certificate works.
 If there are problems verifying a server certificate then the
 B<-showcerts> option can be used to show the whole chain.
 
+Since the SSLv23 client hello cannot include compression methods or extensions
+these will only be supported if its use is disabled, for example by using the
+B<-no_sslv2> option.
+
+TLS extensions are only supported in OpenSSL 0.9.8 if they are explictly
+enabled at compile time using for example the B<enable-tlsext> switch.
+
 =head1 BUGS
 
 Because this program has a lot of options and also because some of
diff --git a/src/lib/libssl/src/doc/apps/s_server.pod b/src/lib/libssl/src/doc/apps/s_server.pod
index 1d21921e47..fdcc170e28 100644
--- a/src/lib/libssl/src/doc/apps/s_server.pod
+++ b/src/lib/libssl/src/doc/apps/s_server.pod
@@ -12,10 +12,18 @@ B<openssl> B<s_server>
 [B<-context id>]
 [B<-verify depth>]
 [B<-Verify depth>]
+[B<-crl_check>]
+[B<-crl_check_all>]
 [B<-cert filename>]
+[B<-certform DER|PEM>]
 [B<-key keyfile>]
+[B<-keyform DER|PEM>]
+[B<-pass arg>]
 [B<-dcert filename>]
+[B<-dcertform DER|PEM>]
 [B<-dkey keyfile>]
+[B<-dkeyform DER|PEM>]
+[B<-dpass arg>]
 [B<-dhparam filename>]
 [B<-nbio>]
 [B<-nbio_test>]
@@ -42,6 +50,8 @@ B<openssl> B<s_server>
 [B<-WWW>]
 [B<-HTTP>]
 [B<-engine id>]
+[B<-tlsextdebug>]
+[B<-no_ticket>]
 [B<-id_prefix arg>]
 [B<-rand file(s)>]
 
@@ -70,11 +80,24 @@ certificate and some require a certificate with a certain public key type:
 for example the DSS cipher suites require a certificate containing a DSS
 (DSA) key. If not specified then the filename "server.pem" will be used.
 
+=item B<-certform format>
+
+The certificate format to use: DER or PEM. PEM is the default.
+
 =item B<-key keyfile>
 
 The private key to use. If not specified then the certificate file will
 be used.
 
+=item B<-keyform format>
+
+The private format to use: DER or PEM. PEM is the default.
+
+=item B<-pass arg>
+
+the private key password source. For more information about the format of B<arg>
+see the B<PASS PHRASE ARGUMENTS> section in L<openssl(1)|openssl(1)>.
+
 =item B<-dcert filename>, B<-dkey keyname>
 
 specify an additional certificate and private key, these behave in the
@@ -86,6 +109,10 @@ and some a DSS (DSA) key. By using RSA and DSS certificates and keys
 a server can support clients which only support RSA or DSS cipher suites
 by using an appropriate certificate.
 
+=item B<-dcertform format>, B<-dkeyform format>, B<-dpass arg>
+
+addtional certificate and private key format and passphrase respectively.
+
 =item B<-nocert>
 
 if this option is set then no certificate is used. This restricts the
@@ -117,6 +144,12 @@ the client. With the B<-verify> option a certificate is requested but the
 client does not have to send one, with the B<-Verify> option the client
 must supply a certificate or an error occurs.
 
+=item B<-crl_check>, B<-crl_check_all>
+
+Check the peer certificate has not been revoked by its CA.
+The CRL(s) are appended to the certificate file. With the B<-crl_check_all>
+option all CRLs of all CAs in the chain are checked.
+
 =item B<-CApath directory>
 
 The directory to use for client certificate verification. This directory
@@ -182,6 +215,14 @@ also included in the server list is used. Because the client specifies
 the preference order, the order of the server cipherlist irrelevant. See
 the B<ciphers> command for more information.
 
+=item B<-tlsextdebug>
+
+print out a hex dump of any TLS extensions received from the server.
+
+=item B<-no_ticket>
+
+disable RFC4507bis session ticket support. 
+
 =item B<-www>
 
 sends a status message back to the client when it connects. This includes
@@ -284,6 +325,9 @@ mean any CA is acceptable. This is useful for debugging purposes.
 
 The session parameters can printed out using the B<sess_id> program.
 
+TLS extensions are only supported in OpenSSL 0.9.8 if they are explictly
+enabled at compile time using for example the B<enable-tlsext> switch.
+
 =head1 BUGS
 
 Because this program has a lot of options and also because some of
diff --git a/src/lib/libssl/src/doc/apps/smime.pod b/src/lib/libssl/src/doc/apps/smime.pod
index 84b673f791..caf2d2689e 100644
--- a/src/lib/libssl/src/doc/apps/smime.pod
+++ b/src/lib/libssl/src/doc/apps/smime.pod
@@ -20,6 +20,9 @@ B<openssl> B<smime>
 [B<-aes128>]
 [B<-aes192>]
 [B<-aes256>]
+[B<-camellia128>]
+[B<-camellia192>]
+[B<-camellia256>]
 [B<-in file>]
 [B<-certfile file>]
 [B<-signer file>]
@@ -129,10 +132,10 @@ B<-verify>. This directory must be a standard certificate directory: that
 is a hash of each subject name (using B<x509 -hash>) should be linked
 to each certificate.
 
-=item B<-des -des3 -rc2-40 -rc2-64 -rc2-128 -aes128 -aes192 -aes256>
+=item B<-des -des3 -rc2-40 -rc2-64 -rc2-128 -aes128 -aes192 -aes256 -camellia128 -camellia192 -camellia256>
 
 the encryption algorithm to use. DES (56 bits), triple DES (168 bits),
-40, 64 or 128 bit RC2 or 128, 192 or 256 bit AES respectively.  If not
+40, 64 or 128 bit RC2, 128, 192 or 256 bit AES, or 128, 192 or 256 bit Camellia respectively.  If not
 specified 40 bit RC2 is used. Only used with B<-encrypt>.
 
 =item B<-nointern>
@@ -354,6 +357,10 @@ alternatively you can base64 decode the signature and use
 
  openssl smime -verify -inform DER -in signature.der -content content.txt
 
+Create an encrypted message using 128 bit Camellia:
+
+ openssl smime -encrypt -in plain.txt -camellia128 -out mail.msg cert.pem
+
 =head1 BUGS
 
 The MIME parser isn't very clever: it seems to handle most messages that I've thrown
diff --git a/src/lib/libssl/src/doc/apps/verify.pod b/src/lib/libssl/src/doc/apps/verify.pod
index ea5c29c150..ff2629d2cf 100644
--- a/src/lib/libssl/src/doc/apps/verify.pod
+++ b/src/lib/libssl/src/doc/apps/verify.pod
@@ -169,7 +169,7 @@ the operation was successful.
 the issuer certificate could not be found: this occurs if the issuer certificate
 of an untrusted certificate cannot be found.
 
-=item B<3 X509_V_ERR_UNABLE_TO_GET_CRL unable to get certificate CRL>
+=item B<3 X509_V_ERR_UNABLE_TO_GET_CRL: unable to get certificate CRL>
 
 the CRL of a certificate could not be found. Unused.
 
diff --git a/src/lib/libssl/src/doc/apps/x509.pod b/src/lib/libssl/src/doc/apps/x509.pod
index 50343cd685..a925da41f1 100644
--- a/src/lib/libssl/src/doc/apps/x509.pod
+++ b/src/lib/libssl/src/doc/apps/x509.pod
@@ -17,6 +17,8 @@ B<openssl> B<x509>
 [B<-out filename>]
 [B<-serial>]
 [B<-hash>]
+[B<-subject_hash>]
+[B<-issuer_hash>]
 [B<-subject>]
 [B<-issuer>]
 [B<-nameopt option>]
@@ -96,8 +98,8 @@ default.
 
 the digest to use. This affects any signing or display option that uses a message
 digest, such as the B<-fingerprint>, B<-signkey> and B<-CA> options. If not
-specified then MD5 is used. If the key being used to sign with is a DSA key then
-this option has no effect: SHA1 is always used with DSA keys.
+specified then SHA1 is used. If the key being used to sign with is a DSA key
+then this option has no effect: SHA1 is always used with DSA keys.
 
 =item B<-engine id>
 
@@ -141,12 +143,20 @@ contained in the certificate.
 
 outputs the certificate serial number.
 
-=item B<-hash>
+=item B<-subject_hash>
 
 outputs the "hash" of the certificate subject name. This is used in OpenSSL to
 form an index to allow certificates in a directory to be looked up by subject
 name.
 
+=item B<-issuer_hash>
+
+outputs the "hash" of the certificate issuer name.
+
+=item B<-hash>
+
+synonym for "-hash" for backward compatibility reasons.
+
 =item B<-subject>
 
 outputs the subject name.
@@ -394,13 +404,13 @@ B<sep_comma_plus>, B<dn_rev> and B<sname>.
 
 a oneline format which is more readable than RFC2253. It is equivalent to
 specifying the  B<esc_2253>, B<esc_ctrl>, B<esc_msb>, B<utf8>, B<dump_nostr>,
-B<dump_der>, B<use_quote>, B<sep_comma_plus_spc>, B<spc_eq> and B<sname>
+B<dump_der>, B<use_quote>, B<sep_comma_plus_space>, B<space_eq> and B<sname>
 options.
 
 =item B<multiline>
 
 a multiline format. It is equivalent B<esc_ctrl>, B<esc_msb>, B<sep_multiline>,
-B<spc_eq>, B<lname> and B<align>.
+B<space_eq>, B<lname> and B<align>.
 
 =item B<esc_2253>
 
@@ -500,7 +510,7 @@ diagnostic purpose.
 align field values for a more readable output. Only usable with
 B<sep_multiline>.
 
-=item B<spc_eq>
+=item B<space_eq>
 
 places spaces round the B<=> character which follows the field
 name.
@@ -610,7 +620,7 @@ Display the certificate subject name in RFC2253 form:
 Display the certificate subject name in oneline form on a terminal
 supporting UTF8:
 
- openssl x509 -in cert.pem -noout -subject -nameopt oneline,-escmsb
+ openssl x509 -in cert.pem -noout -subject -nameopt oneline,-esc_msb
 
 Display the certificate MD5 fingerprint:
 
@@ -815,4 +825,8 @@ OpenSSL 0.9.5 and later.
 L<req(1)|req(1)>, L<ca(1)|ca(1)>, L<genrsa(1)|genrsa(1)>,
 L<gendsa(1)|gendsa(1)>, L<verify(1)|verify(1)>
 
+=head1 HISTORY
+
+Before OpenSSL 0.9.8, the default digest for RSA keys was MD5.
+
 =cut
diff --git a/src/lib/libssl/src/doc/c-indentation.el b/src/lib/libssl/src/doc/c-indentation.el
index cbf01cb172..90861d3979 100644
--- a/src/lib/libssl/src/doc/c-indentation.el
+++ b/src/lib/libssl/src/doc/c-indentation.el
@@ -20,6 +20,7 @@
 
 (c-add-style "eay"
              '((c-basic-offset . 8)
+               (indent-tabs-mode . t)
                (c-comment-only-line-offset . 0)
                (c-hanging-braces-alist)
                (c-offsets-alist . ((defun-open . +)
diff --git a/src/lib/libssl/src/doc/crypto/BIO_f_base64.pod b/src/lib/libssl/src/doc/crypto/BIO_f_base64.pod
index 929557d22f..438af3b6b6 100644
--- a/src/lib/libssl/src/doc/crypto/BIO_f_base64.pod
+++ b/src/lib/libssl/src/doc/crypto/BIO_f_base64.pod
@@ -63,7 +63,7 @@ data to standard output:
  bio = BIO_new_fp(stdin, BIO_NOCLOSE);
  bio_out = BIO_new_fp(stdout, BIO_NOCLOSE);
  bio = BIO_push(b64, bio);
- while((inlen = BIO_read(bio, inbuf, 512) > 0) 
+ while((inlen = BIO_read(bio, inbuf, 512)) > 0) 
         BIO_write(bio_out, inbuf, inlen);
 
  BIO_free_all(bio);
diff --git a/src/lib/libssl/src/doc/crypto/BIO_set_callback.pod b/src/lib/libssl/src/doc/crypto/BIO_set_callback.pod
index 9b6961ca8d..4759556245 100644
--- a/src/lib/libssl/src/doc/crypto/BIO_set_callback.pod
+++ b/src/lib/libssl/src/doc/crypto/BIO_set_callback.pod
@@ -17,7 +17,7 @@ BIO_debug_callback - BIO callback functions
  long BIO_debug_callback(BIO *bio,int cmd,const char *argp,int argi,
         long argl,long ret);
 
- typedef long callback(BIO *b, int oper, const char *argp,
+ typedef long (*callback)(BIO *b, int oper, const char *argp,
                         int argi, long argl, long retvalue);
 
 =head1 DESCRIPTION
diff --git a/src/lib/libssl/src/doc/crypto/BN_add_word.pod b/src/lib/libssl/src/doc/crypto/BN_add_word.pod
index 94244adea4..70667d2893 100644
--- a/src/lib/libssl/src/doc/crypto/BN_add_word.pod
+++ b/src/lib/libssl/src/doc/crypto/BN_add_word.pod
@@ -29,11 +29,11 @@ BN_add_word() adds B<w> to B<a> (C<a+=w>).
 
 BN_sub_word() subtracts B<w> from B<a> (C<a-=w>).
 
-BN_mul_word() multiplies B<a> and B<w> (C<a*=b>).
+BN_mul_word() multiplies B<a> and B<w> (C<a*=w>).
 
 BN_div_word() divides B<a> by B<w> (C<a/=w>) and returns the remainder.
 
-BN_mod_word() returns the remainder of B<a> divided by B<w> (C<a%m>).
+BN_mod_word() returns the remainder of B<a> divided by B<w> (C<a%w>).
 
 For BN_div_word() and BN_mod_word(), B<w> must not be 0.
 
@@ -42,7 +42,8 @@ For BN_div_word() and BN_mod_word(), B<w> must not be 0.
 BN_add_word(), BN_sub_word() and BN_mul_word() return 1 for success, 0
 on error. The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
 
-BN_mod_word() and BN_div_word() return B<a>%B<w>.
+BN_mod_word() and BN_div_word() return B<a>%B<w> on success and
+B<(BN_ULONG)-1> if an error occurred.
 
 =head1 SEE ALSO
 
@@ -54,4 +55,7 @@ BN_add_word() and BN_mod_word() are available in all versions of
 SSLeay and OpenSSL. BN_div_word() was added in SSLeay 0.8, and
 BN_sub_word() and BN_mul_word() in SSLeay 0.9.0.
 
+Before 0.9.8a the return value for BN_div_word() and BN_mod_word()
+in case of an error was 0.
+
 =cut
diff --git a/src/lib/libssl/src/doc/crypto/BN_new.pod b/src/lib/libssl/src/doc/crypto/BN_new.pod
index 3033789c51..ab7a105e3a 100644
--- a/src/lib/libssl/src/doc/crypto/BN_new.pod
+++ b/src/lib/libssl/src/doc/crypto/BN_new.pod
@@ -20,7 +20,7 @@ BN_new, BN_init, BN_clear, BN_free, BN_clear_free - allocate and free BIGNUMs
 
 =head1 DESCRIPTION
 
-BN_new() allocated and initializes a B<BIGNUM> structure. BN_init()
+BN_new() allocates and initializes a B<BIGNUM> structure. BN_init()
 initializes an existing uninitialized B<BIGNUM>.
 
 BN_clear() is used to destroy sensitive data such as keys when they
diff --git a/src/lib/libssl/src/doc/crypto/DH_set_method.pod b/src/lib/libssl/src/doc/crypto/DH_set_method.pod
index 73261fc467..d5cdc3be0c 100644
--- a/src/lib/libssl/src/doc/crypto/DH_set_method.pod
+++ b/src/lib/libssl/src/doc/crypto/DH_set_method.pod
@@ -36,7 +36,7 @@ structures created later. B<NB>: This is true only whilst no ENGINE has been set
 as a default for DH, so this function is no longer recommended.
 
 DH_get_default_method() returns a pointer to the current default DH_METHOD.
-However, the meaningfulness of this result is dependant on whether the ENGINE
+However, the meaningfulness of this result is dependent on whether the ENGINE
 API is being used, so this function is no longer recommended.
 
 DH_set_method() selects B<meth> to perform all operations using the key B<dh>.
diff --git a/src/lib/libssl/src/doc/crypto/DSA_set_method.pod b/src/lib/libssl/src/doc/crypto/DSA_set_method.pod
index bc3cfb1f0a..9c1434bd8d 100644
--- a/src/lib/libssl/src/doc/crypto/DSA_set_method.pod
+++ b/src/lib/libssl/src/doc/crypto/DSA_set_method.pod
@@ -36,7 +36,7 @@ structures created later. B<NB>: This is true only whilst no ENGINE has
 been set as a default for DSA, so this function is no longer recommended.
 
 DSA_get_default_method() returns a pointer to the current default
-DSA_METHOD. However, the meaningfulness of this result is dependant on
+DSA_METHOD. However, the meaningfulness of this result is dependent on
 whether the ENGINE API is being used, so this function is no longer 
 recommended.
 
diff --git a/src/lib/libssl/src/doc/crypto/EVP_BytesToKey.pod b/src/lib/libssl/src/doc/crypto/EVP_BytesToKey.pod
index 016381f3e9..d375c46e03 100644
--- a/src/lib/libssl/src/doc/crypto/EVP_BytesToKey.pod
+++ b/src/lib/libssl/src/doc/crypto/EVP_BytesToKey.pod
@@ -60,7 +60,7 @@ EVP_BytesToKey() returns the size of the derived key in bytes.
 =head1 SEE ALSO
 
 L<evp(3)|evp(3)>, L<rand(3)|rand(3)>,
-L<EVP_EncryptInit(3)|EVP_EncryptInit(3)>,
+L<EVP_EncryptInit(3)|EVP_EncryptInit(3)>
 
 =head1 HISTORY
 
diff --git a/src/lib/libssl/src/doc/crypto/EVP_DigestInit.pod b/src/lib/libssl/src/doc/crypto/EVP_DigestInit.pod
index faa992286b..236e2fa8d1 100644
--- a/src/lib/libssl/src/doc/crypto/EVP_DigestInit.pod
+++ b/src/lib/libssl/src/doc/crypto/EVP_DigestInit.pod
@@ -18,7 +18,7 @@ EVP digest routines
  EVP_MD_CTX *EVP_MD_CTX_create(void);
 
  int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl);
- int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *d, unsigned int cnt);
+ int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *d, size_t cnt);
  int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *md,
         unsigned int *s);
 
diff --git a/src/lib/libssl/src/doc/crypto/EVP_SealInit.pod b/src/lib/libssl/src/doc/crypto/EVP_SealInit.pod
index 48a0e29954..7d793e19ef 100644
--- a/src/lib/libssl/src/doc/crypto/EVP_SealInit.pod
+++ b/src/lib/libssl/src/doc/crypto/EVP_SealInit.pod
@@ -8,9 +8,9 @@ EVP_SealInit, EVP_SealUpdate, EVP_SealFinal - EVP envelope encryption
 
  #include <openssl/evp.h>
 
- int EVP_SealInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, 
-                unsigned char **ek, int *ekl, unsigned char *iv,
-                EVP_PKEY **pubk, int npubk);
+ int EVP_SealInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+                  unsigned char **ek, int *ekl, unsigned char *iv,
+                  EVP_PKEY **pubk, int npubk);
  int EVP_SealUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out,
          int *outl, unsigned char *in, int inl);
  int EVP_SealFinal(EVP_CIPHER_CTX *ctx, unsigned char *out,
diff --git a/src/lib/libssl/src/doc/crypto/RAND_bytes.pod b/src/lib/libssl/src/doc/crypto/RAND_bytes.pod
index ce6329ce54..1a9b91e281 100644
--- a/src/lib/libssl/src/doc/crypto/RAND_bytes.pod
+++ b/src/lib/libssl/src/doc/crypto/RAND_bytes.pod
@@ -25,6 +25,9 @@ unpredictable. They can be used for non-cryptographic purposes and for
 certain purposes in cryptographic protocols, but usually not for key
 generation etc.
 
+The contents of B<buf> is mixed into the entropy pool before retrieving
+the new pseudo-random bytes unless disabled at compile time (see FAQ).
+
 =head1 RETURN VALUES
 
 RAND_bytes() returns 1 on success, 0 otherwise. The error code can be
diff --git a/src/lib/libssl/src/doc/crypto/RAND_egd.pod b/src/lib/libssl/src/doc/crypto/RAND_egd.pod
index 62adbe19b2..079838ea2e 100644
--- a/src/lib/libssl/src/doc/crypto/RAND_egd.pod
+++ b/src/lib/libssl/src/doc/crypto/RAND_egd.pod
@@ -50,7 +50,7 @@ non-blocking mode.
 
 Alternatively, the EGD-interface compatible daemon PRNGD can be used. It is
 available from
-http://www.aet.tu-cottbus.de/personen/jaenicke/postfix_tls/prngd.html .
+http://prngd.sourceforge.net/ .
 PRNGD does employ an internal PRNG itself and can therefore never run
 out of entropy.
 
diff --git a/src/lib/libssl/src/doc/crypto/RAND_set_rand_method.pod b/src/lib/libssl/src/doc/crypto/RAND_set_rand_method.pod
index c9bb6d9f27..e5b780fad0 100644
--- a/src/lib/libssl/src/doc/crypto/RAND_set_rand_method.pod
+++ b/src/lib/libssl/src/doc/crypto/RAND_set_rand_method.pod
@@ -30,7 +30,7 @@ true only whilst no ENGINE has been set as a default for RAND, so this function
 is no longer recommended.
 
 RAND_get_default_method() returns a pointer to the current RAND_METHOD.
-However, the meaningfulness of this result is dependant on whether the ENGINE
+However, the meaningfulness of this result is dependent on whether the ENGINE
 API is being used, so this function is no longer recommended.
 
 =head1 THE RAND_METHOD STRUCTURE
diff --git a/src/lib/libssl/src/doc/crypto/RSA_get_ex_new_index.pod b/src/lib/libssl/src/doc/crypto/RSA_get_ex_new_index.pod
index 46cc8f5359..7d0fd1f91d 100644
--- a/src/lib/libssl/src/doc/crypto/RSA_get_ex_new_index.pod
+++ b/src/lib/libssl/src/doc/crypto/RSA_get_ex_new_index.pod
@@ -17,12 +17,12 @@ RSA_get_ex_new_index, RSA_set_ex_data, RSA_get_ex_data - add application specifi
 
  void *RSA_get_ex_data(RSA *r, int idx);
 
- typedef int new_func(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
-                int idx, long argl, void *argp);
- typedef void free_func(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
-                int idx, long argl, void *argp);
- typedef int dup_func(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from, void *from_d, 
-                int idx, long argl, void *argp);
+ typedef int CRYPTO_EX_new(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                           int idx, long argl, void *argp);
+ typedef void CRYPTO_EX_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+                             int idx, long argl, void *argp);
+ typedef int CRYPTO_EX_dup(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from, void *from_d,
+                           int idx, long argl, void *argp);
 
 =head1 DESCRIPTION
 
diff --git a/src/lib/libssl/src/doc/crypto/RSA_set_method.pod b/src/lib/libssl/src/doc/crypto/RSA_set_method.pod
index 0a305f6b14..2c963d7e5b 100644
--- a/src/lib/libssl/src/doc/crypto/RSA_set_method.pod
+++ b/src/lib/libssl/src/doc/crypto/RSA_set_method.pod
@@ -42,7 +42,7 @@ structures created later. B<NB>: This is true only whilst no ENGINE has
 been set as a default for RSA, so this function is no longer recommended.
 
 RSA_get_default_method() returns a pointer to the current default
-RSA_METHOD. However, the meaningfulness of this result is dependant on
+RSA_METHOD. However, the meaningfulness of this result is dependent on
 whether the ENGINE API is being used, so this function is no longer 
 recommended.
 
diff --git a/src/lib/libssl/src/doc/crypto/RSA_sign.pod b/src/lib/libssl/src/doc/crypto/RSA_sign.pod
index 71688a665e..8553be8e99 100644
--- a/src/lib/libssl/src/doc/crypto/RSA_sign.pod
+++ b/src/lib/libssl/src/doc/crypto/RSA_sign.pod
@@ -8,10 +8,10 @@ RSA_sign, RSA_verify - RSA signatures
 
  #include <openssl/rsa.h>
 
- int RSA_sign(int type, unsigned char *m, unsigned int m_len,
+ int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
     unsigned char *sigret, unsigned int *siglen, RSA *rsa);
 
- int RSA_verify(int type, unsigned char *m, unsigned int m_len,
+ int RSA_verify(int type, const unsigned char *m, unsigned int m_len,
     unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
 
 =head1 DESCRIPTION
diff --git a/src/lib/libssl/src/doc/crypto/bn.pod b/src/lib/libssl/src/doc/crypto/bn.pod
index 210dfeac08..cd2f8e50c6 100644
--- a/src/lib/libssl/src/doc/crypto/bn.pod
+++ b/src/lib/libssl/src/doc/crypto/bn.pod
@@ -27,6 +27,9 @@ bn - multiprecision integer arithmetics
  int BN_num_bits(const BIGNUM *a);
  int BN_num_bits_word(BN_ULONG w);
 
+ void BN_set_negative(BIGNUM *a, int n);
+ int  BN_is_negative(const BIGNUM *a);
+
  int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
  int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
  int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx);
@@ -118,6 +121,25 @@ bn - multiprecision integer arithmetics
  int BN_to_montgomery(BIGNUM *r, BIGNUM *a, BN_MONT_CTX *mont,
          BN_CTX *ctx);
 
+ BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai,
+        BIGNUM *mod);
+ void BN_BLINDING_free(BN_BLINDING *b);
+ int BN_BLINDING_update(BN_BLINDING *b,BN_CTX *ctx);
+ int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx);
+ int BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx);
+ int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b,
+        BN_CTX *ctx);
+ int BN_BLINDING_invert_ex(BIGNUM *n,const BIGNUM *r,BN_BLINDING *b,
+        BN_CTX *ctx);
+ unsigned long BN_BLINDING_get_thread_id(const BN_BLINDING *);
+ void BN_BLINDING_set_thread_id(BN_BLINDING *, unsigned long);
+ unsigned long BN_BLINDING_get_flags(const BN_BLINDING *);
+ void BN_BLINDING_set_flags(BN_BLINDING *, unsigned long);
+ BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b,
+        const BIGNUM *e, BIGNUM *m, BN_CTX *ctx,
+        int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                          const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx),
+        BN_MONT_CTX *m_ctx);
 
 =head1 DESCRIPTION
 
@@ -153,6 +175,7 @@ L<BN_cmp(3)|BN_cmp(3)>, L<BN_zero(3)|BN_zero(3)>, L<BN_rand(3)|BN_rand(3)>,
 L<BN_generate_prime(3)|BN_generate_prime(3)>, L<BN_set_bit(3)|BN_set_bit(3)>,
 L<BN_bn2bin(3)|BN_bn2bin(3)>, L<BN_mod_inverse(3)|BN_mod_inverse(3)>,
 L<BN_mod_mul_reciprocal(3)|BN_mod_mul_reciprocal(3)>,
-L<BN_mod_mul_montgomery(3)|BN_mod_mul_montgomery(3)> 
+L<BN_mod_mul_montgomery(3)|BN_mod_mul_montgomery(3)>,
+L<BN_BLINDING_new(3)|BN_BLINDING_new(3)>
 
 =cut
diff --git a/src/lib/libssl/src/doc/crypto/bn_internal.pod b/src/lib/libssl/src/doc/crypto/bn_internal.pod
index 9805a7c9f2..891914678c 100644
--- a/src/lib/libssl/src/doc/crypto/bn_internal.pod
+++ b/src/lib/libssl/src/doc/crypto/bn_internal.pod
@@ -72,19 +72,19 @@ applications.
 
  typedef struct bignum_st
         {
-        int top;      /* index of last used d (most significant word) */
-        BN_ULONG *d;  /* pointer to an array of 'BITS2' bit chunks */
+        int top;      /* number of words used in d */
+        BN_ULONG *d;  /* pointer to an array containing the integer value */
         int max;      /* size of the d array */
         int neg;      /* sign */
         } BIGNUM;
 
-The big number is stored in B<d>, a malloc()ed array of B<BN_ULONG>s,
-least significant first. A B<BN_ULONG> can be either 16, 32 or 64 bits
-in size (B<BITS2>), depending on the 'number of bits' specified in
+The integer value is stored in B<d>, a malloc()ed array of words (B<BN_ULONG>),
+least significant word first. A B<BN_ULONG> can be either 16, 32 or 64 bits
+in size, depending on the 'number of bits' (B<BITS2>) specified in
 C<openssl/bn.h>.
 
 B<max> is the size of the B<d> array that has been allocated.  B<top>
-is the 'last' entry being used, so for a value of 4, bn.d[0]=4 and
+is the number of words being used, so for a value of 4, bn.d[0]=4 and
 bn.top=1.  B<neg> is 1 if the number is negative.  When a B<BIGNUM> is
 B<0>, the B<d> field can be B<NULL> and B<top> == B<0>.
 
@@ -202,7 +202,7 @@ call bn_expand2(), which allocates a new B<d> array and copies the
 data.  They return B<NULL> on error, B<b> otherwise.
 
 The bn_fix_top() macro reduces B<a-E<gt>top> to point to the most
-significant non-zero word when B<a> has shrunk.
+significant non-zero word plus one when B<a> has shrunk.
 
 =head2 Debugging
 
diff --git a/src/lib/libssl/src/doc/crypto/des_modes.pod b/src/lib/libssl/src/doc/crypto/des_modes.pod
index 0cc22150e7..0ad01eafe2 100644
--- a/src/lib/libssl/src/doc/crypto/des_modes.pod
+++ b/src/lib/libssl/src/doc/crypto/des_modes.pod
@@ -1,5 +1,7 @@
 =pod
 
+=for comment openssl_manual_section:7
+
 =head1 NAME
 
 des_modes - the variants of DES and other crypto algorithms of OpenSSL
diff --git a/src/lib/libssl/src/doc/crypto/md5.pod b/src/lib/libssl/src/doc/crypto/md5.pod
index 6e6322dcdc..d11d5c32cb 100644
--- a/src/lib/libssl/src/doc/crypto/md5.pod
+++ b/src/lib/libssl/src/doc/crypto/md5.pod
@@ -12,10 +12,10 @@ MD4_Final, MD5_Init, MD5_Update, MD5_Final - MD2, MD4, and MD5 hash functions
  unsigned char *MD2(const unsigned char *d, unsigned long n,
                   unsigned char *md);
 
- void MD2_Init(MD2_CTX *c);
- void MD2_Update(MD2_CTX *c, const unsigned char *data,
+ int MD2_Init(MD2_CTX *c);
+ int MD2_Update(MD2_CTX *c, const unsigned char *data,
                   unsigned long len);
- void MD2_Final(unsigned char *md, MD2_CTX *c);
+ int MD2_Final(unsigned char *md, MD2_CTX *c);
 
 
  #include <openssl/md4.h>
@@ -23,10 +23,10 @@ MD4_Final, MD5_Init, MD5_Update, MD5_Final - MD2, MD4, and MD5 hash functions
  unsigned char *MD4(const unsigned char *d, unsigned long n,
                   unsigned char *md);
 
- void MD4_Init(MD4_CTX *c);
- void MD4_Update(MD4_CTX *c, const void *data,
+ int MD4_Init(MD4_CTX *c);
+ int MD4_Update(MD4_CTX *c, const void *data,
                   unsigned long len);
- void MD4_Final(unsigned char *md, MD4_CTX *c);
+ int MD4_Final(unsigned char *md, MD4_CTX *c);
 
 
  #include <openssl/md5.h>
@@ -34,10 +34,10 @@ MD4_Final, MD5_Init, MD5_Update, MD5_Final - MD2, MD4, and MD5 hash functions
  unsigned char *MD5(const unsigned char *d, unsigned long n,
                   unsigned char *md);
 
- void MD5_Init(MD5_CTX *c);
- void MD5_Update(MD5_CTX *c, const void *data,
+ int MD5_Init(MD5_CTX *c);
+ int MD5_Update(MD5_CTX *c, const void *data,
                   unsigned long len);
- void MD5_Final(unsigned char *md, MD5_CTX *c);
+ int MD5_Final(unsigned char *md, MD5_CTX *c);
 
 =head1 DESCRIPTION
 
@@ -78,8 +78,8 @@ preferred.
 MD2(), MD4(), and MD5() return pointers to the hash value. 
 
 MD2_Init(), MD2_Update(), MD2_Final(), MD4_Init(), MD4_Update(),
-MD4_Final(), MD5_Init(), MD5_Update(), and MD5_Final() do not return
-values.
+MD4_Final(), MD5_Init(), MD5_Update(), and MD5_Final() return 1 for
+success, 0 otherwise.
 
 =head1 CONFORMING TO
 
diff --git a/src/lib/libssl/src/doc/crypto/mdc2.pod b/src/lib/libssl/src/doc/crypto/mdc2.pod
index 538f474e30..2fab9a9871 100644
--- a/src/lib/libssl/src/doc/crypto/mdc2.pod
+++ b/src/lib/libssl/src/doc/crypto/mdc2.pod
@@ -11,10 +11,10 @@ MDC2, MDC2_Init, MDC2_Update, MDC2_Final - MDC2 hash function
  unsigned char *MDC2(const unsigned char *d, unsigned long n,
                   unsigned char *md);
 
- void MDC2_Init(MDC2_CTX *c);
- void MDC2_Update(MDC2_CTX *c, const unsigned char *data,
+ int MDC2_Init(MDC2_CTX *c);
+ int MDC2_Update(MDC2_CTX *c, const unsigned char *data,
                   unsigned long len);
- void MDC2_Final(unsigned char *md, MDC2_CTX *c);
+ int MDC2_Final(unsigned char *md, MDC2_CTX *c);
 
 =head1 DESCRIPTION
 
@@ -46,7 +46,7 @@ hash functions directly.
 
 MDC2() returns a pointer to the hash value. 
 
-MDC2_Init(), MDC2_Update() and MDC2_Final() do not return values.
+MDC2_Init(), MDC2_Update() and MDC2_Final() return 1 for success, 0 otherwise.
 
 =head1 CONFORMING TO
 
diff --git a/src/lib/libssl/src/doc/crypto/ripemd.pod b/src/lib/libssl/src/doc/crypto/ripemd.pod
index 9a634ca866..348ef7c961 100644
--- a/src/lib/libssl/src/doc/crypto/ripemd.pod
+++ b/src/lib/libssl/src/doc/crypto/ripemd.pod
@@ -12,10 +12,10 @@ RIPEMD-160 hash function
  unsigned char *RIPEMD160(const unsigned char *d, unsigned long n,
                   unsigned char *md);
 
- void RIPEMD160_Init(RIPEMD160_CTX *c);
- void RIPEMD160_Update(RIPEMD_CTX *c, const void *data,
+ int RIPEMD160_Init(RIPEMD160_CTX *c);
+ int RIPEMD160_Update(RIPEMD_CTX *c, const void *data,
                   unsigned long len);
- void RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c);
+ int RIPEMD160_Final(unsigned char *md, RIPEMD160_CTX *c);
 
 =head1 DESCRIPTION
 
@@ -47,8 +47,8 @@ hash functions directly.
 
 RIPEMD160() returns a pointer to the hash value. 
 
-RIPEMD160_Init(), RIPEMD160_Update() and RIPEMD160_Final() do not
-return values.
+RIPEMD160_Init(), RIPEMD160_Update() and RIPEMD160_Final() return 1 for
+success, 0 otherwise.
 
 =head1 CONFORMING TO
 
diff --git a/src/lib/libssl/src/doc/crypto/sha.pod b/src/lib/libssl/src/doc/crypto/sha.pod
index 158457270f..d7a56accd3 100644
--- a/src/lib/libssl/src/doc/crypto/sha.pod
+++ b/src/lib/libssl/src/doc/crypto/sha.pod
@@ -11,10 +11,10 @@ SHA1, SHA1_Init, SHA1_Update, SHA1_Final - Secure Hash Algorithm
  unsigned char *SHA1(const unsigned char *d, unsigned long n,
                   unsigned char *md);
 
- void SHA1_Init(SHA_CTX *c);
- void SHA1_Update(SHA_CTX *c, const void *data,
+ int SHA1_Init(SHA_CTX *c);
+ int SHA1_Update(SHA_CTX *c, const void *data,
                   unsigned long len);
- void SHA1_Final(unsigned char *md, SHA_CTX *c);
+ int SHA1_Final(unsigned char *md, SHA_CTX *c);
 
 =head1 DESCRIPTION
 
@@ -48,7 +48,7 @@ used only when backward compatibility is required.
 
 SHA1() returns a pointer to the hash value. 
 
-SHA1_Init(), SHA1_Update() and SHA1_Final() do not return values.
+SHA1_Init(), SHA1_Update() and SHA1_Final() return 1 for success, 0 otherwise.
 
 =head1 CONFORMING TO
 
diff --git a/src/lib/libssl/src/doc/openssl.txt b/src/lib/libssl/src/doc/openssl.txt
index 432a17b66c..f8817b0a71 100644
--- a/src/lib/libssl/src/doc/openssl.txt
+++ b/src/lib/libssl/src/doc/openssl.txt
@@ -154,8 +154,22 @@ for example contain data in multiple sections. The correct syntax to
 use is defined by the extension code itself: check out the certificate
 policies extension for an example.
 
-In addition it is also possible to use the word DER to include arbitrary
-data in any extension.
+There are two ways to encode arbitrary extensions.
+
+The first way is to use the word ASN1 followed by the extension content
+using the same syntax as ASN1_generate_nconf(). For example:
+
+1.2.3.4=critical,ASN1:UTF8String:Some random data
+
+1.2.3.4=ASN1:SEQUENCE:seq_sect
+
+[seq_sect]
+
+field1 = UTF8:field1
+field2 = UTF8:field2
+
+It is also possible to use the word DER to include arbitrary data in any
+extension.
 
 1.2.3.4=critical,DER:01:02:03:04
 1.2.3.4=DER:01020304
@@ -336,16 +350,21 @@ Subject Alternative Name.
 The subject alternative name extension allows various literal values to be
 included in the configuration file. These include "email" (an email address)
 "URI" a uniform resource indicator, "DNS" (a DNS domain name), RID (a
-registered ID: OBJECT IDENTIFIER) and IP (and IP address).
+registered ID: OBJECT IDENTIFIER), IP (and IP address) and otherName.
 
 Also the email option include a special 'copy' value. This will automatically
 include and email addresses contained in the certificate subject name in
 the extension.
 
+otherName can include arbitrary data associated with an OID: the value
+should be the OID followed by a semicolon and the content in standard
+ASN1_generate_nconf() format.
+
 Examples:
 
 subjectAltName=email:copy,email:my@other.address,URI:http://my.url.here/
 subjectAltName=email:my@other.address,RID:1.2.3.4
+subjectAltName=otherName:1.2.3.4;UTF8:some other identifier
 
 Issuer Alternative Name.
 
@@ -759,7 +778,7 @@ called.
 
 The X509V3_EXT_METHOD structure is described below.
 
-strut {
+struct {
 int ext_nid;
 int ext_flags;
 X509V3_EXT_NEW ext_new;
diff --git a/src/lib/libssl/src/doc/ssl/SSL_CTX_set_options.pod b/src/lib/libssl/src/doc/ssl/SSL_CTX_set_options.pod
index fa63263601..eaed190809 100644
--- a/src/lib/libssl/src/doc/ssl/SSL_CTX_set_options.pod
+++ b/src/lib/libssl/src/doc/ssl/SSL_CTX_set_options.pod
@@ -201,6 +201,15 @@ When performing renegotiation as a server, always start a new session
 (i.e., session resumption requests are only accepted in the initial
 handshake).  This option is not needed for clients.
 
+=item SSL_OP_NO_TICKET
+
+Normally clients and servers will, where possible, transparently make use
+of RFC4507bis tickets for stateless session resumption if extension support
+is explicitly set when OpenSSL is compiled.
+
+If this option is set this functionality is disabled and tickets will
+not be used by clients or servers.
+
 =back
 
 =head1 RETURN VALUES
diff --git a/src/lib/libssl/src/doc/ssl/SSL_CTX_set_tmp_rsa_callback.pod b/src/lib/libssl/src/doc/ssl/SSL_CTX_set_tmp_rsa_callback.pod
index f85775927d..534643cd9d 100644
--- a/src/lib/libssl/src/doc/ssl/SSL_CTX_set_tmp_rsa_callback.pod
+++ b/src/lib/libssl/src/doc/ssl/SSL_CTX_set_tmp_rsa_callback.pod
@@ -18,7 +18,7 @@ SSL_CTX_set_tmp_rsa_callback, SSL_CTX_set_tmp_rsa, SSL_CTX_need_tmp_rsa, SSL_set
  long SSL_set_tmp_rsa(SSL *ssl, RSA *rsa)
  long SSL_need_tmp_rsa(SSL *ssl)
 
- RSA *(*tmp_rsa_callback)(SSL *ssl, int is_export, int keylength));
+ RSA *(*tmp_rsa_callback)(SSL *ssl, int is_export, int keylength);
 
 =head1 DESCRIPTION
 
diff --git a/src/lib/libssl/src/doc/ssl/SSL_CTX_use_certificate.pod b/src/lib/libssl/src/doc/ssl/SSL_CTX_use_certificate.pod
index 48c888c337..10be95fdb1 100644
--- a/src/lib/libssl/src/doc/ssl/SSL_CTX_use_certificate.pod
+++ b/src/lib/libssl/src/doc/ssl/SSL_CTX_use_certificate.pod
@@ -77,6 +77,12 @@ SSL_CTX_use_PrivateKey() adds B<pkey> as private key to B<ctx>.
 SSL_CTX_use_RSAPrivateKey() adds the private key B<rsa> of type RSA
 to B<ctx>. SSL_use_PrivateKey() adds B<pkey> as private key to B<ssl>;
 SSL_use_RSAPrivateKey() adds B<rsa> as private key of type RSA to B<ssl>.
+If a certificate has already been set and the private does not belong
+to the certificate an error is returned. To change a certificate, private
+key pair the new certificate needs to be set with SSL_use_certificate()
+or SSL_CTX_use_certificate() before setting the private key with
+SSL_CTX_use_PrivateKey() or SSL_use_PrivateKey(). 
+
 
 SSL_CTX_use_PrivateKey_ASN1() adds the private key of type B<pk>
 stored at memory location B<d> (length B<len>) to B<ctx>.
@@ -154,4 +160,10 @@ L<SSL_CTX_set_cipher_list(3)|SSL_CTX_set_cipher_list(3)>,
 L<SSL_CTX_set_client_cert_cb(3)|SSL_CTX_set_client_cert_cb(3)>,
 L<SSL_CTX_add_extra_chain_cert(3)|SSL_CTX_add_extra_chain_cert(3)>
 
+=head1 HISTORY
+
+Support for DER encoded private keys (SSL_FILETYPE_ASN1) in
+SSL_CTX_use_PrivateKey_file() and SSL_use_PrivateKey_file() was added
+in 0.9.8 .
+
 =cut
diff --git a/src/lib/libssl/src/doc/ssl/SSL_SESSION_get_time.pod b/src/lib/libssl/src/doc/ssl/SSL_SESSION_get_time.pod
index 00883ed2a0..490337a32f 100644
--- a/src/lib/libssl/src/doc/ssl/SSL_SESSION_get_time.pod
+++ b/src/lib/libssl/src/doc/ssl/SSL_SESSION_get_time.pod
@@ -2,7 +2,7 @@
 
 =head1 NAME
 
-SSL_SESSION_get_time, SSL_SESSION_set_time, SSL_SESSION_get_timeout, SSL_SESSION_get_timeout - retrieve and manipulate session time and timeout settings
+SSL_SESSION_get_time, SSL_SESSION_set_time, SSL_SESSION_get_timeout, SSL_SESSION_set_timeout - retrieve and manipulate session time and timeout settings
 
 =head1 SYNOPSIS
 
diff --git a/src/lib/libssl/src/doc/ssleay.txt b/src/lib/libssl/src/doc/ssleay.txt
index 666de94e50..a8b04d7059 100644
--- a/src/lib/libssl/src/doc/ssleay.txt
+++ b/src/lib/libssl/src/doc/ssleay.txt
@@ -4295,7 +4295,7 @@ X-Status:
 Loading client certs into MSIE 3.01
 ===================================
 
-This document conatains all the information necessary to succesfully set up 
+This document contains all the information necessary to successfully set up 
 some scripts to issue client certs to Microsoft Internet Explorer. It 
 includes the required knowledge about the model MSIE uses for client 
 certification and includes complete sample scripts ready to play with. The 
diff --git a/src/lib/libssl/src/doc/standards.txt b/src/lib/libssl/src/doc/standards.txt
index f6675b574b..a5ce778f8e 100644
--- a/src/lib/libssl/src/doc/standards.txt
+++ b/src/lib/libssl/src/doc/standards.txt
@@ -88,10 +88,26 @@ PKCS#12: Personal Information Exchange Syntax Standard, version 1.0.
      (Format: TXT=143173 bytes) (Obsoletes RFC2437) (Status:           
      INFORMATIONAL)                                         
 
+3713 A Description of the Camellia Encryption Algorithm. M. Matsui,
+     J. Nakajima, S. Moriai. April 2004. (Format: TXT=25031 bytes)
+     (Status: INFORMATIONAL)
+
 3820 Internet X.509 Public Key Infrastructure (PKI) Proxy Certificate
      Profile. S. Tuecke, V. Welch, D. Engert, L. Pearlman, M. Thompson.
      June 2004. (Format: TXT=86374 bytes) (Status: PROPOSED STANDARD)
 
+4132 Addition of Camellia Cipher Suites to Transport Layer Security
+     (TLS). S. Moriai, A. Kato, M. Kanda. July 2005. (Format: TXT=13590
+     bytes) (Status: PROPOSED STANDARD)
+
+4162 Addition of SEED Cipher Suites to Transport Layer Security (TLS).
+     H.J. Lee, J.H. Yoon, J.I. Lee. August 2005. (Format: TXT=10578 bytes)
+     (Status: PROPOSED STANDARD)
+
+4269 The SEED Encryption Algorithm. H.J. Lee, S.J. Lee, J.H. Yoon,
+     D.H. Cheon, J.I. Lee. December 2005. (Format: TXT=34390 bytes)
+     (Obsoletes RFC4009) (Status: INFORMATIONAL)
+
 
 Related:
 --------
@@ -250,7 +266,11 @@ STARTTLS documents.
      Protocol. A. Jungmaier, E. Rescorla, M. Tuexen. December 2002.
      (Format: TXT=16333 bytes) (Status: PROPOSED STANDARD)
 
-  "Securing FTP with TLS", 01/27/2000, <draft-murray-auth-ftp-ssl-05.txt>  
+3657 Use of the Camellia Encryption Algorithm in Cryptographic 
+     Message Syntax (CMS). S. Moriai, A. Kato. January 2004.
+     (Format: TXT=26282 bytes) (Status: PROPOSED STANDARD)
+
+"Securing FTP with TLS", 01/27/2000, <draft-murray-auth-ftp-ssl-05.txt>  
  
 
 To be implemented:
diff --git a/src/lib/libssl/src/e_os.h b/src/lib/libssl/src/e_os.h
index e2b6561066..acc6a15eb7 100644
--- a/src/lib/libssl/src/e_os.h
+++ b/src/lib/libssl/src/e_os.h
@@ -181,6 +181,25 @@ extern "C" {
 #define closesocket(s)              close(s)
 #define readsocket(s,b,n)           read((s),(b),(n))
 #define writesocket(s,b,n)          write((s),(char *)(b),(n))
+#elif defined(OPENSSL_SYS_NETWARE)
+#if defined(NETWARE_BSDSOCK)
+#define get_last_socket_error() errno
+#define clear_socket_error()    errno=0
+#define closesocket(s)          close(s)
+#define ioctlsocket(a,b,c)      ioctl(a,b,c)
+#if defined(NETWARE_LIBC)
+#define readsocket(s,b,n)       recv((s),(b),(n),0)
+#define writesocket(s,b,n)      send((s),(b),(n),0)
+#else
+#define readsocket(s,b,n)       recv((s),(char*)(b),(n),0)
+#define writesocket(s,b,n)      send((s),(char*)(b),(n),0)
+#endif
+#else
+#define get_last_socket_error() WSAGetLastError()
+#define clear_socket_error()    WSASetLastError(0)
+#define readsocket(s,b,n)               recv((s),(b),(n),0)
+#define writesocket(s,b,n)              send((s),(b),(n),0)
+#endif
 #else
 #define get_last_socket_error() errno
 #define clear_socket_error()    errno=0
@@ -191,7 +210,6 @@ extern "C" {
 #endif
 
 #ifdef WIN16
-#  define OPENSSL_NO_FP_API
 #  define MS_CALLBACK   _far _loadds
 #  define MS_FAR        _far
 #else
@@ -200,6 +218,7 @@ extern "C" {
 #endif
 
 #ifdef OPENSSL_NO_STDIO
+#  undef OPENSSL_NO_FP_API
 #  define OPENSSL_NO_FP_API
 #endif
 
@@ -232,11 +251,46 @@ extern "C" {
 #  define NO_DIRENT
 
 #  ifdef WINDOWS
+#    if !defined(_WIN32_WCE) && !defined(_WIN32_WINNT)
+       /*
+        * Defining _WIN32_WINNT here in e_os.h implies certain "discipline."
+        * Most notably we ought to check for availability of each specific
+        * routine with GetProcAddress() and/or quard NT-specific calls with
+        * GetVersion() < 0x80000000. One can argue that in latter "or" case
+        * we ought to /DELAYLOAD some .DLLs in order to protect ourselves
+        * against run-time link errors. This doesn't seem to be necessary,
+        * because it turned out that already Windows 95, first non-NT Win32
+        * implementation, is equipped with at least NT 3.51 stubs, dummy
+        * routines with same name, but which do nothing. Meaning that it's
+        * apparently appropriate to guard generic NT calls with GetVersion
+        * alone, while NT 4.0 and above calls ought to be additionally
+        * checked upon with GetProcAddress.
+        */
+#      define _WIN32_WINNT 0x0400
+#    endif
 #    include <windows.h>
 #    include <stddef.h>
 #    include <errno.h>
 #    include <string.h>
+#    ifdef _WIN64
+#      define strlen(s) _strlen31(s)
+/* cut strings to 2GB */
+static unsigned int _strlen31(const char *str)
+        {
+        unsigned int len=0;
+        while (*str && len<0x80000000U) str++, len++;
+        return len&0x7FFFFFFF;
+        }
+#    endif
 #    include <malloc.h>
+#    if defined(_MSC_VER) && _MSC_VER<=1200 && defined(_MT) && defined(isspace)
+       /* compensate for bug is VC6 ctype.h */
+#      undef isspace
+#      undef isdigit
+#      undef isalnum
+#      undef isupper
+#      undef isxdigit
+#    endif
 #  endif
 #  include <io.h>
 #  include <fcntl.h>
@@ -323,6 +377,32 @@ extern "C" {
                                      __VMS_EXIT |= 0x10000000; \
                                      exit(__VMS_EXIT); } while(0)
 #    define NO_SYS_PARAM_H
+
+#  elif defined(OPENSSL_SYS_NETWARE)
+#    include <fcntl.h>
+#    include <unistd.h>
+#    define NO_SYS_TYPES_H
+#    undef  DEVRANDOM
+#    ifdef NETWARE_CLIB
+#      define getpid GetThreadID
+       extern int GetThreadID(void);
+/* #      include <conio.h> */
+       extern int kbhit(void);
+       extern void delay(unsigned milliseconds);
+#    else
+#      include <screen.h>
+#    endif
+#    define NO_SYSLOG
+#    define _setmode setmode
+#    define _kbhit kbhit
+#    define _O_TEXT O_TEXT
+#    define _O_BINARY O_BINARY
+#    define OPENSSL_CONF   "openssl.cnf"
+#    define SSLEAY_CONF    OPENSSL_CONF
+#    define RFILE    ".rnd"
+#    define LIST_SEPARATOR_CHAR ';'
+#    define EXIT(n)  { if (n) printf("ERROR: %d\n", (int)n); exit(n); }
+
 #  else
      /* !defined VMS */
 #    ifdef OPENSSL_SYS_MPE
@@ -376,6 +456,15 @@ extern "C" {
 #    elif !defined(__DJGPP__)
 #      include <winsock.h>
 extern HINSTANCE _hInstance;
+#      ifdef _WIN64
+/*
+ * Even though sizeof(SOCKET) is 8, it's safe to cast it to int, because
+ * the value constitutes an index in per-process table of limited size
+ * and not a real pointer.
+ */
+#        define socket(d,t,p)   ((int)socket(d,t,p))
+#        define accept(s,f,l)   ((int)accept(s,f,l))
+#      endif
 #      define SSLeay_Write(a,b,c)       send((a),(b),(c),0)
 #      define SSLeay_Read(a,b,c)        recv((a),(b),(c),0)
 #      define SHUTDOWN(fd)              { shutdown((fd),0); closesocket(fd); }
@@ -395,6 +484,27 @@ extern HINSTANCE _hInstance;
 #    define SHUTDOWN(fd)                MacSocket_close(fd)
 #    define SHUTDOWN2(fd)               MacSocket_close(fd)
 
+#  elif defined(OPENSSL_SYS_NETWARE)
+         /* NetWare uses the WinSock2 interfaces by default, but can be configured for BSD
+         */
+#      if defined(NETWARE_BSDSOCK)
+#        include <sys/socket.h>
+#        include <netinet/in.h>
+#        include <sys/time.h>
+#        if defined(NETWARE_CLIB)
+#          include <sys/bsdskt.h>
+#        else
+#          include <sys/select.h>
+#        endif
+#        define INVALID_SOCKET (int)(~0)
+#      else
+#        include <novsock2.h>
+#      endif
+#      define SSLeay_Write(a,b,c)   send((a),(b),(c),0)
+#      define SSLeay_Read(a,b,c) recv((a),(b),(c),0)
+#      define SHUTDOWN(fd)    { shutdown((fd),0); closesocket(fd); }
+#      define SHUTDOWN2(fd)      { shutdown((fd),2); closesocket(fd); }
+
 #  else
 
 #    ifndef NO_SYS_PARAM_H
@@ -479,6 +589,9 @@ extern HINSTANCE _hInstance;
 extern char *sys_errlist[]; extern int sys_nerr;
 # define strerror(errnum) \
         (((errnum)<0 || (errnum)>=sys_nerr) ? NULL : sys_errlist[errnum])
+  /* Being signed SunOS 4.x memcpy breaks ASN1_OBJECT table lookup */
+#include "crypto/o_str.h"
+# define memcmp OPENSSL_memcmp
 #endif
 
 #ifndef OPENSSL_EXIT
@@ -524,13 +637,12 @@ extern char *sys_errlist[]; extern int sys_nerr;
 #elif defined(OPENSSL_SYS_OS2) && defined(__EMX__)
 #  define strcasecmp stricmp
 #  define strncasecmp strnicmp
-#else
-#  ifdef NO_STRINGS_H
-    int strcasecmp();
-    int strncasecmp();
-#  else
-#    include <strings.h>
-#  endif /* NO_STRINGS_H */
+#elif defined(OPENSSL_SYS_NETWARE)
+#  include <string.h>
+#  if defined(NETWARE_CLIB)
+#    define strcasecmp stricmp
+#    define strncasecmp strnicmp
+#  endif /* NETWARE_CLIB */
 #endif
 
 #if defined(OPENSSL_SYS_OS2) && defined(__EMX__)
diff --git a/src/lib/libssl/src/e_os2.h b/src/lib/libssl/src/e_os2.h
index d8de8beead..9da0b65448 100644
--- a/src/lib/libssl/src/e_os2.h
+++ b/src/lib/libssl/src/e_os2.h
@@ -76,17 +76,20 @@ extern "C" {
 # define OPENSSL_SYS_MACINTOSH_CLASSIC
 #endif
 
+/* ----------------------- NetWare ----------------------------------------- */
+#if defined(NETWARE) || defined(OPENSSL_SYSNAME_NETWARE)
+# undef OPENSSL_SYS_UNIX
+# define OPENSSL_SYS_NETWARE
+#endif
+
 /* ---------------------- Microsoft operating systems ---------------------- */
 
-/* The 16 bit environments are pretty straightforward */
-#if defined(OPENSSL_SYSNAME_WIN16) || defined(OPENSSL_SYSNAME_MSDOS)
+/* Note that MSDOS actually denotes 32-bit environments running on top of
+   MS-DOS, such as DJGPP one. */
+#if defined(OPENSSL_SYSNAME_MSDOS)
 # undef OPENSSL_SYS_UNIX
 # define OPENSSL_SYS_MSDOS
 #endif
-#if defined(OPENSSL_SYSNAME_WIN16)
-# undef OPENSSL_SYS_UNIX
-# define OPENSSL_SYS_WIN16
-#endif
 
 /* For 32 bit environment, there seems to be the CygWin environment and then
    all the others that try to do the same thing Microsoft does... */
@@ -114,7 +117,7 @@ extern "C" {
 #endif
 
 /* Anything that tries to look like Microsoft is "Windows" */
-#if defined(OPENSSL_SYS_WIN16) || defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WINNT) || defined(OPENSSL_SYS_WINCE)
+#if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WINNT) || defined(OPENSSL_SYS_WINCE)
 # undef OPENSSL_SYS_UNIX
 # define OPENSSL_SYS_WINDOWS
 # ifndef OPENSSL_SYS_MSDOS
@@ -248,7 +251,7 @@ extern "C" {
 #define OPENSSL_EXTERN OPENSSL_IMPORT
 
 /* Macros to allow global variables to be reached through function calls when
-   required (if a shared library version requires it, for example.
+   required (if a shared library version requvres it, for example.
    The way it's done allows definitions like this:
 
         // in foobar.c
diff --git a/src/lib/libssl/src/install.com b/src/lib/libssl/src/install.com
index 8de3a7f977..4e4fe80dfe 100644
--- a/src/lib/libssl/src/install.com
+++ b/src/lib/libssl/src/install.com
@@ -52,23 +52,23 @@ $	IF F$PARSE("WRK_SSLPRIVATE:") .EQS. "" THEN -
 $       IF F$PARSE("WRK_SSLROOT:[VMS]") .EQS. "" THEN -
            CREATE/DIR/LOG WRK_SSLROOT:[VMS]
 $
-$       DIRS := CRYPTO,FIPS,SSL,APPS,VMS!,RSAREF,TEST,TOOLS
+$       SDIRS := CRYPTO,SSL,APPS,VMS!,RSAREF,TEST,TOOLS
 $       EXHEADER := e_os2.h
 $
 $       COPY 'EXHEADER' WRK_SSLINCLUDE: /LOG
 $       SET FILE/PROT=WORLD:RE WRK_SSLINCLUDE:'EXHEADER'
 $
 $       I = 0
-$ LOOP_DIRS: 
-$       D = F$ELEMENT(I, ",", DIRS)
+$ LOOP_SDIRS: 
+$       D = F$ELEMENT(I, ",", SDIRS)
 $       I = I + 1
-$       IF D .EQS. "," THEN GOTO LOOP_DIRS_END
+$       IF D .EQS. "," THEN GOTO LOOP_SDIRS_END
 $       WRITE SYS$OUTPUT "Installing ",D," files."
 $       SET DEFAULT [.'D']
 $       @INSTALL 'ROOT']
 $       SET DEFAULT [-]
-$       GOTO LOOP_DIRS
-$ LOOP_DIRS_END:
+$       GOTO LOOP_SDIRS
+$ LOOP_SDIRS_END:
 $
 $       DEASSIGN WRK_SSLROOT
 $       DEASSIGN WRK_SSLVLIB
diff --git a/src/lib/libssl/src/makevms.com b/src/lib/libssl/src/makevms.com
index a739625302..4f70308082 100644
--- a/src/lib/libssl/src/makevms.com
+++ b/src/lib/libssl/src/makevms.com
@@ -28,6 +28,7 @@ $!      SSL       Just build the "[.xxx.EXE.SSL]LIBSSL.OLB" library.
 $!      SSL_TASK  Just build the "[.xxx.EXE.SSL]SSL_TASK.EXE" program.
 $!      TEST      Just build the "[.xxx.EXE.TEST]" test programs for OpenSSL.
 $!      APPS      Just build the "[.xxx.EXE.APPS]" application programs for OpenSSL.
+$!      ENGINES   Just build the "[.xxx.EXE.ENGINES]" application programs for OpenSSL.
 $!
 $!
 $! P2 is ignored (it was used to denote if RSAref should be used or not,
@@ -138,6 +139,10 @@ $!  Build The [.xxx.EXE.APPS] OpenSSL Application Utilities.
 $!
 $   GOSUB APPS
 $!
+$!  Build The [.xxx.EXE.ENGINES] OpenSSL Shareable Engines.
+$!
+$   GOSUB ENGINES
+$!
 $! Else...
 $!
 $ ELSE
@@ -178,7 +183,7 @@ $ WRITE H_FILE "# define OPENSSL_SYS_VMS"
 $ WRITE H_FILE "#endif"
 $ CONFIG_LOGICALS := NO_ASM,NO_RSA,NO_DSA,NO_DH,NO_MD2,NO_MD5,NO_RIPEMD,-
         NO_SHA,NO_SHA0,NO_SHA1,NO_DES/NO_MDC2;NO_MDC2,NO_RC2,NO_RC4,NO_RC5,-
-        NO_IDEA,NO_BF,NO_CAST,NO_HMAC,NO_SSL2,FIPS
+        NO_IDEA,NO_BF,NO_CAST,NO_CAMELLIA,NO_SEED,NO_HMAC,NO_SSL2
 $ CONFIG_LOG_I = 0
 $ CONFIG_LOG_LOOP:
 $   CONFIG_LOG_E1 = F$ELEMENT(CONFIG_LOG_I,",",CONFIG_LOGICALS)
@@ -214,6 +219,9 @@ $     ENDIF
 $   ENDIF
 $   GOTO CONFIG_LOG_LOOP
 $ CONFIG_LOG_LOOP_END:
+$ WRITE H_FILE "#ifndef OPENSSL_NO_STATIC_ENGINE"
+$ WRITE H_FILE "# define OPENSSL_NO_STATIC_ENGINE"
+$ WRITE H_FILE "#endif"
 $ WRITE H_FILE "#ifndef OPENSSL_THREADS"
 $ WRITE H_FILE "# define OPENSSL_THREADS"
 $ WRITE H_FILE "#endif"
@@ -266,6 +274,7 @@ $   WRITE H_FILE "#define DES_UNROLL"
 $   WRITE H_FILE "#endif"
 $!
 $   WRITE H_FILE "#if defined(HEADER_BN_H)"
+$   WRITE H_FILE "#undef BN_LLONG"      ! Never define with SIXTY_FOUR_BIT
 $   WRITE H_FILE "#undef SIXTY_FOUR_BIT_LONG"
 $   WRITE H_FILE "#undef SIXTY_FOUR_BIT"
 $   WRITE H_FILE "#define SIXTY_FOUR_BIT"
@@ -300,6 +309,7 @@ $   WRITE H_FILE "#undef DES_UNROLL"
 $   WRITE H_FILE "#endif"
 $!
 $   WRITE H_FILE "#if defined(HEADER_BN_H)"
+$   WRITE H_FILE "#undef BN_LLONG"      ! VAX C/DEC C doesn't have long long
 $   WRITE H_FILE "#undef SIXTY_FOUR_BIT_LONG"
 $   WRITE H_FILE "#undef SIXTY_FOUR_BIT"
 $   WRITE H_FILE "#undef THIRTY_TWO_BIT"
@@ -307,7 +317,12 @@ $   WRITE H_FILE "#define THIRTY_TWO_BIT"
 $   WRITE H_FILE "#undef SIXTEEN_BIT"
 $   WRITE H_FILE "#undef EIGHT_BIT"
 $   WRITE H_FILE "#endif"
-$
+$!
+$   WRITE H_FILE "#if defined(HEADER_SHA_H)"
+$   WRITE H_FILE "#undef OPENSSL_NO_SHA512"
+$   WRITE H_FILE "#define OPENSSL_NO_SHA512"
+$   WRITE H_FILE "#endif"
+$!
 $   WRITE H_FILE "#undef OPENSSL_EXPORT_VAR_AS_FUNCTION"
 $   WRITE H_FILE "#define OPENSSL_EXPORT_VAR_AS_FUNCTION"
 $!
@@ -388,6 +403,7 @@ $!
 $! Copy all the *TEST.C files from [.CRYPTO...] into [.TEST]
 $!
 $ COPY SYS$DISK:[.CRYPTO.*]%*TEST.C SYS$DISK:[.TEST]
+$ COPY SYS$DISK:[.CRYPTO.SHA]SHA%%%T.C SYS$DISK:[.TEST]
 $ COPY SYS$DISK:[.CRYPTO.EVP]EVPTESTS.TXT SYS$DISK:[.TEST]
 $!
 $! Copy all the *TEST.C files from [.SSL...] into [.TEST]
@@ -410,13 +426,17 @@ $ COPY 'EXHEADER' SYS$DISK:[.INCLUDE.OPENSSL]
 $!
 $! Copy All The ".H" Files From The [.CRYPTO] Directory Tree.
 $!
-$ SDIRS := ,MD2,MD4,MD5,SHA,MDC2,HMAC,RIPEMD,-
-   DES,RC2,RC4,RC5,IDEA,BF,CAST,-
-   BN,EC,RSA,DSA,DH,DSO,ENGINE,AES,-
-   BUFFER,BIO,STACK,LHASH,RAND,ERR,OBJECTS,-
-   EVP,ASN1,PEM,X509,X509V3,CONF,TXT_DB,PKCS7,PKCS12,COMP,OCSP,UI,KRB5
+$ SDIRS := ,-
+   OBJECTS,-
+   MD2,MD4,MD5,SHA,MDC2,HMAC,RIPEMD,-
+   DES,RC2,RC4,RC5,IDEA,BF,CAST,CAMELLIA,SEED,-
+   BN,EC,RSA,DSA,ECDSA,DH,ECDH,DSO,ENGINE,AES,-
+   BUFFER,BIO,STACK,LHASH,RAND,ERR,-
+   EVP,ASN1,PEM,X509,X509V3,CONF,TXT_DB,PKCS7,PKCS12,COMP,OCSP,UI,KRB5,-
+   STORE,CMS,PQUEUE
 $ EXHEADER_ := crypto.h,tmdiff.h,opensslv.h,opensslconf.h,ebcdic.h,symhacks.h,-
                 ossl_typ.h
+$ EXHEADER_OBJECTS := objects.h,obj_mac.h
 $ EXHEADER_MD2 := md2.h
 $ EXHEADER_MD4 := md4.h
 $ EXHEADER_MD5 := md5.h
@@ -431,11 +451,15 @@ $ EXHEADER_RC5 := rc5.h
 $ EXHEADER_IDEA := idea.h
 $ EXHEADER_BF := blowfish.h
 $ EXHEADER_CAST := cast.h
+$ EXHEADER_CAMELLIA := camellia.h
+$ EXHEADER_SEED := seed.h
 $ EXHEADER_BN := bn.h
 $ EXHEADER_EC := ec.h
 $ EXHEADER_RSA := rsa.h
 $ EXHEADER_DSA := dsa.h
+$ EXHEADER_ECDSA := ecdsa.h
 $ EXHEADER_DH := dh.h
+$ EXHEADER_ECDH := ecdh.h
 $ EXHEADER_DSO := dso.h
 $ EXHEADER_ENGINE := engine.h
 $ EXHEADER_AES := aes.h
@@ -445,7 +469,6 @@ $ EXHEADER_STACK := stack.h,safestack.h
 $ EXHEADER_LHASH := lhash.h
 $ EXHEADER_RAND := rand.h
 $ EXHEADER_ERR := err.h
-$ EXHEADER_OBJECTS := objects.h,obj_mac.h
 $ EXHEADER_EVP := evp.h
 $ EXHEADER_ASN1 := asn1.h,asn1_mac.h,asn1t.h
 $ EXHEADER_PEM := pem.h,pem2.h
@@ -459,6 +482,10 @@ $ EXHEADER_COMP := comp.h
 $ EXHEADER_OCSP := ocsp.h
 $ EXHEADER_UI := ui.h,ui_compat.h
 $ EXHEADER_KRB5 := krb5_asn.h
+$!EXHEADER_STORE := store.h,str_compat.h
+$ EXHEADER_STORE := store.h
+$ EXHEADER_CMS := cms.h
+$ EXHEADER_PQUEUE := pqueue.h,pq_compat.h
 $
 $ I = 0
 $ LOOP_SDIRS: 
@@ -477,38 +504,9 @@ $ LOOP_SDIRS_END:
 $!
 $! Copy All The ".H" Files From The [.SSL] Directory.
 $!
-$ EXHEADER := ssl.h,ssl2.h,ssl3.h,ssl23.h,tls1.h,kssl.h
+$ EXHEADER := ssl.h,ssl2.h,ssl3.h,ssl23.h,tls1.h,dtls1.h,kssl.h
 $ COPY SYS$DISK:[.SSL]'EXHEADER' SYS$DISK:[.INCLUDE.OPENSSL]
 $!
-$! Copy All The ".H" Files From The [.FIPS-1_0] Directories.
-$!
-$ FDIRS := ,SHA,RAND,DES,AES,DSA,RSA,DH,HMAC
-$ EXHEADER_ := fips.h
-$ EXHEADER_SHA := fips_sha.h
-$ EXHEADER_RAND := fips_rand.h
-$ EXHEADER_DES :=
-$ EXHEADER_AES :=
-$ EXHEADER_DSA :=
-$ EXHEADER_RSA :=
-$ EXHEADER_DH :=
-$ EXHEADER_HMAC :=
-$
-$ I = 0
-$ LOOP_FDIRS: 
-$ D = F$EDIT(F$ELEMENT(I, ",", FDIRS),"TRIM")
-$ I = I + 1
-$ IF D .EQS. "," THEN GOTO LOOP_FDIRS_END
-$ tmp = EXHEADER_'D'
-$ IF tmp .EQS. "" THEN GOTO LOOP_FDIRS
-$ IF D .EQS. ""
-$ THEN
-$   COPY [.FIPS-1_0]'tmp' SYS$DISK:[.INCLUDE.OPENSSL] !/LOG
-$ ELSE
-$   COPY [.FIPS-1_0.'D']'tmp' SYS$DISK:[.INCLUDE.OPENSSL] !/LOG
-$ ENDIF
-$ GOTO LOOP_FDIRS
-$ LOOP_FDIRS_END:
-$!
 $! Purge all doubles
 $!
 $ PURGE SYS$DISK:[.INCLUDE.OPENSSL]*.H
@@ -534,21 +532,9 @@ $! Build The [.xxx.EXE.CRYPTO]LIBCRYPTO.OLB Library.
 $!  
 $ @CRYPTO-LIB LIBRARY 'DEBUGGER' "''COMPILER'" "''TCPIP_TYPE'" "''ISSEVEN'" "''BUILDPART'"
 $!
-$! Go Back To The Main Directory.
-$!
-$ SET DEFAULT [-]
-$!
-$! Go To The [.FIPS-1_0] Directory.
-$!
-$ SET DEFAULT SYS$DISK:[.FIPS-1_0]
-$!
-$! Build The [.xxx.EXE.CRYPTO]LIBCRYPTO.OLB Library.
-$!  
-$ @FIPS-LIB LIBRARY 'DEBUGGER' "''COMPILER'" "''TCPIP_TYPE'" "''ISSEVEN'" "''BUILDPART'"
-$!
 $! Build The [.xxx.EXE.CRYPTO]*.EXE Test Applications.
 $!  
-$ @FIPS-LIB APPS 'DEBUGGER' "''COMPILER'" "''TCPIP_TYPE'" 'ISSEVEN'
+$ @CRYPTO-LIB APPS 'DEBUGGER' "''COMPILER'" "''TCPIP_TYPE'" 'ISSEVEN' "''BUILDPART'"
 $!
 $! Go Back To The Main Directory.
 $!
@@ -658,6 +644,31 @@ $! That's All, Time To RETURN.
 $!
 $ RETURN
 $!
+$! Build The OpenSSL Application Programs.
+$!
+$ ENGINES:
+$!
+$! Tell The User What We Are Doing.
+$!
+$ WRITE SYS$OUTPUT ""
+$ WRITE SYS$OUTPUT "Building OpenSSL [.",ARCH,".EXE.ENGINES] Engines."
+$!
+$! Go To The [.ENGINES] Directory.
+$!
+$ SET DEFAULT SYS$DISK:[.ENGINES]
+$!
+$! Build The Application Programs.
+$!
+$ @MAKEENGINES ENGINES 'DEBUGGER' "''COMPILER'" "''TCPIP_TYPE'" 'ISSEVEN' "''BUILDPART'"
+$!
+$! Go Back To The Main Directory.
+$!
+$ SET DEFAULT [-]
+$!
+$! That's All, Time To RETURN.
+$!
+$ RETURN
+$!
 $! Check The User's Options.
 $!
 $ CHECK_OPTIONS:
diff --git a/src/lib/libssl/src/ms/do_masm.bat b/src/lib/libssl/src/ms/do_masm.bat
index ce22a44305..6ea1c98716 100644
--- a/src/lib/libssl/src/ms/do_masm.bat
+++ b/src/lib/libssl/src/ms/do_masm.bat
@@ -1,69 +1,77 @@
-

-@echo off

-echo Generating x86 for MASM assember

-

-echo Bignum

-cd crypto\bn\asm

-perl x86.pl win32 > bn_win32.asm

-cd ..\..\..

-

-echo DES

-cd crypto\des\asm

-perl des-586.pl win32 > d_win32.asm

-cd ..\..\..

-

-echo "crypt(3)"

-

-cd crypto\des\asm

-perl crypt586.pl win32 > y_win32.asm

-cd ..\..\..

-

-echo Blowfish

-

-cd crypto\bf\asm

-perl bf-586.pl win32 > b_win32.asm

-cd ..\..\..

-

-echo CAST5

-cd crypto\cast\asm

-perl cast-586.pl win32 > c_win32.asm

-cd ..\..\..

-

-echo RC4

-cd crypto\rc4\asm

-perl rc4-586.pl win32 > r4_win32.asm

-cd ..\..\..

-

-echo MD5

-cd crypto\md5\asm

-perl md5-586.pl win32 > m5_win32.asm

-cd ..\..\..

-

-echo SHA1

-cd crypto\sha\asm

-perl sha1-586.pl win32 > s1_win32.asm

-cd ..\..\..

-

-echo RIPEMD160

-cd crypto\ripemd\asm

-perl rmd-586.pl win32 > rm_win32.asm

-cd ..\..\..

-

-echo RC5\32

-cd crypto\rc5\asm

-perl rc5-586.pl win32 > r5_win32.asm

-cd ..\..\..

-

-echo on

-

-perl util\mkfiles.pl >MINFO

-rem perl util\mk1mf.pl no-sock %1 VC-MSDOS >ms\msdos.mak

-rem perl util\mk1mf.pl %1 VC-W31-32 >ms\w31.mak

-rem perl util\mk1mf.pl dll %1 VC-W31-32 >ms\w31dll.mak

-perl util\mk1mf.pl %1 VC-WIN32 >ms\nt.mak

-perl util\mk1mf.pl dll %1 VC-WIN32 >ms\ntdll.mak

-

-perl util\mkdef.pl 16 libeay %1 > ms\libeay16.def

-perl util\mkdef.pl 32 libeay %1 > ms\libeay32.def

-perl util\mkdef.pl 16 ssleay %1 > ms\ssleay16.def

-perl util\mkdef.pl 32 ssleay %1 > ms\ssleay32.def

+@echo off
+
+SET ASMOPTS=-DOPENSSL_IA32_SSE2
+echo Generating x86 for MASM assember
+
+echo Bignum
+cd crypto\bn\asm
+perl bn-586.pl win32 %ASMOPTS% > bn_win32.asm
+perl co-586.pl win32 %ASMOPTS% > co_win32.asm
+cd ..\..\..
+
+echo AES
+cd crypto\aes\asm
+perl aes-586.pl win32 %ASMOPTS% > a_win32.asm
+cd ..\..\..
+
+echo DES
+cd crypto\des\asm
+perl des-586.pl win32 %ASMOPTS% > d_win32.asm
+cd ..\..\..
+
+echo "crypt(3)"
+
+cd crypto\des\asm
+perl crypt586.pl win32 %ASMOPTS% > y_win32.asm
+cd ..\..\..
+
+echo Blowfish
+
+cd crypto\bf\asm
+perl bf-586.pl win32 %ASMOPTS% > b_win32.asm
+cd ..\..\..
+
+echo CAST5
+cd crypto\cast\asm
+perl cast-586.pl win32 %ASMOPTS% > c_win32.asm
+cd ..\..\..
+
+echo RC4
+cd crypto\rc4\asm
+perl rc4-586.pl win32 %ASMOPTS% > r4_win32.asm
+cd ..\..\..
+
+echo MD5
+cd crypto\md5\asm
+perl md5-586.pl win32 %ASMOPTS% > m5_win32.asm
+cd ..\..\..
+
+echo SHA1
+cd crypto\sha\asm
+perl sha1-586.pl win32 %ASMOPTS% > s1_win32.asm
+perl sha512-sse2.pl win32 %ASMOPTS% > sha512-sse2.asm
+cd ..\..\..
+
+echo RIPEMD160
+cd crypto\ripemd\asm
+perl rmd-586.pl win32 %ASMOPTS% > rm_win32.asm
+cd ..\..\..
+
+echo RC5\32
+cd crypto\rc5\asm
+perl rc5-586.pl win32 %ASMOPTS% > r5_win32.asm
+cd ..\..\..
+
+echo CPU-ID
+cd crypto
+perl x86cpuid.pl win32 %ASMOPTS% > cpu_win32.asm
+cd ..
+
+echo on
+
+perl util\mkfiles.pl >MINFO
+perl util\mk1mf.pl VC-WIN32 >ms\nt.mak
+perl util\mk1mf.pl dll VC-WIN32 >ms\ntdll.mak
+
+perl util\mkdef.pl 32 libeay > ms\libeay32.def
+perl util\mkdef.pl 32 ssleay > ms\ssleay32.def
diff --git a/src/lib/libssl/src/ms/do_ms.bat b/src/lib/libssl/src/ms/do_ms.bat
index 4a76921298..9323336f9b 100644
--- a/src/lib/libssl/src/ms/do_ms.bat
+++ b/src/lib/libssl/src/ms/do_ms.bat
@@ -1,14 +1,9 @@
 

 perl util\mkfiles.pl >MINFO

-rem perl util\mk1mf.pl no-sock %1 VC-MSDOS >ms\msdos.mak

-rem perl util\mk1mf.pl %1 VC-W31-32 >ms\w31.mak

-rem perl util\mk1mf.pl dll %1 VC-W31-32 >ms\w31dll.mak

-perl util\mk1mf.pl no-asm %1 VC-WIN32 >ms\nt.mak

-perl util\mk1mf.pl dll no-asm %1 VC-WIN32 >ms\ntdll.mak

-perl util\mk1mf.pl no-asm %1 VC-CE >ms\ce.mak

-perl util\mk1mf.pl dll no-asm %1 VC-CE >ms\cedll.mak

+perl util\mk1mf.pl no-asm VC-WIN32 >ms\nt.mak

+perl util\mk1mf.pl dll no-asm VC-WIN32 >ms\ntdll.mak

+perl util\mk1mf.pl no-asm VC-CE >ms\ce.mak

+perl util\mk1mf.pl dll no-asm VC-CE >ms\cedll.mak

 

-perl util\mkdef.pl 16 libeay %1 > ms\libeay16.def

-perl util\mkdef.pl 32 libeay %1 > ms\libeay32.def

-perl util\mkdef.pl 16 ssleay %1 > ms\ssleay16.def

-perl util\mkdef.pl 32 ssleay %1 > ms\ssleay32.def

+perl util\mkdef.pl 32 libeay > ms\libeay32.def

+perl util\mkdef.pl 32 ssleay > ms\ssleay32.def

diff --git a/src/lib/libssl/src/ms/do_nasm.bat b/src/lib/libssl/src/ms/do_nasm.bat
index 270dab0058..7a2fa45663 100644
--- a/src/lib/libssl/src/ms/do_nasm.bat
+++ b/src/lib/libssl/src/ms/do_nasm.bat
@@ -1,71 +1,79 @@
-rem use "fips" as the first argument to make a proper FIPS build.

-

-@echo off

-echo Generating x86 for NASM assember

-

-echo Bignum

-cd crypto\bn\asm

-perl x86.pl win32n > bn_win32.asm

-cd ..\..\..

-

-echo DES

-cd crypto\des\asm

-perl des-586.pl win32n > d_win32.asm

-cd ..\..\..

-

-echo "crypt(3)"

-

-cd crypto\des\asm

-perl crypt586.pl win32n > y_win32.asm

-cd ..\..\..

-

-echo Blowfish

-

-cd crypto\bf\asm

-perl bf-586.pl win32n > b_win32.asm

-cd ..\..\..

-

-echo CAST5

-cd crypto\cast\asm

-perl cast-586.pl win32n > c_win32.asm

-cd ..\..\..

-

-echo RC4

-cd crypto\rc4\asm

-perl rc4-586.pl win32n > r4_win32.asm

-cd ..\..\..

-

-echo MD5

-cd crypto\md5\asm

-perl md5-586.pl win32n > m5_win32.asm

-cd ..\..\..

-

-echo SHA1

-cd crypto\sha\asm

-perl sha1-586.pl win32n > s1_win32.asm

-cd ..\..\..

-

-echo RIPEMD160

-cd crypto\ripemd\asm

-perl rmd-586.pl win32n > rm_win32.asm

-cd ..\..\..

-

-echo RC5\32

-cd crypto\rc5\asm

-perl rc5-586.pl win32n > r5_win32.asm

-cd ..\..\..

-

-echo on

-

-perl util\mkfiles.pl >MINFO

-rem perl util\mk1mf.pl no-sock %1 VC-MSDOS >ms\msdos.mak

-rem perl util\mk1mf.pl %1 VC-W31-32 >ms\w31.mak

-perl util\mk1mf.pl dll %1 VC-W31-32 >ms\w31dll.mak

-perl util\mk1mf.pl nasm %1 VC-WIN32 >ms\nt.mak

-perl util\mk1mf.pl dll nasm %1 VC-WIN32 >ms\ntdll.mak

-perl util\mk1mf.pl nasm %1 BC-NT >ms\bcb.mak

-

-perl util\mkdef.pl 16 libeay %1 > ms\libeay16.def

-perl util\mkdef.pl 32 libeay %1 > ms\libeay32.def

-perl util\mkdef.pl 16 ssleay %1 > ms\ssleay16.def

-perl util\mkdef.pl 32 ssleay %1 > ms\ssleay32.def

+
+@echo off
+
+SET ASMOPTS=-DOPENSSL_IA32_SSE2
+echo Generating x86 for NASM assember
+
+echo Bignum
+cd crypto\bn\asm
+perl bn-586.pl win32n %ASMOPTS% > bn_win32.asm
+perl co-586.pl win32n %ASMOPTS% > co_win32.asm
+cd ..\..\..
+
+echo AES
+cd crypto\aes\asm
+perl aes-586.pl win32n %ASMOPTS% > a_win32.asm
+cd ..\..\..
+
+echo DES
+cd crypto\des\asm
+perl des-586.pl win32n %ASMOPTS% > d_win32.asm
+cd ..\..\..
+
+echo "crypt(3)"
+
+cd crypto\des\asm
+perl crypt586.pl win32n %ASMOPTS% > y_win32.asm
+cd ..\..\..
+
+echo Blowfish
+
+cd crypto\bf\asm
+perl bf-586.pl win32n %ASMOPTS% > b_win32.asm
+cd ..\..\..
+
+echo CAST5
+cd crypto\cast\asm
+perl cast-586.pl win32n %ASMOPTS% > c_win32.asm
+cd ..\..\..
+
+echo RC4
+cd crypto\rc4\asm
+perl rc4-586.pl win32n %ASMOPTS% > r4_win32.asm
+cd ..\..\..
+
+echo MD5
+cd crypto\md5\asm
+perl md5-586.pl win32n %ASMOPTS% > m5_win32.asm
+cd ..\..\..
+
+echo SHA1
+cd crypto\sha\asm
+perl sha1-586.pl win32n %ASMOPTS% > s1_win32.asm
+perl sha512-sse2.pl win32n %ASMOPTS% > sha512-sse2.asm
+cd ..\..\..
+
+echo RIPEMD160
+cd crypto\ripemd\asm
+perl rmd-586.pl win32n %ASMOPTS% > rm_win32.asm
+cd ..\..\..
+
+echo RC5\32
+cd crypto\rc5\asm
+perl rc5-586.pl win32n %ASMOPTS% > r5_win32.asm
+cd ..\..\..
+
+echo CPU-ID
+cd crypto
+perl x86cpuid.pl win32n %ASMOPTS% > cpu_win32.asm
+cd ..
+
+echo on
+
+perl util\mkfiles.pl >MINFO
+perl util\mk1mf.pl nasm VC-WIN32 >ms\nt.mak
+perl util\mk1mf.pl dll nasm VC-WIN32 >ms\ntdll.mak
+perl util\mk1mf.pl nasm BC-NT >ms\bcb.mak
+
+perl util\mkdef.pl 32 libeay > ms\libeay32.def
+perl util\mkdef.pl 32 ssleay > ms\ssleay32.def
diff --git a/src/lib/libssl/src/ms/do_nt.bat b/src/lib/libssl/src/ms/do_nt.bat
index 66b408b283..9c06c27caa 100644
--- a/src/lib/libssl/src/ms/do_nt.bat
+++ b/src/lib/libssl/src/ms/do_nt.bat
@@ -1,7 +1,7 @@
 

 perl util\mkfiles.pl >MINFO

-perl util\mk1mf.pl no-asm %1 VC-NT >ms\nt.mak

-perl util\mk1mf.pl dll no-asm %1 VC-NT >ms\ntdll.mak

+perl util\mk1mf.pl no-asm VC-NT >ms\nt.mak

+perl util\mk1mf.pl dll no-asm VC-NT >ms\ntdll.mak

 

-perl util\mkdef.pl libeay NT %1 > ms\libeay32.def

-perl util\mkdef.pl ssleay NT %1 > ms\ssleay32.def

+perl util\mkdef.pl libeay NT > ms\libeay32.def

+perl util\mkdef.pl ssleay NT > ms\ssleay32.def

diff --git a/src/lib/libssl/src/ms/mingw32.bat b/src/lib/libssl/src/ms/mingw32.bat
index 8c7c63e0f2..f9377a8695 100644
--- a/src/lib/libssl/src/ms/mingw32.bat
+++ b/src/lib/libssl/src/ms/mingw32.bat
@@ -1,90 +1,94 @@
-@rem OpenSSL with Mingw32+GNU as

-@rem ---------------------------

-

-perl Configure mingw %1 %2 %3 %4 %5 %6 %7 %8

-

-@echo off

-

-perl -e "exit 1 if '%1' eq 'no-asm'"

-if errorlevel 1 goto noasm

-

-echo Generating x86 for GNU assember

-

-echo Bignum

-cd crypto\bn\asm

-perl bn-586.pl gaswin > bn-win32.s

-perl co-586.pl gaswin > co-win32.s

-cd ..\..\..

-

-echo DES

-cd crypto\des\asm

-perl des-586.pl gaswin > d-win32.s

-cd ..\..\..

-

-echo crypt

-cd crypto\des\asm

-perl crypt586.pl gaswin > y-win32.s

-cd ..\..\..

-

-echo Blowfish

-cd crypto\bf\asm

-perl bf-586.pl gaswin > b-win32.s

-cd ..\..\..

-

-echo CAST5

-cd crypto\cast\asm

-perl cast-586.pl gaswin > c-win32.s

-cd ..\..\..

-

-echo RC4

-cd crypto\rc4\asm

-perl rc4-586.pl gaswin > r4-win32.s

-cd ..\..\..

-

-echo MD5

-cd crypto\md5\asm

-perl md5-586.pl gaswin > m5-win32.s

-cd ..\..\..

-

-echo SHA1

-cd crypto\sha\asm

-perl sha1-586.pl gaswin > s1-win32.s

-cd ..\..\..

-

-echo RIPEMD160

-cd crypto\ripemd\asm

-perl rmd-586.pl gaswin > rm-win32.s

-cd ..\..\..

-

-echo RC5\32

-cd crypto\rc5\asm

-perl rc5-586.pl gaswin > r5-win32.s

-cd ..\..\..

-

-:noasm

-

-echo Generating makefile

-perl util\mkfiles.pl >MINFO

-perl util\mk1mf.pl gaswin Mingw32 >ms\mingw32a.mak

-echo Generating DLL definition files

-perl util\mkdef.pl 32 libeay >ms\libeay32.def

-if errorlevel 1 goto end

-perl util\mkdef.pl 32 ssleay >ms\ssleay32.def

-if errorlevel 1 goto end

-

-rem copy ms\tlhelp32.h outinc

-

-echo Building the libraries

-mingw32-make -f ms/mingw32a.mak

-if errorlevel 1 goto end

-

-echo Generating the DLLs and input libraries

-dllwrap --dllname libeay32.dll --output-lib out/libeay32.a --def ms/libeay32.def out/libcrypto.a -lwsock32 -lgdi32

-if errorlevel 1 goto end

-dllwrap --dllname libssl32.dll --output-lib out/libssl32.a --def ms/ssleay32.def out/libssl.a out/libeay32.a

-if errorlevel 1 goto end

-

-echo Done compiling OpenSSL

-

-:end

-

+@rem OpenSSL with Mingw32+GNU as
+@rem ---------------------------
+
+perl Configure mingw %1 %2 %3 %4 %5 %6 %7 %8
+
+@echo off
+
+perl -e "exit 1 if '%1' eq 'no-asm'"
+if errorlevel 1 goto noasm
+
+echo Generating x86 for GNU assember
+
+echo Bignum
+cd crypto\bn\asm
+perl bn-586.pl gaswin > bn-win32.s
+perl co-586.pl gaswin > co-win32.s
+cd ..\..\..
+
+echo DES
+cd crypto\des\asm
+perl des-586.pl gaswin > d-win32.s
+cd ..\..\..
+
+echo crypt
+cd crypto\des\asm
+perl crypt586.pl gaswin > y-win32.s
+cd ..\..\..
+
+echo Blowfish
+cd crypto\bf\asm
+perl bf-586.pl gaswin > b-win32.s
+cd ..\..\..
+
+echo CAST5
+cd crypto\cast\asm
+perl cast-586.pl gaswin > c-win32.s
+cd ..\..\..
+
+echo RC4
+cd crypto\rc4\asm
+perl rc4-586.pl gaswin > r4-win32.s
+cd ..\..\..
+
+echo MD5
+cd crypto\md5\asm
+perl md5-586.pl gaswin > m5-win32.s
+cd ..\..\..
+
+echo SHA1
+cd crypto\sha\asm
+perl sha1-586.pl gaswin > s1-win32.s
+cd ..\..\..
+
+echo RIPEMD160
+cd crypto\ripemd\asm
+perl rmd-586.pl gaswin > rm-win32.s
+cd ..\..\..
+
+echo RC5\32
+cd crypto\rc5\asm
+perl rc5-586.pl gaswin > r5-win32.s
+cd ..\..\..
+echo CPUID
+cd crypto
+perl x86cpuid.pl gaswin > cpu-win32.s
+cd ..
+
+:noasm
+
+echo Generating makefile
+perl util\mkfiles.pl >MINFO
+perl util\mk1mf.pl gaswin Mingw32 >ms\mingw32a.mak
+echo Generating DLL definition files
+perl util\mkdef.pl 32 libeay >ms\libeay32.def
+if errorlevel 1 goto end
+perl util\mkdef.pl 32 ssleay >ms\ssleay32.def
+if errorlevel 1 goto end
+
+rem copy ms\tlhelp32.h outinc
+
+echo Building the libraries
+mingw32-make -f ms/mingw32a.mak
+if errorlevel 1 goto end
+
+echo Generating the DLLs and input libraries
+dllwrap --dllname libeay32.dll --output-lib out/libeay32.a --def ms/libeay32.def out/libcrypto.a -lwsock32 -lgdi32
+if errorlevel 1 goto end
+dllwrap --dllname libssl32.dll --output-lib out/libssl32.a --def ms/ssleay32.def out/libssl.a out/libeay32.a
+if errorlevel 1 goto end
+
+echo Done compiling OpenSSL
+
+:end
+
diff --git a/src/lib/libssl/src/ms/test.bat b/src/lib/libssl/src/ms/test.bat
index 7fb0442147..5085670b99 100644
--- a/src/lib/libssl/src/ms/test.bat
+++ b/src/lib/libssl/src/ms/test.bat
@@ -39,10 +39,6 @@ echo md2test
 md2test

 if errorlevel 1 goto done

 

-echo mdc2test

-mdc2test

-if errorlevel 1 goto done

-

 echo rc2test

 rc2test

 if errorlevel 1 goto done

diff --git a/src/lib/libssl/src/ms/x86asm.bat b/src/lib/libssl/src/ms/x86asm.bat
index 4d80e706e4..ba26637812 100644
--- a/src/lib/libssl/src/ms/x86asm.bat
+++ b/src/lib/libssl/src/ms/x86asm.bat
@@ -1,57 +1,63 @@
-

-@echo off

-echo Generating x86 assember

-

-echo Bignum

-cd crypto\bn\asm

-perl x86.pl win32n > bn-win32.asm

-cd ..\..\..

-

-echo DES

-cd crypto\des\asm

-perl des-586.pl win32n > d-win32.asm

-cd ..\..\..

-

-echo "crypt(3)"

-

-cd crypto\des\asm

-perl crypt586.pl win32n > y-win32.asm

-cd ..\..\..

-

-echo Blowfish

-

-cd crypto\bf\asm

-perl bf-586.pl win32n > b-win32.asm

-cd ..\..\..

-

-echo CAST5

-cd crypto\cast\asm

-perl cast-586.pl win32n > c-win32.asm

-cd ..\..\..

-

-echo RC4

-cd crypto\rc4\asm

-perl rc4-586.pl win32n > r4-win32.asm

-cd ..\..\..

-

-echo MD5

-cd crypto\md5\asm

-perl md5-586.pl win32n > m5-win32.asm

-cd ..\..\..

-

-echo SHA1

-cd crypto\sha\asm

-perl sha1-586.pl win32n > s1-win32.asm

-cd ..\..\..

-

-echo RIPEMD160

-cd crypto\ripemd\asm

-perl rmd-586.pl win32n > rm-win32.asm

-cd ..\..\..

-

-echo RC5\32

-cd crypto\rc5\asm

-perl rc5-586.pl win32n > r5-win32.asm

-cd ..\..\..

-

-echo on

+
+@echo off
+echo Bignum
+cd crypto\bn\asm
+perl x86.pl %1 > bn%2
+perl bn-586.pl %1 > bn%2
+perl co-586.pl %1 > co%2
+cd ..\..\..
+
+echo DES
+cd crypto\des\asm
+perl des-586.pl %1 > d%2
+cd ..\..\..
+
+echo "crypt(3)"
+
+cd crypto\des\asm
+perl crypt586.pl %1 > y%2
+cd ..\..\..
+
+echo Blowfish
+
+cd crypto\bf\asm
+perl bf-586.pl %1 > b%2
+cd ..\..\..
+
+echo CAST5
+cd crypto\cast\asm
+perl cast-586.pl %1 > c%2
+cd ..\..\..
+
+echo RC4
+cd crypto\rc4\asm
+perl rc4-586.pl %1 > r4%2
+cd ..\..\..
+
+echo MD5
+cd crypto\md5\asm
+perl md5-586.pl %1 > m5%2
+cd ..\..\..
+
+echo SHA1
+cd crypto\sha\asm
+perl sha1-586.pl %1 > s1%2
+cd ..\..\..
+
+echo RIPEMD160
+cd crypto\ripemd\asm
+perl rmd-586.pl %1 > rm%2
+cd ..\..\..
+
+echo RC5\32
+cd crypto\rc5\asm
+perl rc5-586.pl %1 > r5%2
+cd ..\..\..
+
+echo CPUID
+cd crypto
+perl x86cpuid.pl %1 > x86cpuid%2
+cd ..\
+
+
+echo on
diff --git a/src/lib/libssl/src/openssl.spec b/src/lib/libssl/src/openssl.spec
index 3dad37d49b..4acba76aa2 100644
--- a/src/lib/libssl/src/openssl.spec
+++ b/src/lib/libssl/src/openssl.spec
@@ -1,8 +1,8 @@
 %define libmaj 0
 %define libmin 9
-%define librel 7
-%define librev j
-Release: 2
+%define librel 8
+%define librev h
+Release: 1
 
 %define openssldir /var/ssl
 
diff --git a/src/lib/libssl/src/shlib/Makefile.hpux10-cc b/src/lib/libssl/src/shlib/Makefile.hpux10-cc
index 4d2d19bcf2..89c28dcf46 100644
--- a/src/lib/libssl/src/shlib/Makefile.hpux10-cc
+++ b/src/lib/libssl/src/shlib/Makefile.hpux10-cc
@@ -1,6 +1,6 @@
 # Makefile.hpux-cc
 
-major=0.9.7
+major=0.9.8
 
 slib=libssl
 sh_slib=$(slib).sl.$(major)
diff --git a/src/lib/libssl/src/shlib/hpux10-cc.sh b/src/lib/libssl/src/shlib/hpux10-cc.sh
index fcadda827d..ceeb8c5236 100644
--- a/src/lib/libssl/src/shlib/hpux10-cc.sh
+++ b/src/lib/libssl/src/shlib/hpux10-cc.sh
@@ -60,9 +60,9 @@ mkdir /usr/local
 mkdir /usr/local/ssl
 mkdir /usr/local/ssl/lib
 chmod 444 lib*_pic.a
-chmod 555 lib*.sl.0.9.7
-cp -p lib*_pic.a lib*.sl.0.9.7 /usr/local/ssl/lib
-(cd /usr/local/ssl/lib ; ln -sf libcrypto.sl.0.9.7 libcrypto.sl ; ln -sf libssl.sl.0.9.7 libssl.sl)
+chmod 555 lib*.sl.0.9.8
+cp -p lib*_pic.a lib*.sl.0.9.8 /usr/local/ssl/lib
+(cd /usr/local/ssl/lib ; ln -sf libcrypto.sl.0.9.8 libcrypto.sl ; ln -sf libssl.sl.0.9.8 libssl.sl)
 
 # Reconfigure without pic to compile the executables. Unfortunately, while
 # performing this task we have to recompile the library components, even
@@ -74,9 +74,9 @@ make clean
 
 # Hack the Makefiles to pick up the dynamic libraries during linking
 #
-sed 's/^PEX_LIBS=.*$/PEX_LIBS=-L\/usr\/local\/ssl\/lib/' Makefile >xxx; mv xxx Makefile.ssl
-sed 's/-L\.\.//' apps/Makefile >xxx; mv xxx apps/Makefile
-sed 's/-L\.\.//' test/Makefile >xxx; mv xxx test/Makefile
+sed 's/^PEX_LIBS=.*$/PEX_LIBS=-L\/usr\/local\/ssl\/lib/' Makefile.ssl >xxx; mv xxx Makefile.ssl
+sed 's/-L\.\.//' apps/Makefile.ssl >xxx; mv xxx apps/Makefile.ssl
+sed 's/-L\.\.//' test/Makefile.ssl >xxx; mv xxx test/Makefile.ssl
 # Build the static libs and the executables in one make.
 make
 # Install everything
diff --git a/src/lib/libssl/src/ssl/bio_ssl.c b/src/lib/libssl/src/ssl/bio_ssl.c
index d683ee43e1..420deb7fc9 100644
--- a/src/lib/libssl/src/ssl/bio_ssl.c
+++ b/src/lib/libssl/src/ssl/bio_ssl.c
@@ -456,7 +456,7 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
         case BIO_CTRL_SET_CALLBACK:
                 {
 #if 0 /* FIXME: Should this be used?  -- Richard Levitte */
-                BIOerr(SSL_F_SSL_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                SSLerr(SSL_F_SSL_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 ret = -1;
 #else
                 ret=0;
@@ -465,9 +465,9 @@ static long ssl_ctrl(BIO *b, int cmd, long num, void *ptr)
                 break;
         case BIO_CTRL_GET_CALLBACK:
                 {
-                void (**fptr)();
+                void (**fptr)(const SSL *xssl,int type,int val);
 
-                fptr=(void (**)())ptr;
+                fptr=(void (**)(const SSL *xssl,int type,int val))ptr;
                 *fptr=SSL_get_info_callback(ssl);
                 }
                 break;
diff --git a/src/lib/libssl/src/ssl/install.com b/src/lib/libssl/src/ssl/install.com
index 7fc008f91a..fce8c66737 100644
--- a/src/lib/libssl/src/ssl/install.com
+++ b/src/lib/libssl/src/ssl/install.com
@@ -38,7 +38,7 @@ $	IF F$PARSE("WRK_SSLVEXE:") .EQS. "" THEN -
 $       IF F$PARSE("WRK_SSLAEXE:") .EQS. "" THEN -
            CREATE/DIR/LOG WRK_SSLAEXE:
 $
-$       EXHEADER := ssl.h,ssl2.h,ssl3.h,ssl23.h,tls1.h,kssl.h
+$       EXHEADER := ssl.h,ssl2.h,ssl3.h,ssl23.h,tls1.h,dtls1.h,kssl.h
 $       E_EXE := ssl_task
 $       LIBS := LIBSSL
 $
diff --git a/src/lib/libssl/src/ssl/kssl.c b/src/lib/libssl/src/ssl/kssl.c
index 926db44b80..019030ae3c 100644
--- a/src/lib/libssl/src/ssl/kssl.c
+++ b/src/lib/libssl/src/ssl/kssl.c
@@ -70,7 +70,7 @@
 
 #define _XOPEN_SOURCE 500 /* glibc2 needs this to declare strptime() */
 #include <time.h>
-#if 0 /* Experimental */
+#if 0 /* experimental */
 #undef _XOPEN_SOURCE /* To avoid clashes with anything else... */
 #endif
 #include <string.h>
@@ -784,6 +784,25 @@ kssl_krb5_kt_get_entry(krb5_context context, krb5_keytab keytab,
         }
 #endif  /* OPENSSL_SYS_WINDOWS || OPENSSL_SYS_WIN32 */
 
+
+/* memory allocation functions for non-temporary storage
+ * (e.g. stuff that gets saved into the kssl context) */
+static void* kssl_calloc(size_t nmemb, size_t size)
+{
+        void* p;
+        
+        p=OPENSSL_malloc(nmemb*size);
+        if (p){
+                memset(p, 0, nmemb*size);
+        }
+        return p;
+}
+
+#define kssl_malloc(size) OPENSSL_malloc((size))
+#define kssl_realloc(ptr, size) OPENSSL_realloc(ptr, size)
+#define kssl_free(ptr) OPENSSL_free((ptr))
+
+
 char
 *kstring(char *string)
         {
@@ -1132,7 +1151,7 @@ kssl_cget_tkt(	/* UPDATE */	KSSL_CTX *kssl_ctx,
         if (authenp)
                 {
                 krb5_data       krb5in_data;
-                unsigned char   *p;
+                const unsigned char     *p;
                 long            arlen;
                 KRB5_APREQBODY  *ap_req;
 
@@ -1301,7 +1320,7 @@ kssl_sget_tkt(	/* UPDATE */	KSSL_CTX		*kssl_ctx,
         static krb5_auth_context        krb5auth_context = NULL;
         krb5_ticket                     *krb5ticket = NULL;
         KRB5_TKTBODY                    *asn1ticket = NULL;
-        unsigned char                   *p;
+        const unsigned char             *p;
         krb5_keytab                     krb5keytab = NULL;
         krb5_keytab_entry               kt_entry;
         krb5_principal                  krb5server;
@@ -1548,7 +1567,7 @@ kssl_sget_tkt(	/* UPDATE */	KSSL_CTX		*kssl_ctx,
 KSSL_CTX        *
 kssl_ctx_new(void)
         {
-        return ((KSSL_CTX *) calloc(1, sizeof(KSSL_CTX)));
+        return ((KSSL_CTX *) kssl_calloc(1, sizeof(KSSL_CTX)));
         }
 
 
@@ -1562,13 +1581,13 @@ kssl_ctx_free(KSSL_CTX *kssl_ctx)
 
         if (kssl_ctx->key)              OPENSSL_cleanse(kssl_ctx->key,
                                                               kssl_ctx->length);
-        if (kssl_ctx->key)              free(kssl_ctx->key);
-        if (kssl_ctx->client_princ)     free(kssl_ctx->client_princ);
-        if (kssl_ctx->service_host)     free(kssl_ctx->service_host);
-        if (kssl_ctx->service_name)     free(kssl_ctx->service_name);
-        if (kssl_ctx->keytab_file)      free(kssl_ctx->keytab_file);
+        if (kssl_ctx->key)              kssl_free(kssl_ctx->key);
+        if (kssl_ctx->client_princ)     kssl_free(kssl_ctx->client_princ);
+        if (kssl_ctx->service_host)     kssl_free(kssl_ctx->service_host);
+        if (kssl_ctx->service_name)     kssl_free(kssl_ctx->service_name);
+        if (kssl_ctx->keytab_file)      kssl_free(kssl_ctx->keytab_file);
 
-        free(kssl_ctx);
+        kssl_free(kssl_ctx);
         return (KSSL_CTX *) NULL;
         }
 
@@ -1593,7 +1612,7 @@ kssl_ctx_setprinc(KSSL_CTX *kssl_ctx, int which,
         case KSSL_SERVER:       princ = &kssl_ctx->service_host;        break;
         default:                return KSSL_CTX_ERR;                    break;
                 }
-        if (*princ)  free(*princ);
+        if (*princ)  kssl_free(*princ);
 
         /* Add up all the entity->lengths */
         length = 0;
@@ -1606,7 +1625,7 @@ kssl_ctx_setprinc(KSSL_CTX *kssl_ctx, int which,
         /* Space for the ('@'+realm+NULL | NULL) */
         length += ((realm)? realm->length + 2: 1);
 
-        if ((*princ = calloc(1, length)) == NULL)
+        if ((*princ = kssl_calloc(1, length)) == NULL)
                 return KSSL_CTX_ERR;
         else
                 {
@@ -1649,7 +1668,7 @@ kssl_ctx_setstring(KSSL_CTX *kssl_ctx, int which, char *text)
         case KSSL_KEYTAB:       string = &kssl_ctx->keytab_file;        break;
         default:                return KSSL_CTX_ERR;                    break;
                 }
-        if (*string)  free(*string);
+        if (*string)  kssl_free(*string);
 
         if (!text)
                 {
@@ -1657,7 +1676,7 @@ kssl_ctx_setstring(KSSL_CTX *kssl_ctx, int which, char *text)
                 return KSSL_CTX_OK;
                 }
 
-        if ((*string = calloc(1, strlen(text) + 1)) == NULL)
+        if ((*string = kssl_calloc(1, strlen(text) + 1)) == NULL)
                 return KSSL_CTX_ERR;
         else
                 strcpy(*string, text);
@@ -1681,7 +1700,7 @@ kssl_ctx_setkey(KSSL_CTX *kssl_ctx, krb5_keyblock *session)
         if (kssl_ctx->key)
                 {
                 OPENSSL_cleanse(kssl_ctx->key, kssl_ctx->length);
-                free(kssl_ctx->key);
+                kssl_free(kssl_ctx->key);
                 }
 
         if (session)
@@ -1707,7 +1726,7 @@ kssl_ctx_setkey(KSSL_CTX *kssl_ctx, krb5_keyblock *session)
                 }
 
         if ((kssl_ctx->key =
-                (krb5_octet FAR *) calloc(1, kssl_ctx->length)) == NULL)
+                (krb5_octet FAR *) kssl_calloc(1, kssl_ctx->length)) == NULL)
                 {
                 kssl_ctx->length  = 0;
                 return KSSL_CTX_ERR;
@@ -1986,7 +2005,8 @@ krb5_error_code  kssl_check_authent(
         EVP_CIPHER_CTX          ciph_ctx;
         const EVP_CIPHER        *enc = NULL;
         unsigned char           iv[EVP_MAX_IV_LENGTH];
-        unsigned char           *p, *unenc_authent;
+        const unsigned char     *p;
+        unsigned char           *unenc_authent;
         int                     outl, unencbufsize;
         struct tm               tm_time, *tm_l, *tm_g;
         time_t                  now, tl, tg, tr, tz_offset;
@@ -2176,7 +2196,7 @@ krb5_error_code  kssl_build_principal_2(
 #else /* !OPENSSL_NO_KRB5 */
 
 #if defined(PEDANTIC) || defined(OPENSSL_SYS_VMS)
-static int dummy=(int)&dummy;
+static void *dummy=&dummy;
 #endif
 
 #endif  /* !OPENSSL_NO_KRB5     */
diff --git a/src/lib/libssl/src/ssl/s23_clnt.c b/src/lib/libssl/src/ssl/s23_clnt.c
index 86356731ea..c45a8e0a04 100644
--- a/src/lib/libssl/src/ssl/s23_clnt.c
+++ b/src/lib/libssl/src/ssl/s23_clnt.c
@@ -80,28 +80,10 @@ static SSL_METHOD *ssl23_get_client_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *SSLv23_client_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv23_client_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&SSLv23_client_data,
-                                (char *)sslv23_base_method(),sizeof(SSL_METHOD));
-                        SSLv23_client_data.ssl_connect=ssl23_connect;
-                        SSLv23_client_data.get_ssl_method=ssl23_get_client_method;
-                        init=0;
-                        }
-
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv23_client_data);
-        }
+IMPLEMENT_ssl23_meth_func(SSLv23_client_method,
+                        ssl_undefined_function,
+                        ssl23_connect,
+                        ssl23_get_client_method)
 
 int ssl23_connect(SSL *s)
         {
@@ -241,6 +223,17 @@ static int ssl23_client_hello(SSL *s)
                 {
                 version = SSL2_VERSION;
                 }
+#ifndef OPENSSL_NO_TLSEXT 
+        if (version != SSL2_VERSION)
+                {
+                /* have to disable SSL 2.0 compatibility if we need TLS extensions */
+
+                if (s->tlsext_hostname != NULL)
+                        ssl2_compat = 0;
+                if (s->tlsext_status_type != -1)
+                        ssl2_compat = 0;
+                }
+#endif
 
         buf=(unsigned char *)s->init_buf->data;
         if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
@@ -254,7 +247,7 @@ static int ssl23_client_hello(SSL *s)
 #endif
 
                 p=s->s3->client_random;
-                Time=(unsigned long)time(NULL);                 /* Time */
+                Time=(unsigned long)time(NULL);         /* Time */
                 l2n(Time,p);
                 if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
                         return -1;
@@ -264,14 +257,6 @@ static int ssl23_client_hello(SSL *s)
                         version_major = TLS1_VERSION_MAJOR;
                         version_minor = TLS1_VERSION_MINOR;
                         }
-#ifdef OPENSSL_FIPS
-                else if(FIPS_mode())
-                        {
-                        SSLerr(SSL_F_SSL23_CLIENT_HELLO,
-                                        SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
-                        return -1;
-                        }
-#endif
                 else if (version == SSL3_VERSION)
                         {
                         version_major = SSL3_VERSION_MAJOR;
@@ -386,6 +371,13 @@ static int ssl23_client_hello(SSL *s)
                                 *(p++)=comp->id;
                                 }
                         *(p++)=0; /* Add the NULL method */
+#ifndef OPENSSL_NO_TLSEXT
+                        if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
+                                {
+                                SSLerr(SSL_F_SSL23_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);
+                                return -1;
+                                }
+#endif
                         
                         l = p-d;
                         *p = 42;
@@ -544,14 +536,6 @@ static int ssl23_get_server_hello(SSL *s)
                 if ((p[2] == SSL3_VERSION_MINOR) &&
                         !(s->options & SSL_OP_NO_SSLv3))
                         {
-#ifdef OPENSSL_FIPS
-                        if(FIPS_mode())
-                                {
-                                SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,
-                                        SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
-                                goto err;
-                                }
-#endif
                         s->version=SSL3_VERSION;
                         s->method=SSLv3_client_method();
                         }
@@ -608,7 +592,6 @@ static int ssl23_get_server_hello(SSL *s)
         if (!ssl_get_new_session(s,0))
                 goto err;
 
-        s->first_packet=1;
         return(SSL_connect(s));
 err:
         return(-1);
diff --git a/src/lib/libssl/src/ssl/s23_lib.c b/src/lib/libssl/src/ssl/s23_lib.c
index 8d7dbcf569..fc2981308d 100644
--- a/src/lib/libssl/src/ssl/s23_lib.c
+++ b/src/lib/libssl/src/ssl/s23_lib.c
@@ -60,55 +60,17 @@
 #include <openssl/objects.h>
 #include "ssl_locl.h"
 
-static int ssl23_num_ciphers(void );
-static SSL_CIPHER *ssl23_get_cipher(unsigned int u);
-static int ssl23_read(SSL *s, void *buf, int len);
-static int ssl23_peek(SSL *s, void *buf, int len);
-static int ssl23_write(SSL *s, const void *buf, int len);
-static long ssl23_default_timeout(void );
-static int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p);
-static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p);
-const char *SSL23_version_str="SSLv2/3 compatibility" OPENSSL_VERSION_PTEXT;
-
-static SSL_METHOD SSLv23_data= {
-        TLS1_VERSION,
-        tls1_new,
-        tls1_clear,
-        tls1_free,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl23_read,
-        ssl23_peek,
-        ssl23_write,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl_ok,
-        ssl3_ctrl,
-        ssl3_ctx_ctrl,
-        ssl23_get_cipher_by_char,
-        ssl23_put_cipher_by_char,
-        ssl_undefined_const_function,
-        ssl23_num_ciphers,
-        ssl23_get_cipher,
-        ssl_bad_method,
-        ssl23_default_timeout,
-        &ssl3_undef_enc_method,
-        ssl_undefined_function,
-        ssl3_callback_ctrl,
-        ssl3_ctx_callback_ctrl,
-        };
-
-static long ssl23_default_timeout(void)
+long ssl23_default_timeout(void)
         {
         return(300);
         }
 
-SSL_METHOD *sslv23_base_method(void)
-        {
-        return(&SSLv23_data);
-        }
+IMPLEMENT_ssl23_meth_func(sslv23_base_method,
+                        ssl_undefined_function,
+                        ssl_undefined_function,
+                        ssl_bad_method)
 
-static int ssl23_num_ciphers(void)
+int ssl23_num_ciphers(void)
         {
         return(ssl3_num_ciphers()
 #ifndef OPENSSL_NO_SSL2
@@ -117,7 +79,7 @@ static int ssl23_num_ciphers(void)
             );
         }
 
-static SSL_CIPHER *ssl23_get_cipher(unsigned int u)
+SSL_CIPHER *ssl23_get_cipher(unsigned int u)
         {
         unsigned int uu=ssl3_num_ciphers();
 
@@ -133,7 +95,7 @@ static SSL_CIPHER *ssl23_get_cipher(unsigned int u)
 
 /* This function needs to check if the ciphers required are actually
  * available */
-static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p)
+SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p)
         {
         SSL_CIPHER c,*cp;
         unsigned long id;
@@ -151,7 +113,7 @@ static SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p)
         return(cp);
         }
 
-static int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
+int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
         {
         long l;
 
@@ -166,7 +128,7 @@ static int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
         return(3);
         }
 
-static int ssl23_read(SSL *s, void *buf, int len)
+int ssl23_read(SSL *s, void *buf, int len)
         {
         int n;
 
@@ -189,7 +151,7 @@ static int ssl23_read(SSL *s, void *buf, int len)
                 }
         }
 
-static int ssl23_peek(SSL *s, void *buf, int len)
+int ssl23_peek(SSL *s, void *buf, int len)
         {
         int n;
 
@@ -212,7 +174,7 @@ static int ssl23_peek(SSL *s, void *buf, int len)
                 }
         }
 
-static int ssl23_write(SSL *s, const void *buf, int len)
+int ssl23_write(SSL *s, const void *buf, int len)
         {
         int n;
 
diff --git a/src/lib/libssl/src/ssl/s23_meth.c b/src/lib/libssl/src/ssl/s23_meth.c
index f207140835..950d9aab3d 100644
--- a/src/lib/libssl/src/ssl/s23_meth.c
+++ b/src/lib/libssl/src/ssl/s23_meth.c
@@ -63,37 +63,26 @@
 static SSL_METHOD *ssl23_get_method(int ver);
 static SSL_METHOD *ssl23_get_method(int ver)
         {
+#ifndef OPENSSL_NO_SSL2
         if (ver == SSL2_VERSION)
                 return(SSLv2_method());
-        else if (ver == SSL3_VERSION)
+        else
+#endif
+#ifndef OPENSSL_NO_SSL3
+        if (ver == SSL3_VERSION)
                 return(SSLv3_method());
-        else if (ver == TLS1_VERSION)
+        else
+#endif
+#ifndef OPENSSL_NO_TLS1
+        if (ver == TLS1_VERSION)
                 return(TLSv1_method());
         else
+#endif
                 return(NULL);
         }
 
-SSL_METHOD *SSLv23_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv23_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-                
-                if (init)
-                        {
-                        memcpy((char *)&SSLv23_data,(char *)sslv23_base_method(),
-                                sizeof(SSL_METHOD));
-                        SSLv23_data.ssl_connect=ssl23_connect;
-                        SSLv23_data.ssl_accept=ssl23_accept;
-                        SSLv23_data.get_ssl_method=ssl23_get_method;
-                        init=0;
-                        }
-                
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv23_data);
-        }
+IMPLEMENT_ssl23_meth_func(SSLv23_method,
+                        ssl23_accept,
+                        ssl23_connect,
+                        ssl23_get_method)
 
diff --git a/src/lib/libssl/src/ssl/s23_srvr.c b/src/lib/libssl/src/ssl/s23_srvr.c
index b73abc448f..6637bb9549 100644
--- a/src/lib/libssl/src/ssl/s23_srvr.c
+++ b/src/lib/libssl/src/ssl/s23_srvr.c
@@ -132,28 +132,10 @@ static SSL_METHOD *ssl23_get_server_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *SSLv23_server_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv23_server_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&SSLv23_server_data,
-                                (char *)sslv23_base_method(),sizeof(SSL_METHOD));
-                        SSLv23_server_data.ssl_accept=ssl23_accept;
-                        SSLv23_server_data.get_ssl_method=ssl23_get_server_method;
-                        init=0;
-                        }
-
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv23_server_data);
-        }
+IMPLEMENT_ssl23_meth_func(SSLv23_server_method,
+                        ssl23_accept,
+                        ssl_undefined_function,
+                        ssl23_get_server_method)
 
 int ssl23_accept(SSL *s)
         {
@@ -404,15 +386,6 @@ int ssl23_get_client_hello(SSL *s)
                         }
                 }
 
-#ifdef OPENSSL_FIPS
-        if (FIPS_mode() && (s->version < TLS1_VERSION))
-                {
-                SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
-                                        SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
-                goto err;
-                }
-#endif
-
         if (s->state == SSL23_ST_SR_CLNT_HELLO_B)
                 {
                 /* we have SSLv3/TLSv1 in an SSLv2 header
@@ -592,7 +565,6 @@ int ssl23_get_client_hello(SSL *s)
         s->init_num=0;
 
         if (buf != buf_space) OPENSSL_free(buf);
-        s->first_packet=1;
         return(SSL_accept(s));
 err:
         if (buf != buf_space) OPENSSL_free(buf);
diff --git a/src/lib/libssl/src/ssl/s2_clnt.c b/src/lib/libssl/src/ssl/s2_clnt.c
index 003809271b..e2a90a3ca2 100644
--- a/src/lib/libssl/src/ssl/s2_clnt.c
+++ b/src/lib/libssl/src/ssl/s2_clnt.c
@@ -137,28 +137,10 @@ static SSL_METHOD *ssl2_get_client_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *SSLv2_client_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv2_client_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&SSLv2_client_data,(char *)sslv2_base_method(),
-                                sizeof(SSL_METHOD));
-                        SSLv2_client_data.ssl_connect=ssl2_connect;
-                        SSLv2_client_data.get_ssl_method=ssl2_get_client_method;
-                        init=0;
-                        }
-
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv2_client_data);
-        }
+IMPLEMENT_ssl2_meth_func(SSLv2_client_method,
+                        ssl_undefined_function,
+                        ssl2_connect,
+                        ssl2_get_client_method)
 
 int ssl2_connect(SSL *s)
         {
@@ -484,11 +466,11 @@ static int get_server_hello(SSL *s)
                         return(-1);
                         }
 
-                sk_SSL_CIPHER_set_cmp_func(sk,ssl_cipher_ptr_id_cmp);
+                (void)sk_SSL_CIPHER_set_cmp_func(sk,ssl_cipher_ptr_id_cmp);
 
                 /* get the array of ciphers we will accept */
                 cl=SSL_get_ciphers(s);
-                sk_SSL_CIPHER_set_cmp_func(cl,ssl_cipher_ptr_id_cmp);
+                (void)sk_SSL_CIPHER_set_cmp_func(cl,ssl_cipher_ptr_id_cmp);
 
                 /*
                  * If server preference flag set, choose the first
@@ -538,8 +520,8 @@ static int get_server_hello(SSL *s)
                 CRYPTO_add(&s->session->peer->references, 1, CRYPTO_LOCK_X509);
                 }
 
-        if (s->session->sess_cert == NULL ||
-            s->session->peer != s->session->sess_cert->peer_key->x509)
+        if (s->session->sess_cert == NULL 
+      || s->session->peer != s->session->sess_cert->peer_key->x509)
                 /* can't happen */
                 {
                 ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
@@ -613,7 +595,7 @@ static int client_hello(SSL *s)
                 s->s2->challenge_length=SSL2_CHALLENGE_LENGTH;
                 s2n(SSL2_CHALLENGE_LENGTH,p);           /* challenge length */
                 /*challenge id data*/
-                if(RAND_pseudo_bytes(s->s2->challenge,SSL2_CHALLENGE_LENGTH) <= 0)
+                if (RAND_pseudo_bytes(s->s2->challenge,SSL2_CHALLENGE_LENGTH) <= 0)
                         return -1;
                 memcpy(d,s->s2->challenge,SSL2_CHALLENGE_LENGTH);
                 d+=SSL2_CHALLENGE_LENGTH;
@@ -663,7 +645,7 @@ static int client_master_key(SSL *s)
                         return -1;
                         }
                 if (i > 0)
-                        if(RAND_pseudo_bytes(sess->key_arg,i) <= 0)
+                        if (RAND_pseudo_bytes(sess->key_arg,i) <= 0)
                                 return -1;
 
                 /* make a master key */
@@ -671,7 +653,7 @@ static int client_master_key(SSL *s)
                 sess->master_key_length=i;
                 if (i > 0)
                         {
-                        if (i > sizeof sess->master_key)
+                        if (i > (int)sizeof(sess->master_key))
                                 {
                                 ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
                                 SSLerr(SSL_F_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
@@ -691,7 +673,7 @@ static int client_master_key(SSL *s)
                 else
                         enc=i;
 
-                if (i < enc)
+                if ((int)i < enc)
                         {
                         ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
                         SSLerr(SSL_F_CLIENT_MASTER_KEY,SSL_R_CIPHER_TABLE_SRC_ERROR);
@@ -720,7 +702,7 @@ static int client_master_key(SSL *s)
                 d+=enc;
                 karg=sess->key_arg_length;      
                 s2n(karg,p); /* key arg size */
-                if (karg > sizeof sess->key_arg)
+                if (karg > (int)sizeof(sess->key_arg))
                         {
                         ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
                         SSLerr(SSL_F_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
@@ -1038,7 +1020,7 @@ static int get_server_finished(SSL *s)
         }
 
 /* loads in the certificate from the server */
-int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
+int ssl2_set_certificate(SSL *s, int type, int len, const unsigned char *data)
         {
         STACK_OF(X509) *sk=NULL;
         EVP_PKEY *pkey=NULL;
diff --git a/src/lib/libssl/src/ssl/s2_enc.c b/src/lib/libssl/src/ssl/s2_enc.c
index 21a06f76cb..1f62acd5b1 100644
--- a/src/lib/libssl/src/ssl/s2_enc.c
+++ b/src/lib/libssl/src/ssl/s2_enc.c
@@ -82,15 +82,18 @@ int ssl2_enc_init(SSL *s, int client)
                 ((s->enc_read_ctx=(EVP_CIPHER_CTX *)
                 OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
                 goto err;
+
+        /* make sure it's intialized in case the malloc for enc_write_ctx fails
+         * and we exit with an error */
+        rs= s->enc_read_ctx;
+        EVP_CIPHER_CTX_init(rs);
+
         if ((s->enc_write_ctx == NULL) &&
                 ((s->enc_write_ctx=(EVP_CIPHER_CTX *)
                 OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
                 goto err;
 
-        rs= s->enc_read_ctx;
         ws= s->enc_write_ctx;
-
-        EVP_CIPHER_CTX_init(rs);
         EVP_CIPHER_CTX_init(ws);
 
         num=c->key_len;
@@ -100,7 +103,7 @@ int ssl2_enc_init(SSL *s, int client)
         if (ssl2_generate_key_material(s) <= 0)
                 return 0;
 
-        OPENSSL_assert(c->iv_len <= sizeof s->session->key_arg);
+        OPENSSL_assert(c->iv_len <= (int)sizeof(s->session->key_arg));
         EVP_EncryptInit_ex(ws,c,NULL,&(s->s2->key_material[(client)?num:0]),
                 s->session->key_arg);
         EVP_DecryptInit_ex(rs,c,NULL,&(s->s2->key_material[(client)?0:num]),
diff --git a/src/lib/libssl/src/ssl/s2_lib.c b/src/lib/libssl/src/ssl/s2_lib.c
index 26ce8c8d98..10751b22ba 100644
--- a/src/lib/libssl/src/ssl/s2_lib.c
+++ b/src/lib/libssl/src/ssl/s2_lib.c
@@ -59,16 +59,15 @@
 #include "ssl_locl.h"
 #ifndef OPENSSL_NO_SSL2
 #include <stdio.h>
-#include <openssl/rsa.h>
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include <openssl/md5.h>
 
-static long ssl2_default_timeout(void );
-const char *ssl2_version_str="SSLv2" OPENSSL_VERSION_PTEXT;
+const char ssl2_version_str[]="SSLv2" OPENSSL_VERSION_PTEXT;
 
 #define SSL2_NUM_CIPHERS (sizeof(ssl2_ciphers)/sizeof(SSL_CIPHER))
 
+/* list of available SSLv2 ciphers (sorted by id) */
 OPENSSL_GLOBAL SSL_CIPHER ssl2_ciphers[]={
 /* NULL_WITH_MD5 v3 */
 #if 0
@@ -85,19 +84,6 @@ OPENSSL_GLOBAL SSL_CIPHER ssl2_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 #endif
-/* RC4_128_EXPORT40_WITH_MD5 */
-        {
-        1,
-        SSL2_TXT_RC4_128_EXPORT40_WITH_MD5,
-        SSL2_CK_RC4_128_EXPORT40_WITH_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_SSLV2,
-        SSL_EXPORT|SSL_EXP40,
-        SSL2_CF_5_BYTE_ENC,
-        40,
-        128,
-        SSL_ALL_CIPHERS,
-        SSL_ALL_STRENGTHS,
-        },
 /* RC4_128_WITH_MD5 */
         {
         1,
@@ -111,12 +97,12 @@ OPENSSL_GLOBAL SSL_CIPHER ssl2_ciphers[]={
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
-/* RC2_128_CBC_EXPORT40_WITH_MD5 */
+/* RC4_128_EXPORT40_WITH_MD5 */
         {
         1,
-        SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5,
-        SSL2_CK_RC2_128_CBC_EXPORT40_WITH_MD5,
-        SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_SSLV2,
+        SSL2_TXT_RC4_128_EXPORT40_WITH_MD5,
+        SSL2_CK_RC4_128_EXPORT40_WITH_MD5,
+        SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_SSLV2,
         SSL_EXPORT|SSL_EXP40,
         SSL2_CF_5_BYTE_ENC,
         40,
@@ -137,6 +123,19 @@ OPENSSL_GLOBAL SSL_CIPHER ssl2_ciphers[]={
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
+/* RC2_128_CBC_EXPORT40_WITH_MD5 */
+        {
+        1,
+        SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5,
+        SSL2_CK_RC2_128_CBC_EXPORT40_WITH_MD5,
+        SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_SSLV2,
+        SSL_EXPORT|SSL_EXP40,
+        SSL2_CF_5_BYTE_ENC,
+        40,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
 /* IDEA_128_CBC_WITH_MD5 */
 #ifndef OPENSSL_NO_IDEA
         {
@@ -179,7 +178,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl2_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 /* RC4_64_WITH_MD5 */
-#if 1
+#if 0
         {
         1,
         SSL2_TXT_RC4_64_WITH_MD5,
@@ -212,43 +211,15 @@ OPENSSL_GLOBAL SSL_CIPHER ssl2_ciphers[]={
 /* end of list :-) */
         };
 
-static SSL_METHOD SSLv2_data= {
-        SSL2_VERSION,
-        ssl2_new,       /* local */
-        ssl2_clear,     /* local */
-        ssl2_free,      /* local */
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl2_read,
-        ssl2_peek,
-        ssl2_write,
-        ssl2_shutdown,
-        ssl_ok, /* NULL - renegotiate */
-        ssl_ok, /* NULL - check renegotiate */
-        ssl2_ctrl,      /* local */
-        ssl2_ctx_ctrl,  /* local */
-        ssl2_get_cipher_by_char,
-        ssl2_put_cipher_by_char,
-        ssl2_pending,
-        ssl2_num_ciphers,
-        ssl2_get_cipher,
-        ssl_bad_method,
-        ssl2_default_timeout,
-        &ssl3_undef_enc_method,
-        ssl_undefined_function,
-        ssl2_callback_ctrl,     /* local */
-        ssl2_ctx_callback_ctrl, /* local */
-        };
-
-static long ssl2_default_timeout(void)
+long ssl2_default_timeout(void)
         {
         return(300);
         }
 
-SSL_METHOD *sslv2_base_method(void)
-        {
-        return(&SSLv2_data);
-        }
+IMPLEMENT_ssl2_meth_func(sslv2_base_method,
+                        ssl_undefined_function,
+                        ssl_undefined_function,
+                        ssl_bad_method)
 
 int ssl2_num_ciphers(void)
         {
@@ -349,7 +320,7 @@ long ssl2_ctrl(SSL *s, int cmd, long larg, void *parg)
         return(ret);
         }
 
-long ssl2_callback_ctrl(SSL *s, int cmd, void (*fp)())
+long ssl2_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
         {
         return(0);
         }
@@ -359,7 +330,7 @@ long ssl2_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
         return(0);
         }
 
-long ssl2_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
+long ssl2_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
         {
         return(0);
         }
@@ -368,42 +339,20 @@ long ssl2_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
  * available */
 SSL_CIPHER *ssl2_get_cipher_by_char(const unsigned char *p)
         {
-        static int init=1;
-        static SSL_CIPHER *sorted[SSL2_NUM_CIPHERS];
-        SSL_CIPHER c,*cp= &c,**cpp;
+        SSL_CIPHER c,*cp;
         unsigned long id;
-        int i;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL);
-
-                if (init)
-                        {
-                        for (i=0; i<SSL2_NUM_CIPHERS; i++)
-                                sorted[i]= &(ssl2_ciphers[i]);
-
-                        qsort((char *)sorted,
-                                SSL2_NUM_CIPHERS,sizeof(SSL_CIPHER *),
-                                FP_ICC ssl_cipher_ptr_id_cmp);
-
-                        init=0;
-                        }
-                        
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
-                }
 
         id=0x02000000L|((unsigned long)p[0]<<16L)|
                 ((unsigned long)p[1]<<8L)|(unsigned long)p[2];
         c.id=id;
-        cpp=(SSL_CIPHER **)OBJ_bsearch((char *)&cp,
-                (char *)sorted,
-                SSL2_NUM_CIPHERS,sizeof(SSL_CIPHER *),
-                FP_ICC ssl_cipher_ptr_id_cmp);
-        if ((cpp == NULL) || !(*cpp)->valid)
-                return(NULL);
+        cp = (SSL_CIPHER *)OBJ_bsearch((char *)&c,
+                (char *)ssl2_ciphers,
+                SSL2_NUM_CIPHERS,sizeof(SSL_CIPHER),
+                FP_ICC ssl_cipher_id_cmp);
+        if ((cp == NULL) || (cp->valid == 0))
+                return NULL;
         else
-                return(*cpp);
+                return cp;
         }
 
 int ssl2_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
@@ -438,7 +387,8 @@ int ssl2_generate_key_material(SSL *s)
         EVP_MD_CTX_init(&ctx);
         km=s->s2->key_material;
 
-        if (s->session->master_key_length < 0 || s->session->master_key_length > sizeof s->session->master_key)
+        if (s->session->master_key_length < 0 ||
+                        s->session->master_key_length > (int)sizeof(s->session->master_key))
                 {
                 SSLerr(SSL_F_SSL2_GENERATE_KEY_MATERIAL, ERR_R_INTERNAL_ERROR);
                 return 0;
@@ -446,7 +396,8 @@ int ssl2_generate_key_material(SSL *s)
 
         for (i=0; i<s->s2->key_material_length; i += EVP_MD_size(md5))
                 {
-                if (((km - s->s2->key_material) + EVP_MD_size(md5)) > sizeof s->s2->key_material)
+                if (((km - s->s2->key_material) + EVP_MD_size(md5)) >
+                                (int)sizeof(s->s2->key_material))
                         {
                         /* EVP_DigestFinal_ex() below would write beyond buffer */
                         SSLerr(SSL_F_SSL2_GENERATE_KEY_MATERIAL, ERR_R_INTERNAL_ERROR);
@@ -457,7 +408,7 @@ int ssl2_generate_key_material(SSL *s)
 
                 OPENSSL_assert(s->session->master_key_length >= 0
                     && s->session->master_key_length
-                    < sizeof s->session->master_key);
+                    < (int)sizeof(s->session->master_key));
                 EVP_DigestUpdate(&ctx,s->session->master_key,s->session->master_key_length);
                 EVP_DigestUpdate(&ctx,&c,1);
                 c++;
@@ -496,7 +447,7 @@ void ssl2_write_error(SSL *s)
 
         error=s->error; /* number of bytes left to write */
         s->error=0;
-        OPENSSL_assert(error >= 0 && error <= sizeof buf);
+        OPENSSL_assert(error >= 0 && error <= (int)sizeof(buf));
         i=ssl2_write(s,&(buf[3-error]),error);
 
 /*      if (i == error) s->rwstate=state; */
diff --git a/src/lib/libssl/src/ssl/s2_meth.c b/src/lib/libssl/src/ssl/s2_meth.c
index 8b6cbd086e..a35e435b71 100644
--- a/src/lib/libssl/src/ssl/s2_meth.c
+++ b/src/lib/libssl/src/ssl/s2_meth.c
@@ -70,29 +70,11 @@ static SSL_METHOD *ssl2_get_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *SSLv2_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv2_data;
+IMPLEMENT_ssl2_meth_func(SSLv2_method,
+                        ssl2_accept,
+                        ssl2_connect,
+                        ssl2_get_method)
 
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-                
-                if (init)
-                        {
-                        memcpy((char *)&SSLv2_data,(char *)sslv2_base_method(),
-                                sizeof(SSL_METHOD));
-                        SSLv2_data.ssl_connect=ssl2_connect;
-                        SSLv2_data.ssl_accept=ssl2_accept;
-                        SSLv2_data.get_ssl_method=ssl2_get_method;
-                        init=0;
-                        }
-                
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv2_data);
-        }
 #else /* !OPENSSL_NO_SSL2 */
 
 # if PEDANTIC
diff --git a/src/lib/libssl/src/ssl/s2_srvr.c b/src/lib/libssl/src/ssl/s2_srvr.c
index 7a4992b7aa..0daf2b129d 100644
--- a/src/lib/libssl/src/ssl/s2_srvr.c
+++ b/src/lib/libssl/src/ssl/s2_srvr.c
@@ -137,28 +137,10 @@ static SSL_METHOD *ssl2_get_server_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *SSLv2_server_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv2_server_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&SSLv2_server_data,(char *)sslv2_base_method(),
-                                sizeof(SSL_METHOD));
-                        SSLv2_server_data.ssl_accept=ssl2_accept;
-                        SSLv2_server_data.get_ssl_method=ssl2_get_server_method;
-                        init=0;
-                        }
-
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv2_server_data);
-        }
+IMPLEMENT_ssl2_meth_func(SSLv2_server_method,
+                        ssl2_accept,
+                        ssl_undefined_function,
+                        ssl2_get_server_method)
 
 int ssl2_accept(SSL *s)
         {
@@ -498,8 +480,8 @@ static int get_client_master_key(SSL *s)
                         i=ek;
                 else
                         i=EVP_CIPHER_key_length(c);
-                if(RAND_pseudo_bytes(p,i) <= 0)
-                    return 0;
+                if (RAND_pseudo_bytes(p,i) <= 0)
+                        return 0;
                 }
 #else
         if (i < 0)
@@ -625,7 +607,7 @@ static int get_client_hello(SSL *s)
         else
                 {
                 i=ssl_get_prev_session(s,&(p[s->s2->tmp.cipher_spec_length]),
-                        s->s2->tmp.session_id_length);
+                        s->s2->tmp.session_id_length, NULL);
                 if (i == 1)
                         { /* previous session */
                         s->hit=1;
@@ -675,7 +657,7 @@ static int get_client_hello(SSL *s)
                         {
                         if (sk_SSL_CIPHER_find(allow,sk_SSL_CIPHER_value(prio,z)) < 0)
                                 {
-                                sk_SSL_CIPHER_delete(prio,z);
+                                (void)sk_SSL_CIPHER_delete(prio,z);
                                 z--;
                                 }
                         }
@@ -805,8 +787,8 @@ static int server_hello(SSL *s)
                 /* make and send conn_id */
                 s2n(SSL2_CONNECTION_ID_LENGTH,p);       /* add conn_id length */
                 s->s2->conn_id_length=SSL2_CONNECTION_ID_LENGTH;
-                if(RAND_pseudo_bytes(s->s2->conn_id,(int)s->s2->conn_id_length) <= 0)
-                    return -1;
+                if (RAND_pseudo_bytes(s->s2->conn_id,(int)s->s2->conn_id_length) <= 0)
+                        return -1;
                 memcpy(d,s->s2->conn_id,SSL2_CONNECTION_ID_LENGTH);
                 d+=SSL2_CONNECTION_ID_LENGTH;
 
@@ -938,6 +920,7 @@ static int server_finish(SSL *s)
 /* send the request and check the response */
 static int request_certificate(SSL *s)
         {
+        const unsigned char *cp;
         unsigned char *p,*p2,*buf2;
         unsigned char *ccd;
         int i,j,ctype,ret= -1;
@@ -951,7 +934,7 @@ static int request_certificate(SSL *s)
                 p=(unsigned char *)s->init_buf->data;
                 *(p++)=SSL2_MT_REQUEST_CERTIFICATE;
                 *(p++)=SSL2_AT_MD5_WITH_RSA_ENCRYPTION;
-                if(RAND_pseudo_bytes(ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH) <= 0)
+                if (RAND_pseudo_bytes(ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH) <= 0)
                         return -1;
                 memcpy(p,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
 
@@ -1055,7 +1038,8 @@ static int request_certificate(SSL *s)
                 s->msg_callback(0, s->version, 0, p, len, s, s->msg_callback_arg); /* CLIENT-CERTIFICATE */
         p += 6;
 
-        x509=(X509 *)d2i_X509(NULL,&p,(long)s->s2->tmp.clen);
+        cp = p;
+        x509=(X509 *)d2i_X509(NULL,&cp,(long)s->s2->tmp.clen);
         if (x509 == NULL)
                 {
                 SSLerr(SSL_F_REQUEST_CERTIFICATE,ERR_R_X509_LIB);
@@ -1095,7 +1079,7 @@ static int request_certificate(SSL *s)
 
                 pkey=X509_get_pubkey(x509);
                 if (pkey == NULL) goto end;
-                i=EVP_VerifyFinal(&ctx,p,s->s2->tmp.rlen,pkey);
+                i=EVP_VerifyFinal(&ctx,cp,s->s2->tmp.rlen,pkey);
                 EVP_PKEY_free(pkey);
                 EVP_MD_CTX_cleanup(&ctx);
 
diff --git a/src/lib/libssl/src/ssl/s3_both.c b/src/lib/libssl/src/ssl/s3_both.c
index 64d317b7ac..2ecfbb77cb 100644
--- a/src/lib/libssl/src/ssl/s3_both.c
+++ b/src/lib/libssl/src/ssl/s3_both.c
@@ -108,6 +108,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #include <limits.h>
 #include <string.h>
@@ -192,7 +197,7 @@ int ssl3_get_finished(SSL *s, int a, int b)
          * change cipher spec message and is in s->s3->tmp.peer_finish_md
          */ 
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 a,
                 b,
                 SSL3_MT_FINISHED,
@@ -386,8 +391,8 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
                         {
                         while (s->init_num < 4)
                                 {
-                                i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],
-                                        4 - s->init_num, 0);
+                                i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
+                                        &p[s->init_num],4 - s->init_num, 0);
                                 if (i <= 0)
                                         {
                                         s->rwstate=SSL_READING;
@@ -467,7 +472,7 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
         n = s->s3->tmp.message_size - s->init_num;
         while (n > 0)
                 {
-                i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n,0);
+                i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n,0);
                 if (i <= 0)
                         {
                         s->rwstate=SSL_READING;
@@ -492,7 +497,7 @@ err:
 int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
         {
         EVP_PKEY *pk;
-        int ret= -1,i,j;
+        int ret= -1,i;
 
         if (pkey == NULL)
                 pk=X509_get_pubkey(x);
@@ -504,35 +509,17 @@ int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
         if (i == EVP_PKEY_RSA)
                 {
                 ret=SSL_PKEY_RSA_ENC;
-                if (x != NULL)
-                        {
-                        j=X509_get_ext_count(x);
-                        /* check to see if this is a signing only certificate */
-                        /* EAY EAY EAY EAY */
-                        }
                 }
         else if (i == EVP_PKEY_DSA)
                 {
                 ret=SSL_PKEY_DSA_SIGN;
                 }
-        else if (i == EVP_PKEY_DH)
+#ifndef OPENSSL_NO_EC
+        else if (i == EVP_PKEY_EC)
                 {
-                /* if we just have a key, we needs to be guess */
-
-                if (x == NULL)
-                        ret=SSL_PKEY_DH_DSA;
-                else
-                        {
-                        j=X509_get_signature_type(x);
-                        if (j == EVP_PKEY_RSA)
-                                ret=SSL_PKEY_DH_RSA;
-                        else if (j== EVP_PKEY_DSA)
-                                ret=SSL_PKEY_DH_DSA;
-                        else ret= -1;
-                        }
+                ret = SSL_PKEY_ECC;
                 }
-        else
-                ret= -1;
+#endif
 
 err:
         if(!pkey) EVP_PKEY_free(pk);
diff --git a/src/lib/libssl/src/ssl/s3_clnt.c b/src/lib/libssl/src/ssl/s3_clnt.c
index 4163d97944..9a87c1cfb3 100644
--- a/src/lib/libssl/src/ssl/s3_clnt.c
+++ b/src/lib/libssl/src/ssl/s3_clnt.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -108,6 +108,19 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * ECC cipher suite support in OpenSSL originally written by
+ * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
+ *
+ */
 
 #include <stdio.h>
 #include "ssl_locl.h"
@@ -117,20 +130,22 @@
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include <openssl/md5.h>
-#include <openssl/fips.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
 
 static SSL_METHOD *ssl3_get_client_method(int ver);
-static int ssl3_client_hello(SSL *s);
-static int ssl3_get_server_hello(SSL *s);
-static int ssl3_get_certificate_request(SSL *s);
 static int ca_dn_cmp(const X509_NAME * const *a,const X509_NAME * const *b);
-static int ssl3_get_server_done(SSL *s);
-static int ssl3_send_client_verify(SSL *s);
-static int ssl3_send_client_certificate(SSL *s);
-static int ssl3_send_client_key_exchange(SSL *s);
-static int ssl3_get_key_exchange(SSL *s);
-static int ssl3_get_server_certificate(SSL *s);
-static int ssl3_check_cert_and_algorithm(SSL *s);
+#ifndef OPENSSL_NO_TLSEXT
+static int ssl3_check_finished(SSL *s);
+#endif
+
+#ifndef OPENSSL_NO_ECDH
+static int curve_id2nid(int curve_id);
+int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs);
+#endif
+
 static SSL_METHOD *ssl3_get_client_method(int ver)
         {
         if (ver == SSL3_VERSION)
@@ -139,28 +154,10 @@ static SSL_METHOD *ssl3_get_client_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *SSLv3_client_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv3_client_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&SSLv3_client_data,(char *)sslv3_base_method(),
-                                sizeof(SSL_METHOD));
-                        SSLv3_client_data.ssl_connect=ssl3_connect;
-                        SSLv3_client_data.get_ssl_method=ssl3_get_client_method;
-                        init=0;
-                        }
-
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv3_client_data);
-        }
+IMPLEMENT_ssl3_meth_func(SSLv3_client_method,
+                        ssl_undefined_function,
+                        ssl3_connect,
+                        ssl3_get_client_method)
 
 int ssl3_connect(SSL *s)
         {
@@ -270,15 +267,43 @@ int ssl3_connect(SSL *s)
 
                 case SSL3_ST_CR_CERT_A:
                 case SSL3_ST_CR_CERT_B:
-                        /* Check if it is anon DH */
+#ifndef OPENSSL_NO_TLSEXT
+                        ret=ssl3_check_finished(s);
+                        if (ret <= 0) goto end;
+                        if (ret == 2)
+                                {
+                                s->hit = 1;
+                                if (s->tlsext_ticket_expected)
+                                        s->state=SSL3_ST_CR_SESSION_TICKET_A;
+                                else
+                                        s->state=SSL3_ST_CR_FINISHED_A;
+                                s->init_num=0;
+                                break;
+                                }
+#endif
+                        /* Check if it is anon DH/ECDH */
                         if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
                                 {
                                 ret=ssl3_get_server_certificate(s);
                                 if (ret <= 0) goto end;
+#ifndef OPENSSL_NO_TLSEXT
+                                if (s->tlsext_status_expected)
+                                        s->state=SSL3_ST_CR_CERT_STATUS_A;
+                                else
+                                        s->state=SSL3_ST_CR_KEY_EXCH_A;
+                                }
+                        else
+                                {
+                                skip = 1;
+                                s->state=SSL3_ST_CR_KEY_EXCH_A;
+                                }
+#else
                                 }
                         else
                                 skip=1;
+
                         s->state=SSL3_ST_CR_KEY_EXCH_A;
+#endif
                         s->init_num=0;
                         break;
 
@@ -337,6 +362,13 @@ int ssl3_connect(SSL *s)
                          * sent back */
                         /* For TLS, cert_req is set to 2, so a cert chain
                          * of nothing is sent, but no verify packet is sent */
+                        /* XXX: For now, we do not support client 
+                         * authentication in ECDH cipher suites with
+                         * ECDH (rather than ECDSA) certificates.
+                         * We need to skip the certificate verify 
+                         * message when client's ECDH public key is sent 
+                         * inside the client certificate.
+                         */
                         if (s->s3->tmp.cert_req == 1)
                                 {
                                 s->state=SSL3_ST_CW_CERT_VRFY_A;
@@ -368,11 +400,15 @@ int ssl3_connect(SSL *s)
                         s->init_num=0;
 
                         s->session->cipher=s->s3->tmp.new_cipher;
+#ifdef OPENSSL_NO_COMP
+                        s->session->compress_meth=0;
+#else
                         if (s->s3->tmp.new_compression == NULL)
                                 s->session->compress_meth=0;
                         else
                                 s->session->compress_meth=
                                         s->s3->tmp.new_compression->id;
+#endif
                         if (!s->method->ssl3_enc->setup_key_block(s))
                                 {
                                 ret= -1;
@@ -411,11 +447,36 @@ int ssl3_connect(SSL *s)
                                 }
                         else
                                 {
+#ifndef OPENSSL_NO_TLSEXT
+                                /* Allow NewSessionTicket if ticket expected */
+                                if (s->tlsext_ticket_expected)
+                                        s->s3->tmp.next_state=SSL3_ST_CR_SESSION_TICKET_A;
+                                else
+#endif
+                                
                                 s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A;
                                 }
                         s->init_num=0;
                         break;
 
+#ifndef OPENSSL_NO_TLSEXT
+                case SSL3_ST_CR_SESSION_TICKET_A:
+                case SSL3_ST_CR_SESSION_TICKET_B:
+                        ret=ssl3_get_new_session_ticket(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_CR_FINISHED_A;
+                        s->init_num=0;
+                break;
+
+                case SSL3_ST_CR_CERT_STATUS_A:
+                case SSL3_ST_CR_CERT_STATUS_B:
+                        ret=ssl3_get_cert_status(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_CR_KEY_EXCH_A;
+                        s->init_num=0;
+                break;
+#endif
+
                 case SSL3_ST_CR_FINISHED_A:
                 case SSL3_ST_CR_FINISHED_B:
 
@@ -512,13 +573,16 @@ end:
         }
 
 
-static int ssl3_client_hello(SSL *s)
+int ssl3_client_hello(SSL *s)
         {
         unsigned char *buf;
         unsigned char *p,*d;
-        int i,j;
+        int i;
         unsigned long Time,l;
+#ifndef OPENSSL_NO_COMP
+        int j;
         SSL_COMP *comp;
+#endif
 
         buf=(unsigned char *)s->init_buf->data;
         if (s->state == SSL3_ST_CW_CLNT_HELLO_A)
@@ -535,8 +599,8 @@ static int ssl3_client_hello(SSL *s)
                 p=s->s3->client_random;
                 Time=(unsigned long)time(NULL);                 /* Time */
                 l2n(Time,p);
-                if(RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
-                    goto err;
+                if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
+                        goto err;
 
                 /* Do the message type and length last */
                 d=p= &(buf[4]);
@@ -557,7 +621,7 @@ static int ssl3_client_hello(SSL *s)
                 *(p++)=i;
                 if (i != 0)
                         {
-                        if (i > sizeof s->session->session_id)
+                        if (i > (int)sizeof(s->session->session_id))
                                 {
                                 SSLerr(SSL_F_SSL3_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
                                 goto err;
@@ -577,6 +641,9 @@ static int ssl3_client_hello(SSL *s)
                 p+=i;
 
                 /* COMPRESSION */
+#ifdef OPENSSL_NO_COMP
+                *(p++)=1;
+#else
                 if (s->ctx->comp_methods == NULL)
                         j=0;
                 else
@@ -587,8 +654,15 @@ static int ssl3_client_hello(SSL *s)
                         comp=sk_SSL_COMP_value(s->ctx->comp_methods,i);
                         *(p++)=comp->id;
                         }
+#endif
                 *(p++)=0; /* Add the NULL method */
-                
+#ifndef OPENSSL_NO_TLSEXT
+                if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);
+                        goto err;
+                        }
+#endif          
                 l=(p-d);
                 d=buf;
                 *(d++)=SSL3_MT_CLIENT_HELLO;
@@ -606,7 +680,7 @@ err:
         return(-1);
         }
 
-static int ssl3_get_server_hello(SSL *s)
+int ssl3_get_server_hello(SSL *s)
         {
         STACK_OF(SSL_CIPHER) *sk;
         SSL_CIPHER *c;
@@ -614,16 +688,44 @@ static int ssl3_get_server_hello(SSL *s)
         int i,al,ok;
         unsigned int j;
         long n;
+#ifndef OPENSSL_NO_COMP
         SSL_COMP *comp;
+#endif
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_CR_SRVR_HELLO_A,
                 SSL3_ST_CR_SRVR_HELLO_B,
-                SSL3_MT_SERVER_HELLO,
-                300, /* ?? */
+                -1,
+                20000, /* ?? */
                 &ok);
 
         if (!ok) return((int)n);
+
+        if ( SSL_version(s) == DTLS1_VERSION)
+                {
+                if ( s->s3->tmp.message_type == DTLS1_MT_HELLO_VERIFY_REQUEST)
+                        {
+                        if ( s->d1->send_cookie == 0)
+                                {
+                                s->s3->tmp.reuse_message = 1;
+                                return 1;
+                                }
+                        else /* already sent a cookie */
+                                {
+                                al=SSL_AD_UNEXPECTED_MESSAGE;
+                                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_MESSAGE_TYPE);
+                                goto f_err;
+                                }
+                        }
+                }
+        
+        if ( s->s3->tmp.message_type != SSL3_MT_SERVER_HELLO)
+                {
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_MESSAGE_TYPE);
+                goto f_err;
+                }
+
         d=p=(unsigned char *)s->init_msg;
 
         if ((p[0] != (s->version>>8)) || (p[1] != (s->version&0xff)))
@@ -719,6 +821,14 @@ static int ssl3_get_server_hello(SSL *s)
 
         /* lets get the compression algorithm */
         /* COMPRESSION */
+#ifdef OPENSSL_NO_COMP
+        if (*(p++) != 0)
+                {
+                al=SSL_AD_ILLEGAL_PARAMETER;
+                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
+                goto f_err;
+                }
+#else
         j= *(p++);
         if (j == 0)
                 comp=NULL;
@@ -735,6 +845,25 @@ static int ssl3_get_server_hello(SSL *s)
                 {
                 s->s3->tmp.new_compression=comp;
                 }
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+        /* TLS extensions*/
+        if (s->version > SSL3_VERSION)
+                {
+                if (!ssl_parse_serverhello_tlsext(s,&p,d,n, &al))
+                        {
+                        /* 'al' set by ssl_parse_serverhello_tlsext */
+                        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_PARSE_TLSEXT);
+                        goto f_err; 
+                        }
+                if (ssl_check_serverhello_tlsext(s) <= 0)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_SERVERHELLO_TLSEXT);
+                                goto err;
+                        }
+                }
+#endif
+
 
         if (p != (d+n))
                 {
@@ -751,18 +880,19 @@ err:
         return(-1);
         }
 
-static int ssl3_get_server_certificate(SSL *s)
+int ssl3_get_server_certificate(SSL *s)
         {
         int al,i,ok,ret= -1;
         unsigned long n,nc,llen,l;
         X509 *x=NULL;
-        unsigned char *p,*d,*q;
+        const unsigned char *q,*p;
+        unsigned char *d;
         STACK_OF(X509) *sk=NULL;
         SESS_CERT *sc;
         EVP_PKEY *pkey=NULL;
-        int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
+        int need_cert = 1; /* VRS: 0=> will allow null cert if auth == KRB5 */
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_CR_CERT_A,
                 SSL3_ST_CR_CERT_B,
                 -1,
@@ -771,7 +901,9 @@ static int ssl3_get_server_certificate(SSL *s)
 
         if (!ok) return((int)n);
 
-        if (s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE)
+        if ((s->s3->tmp.message_type == SSL3_MT_SERVER_KEY_EXCHANGE) ||
+                ((s->s3->tmp.new_cipher->algorithms & SSL_aKRB5) && 
+                (s->s3->tmp.message_type == SSL3_MT_SERVER_DONE)))
                 {
                 s->s3->tmp.reuse_message=1;
                 return(1);
@@ -783,7 +915,7 @@ static int ssl3_get_server_certificate(SSL *s)
                 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_BAD_MESSAGE_TYPE);
                 goto f_err;
                 }
-        d=p=(unsigned char *)s->init_msg;
+        p=d=(unsigned char *)s->init_msg;
 
         if ((sk=sk_X509_new_null()) == NULL)
                 {
@@ -835,10 +967,10 @@ static int ssl3_get_server_certificate(SSL *s)
         i=ssl_verify_cert_chain(s,sk);
         if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)
 #ifndef OPENSSL_NO_KRB5
-                && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
-                != (SSL_aKRB5|SSL_kKRB5)
+                && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
+                != (SSL_aKRB5|SSL_kKRB5)
 #endif /* OPENSSL_NO_KRB5 */
-                )
+                )
                 {
                 al=ssl_verify_alarm_type(s->verify_result);
                 SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
@@ -861,16 +993,16 @@ static int ssl3_get_server_certificate(SSL *s)
 
         pkey=X509_get_pubkey(x);
 
-        /* VRS: allow null cert if auth == KRB5 */
-        need_cert =     ((s->s3->tmp.new_cipher->algorithms
-                        & (SSL_MKEY_MASK|SSL_AUTH_MASK))
-                        == (SSL_aKRB5|SSL_kKRB5))? 0: 1;
+        /* VRS: allow null cert if auth == KRB5 */
+        need_cert =     ((s->s3->tmp.new_cipher->algorithms
+                         & (SSL_MKEY_MASK|SSL_AUTH_MASK))
+                         == (SSL_aKRB5|SSL_kKRB5))? 0: 1;
 
 #ifdef KSSL_DEBUG
         printf("pkey,x = %p, %p\n", pkey,x);
         printf("ssl_cert_type(x,pkey) = %d\n", ssl_cert_type(x,pkey));
         printf("cipher, alg, nc = %s, %lx, %d\n", s->s3->tmp.new_cipher->name,
-                s->s3->tmp.new_cipher->algorithms, need_cert);
+                s->s3->tmp.new_cipher->algorithms, need_cert);
 #endif    /* KSSL_DEBUG */
 
         if (need_cert && ((pkey == NULL) || EVP_PKEY_missing_parameters(pkey)))
@@ -892,31 +1024,31 @@ static int ssl3_get_server_certificate(SSL *s)
                 goto f_err;
                 }
 
-        if (need_cert)
-                {
-                sc->peer_cert_type=i;
-                CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
-                /* Why would the following ever happen?
-                 * We just created sc a couple of lines ago. */
-                if (sc->peer_pkeys[i].x509 != NULL)
-                        X509_free(sc->peer_pkeys[i].x509);
-                sc->peer_pkeys[i].x509=x;
-                sc->peer_key= &(sc->peer_pkeys[i]);
-
-                if (s->session->peer != NULL)
-                        X509_free(s->session->peer);
-                CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
-                s->session->peer=x;
-                }
-        else
-                {
-                sc->peer_cert_type=i;
-                sc->peer_key= NULL;
-
-                if (s->session->peer != NULL)
-                        X509_free(s->session->peer);
-                s->session->peer=NULL;
-                }
+        if (need_cert)
+                {
+                sc->peer_cert_type=i;
+                CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
+                /* Why would the following ever happen?
+                 * We just created sc a couple of lines ago. */
+                if (sc->peer_pkeys[i].x509 != NULL)
+                        X509_free(sc->peer_pkeys[i].x509);
+                sc->peer_pkeys[i].x509=x;
+                sc->peer_key= &(sc->peer_pkeys[i]);
+
+                if (s->session->peer != NULL)
+                        X509_free(s->session->peer);
+                CRYPTO_add(&x->references,1,CRYPTO_LOCK_X509);
+                s->session->peer=x;
+                }
+        else
+                {
+                sc->peer_cert_type=i;
+                sc->peer_key= NULL;
+
+                if (s->session->peer != NULL)
+                        X509_free(s->session->peer);
+                s->session->peer=NULL;
+                }
         s->session->verify_result = s->verify_result;
 
         x=NULL;
@@ -934,7 +1066,7 @@ err:
         return(ret);
         }
 
-static int ssl3_get_key_exchange(SSL *s)
+int ssl3_get_key_exchange(SSL *s)
         {
 #ifndef OPENSSL_NO_RSA
         unsigned char *q,md_buf[EVP_MAX_MD_SIZE*2];
@@ -950,10 +1082,17 @@ static int ssl3_get_key_exchange(SSL *s)
 #ifndef OPENSSL_NO_DH
         DH *dh=NULL;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *ecdh = NULL;
+        BN_CTX *bn_ctx = NULL;
+        EC_POINT *srvr_ecpoint = NULL;
+        int curve_nid = 0;
+        int encoded_pt_len = 0;
+#endif
 
         /* use same message size as in ssl3_get_certificate_request()
          * as ServerKeyExchange message may be skipped */
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_CR_KEY_EXCH_A,
                 SSL3_ST_CR_KEY_EXCH_B,
                 -1,
@@ -986,6 +1125,13 @@ static int ssl3_get_key_exchange(SSL *s)
                         s->session->sess_cert->peer_dh_tmp=NULL;
                         }
 #endif
+#ifndef OPENSSL_NO_ECDH
+                if (s->session->sess_cert->peer_ecdh_tmp)
+                        {
+                        EC_KEY_free(s->session->sess_cert->peer_ecdh_tmp);
+                        s->session->sess_cert->peer_ecdh_tmp=NULL;
+                        }
+#endif
                 }
         else
                 {
@@ -1127,6 +1273,114 @@ static int ssl3_get_key_exchange(SSL *s)
                 goto f_err;
                 }
 #endif /* !OPENSSL_NO_DH */
+
+#ifndef OPENSSL_NO_ECDH
+        else if (alg & SSL_kECDHE)
+                {
+                EC_GROUP *ngroup;
+                const EC_GROUP *group;
+
+                if ((ecdh=EC_KEY_new()) == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+
+                /* Extract elliptic curve parameters and the
+                 * server's ephemeral ECDH public key.
+                 * Keep accumulating lengths of various components in
+                 * param_len and make sure it never exceeds n.
+                 */
+
+                /* XXX: For now we only support named (not generic) curves
+                 * and the ECParameters in this case is just three bytes.
+                 */
+                param_len=3;
+                if ((param_len > n) ||
+                    (*p != NAMED_CURVE_TYPE) || 
+                    ((curve_nid = curve_id2nid(*(p + 2))) == 0)) 
+                        {
+                        al=SSL_AD_INTERNAL_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
+                        goto f_err;
+                        }
+
+                ngroup = EC_GROUP_new_by_curve_name(curve_nid);
+                if (ngroup == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_EC_LIB);
+                        goto err;
+                        }
+                if (EC_KEY_set_group(ecdh, ngroup) == 0)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_EC_LIB);
+                        goto err;
+                        }
+                EC_GROUP_free(ngroup);
+
+                group = EC_KEY_get0_group(ecdh);
+
+                if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&
+                    (EC_GROUP_get_degree(group) > 163))
+                        {
+                        al=SSL_AD_EXPORT_RESTRICTION;
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER);
+                        goto f_err;
+                        }
+
+                p+=3;
+
+                /* Next, get the encoded ECPoint */
+                if (((srvr_ecpoint = EC_POINT_new(group)) == NULL) ||
+                    ((bn_ctx = BN_CTX_new()) == NULL))
+                        {
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+
+                encoded_pt_len = *p;  /* length of encoded point */
+                p+=1;
+                param_len += (1 + encoded_pt_len);
+                if ((param_len > n) ||
+                    (EC_POINT_oct2point(group, srvr_ecpoint, 
+                        p, encoded_pt_len, bn_ctx) == 0))
+                        {
+                        al=SSL_AD_DECODE_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_ECPOINT);
+                        goto f_err;
+                        }
+
+                n-=param_len;
+                p+=encoded_pt_len;
+
+                /* The ECC/TLS specification does not mention
+                 * the use of DSA to sign ECParameters in the server
+                 * key exchange message. We do support RSA and ECDSA.
+                 */
+                if (0) ;
+#ifndef OPENSSL_NO_RSA
+                else if (alg & SSL_aRSA)
+                        pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
+#endif
+#ifndef OPENSSL_NO_ECDSA
+                else if (alg & SSL_aECDSA)
+                        pkey=X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
+#endif
+                /* else anonymous ECDH, so no certificate or pkey. */
+                EC_KEY_set_public_key(ecdh, srvr_ecpoint);
+                s->session->sess_cert->peer_ecdh_tmp=ecdh;
+                ecdh=NULL;
+                BN_CTX_free(bn_ctx);
+                EC_POINT_free(srvr_ecpoint);
+                srvr_ecpoint = NULL;
+                }
+        else if (alg & SSL_kECDH)
+                {
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
+                goto f_err;
+                }
+#endif /* !OPENSSL_NO_ECDH */
         if (alg & SSL_aFZA)
                 {
                 al=SSL_AD_HANDSHAKE_FAILURE;
@@ -1137,7 +1391,6 @@ static int ssl3_get_key_exchange(SSL *s)
 
         /* p points to the next byte, there are 'n' bytes left */
 
-
         /* if it was signed, check the signature */
         if (pkey != NULL)
                 {
@@ -1162,14 +1415,11 @@ static int ssl3_get_key_exchange(SSL *s)
                         q=md_buf;
                         for (num=2; num > 0; num--)
                                 {
-                                EVP_MD_CTX_set_flags(&md_ctx,
-                                        EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
                                 EVP_DigestInit_ex(&md_ctx,(num == 2)
                                         ?s->ctx->md5:s->ctx->sha1, NULL);
                                 EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
                                 EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
                                 EVP_DigestUpdate(&md_ctx,param,param_len);
-                                
                                 EVP_DigestFinal_ex(&md_ctx,q,(unsigned int *)&i);
                                 q+=i;
                                 j+=i;
@@ -1210,6 +1460,24 @@ static int ssl3_get_key_exchange(SSL *s)
                         }
                 else
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                        if (pkey->type == EVP_PKEY_EC)
+                        {
+                        /* let's do ECDSA */
+                        EVP_VerifyInit_ex(&md_ctx,EVP_ecdsa(), NULL);
+                        EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
+                        EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
+                        EVP_VerifyUpdate(&md_ctx,param,param_len);
+                        if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
+                                {
+                                /* bad signature */
+                                al=SSL_AD_DECRYPT_ERROR;
+                                SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SIGNATURE);
+                                goto f_err;
+                                }
+                        }
+                else
+#endif
                         {
                         SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
                         goto err;
@@ -1245,20 +1513,27 @@ err:
         if (dh != NULL)
                 DH_free(dh);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        BN_CTX_free(bn_ctx);
+        EC_POINT_free(srvr_ecpoint);
+        if (ecdh != NULL)
+                EC_KEY_free(ecdh);
+#endif
         EVP_MD_CTX_cleanup(&md_ctx);
         return(-1);
         }
 
-static int ssl3_get_certificate_request(SSL *s)
+int ssl3_get_certificate_request(SSL *s)
         {
         int ok,ret=0;
         unsigned long n,nc,l;
         unsigned int llen,ctype_num,i;
         X509_NAME *xn=NULL;
-        unsigned char *p,*d,*q;
+        const unsigned char *p,*q;
+        unsigned char *d;
         STACK_OF(X509_NAME) *ca_sk=NULL;
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_CR_CERT_REQ_A,
                 SSL3_ST_CR_CERT_REQ_B,
                 -1,
@@ -1294,7 +1569,7 @@ static int ssl3_get_certificate_request(SSL *s)
                         }
                 }
 
-        d=p=(unsigned char *)s->init_msg;
+        p=d=(unsigned char *)s->init_msg;
 
         if ((ca_sk=sk_X509_NAME_new(ca_dn_cmp)) == NULL)
                 {
@@ -1395,13 +1670,150 @@ static int ca_dn_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
         {
         return(X509_NAME_cmp(*a,*b));
         }
+#ifndef OPENSSL_NO_TLSEXT
+int ssl3_get_new_session_ticket(SSL *s)
+        {
+        int ok,al,ret=0, ticklen;
+        long n;
+        const unsigned char *p;
+        unsigned char *d;
 
-static int ssl3_get_server_done(SSL *s)
+        n=s->method->ssl_get_message(s,
+                SSL3_ST_CR_SESSION_TICKET_A,
+                SSL3_ST_CR_SESSION_TICKET_B,
+                -1,
+                16384,
+                &ok);
+
+        if (!ok)
+                return((int)n);
+
+        if (s->s3->tmp.message_type == SSL3_MT_FINISHED)
+                {
+                s->s3->tmp.reuse_message=1;
+                return(1);
+                }
+        if (s->s3->tmp.message_type != SSL3_MT_NEWSESSION_TICKET)
+                {
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_BAD_MESSAGE_TYPE);
+                goto f_err;
+                }
+        if (n < 6)
+                {
+                /* need at least ticket_lifetime_hint + ticket length */
+                al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
+                SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
+                goto f_err;
+                }
+        p=d=(unsigned char *)s->init_msg;
+        n2l(p, s->session->tlsext_tick_lifetime_hint);
+        n2s(p, ticklen);
+        /* ticket_lifetime_hint + ticket_length + ticket */
+        if (ticklen + 6 != n)
+                {
+                al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
+                SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
+                goto f_err;
+                }
+        if (s->session->tlsext_tick)
+                {
+                OPENSSL_free(s->session->tlsext_tick);
+                s->session->tlsext_ticklen = 0;
+                }
+        s->session->tlsext_tick = OPENSSL_malloc(ticklen);
+        if (!s->session->tlsext_tick)
+                {
+                SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
+        memcpy(s->session->tlsext_tick, p, ticklen);
+        s->session->tlsext_ticklen = ticklen;
+        
+        ret=1;
+        return(ret);
+f_err:
+        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+err:
+        return(-1);
+        }
+
+int ssl3_get_cert_status(SSL *s)
+        {
+        int ok, al;
+        unsigned long resplen;
+        long n;
+        const unsigned char *p;
+
+        n=s->method->ssl_get_message(s,
+                SSL3_ST_CR_CERT_STATUS_A,
+                SSL3_ST_CR_CERT_STATUS_B,
+                SSL3_MT_CERTIFICATE_STATUS,
+                16384,
+                &ok);
+
+        if (!ok) return((int)n);
+        if (n < 4)
+                {
+                /* need at least status type + length */
+                al = SSL_AD_DECODE_ERROR;
+                SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_LENGTH_MISMATCH);
+                goto f_err;
+                }
+        p = (unsigned char *)s->init_msg;
+        if (*p++ != TLSEXT_STATUSTYPE_ocsp)
+                {
+                al = SSL_AD_DECODE_ERROR;
+                SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_UNSUPPORTED_STATUS_TYPE);
+                goto f_err;
+                }
+        n2l3(p, resplen);
+        if (resplen + 4 != n)
+                {
+                al = SSL_AD_DECODE_ERROR;
+                SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_LENGTH_MISMATCH);
+                goto f_err;
+                }
+        if (s->tlsext_ocsp_resp)
+                OPENSSL_free(s->tlsext_ocsp_resp);
+        s->tlsext_ocsp_resp = BUF_memdup(p, resplen);
+        if (!s->tlsext_ocsp_resp)
+                {
+                al = SSL_AD_INTERNAL_ERROR;
+                SSLerr(SSL_F_SSL3_GET_CERT_STATUS,ERR_R_MALLOC_FAILURE);
+                goto f_err;
+                }
+        s->tlsext_ocsp_resplen = resplen;
+        if (s->ctx->tlsext_status_cb)
+                {
+                int ret;
+                ret = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
+                if (ret == 0)
+                        {
+                        al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
+                        SSLerr(SSL_F_SSL3_GET_CERT_STATUS,SSL_R_INVALID_STATUS_RESPONSE);
+                        goto f_err;
+                        }
+                if (ret < 0)
+                        {
+                        al = SSL_AD_INTERNAL_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_CERT_STATUS,ERR_R_MALLOC_FAILURE);
+                        goto f_err;
+                        }
+                }
+        return 1;
+f_err:
+        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+        return(-1);
+        }
+#endif
+
+int ssl3_get_server_done(SSL *s)
         {
         int ok,ret=0;
         long n;
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_CR_SRVR_DONE_A,
                 SSL3_ST_CR_SRVR_DONE_B,
                 SSL3_MT_SERVER_DONE,
@@ -1420,7 +1832,8 @@ static int ssl3_get_server_done(SSL *s)
         return(ret);
         }
 
-static int ssl3_send_client_key_exchange(SSL *s)
+
+int ssl3_send_client_key_exchange(SSL *s)
         {
         unsigned char *p,*d;
         int n;
@@ -1430,8 +1843,16 @@ static int ssl3_send_client_key_exchange(SSL *s)
         EVP_PKEY *pkey=NULL;
 #endif
 #ifndef OPENSSL_NO_KRB5
-        KSSL_ERR kssl_err;
+        KSSL_ERR kssl_err;
 #endif /* OPENSSL_NO_KRB5 */
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *clnt_ecdh = NULL;
+        const EC_POINT *srvr_ecpoint = NULL;
+        EVP_PKEY *srvr_pub_pkey = NULL;
+        unsigned char *encodedPoint = NULL;
+        int encoded_pt_len = 0;
+        BN_CTX * bn_ctx = NULL;
+#endif
 
         if (s->state == SSL3_ST_CW_KEY_EXCH_A)
                 {
@@ -1440,8 +1861,8 @@ static int ssl3_send_client_key_exchange(SSL *s)
 
                 l=s->s3->tmp.new_cipher->algorithms;
 
-                /* Fool emacs indentation */
-                if (0) {}
+                /* Fool emacs indentation */
+                if (0) {}
 #ifndef OPENSSL_NO_RSA
                 else if (l & SSL_kRSA)
                         {
@@ -1503,12 +1924,12 @@ static int ssl3_send_client_key_exchange(SSL *s)
 #endif
 #ifndef OPENSSL_NO_KRB5
                 else if (l & SSL_kKRB5)
-                        {
-                        krb5_error_code krb5rc;
-                        KSSL_CTX        *kssl_ctx = s->kssl_ctx;
-                        /*  krb5_data   krb5_ap_req;  */
-                        krb5_data       *enc_ticket;
-                        krb5_data       authenticator, *authp = NULL;
+                        {
+                        krb5_error_code krb5rc;
+                        KSSL_CTX        *kssl_ctx = s->kssl_ctx;
+                        /*  krb5_data   krb5_ap_req;  */
+                        krb5_data       *enc_ticket;
+                        krb5_data       authenticator, *authp = NULL;
                         EVP_CIPHER_CTX  ciph_ctx;
                         EVP_CIPHER      *enc = NULL;
                         unsigned char   iv[EVP_MAX_IV_LENGTH];
@@ -1520,8 +1941,8 @@ static int ssl3_send_client_key_exchange(SSL *s)
                         EVP_CIPHER_CTX_init(&ciph_ctx);
 
 #ifdef KSSL_DEBUG
-                        printf("ssl3_send_client_key_exchange(%lx & %lx)\n",
-                                l, SSL_kKRB5);
+                        printf("ssl3_send_client_key_exchange(%lx & %lx)\n",
+                                l, SSL_kKRB5);
 #endif  /* KSSL_DEBUG */
 
                         authp = NULL;
@@ -1529,37 +1950,37 @@ static int ssl3_send_client_key_exchange(SSL *s)
                         if (KRB5SENDAUTH)  authp = &authenticator;
 #endif  /* KRB5SENDAUTH */
 
-                        krb5rc = kssl_cget_tkt(kssl_ctx, &enc_ticket, authp,
+                        krb5rc = kssl_cget_tkt(kssl_ctx, &enc_ticket, authp,
                                 &kssl_err);
                         enc = kssl_map_enc(kssl_ctx->enctype);
-                        if (enc == NULL)
-                            goto err;
+                        if (enc == NULL)
+                            goto err;
 #ifdef KSSL_DEBUG
-                        {
-                        printf("kssl_cget_tkt rtn %d\n", krb5rc);
-                        if (krb5rc && kssl_err.text)
+                        {
+                        printf("kssl_cget_tkt rtn %d\n", krb5rc);
+                        if (krb5rc && kssl_err.text)
                           printf("kssl_cget_tkt kssl_err=%s\n", kssl_err.text);
-                        }
+                        }
 #endif  /* KSSL_DEBUG */
 
-                        if (krb5rc)
-                                {
-                                ssl3_send_alert(s,SSL3_AL_FATAL,
+                        if (krb5rc)
+                                {
+                                ssl3_send_alert(s,SSL3_AL_FATAL,
                                                 SSL_AD_HANDSHAKE_FAILURE);
-                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
                                                 kssl_err.reason);
-                                goto err;
-                                }
+                                goto err;
+                                }
 
                         /*  20010406 VRS - Earlier versions used KRB5 AP_REQ
                         **  in place of RFC 2712 KerberosWrapper, as in:
                         **
-                        **  Send ticket (copy to *p, set n = length)
-                        **  n = krb5_ap_req.length;
-                        **  memcpy(p, krb5_ap_req.data, krb5_ap_req.length);
-                        **  if (krb5_ap_req.data)  
-                        **    kssl_krb5_free_data_contents(NULL,&krb5_ap_req);
-                        **
+                        **  Send ticket (copy to *p, set n = length)
+                        **  n = krb5_ap_req.length;
+                        **  memcpy(p, krb5_ap_req.data, krb5_ap_req.length);
+                        **  if (krb5_ap_req.data)  
+                        **    kssl_krb5_free_data_contents(NULL,&krb5_ap_req);
+                        **
                         **  Now using real RFC 2712 KerberosWrapper
                         **  (Thanks to Simon Wilkinson <sxw@sxw.org.uk>)
                         **  Note: 2712 "opaque" types are here replaced
@@ -1594,8 +2015,10 @@ static int ssl3_send_client_key_exchange(SSL *s)
                                 n+=2;
                                 }
  
-                        if (RAND_bytes(tmp_buf,sizeof tmp_buf) <= 0)
-                            goto err;
+                            tmp_buf[0]=s->client_version>>8;
+                            tmp_buf[1]=s->client_version&0xff;
+                            if (RAND_bytes(&(tmp_buf[2]),sizeof tmp_buf-2) <= 0)
+                                goto err;
 
                         /*  20010420 VRS.  Tried it this way; failed.
                         **      EVP_EncryptInit_ex(&ciph_ctx,enc, NULL,NULL);
@@ -1624,20 +2047,27 @@ static int ssl3_send_client_key_exchange(SSL *s)
                         p+=outl;
                         n+=outl + 2;
 
-                        s->session->master_key_length=
-                                s->method->ssl3_enc->generate_master_secret(s,
+                        s->session->master_key_length=
+                                s->method->ssl3_enc->generate_master_secret(s,
                                         s->session->master_key,
                                         tmp_buf, sizeof tmp_buf);
 
                         OPENSSL_cleanse(tmp_buf, sizeof tmp_buf);
                         OPENSSL_cleanse(epms, outl);
-                        }
+                        }
 #endif
 #ifndef OPENSSL_NO_DH
                 else if (l & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
                         {
                         DH *dh_srvr,*dh_clnt;
 
+                        if (s->session->sess_cert == NULL) 
+                                {
+                                ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
+                                goto err;
+                                }
+
                         if (s->session->sess_cert->peer_dh_tmp != NULL)
                                 dh_srvr=s->session->sess_cert->peer_dh_tmp;
                         else
@@ -1689,10 +2119,198 @@ static int ssl3_send_client_key_exchange(SSL *s)
                         /* perhaps clean things up a bit EAY EAY EAY EAY*/
                         }
 #endif
+
+#ifndef OPENSSL_NO_ECDH 
+                else if ((l & SSL_kECDH) || (l & SSL_kECDHE))
+                        {
+                        const EC_GROUP *srvr_group = NULL;
+                        EC_KEY *tkey;
+                        int ecdh_clnt_cert = 0;
+                        int field_size = 0;
+
+                        /* Did we send out the client's
+                         * ECDH share for use in premaster
+                         * computation as part of client certificate?
+                         * If so, set ecdh_clnt_cert to 1.
+                         */
+                        if ((l & SSL_kECDH) && (s->cert != NULL)) 
+                                {
+                                /* XXX: For now, we do not support client
+                                 * authentication using ECDH certificates.
+                                 * To add such support, one needs to add
+                                 * code that checks for appropriate 
+                                 * conditions and sets ecdh_clnt_cert to 1.
+                                 * For example, the cert have an ECC
+                                 * key on the same curve as the server's
+                                 * and the key should be authorized for
+                                 * key agreement.
+                                 *
+                                 * One also needs to add code in ssl3_connect
+                                 * to skip sending the certificate verify
+                                 * message.
+                                 *
+                                 * if ((s->cert->key->privatekey != NULL) &&
+                                 *     (s->cert->key->privatekey->type ==
+                                 *      EVP_PKEY_EC) && ...)
+                                 * ecdh_clnt_cert = 1;
+                                 */
+                                }
+
+                        if (s->session->sess_cert->peer_ecdh_tmp != NULL)
+                                {
+                                tkey = s->session->sess_cert->peer_ecdh_tmp;
+                                }
+                        else
+                                {
+                                /* Get the Server Public Key from Cert */
+                                srvr_pub_pkey = X509_get_pubkey(s->session-> \
+                                    sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
+                                if ((srvr_pub_pkey == NULL) ||
+                                    (srvr_pub_pkey->type != EVP_PKEY_EC) ||
+                                    (srvr_pub_pkey->pkey.ec == NULL))
+                                        {
+                                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_INTERNAL_ERROR);
+                                        goto err;
+                                        }
+
+                                tkey = srvr_pub_pkey->pkey.ec;
+                                }
+
+                        srvr_group   = EC_KEY_get0_group(tkey);
+                        srvr_ecpoint = EC_KEY_get0_public_key(tkey);
+
+                        if ((srvr_group == NULL) || (srvr_ecpoint == NULL))
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+
+                        if ((clnt_ecdh=EC_KEY_new()) == NULL) 
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+
+                        if (!EC_KEY_set_group(clnt_ecdh, srvr_group))
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_EC_LIB);
+                                goto err;
+                                }
+                        if (ecdh_clnt_cert) 
+                                { 
+                                /* Reuse key info from our certificate
+                                 * We only need our private key to perform
+                                 * the ECDH computation.
+                                 */
+                                const BIGNUM *priv_key;
+                                tkey = s->cert->key->privatekey->pkey.ec;
+                                priv_key = EC_KEY_get0_private_key(tkey);
+                                if (priv_key == NULL)
+                                        {
+                                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                                        goto err;
+                                        }
+                                if (!EC_KEY_set_private_key(clnt_ecdh, priv_key))
+                                        {
+                                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_EC_LIB);
+                                        goto err;
+                                        }
+                                }
+                        else 
+                                {
+                                /* Generate a new ECDH key pair */
+                                if (!(EC_KEY_generate_key(clnt_ecdh)))
+                                        {
+                                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB);
+                                        goto err;
+                                        }
+                                }
+
+                        /* use the 'p' output buffer for the ECDH key, but
+                         * make sure to clear it out afterwards
+                         */
+
+                        field_size = EC_GROUP_get_degree(srvr_group);
+                        if (field_size <= 0)
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 
+                                       ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+                        n=ECDH_compute_key(p, (field_size+7)/8, srvr_ecpoint, clnt_ecdh, NULL);
+                        if (n <= 0)
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, 
+                                       ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+
+                        /* generate master key from the result */
+                        s->session->master_key_length = s->method->ssl3_enc \
+                            -> generate_master_secret(s, 
+                                s->session->master_key,
+                                p, n);
+
+                        memset(p, 0, n); /* clean up */
+
+                        if (ecdh_clnt_cert) 
+                                {
+                                /* Send empty client key exch message */
+                                n = 0;
+                                }
+                        else 
+                                {
+                                /* First check the size of encoding and
+                                 * allocate memory accordingly.
+                                 */
+                                encoded_pt_len = 
+                                    EC_POINT_point2oct(srvr_group, 
+                                        EC_KEY_get0_public_key(clnt_ecdh), 
+                                        POINT_CONVERSION_UNCOMPRESSED, 
+                                        NULL, 0, NULL);
+
+                                encodedPoint = (unsigned char *) 
+                                    OPENSSL_malloc(encoded_pt_len * 
+                                        sizeof(unsigned char)); 
+                                bn_ctx = BN_CTX_new();
+                                if ((encodedPoint == NULL) || 
+                                    (bn_ctx == NULL)) 
+                                        {
+                                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                                        goto err;
+                                        }
+
+                                /* Encode the public key */
+                                n = EC_POINT_point2oct(srvr_group, 
+                                    EC_KEY_get0_public_key(clnt_ecdh), 
+                                    POINT_CONVERSION_UNCOMPRESSED, 
+                                    encodedPoint, encoded_pt_len, bn_ctx);
+
+                                *p = n; /* length of encoded point */
+                                /* Encoded point will be copied here */
+                                p += 1; 
+                                /* copy the point */
+                                memcpy((unsigned char *)p, encodedPoint, n);
+                                /* increment n to account for length field */
+                                n += 1; 
+                                }
+
+                        /* Free allocated memory */
+                        BN_CTX_free(bn_ctx);
+                        if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
+                        if (clnt_ecdh != NULL) 
+                                 EC_KEY_free(clnt_ecdh);
+                        EVP_PKEY_free(srvr_pub_pkey);
+                        }
+#endif /* !OPENSSL_NO_ECDH */
                 else
                         {
-                        ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
-                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
+                        ssl3_send_alert(s, SSL3_AL_FATAL,
+                            SSL_AD_HANDSHAKE_FAILURE);
+                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                            ERR_R_INTERNAL_ERROR);
                         goto err;
                         }
                 
@@ -1708,10 +2326,17 @@ static int ssl3_send_client_key_exchange(SSL *s)
         /* SSL3_ST_CW_KEY_EXCH_B */
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
 err:
+#ifndef OPENSSL_NO_ECDH
+        BN_CTX_free(bn_ctx);
+        if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
+        if (clnt_ecdh != NULL) 
+                EC_KEY_free(clnt_ecdh);
+        EVP_PKEY_free(srvr_pub_pkey);
+#endif
         return(-1);
         }
 
-static int ssl3_send_client_verify(SSL *s)
+int ssl3_send_client_verify(SSL *s)
         {
         unsigned char *p,*d;
         unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
@@ -1720,7 +2345,7 @@ static int ssl3_send_client_verify(SSL *s)
         unsigned u=0;
 #endif
         unsigned long n;
-#ifndef OPENSSL_NO_DSA
+#if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
         int j;
 #endif
 
@@ -1766,6 +2391,23 @@ static int ssl3_send_client_verify(SSL *s)
                         }
                 else
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                        if (pkey->type == EVP_PKEY_EC)
+                        {
+                        if (!ECDSA_sign(pkey->save_type,
+                                &(data[MD5_DIGEST_LENGTH]),
+                                SHA_DIGEST_LENGTH,&(p[2]),
+                                (unsigned int *)&j,pkey->pkey.ec))
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,
+                                    ERR_R_ECDSA_LIB);
+                                goto err;
+                                }
+                        s2n(j,p);
+                        n=j+2;
+                        }
+                else
+#endif
                         {
                         SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_INTERNAL_ERROR);
                         goto err;
@@ -1782,7 +2424,7 @@ err:
         return(-1);
         }
 
-static int ssl3_send_client_certificate(SSL *s)
+int ssl3_send_client_certificate(SSL *s)
         {
         X509 *x509=NULL;
         EVP_PKEY *pkey=NULL;
@@ -1861,7 +2503,7 @@ static int ssl3_send_client_certificate(SSL *s)
 
 #define has_bits(i,m)   (((i)&(m)) == (m))
 
-static int ssl3_check_cert_and_algorithm(SSL *s)
+int ssl3_check_cert_and_algorithm(SSL *s)
         {
         int i,idx;
         long algs;
@@ -1876,18 +2518,18 @@ static int ssl3_check_cert_and_algorithm(SSL *s)
 
         sc=s->session->sess_cert;
 
-        if (sc == NULL)
-                {
-                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,ERR_R_INTERNAL_ERROR);
-                goto err;
-                }
-
         algs=s->s3->tmp.new_cipher->algorithms;
 
         /* we don't have a certificate */
         if (algs & (SSL_aDH|SSL_aNULL|SSL_aKRB5))
                 return(1);
 
+        if (sc == NULL)
+                {
+                SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,ERR_R_INTERNAL_ERROR);
+                goto err;
+                }
+
 #ifndef OPENSSL_NO_RSA
         rsa=s->session->sess_cert->peer_rsa_tmp;
 #endif
@@ -1898,6 +2540,21 @@ static int ssl3_check_cert_and_algorithm(SSL *s)
         /* This is the passed certificate */
 
         idx=sc->peer_cert_type;
+#ifndef OPENSSL_NO_ECDH
+        if (idx == SSL_PKEY_ECC)
+                {
+                if (check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509,
+                    s->s3->tmp.new_cipher) == 0) 
+                        { /* check failed */
+                        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_BAD_ECC_CERT);
+                        goto f_err;                     
+                        }
+                else 
+                        {
+                        return 1;
+                        }
+                }
+#endif
         pkey=X509_get_pubkey(sc->peer_pkeys[idx].x509);
         i=X509_certificate_type(sc->peer_pkeys[idx].x509,pkey);
         EVP_PKEY_free(pkey);
@@ -1983,3 +2640,79 @@ err:
         return(0);
         }
 
+
+#ifndef OPENSSL_NO_ECDH
+/* This is the complement of nid2curve_id in s3_srvr.c. */
+static int curve_id2nid(int curve_id)
+{
+        /* ECC curves from draft-ietf-tls-ecc-01.txt (Mar 15, 2001)
+         * (no changes in draft-ietf-tls-ecc-03.txt [June 2003]) */
+        static int nid_list[26] =
+        {
+                0,
+                NID_sect163k1, /* sect163k1 (1) */
+                NID_sect163r1, /* sect163r1 (2) */
+                NID_sect163r2, /* sect163r2 (3) */
+                NID_sect193r1, /* sect193r1 (4) */ 
+                NID_sect193r2, /* sect193r2 (5) */ 
+                NID_sect233k1, /* sect233k1 (6) */
+                NID_sect233r1, /* sect233r1 (7) */ 
+                NID_sect239k1, /* sect239k1 (8) */ 
+                NID_sect283k1, /* sect283k1 (9) */
+                NID_sect283r1, /* sect283r1 (10) */ 
+                NID_sect409k1, /* sect409k1 (11) */ 
+                NID_sect409r1, /* sect409r1 (12) */
+                NID_sect571k1, /* sect571k1 (13) */ 
+                NID_sect571r1, /* sect571r1 (14) */ 
+                NID_secp160k1, /* secp160k1 (15) */
+                NID_secp160r1, /* secp160r1 (16) */ 
+                NID_secp160r2, /* secp160r2 (17) */ 
+                NID_secp192k1, /* secp192k1 (18) */
+                NID_X9_62_prime192v1, /* secp192r1 (19) */ 
+                NID_secp224k1, /* secp224k1 (20) */ 
+                NID_secp224r1, /* secp224r1 (21) */
+                NID_secp256k1, /* secp256k1 (22) */ 
+                NID_X9_62_prime256v1, /* secp256r1 (23) */ 
+                NID_secp384r1, /* secp384r1 (24) */
+                NID_secp521r1  /* secp521r1 (25) */     
+        };
+        
+        if ((curve_id < 1) || (curve_id > 25)) return 0;
+
+        return nid_list[curve_id];
+}
+#endif
+
+/* Check to see if handshake is full or resumed. Usually this is just a
+ * case of checking to see if a cache hit has occurred. In the case of
+ * session tickets we have to check the next message to be sure.
+ */
+
+#ifndef OPENSSL_NO_TLSEXT
+static int ssl3_check_finished(SSL *s)
+        {
+        int ok;
+        long n;
+        /* If we have no ticket or session ID is non-zero length (a match of
+         * a non-zero session length would never reach here) it cannot be a
+         * resumed session.
+         */
+        if (!s->session->tlsext_tick || s->session->session_id_length)
+                return 1;
+        /* this function is called when we really expect a Certificate
+         * message, so permit appropriate message length */
+        n=s->method->ssl_get_message(s,
+                SSL3_ST_CR_CERT_A,
+                SSL3_ST_CR_CERT_B,
+                -1,
+                s->max_cert_list,
+                &ok);
+        if (!ok) return((int)n);
+        s->s3->tmp.reuse_message = 1;
+        if ((s->s3->tmp.message_type == SSL3_MT_FINISHED)
+                || (s->s3->tmp.message_type == SSL3_MT_NEWSESSION_TICKET))
+                return 2;
+
+        return 1;
+        }
+#endif
diff --git a/src/lib/libssl/src/ssl/s3_enc.c b/src/lib/libssl/src/ssl/s3_enc.c
index a012d3f2b5..2859351b00 100644
--- a/src/lib/libssl/src/ssl/s3_enc.c
+++ b/src/lib/libssl/src/ssl/s3_enc.c
@@ -139,16 +139,15 @@ static int ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
         EVP_MD_CTX s1;
         unsigned char buf[16],smd[SHA_DIGEST_LENGTH];
         unsigned char c='A';
-        int i,j,k;
+        unsigned int i,j,k;
 
 #ifdef CHARSET_EBCDIC
         c = os_toascii[c]; /*'A' in ASCII */
 #endif
         k=0;
         EVP_MD_CTX_init(&m5);
-        EVP_MD_CTX_set_flags(&m5, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
         EVP_MD_CTX_init(&s1);
-        for (i=0; i<num; i+=MD5_DIGEST_LENGTH)
+        for (i=0; (int)i<num; i+=MD5_DIGEST_LENGTH)
                 {
                 k++;
                 if (k > sizeof buf)
@@ -173,7 +172,7 @@ static int ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
                 EVP_DigestUpdate(&m5,s->session->master_key,
                         s->session->master_key_length);
                 EVP_DigestUpdate(&m5,smd,SHA_DIGEST_LENGTH);
-                if ((i+MD5_DIGEST_LENGTH) > num)
+                if ((int)(i+MD5_DIGEST_LENGTH) > num)
                         {
                         EVP_DigestFinal_ex(&m5,smd,NULL);
                         memcpy(km,smd,(num-i));
@@ -197,7 +196,9 @@ int ssl3_change_cipher_state(SSL *s, int which)
         unsigned char *ms,*key,*iv,*er1,*er2;
         EVP_CIPHER_CTX *dd;
         const EVP_CIPHER *c;
+#ifndef OPENSSL_NO_COMP
         COMP_METHOD *comp;
+#endif
         const EVP_MD *m;
         EVP_MD_CTX md;
         int is_exp,n,i,j,k,cl;
@@ -206,10 +207,12 @@ int ssl3_change_cipher_state(SSL *s, int which)
         is_exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
         c=s->s3->tmp.new_sym_enc;
         m=s->s3->tmp.new_hash;
+#ifndef OPENSSL_NO_COMP
         if (s->s3->tmp.new_compression == NULL)
                 comp=NULL;
         else
                 comp=s->s3->tmp.new_compression->method;
+#endif
         key_block=s->s3->tmp.key_block;
 
         if (which & SSL3_CC_READ)
@@ -218,8 +221,12 @@ int ssl3_change_cipher_state(SSL *s, int which)
                         reuse_dd = 1;
                 else if ((s->enc_read_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
                         goto err;
+                else
+                        /* make sure it's intialized in case we exit later with an error */
+                        EVP_CIPHER_CTX_init(s->enc_read_ctx);
                 dd= s->enc_read_ctx;
                 s->read_hash=m;
+#ifndef OPENSSL_NO_COMP
                 /* COMPRESS */
                 if (s->expand != NULL)
                         {
@@ -240,6 +247,7 @@ int ssl3_change_cipher_state(SSL *s, int which)
                         if (s->s3->rrec.comp == NULL)
                                 goto err;
                         }
+#endif
                 memset(&(s->s3->read_sequence[0]),0,8);
                 mac_secret= &(s->s3->read_mac_secret[0]);
                 }
@@ -249,8 +257,12 @@ int ssl3_change_cipher_state(SSL *s, int which)
                         reuse_dd = 1;
                 else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
                         goto err;
+                else
+                        /* make sure it's intialized in case we exit later with an error */
+                        EVP_CIPHER_CTX_init(s->enc_write_ctx);
                 dd= s->enc_write_ctx;
                 s->write_hash=m;
+#ifndef OPENSSL_NO_COMP
                 /* COMPRESS */
                 if (s->compress != NULL)
                         {
@@ -266,19 +278,19 @@ int ssl3_change_cipher_state(SSL *s, int which)
                                 goto err2;
                                 }
                         }
+#endif
                 memset(&(s->s3->write_sequence[0]),0,8);
                 mac_secret= &(s->s3->write_mac_secret[0]);
                 }
 
         if (reuse_dd)
                 EVP_CIPHER_CTX_cleanup(dd);
-        EVP_CIPHER_CTX_init(dd);
 
         p=s->s3->tmp.key_block;
         i=EVP_MD_size(m);
         cl=EVP_CIPHER_key_length(c);
         j=is_exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
-                    cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
+                 cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
         /* Was j=(is_exp)?5:EVP_CIPHER_key_length(c); */
         k=EVP_CIPHER_iv_length(c);
         if (    (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
@@ -364,7 +376,11 @@ int ssl3_setup_key_block(SSL *s)
 
         s->s3->tmp.new_sym_enc=c;
         s->s3->tmp.new_hash=hash;
+#ifdef OPENSSL_NO_COMP
+        s->s3->tmp.new_compression=NULL;
+#else
         s->s3->tmp.new_compression=comp;
+#endif
 
         num=EVP_CIPHER_key_length(c)+EVP_MD_size(hash)+EVP_CIPHER_iv_length(c);
         num*=2;
@@ -502,8 +518,6 @@ int ssl3_enc(SSL *s, int send)
 
 void ssl3_init_finished_mac(SSL *s)
         {
-        EVP_MD_CTX_set_flags(&(s->s3->finish_dgst1),
-                EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
         EVP_DigestInit_ex(&(s->s3->finish_dgst1),s->ctx->md5, NULL);
         EVP_DigestInit_ex(&(s->s3->finish_dgst2),s->ctx->sha1, NULL);
         }
@@ -572,7 +586,7 @@ int ssl3_mac(SSL *ssl, unsigned char *md, int send)
         const EVP_MD *hash;
         unsigned char *p,rec_char;
         unsigned int md_size;
-        int npad,i;
+        int npad;
 
         if (send)
                 {
@@ -615,13 +629,19 @@ int ssl3_mac(SSL *ssl, unsigned char *md, int send)
 
         EVP_MD_CTX_cleanup(&md_ctx);
 
+        ssl3_record_sequence_update(seq);
+        return(md_size);
+        }
+
+void ssl3_record_sequence_update(unsigned char *seq)
+        {
+        int i;
+
         for (i=7; i>=0; i--)
                 {
                 ++seq[i];
                 if (seq[i] != 0) break; 
                 }
-
-        return(md_size);
         }
 
 int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
@@ -644,7 +664,6 @@ int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
         unsigned int n;
 
         EVP_MD_CTX_init(&ctx);
-        EVP_MD_CTX_set_flags(&ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
         for (i=0; i<3; i++)
                 {
                 EVP_DigestInit_ex(&ctx,s->ctx->sha1, NULL);
diff --git a/src/lib/libssl/src/ssl/s3_lib.c b/src/lib/libssl/src/ssl/s3_lib.c
index a77588e725..bdbcd44f27 100644
--- a/src/lib/libssl/src/ssl/s3_lib.c
+++ b/src/lib/libssl/src/ssl/s3_lib.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -108,19 +108,35 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * ECC cipher suite support in OpenSSL originally written by
+ * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
+ *
+ */
 
 #include <stdio.h>
 #include <openssl/objects.h>
 #include "ssl_locl.h"
 #include "kssl_lcl.h"
 #include <openssl/md5.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/pq_compat.h>
 
-const char *ssl3_version_str="SSLv3" OPENSSL_VERSION_PTEXT;
+const char ssl3_version_str[]="SSLv3" OPENSSL_VERSION_PTEXT;
 
 #define SSL3_NUM_CIPHERS        (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
 
-static long ssl3_default_timeout(void );
-
+/* list of available SSLv3 ciphers (sorted by id) */
 OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 /* The RSA ciphers */
 /* Cipher 01 */
@@ -142,82 +158,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_RSA_NULL_SHA,
         SSL3_CK_RSA_NULL_SHA,
         SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        0,
-        0,
-        0,
-        SSL_ALL_CIPHERS,
-        SSL_ALL_STRENGTHS,
-        },
-
-/* anon DH */
-/* Cipher 17 */
-        {
-        1,
-        SSL3_TXT_ADH_RC4_40_MD5,
-        SSL3_CK_ADH_RC4_40_MD5,
-        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        0,
-        40,
-        128,
-        SSL_ALL_CIPHERS,
-        SSL_ALL_STRENGTHS,
-        },
-/* Cipher 18 */
-        {
-        1,
-        SSL3_TXT_ADH_RC4_128_MD5,
-        SSL3_CK_ADH_RC4_128_MD5,
-        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        0,
-        128,
-        128,
-        SSL_ALL_CIPHERS,
-        SSL_ALL_STRENGTHS,
-        },
-/* Cipher 19 */
-        {
-        1,
-        SSL3_TXT_ADH_DES_40_CBC_SHA,
-        SSL3_CK_ADH_DES_40_CBC_SHA,
-        SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_NOT_EXP|SSL_STRONG_NONE,
         0,
-        40,
-        128,
-        SSL_ALL_CIPHERS,
-        SSL_ALL_STRENGTHS,
-        },
-/* Cipher 1A */
-        {
-        1,
-        SSL3_TXT_ADH_DES_64_CBC_SHA,
-        SSL3_CK_ADH_DES_64_CBC_SHA,
-        SSL_kEDH |SSL_aNULL|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
         0,
-        56,
-        56,
-        SSL_ALL_CIPHERS,
-        SSL_ALL_STRENGTHS,
-        },
-/* Cipher 1B */
-        {
-        1,
-        SSL3_TXT_ADH_DES_192_CBC_SHA,
-        SSL3_CK_ADH_DES_192_CBC_SHA,
-        SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
         0,
-        168,
-        168,
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
-
-/* RSA again */
 /* Cipher 03 */
         {
         1,
@@ -291,7 +238,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_RSA_DES_40_CBC_SHA,
         SSL3_CK_RSA_DES_40_CBC_SHA,
         SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_EXPORT|SSL_EXP40,
         0,
         40,
         56,
@@ -304,7 +251,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_RSA_DES_64_CBC_SHA,
         SSL3_CK_RSA_DES_64_CBC_SHA,
         SSL_kRSA|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
+        SSL_NOT_EXP|SSL_LOW,
         0,
         56,
         56,
@@ -317,22 +264,21 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_RSA_DES_192_CBC3_SHA,
         SSL3_CK_RSA_DES_192_CBC3_SHA,
         SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
         168,
         168,
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
-
-/*  The DH ciphers */
+/* The DH ciphers */
 /* Cipher 0B */
         {
         0,
         SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
         SSL3_CK_DH_DSS_DES_40_CBC_SHA,
         SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_EXPORT|SSL_EXP40,
         0,
         40,
         56,
@@ -345,7 +291,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
         SSL3_CK_DH_DSS_DES_64_CBC_SHA,
         SSL_kDHd |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
+        SSL_NOT_EXP|SSL_LOW,
         0,
         56,
         56,
@@ -358,7 +304,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
         SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
         SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
         168,
         168,
@@ -371,7 +317,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
         SSL3_CK_DH_RSA_DES_40_CBC_SHA,
         SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_EXPORT|SSL_EXP40,
         0,
         40,
         56,
@@ -384,7 +330,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
         SSL3_CK_DH_RSA_DES_64_CBC_SHA,
         SSL_kDHr |SSL_aDH|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
+        SSL_NOT_EXP|SSL_LOW,
         0,
         56,
         56,
@@ -397,7 +343,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
         SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
         SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
         168,
         168,
@@ -412,7 +358,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
         SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
         SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_EXPORT|SSL_EXP40,
         0,
         40,
         56,
@@ -425,7 +371,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
         SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
         SSL_kEDH|SSL_aDSS|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
+        SSL_NOT_EXP|SSL_LOW,
         0,
         56,
         56,
@@ -438,7 +384,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
         SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
         SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
         168,
         168,
@@ -451,7 +397,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
         SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
         SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_EXPORT|SSL_EXP40,
         0,
         40,
         56,
@@ -464,7 +410,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
         SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
         SSL_kEDH|SSL_aRSA|SSL_DES  |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
+        SSL_NOT_EXP|SSL_LOW,
         0,
         56,
         56,
@@ -477,7 +423,72 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
         SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
         SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        168,
+        168,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 17 */
+        {
+        1,
+        SSL3_TXT_ADH_RC4_40_MD5,
+        SSL3_CK_ADH_RC4_40_MD5,
+        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
+        0,
+        40,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 18 */
+        {
+        1,
+        SSL3_TXT_ADH_RC4_128_MD5,
+        SSL3_CK_ADH_RC4_128_MD5,
+        SSL_kEDH |SSL_aNULL|SSL_RC4  |SSL_MD5 |SSL_SSLV3,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 19 */
+        {
+        1,
+        SSL3_TXT_ADH_DES_40_CBC_SHA,
+        SSL3_CK_ADH_DES_40_CBC_SHA,
+        SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3,
+        SSL_EXPORT|SSL_EXP40,
+        0,
+        40,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 1A */
+        {
+        1,
+        SSL3_TXT_ADH_DES_64_CBC_SHA,
+        SSL3_CK_ADH_DES_64_CBC_SHA,
+        SSL_kEDH |SSL_aNULL|SSL_DES  |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_LOW,
+        0,
+        56,
+        56,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 1B */
+        {
+        1,
+        SSL3_TXT_ADH_DES_192_CBC_SHA,
+        SSL3_CK_ADH_DES_192_CBC_SHA,
+        SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
         168,
         168,
@@ -531,17 +542,14 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 #endif
 
 #ifndef OPENSSL_NO_KRB5
-/* The Kerberos ciphers
-** 20000107 VRS: And the first shall be last,
-** in hopes of avoiding the lynx ssl renegotiation problem.
-*/
-/* Cipher 1E VRS */
+/* The Kerberos ciphers */
+/* Cipher 1E */
         {
         1,
         SSL3_TXT_KRB5_DES_64_CBC_SHA,
         SSL3_CK_KRB5_DES_64_CBC_SHA,
         SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_SHA1   |SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW|SSL_FIPS,
+        SSL_NOT_EXP|SSL_LOW,
         0,
         56,
         56,
@@ -549,21 +557,21 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 1F VRS */
+/* Cipher 1F */
         {
         1,
         SSL3_TXT_KRB5_DES_192_CBC3_SHA,
         SSL3_CK_KRB5_DES_192_CBC3_SHA,
         SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_SHA1  |SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+        SSL_NOT_EXP|SSL_HIGH,
         0,
-        112,
+        168,
         168,
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 20 VRS */
+/* Cipher 20 */
         {
         1,
         SSL3_TXT_KRB5_RC4_128_SHA,
@@ -577,7 +585,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 21 VRS */
+/* Cipher 21 */
         {
         1,
         SSL3_TXT_KRB5_IDEA_128_CBC_SHA,
@@ -591,7 +599,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 22 VRS */
+/* Cipher 22 */
         {
         1,
         SSL3_TXT_KRB5_DES_64_CBC_MD5,
@@ -605,7 +613,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 23 VRS */
+/* Cipher 23 */
         {
         1,
         SSL3_TXT_KRB5_DES_192_CBC3_MD5,
@@ -613,13 +621,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_kKRB5|SSL_aKRB5|  SSL_3DES|SSL_MD5   |SSL_SSLV3,
         SSL_NOT_EXP|SSL_HIGH,
         0,
-        112,
+        168,
         168,
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 24 VRS */
+/* Cipher 24 */
         {
         1,
         SSL3_TXT_KRB5_RC4_128_MD5,
@@ -633,7 +641,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 25 VRS */
+/* Cipher 25 */
         {
         1,
         SSL3_TXT_KRB5_IDEA_128_CBC_MD5,
@@ -647,13 +655,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 26 VRS */
+/* Cipher 26 */
         {
         1,
         SSL3_TXT_KRB5_DES_40_CBC_SHA,
         SSL3_CK_KRB5_DES_40_CBC_SHA,
         SSL_kKRB5|SSL_aKRB5|  SSL_DES|SSL_SHA1   |SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40|SSL_FIPS,
+        SSL_EXPORT|SSL_EXP40,
         0,
         40,
         56,
@@ -661,7 +669,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 27 VRS */
+/* Cipher 27 */
         {
         1,
         SSL3_TXT_KRB5_RC2_40_CBC_SHA,
@@ -675,7 +683,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 28 VRS */
+/* Cipher 28 */
         {
         1,
         SSL3_TXT_KRB5_RC4_40_SHA,
@@ -683,13 +691,13 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_kKRB5|SSL_aKRB5|  SSL_RC4|SSL_SHA1   |SSL_SSLV3,
         SSL_EXPORT|SSL_EXP40,
         0,
-        128,
+        40,
         128,
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 29 VRS */
+/* Cipher 29 */
         {
         1,
         SSL3_TXT_KRB5_DES_40_CBC_MD5,
@@ -703,7 +711,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 2A VRS */
+/* Cipher 2A */
         {
         1,
         SSL3_TXT_KRB5_RC2_40_CBC_MD5,
@@ -717,7 +725,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 
-/* Cipher 2B VRS */
+/* Cipher 2B */
         {
         1,
         SSL3_TXT_KRB5_RC4_40_MD5,
@@ -725,16 +733,258 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_kKRB5|SSL_aKRB5|  SSL_RC4|SSL_MD5    |SSL_SSLV3,
         SSL_EXPORT|SSL_EXP40,
         0,
-        128,
+        40,
         128,
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
 #endif  /* OPENSSL_NO_KRB5 */
 
+/* New AES ciphersuites */
+/* Cipher 2F */
+        {
+        1,
+        TLS1_TXT_RSA_WITH_AES_128_SHA,
+        TLS1_CK_RSA_WITH_AES_128_SHA,
+        SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 30 */
+        {
+        0,
+        TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
+        TLS1_CK_DH_DSS_WITH_AES_128_SHA,
+        SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 31 */
+        {
+        0,
+        TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
+        TLS1_CK_DH_RSA_WITH_AES_128_SHA,
+        SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 32 */
+        {
+        1,
+        TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
+        TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
+        SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 33 */
+        {
+        1,
+        TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
+        TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
+        SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 34 */
+        {
+        1,
+        TLS1_TXT_ADH_WITH_AES_128_SHA,
+        TLS1_CK_ADH_WITH_AES_128_SHA,
+        SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+/* Cipher 35 */
+        {
+        1,
+        TLS1_TXT_RSA_WITH_AES_256_SHA,
+        TLS1_CK_RSA_WITH_AES_256_SHA,
+        SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 36 */
+        {
+        0,
+        TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
+        TLS1_CK_DH_DSS_WITH_AES_256_SHA,
+        SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 37 */
+        {
+        0,
+        TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
+        TLS1_CK_DH_RSA_WITH_AES_256_SHA,
+        SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 38 */
+        {
+        1,
+        TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
+        TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
+        SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+/* Cipher 39 */
+        {
+        1,
+        TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
+        TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
+        SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+        /* Cipher 3A */
+        {
+        1,
+        TLS1_TXT_ADH_WITH_AES_256_SHA,
+        TLS1_CK_ADH_WITH_AES_256_SHA,
+        SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+#ifndef OPENSSL_NO_CAMELLIA
+        /* Camellia ciphersuites from RFC4132 (128-bit portion) */
+
+        /* Cipher 41 */
+        {
+        1,
+        TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA,
+        TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA,
+        SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 42 */
+        {
+        0, /* not implemented (non-ephemeral DH) */
+        TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
+        TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
+        SSL_kDHd|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 43 */
+        {
+        0, /* not implemented (non-ephemeral DH) */
+        TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
+        TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
+        SSL_kDHr|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 44 */
+        {
+        1,
+        TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
+        TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
+        SSL_kEDH|SSL_aDSS|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 45 */
+        {
+        1,
+        TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
+        TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
+        SSL_kEDH|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 46 */
+        {
+        1,
+        TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA,
+        TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA,
+        SSL_kEDH|SSL_aNULL|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+#endif /* OPENSSL_NO_CAMELLIA */
 
 #if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES
-        /* New TLS Export CipherSuites */
+        /* New TLS Export CipherSuites from expired ID */
+#if 0
         /* Cipher 60 */
             {
             1,
@@ -761,13 +1011,14 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
             SSL_ALL_CIPHERS,
             SSL_ALL_STRENGTHS,
             },
+#endif
         /* Cipher 62 */
             {
             1,
             TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
             TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
             SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1,
-            SSL_EXPORT|SSL_EXP56|SSL_FIPS,
+            SSL_EXPORT|SSL_EXP56,
             0,
             56,
             56,
@@ -780,7 +1031,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
             TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
             TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
             SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1,
-            SSL_EXPORT|SSL_EXP56|SSL_FIPS,
+            SSL_EXPORT|SSL_EXP56,
             0,
             56,
             56,
@@ -827,170 +1078,536 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
             SSL_ALL_STRENGTHS
             },
 #endif
-        /* New AES ciphersuites */
 
-        /* Cipher 2F */
+#ifndef OPENSSL_NO_CAMELLIA
+        /* Camellia ciphersuites from RFC4132 (256-bit portion) */
+
+        /* Cipher 84 */
+        {
+        1,
+        TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA,
+        TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA,
+        SSL_kRSA|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 85 */
+        {
+        0, /* not implemented (non-ephemeral DH) */
+        TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
+        TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
+        SSL_kDHd|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 86 */
+        {
+        0, /* not implemented (non-ephemeral DH) */
+        TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
+        TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
+        SSL_kDHr|SSL_aDH|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 87 */
+        {
+        1,
+        TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
+        TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
+        SSL_kEDH|SSL_aDSS|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 88 */
+        {
+        1,
+        TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
+        TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
+        SSL_kEDH|SSL_aRSA|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+        /* Cipher 89 */
+        {
+        1,
+        TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA,
+        TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA,
+        SSL_kEDH|SSL_aNULL|SSL_CAMELLIA|SSL_SHA|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_HIGH,
+        0,
+        256,
+        256,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS
+        },
+#endif /* OPENSSL_NO_CAMELLIA */
+
+#ifndef OPENSSL_NO_SEED
+        /* SEED ciphersuites from RFC4162 */
+
+        /* Cipher 96 */
+        {
+        1,
+        TLS1_TXT_RSA_WITH_SEED_SHA,
+        TLS1_CK_RSA_WITH_SEED_SHA,
+        SSL_kRSA|SSL_aRSA|SSL_SEED|SSL_SHA1|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+        /* Cipher 97 */
+        {
+        0, /* not implemented (non-ephemeral DH) */
+        TLS1_TXT_DH_DSS_WITH_SEED_SHA,
+        TLS1_CK_DH_DSS_WITH_SEED_SHA,
+        SSL_kDHd|SSL_aDH|SSL_SEED|SSL_SHA1|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+        /* Cipher 98 */
+        {
+        0, /* not implemented (non-ephemeral DH) */
+        TLS1_TXT_DH_RSA_WITH_SEED_SHA,
+        TLS1_CK_DH_RSA_WITH_SEED_SHA,
+        SSL_kDHr|SSL_aDH|SSL_SEED|SSL_SHA1|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+        /* Cipher 99 */
+        {
+        1,
+        TLS1_TXT_DHE_DSS_WITH_SEED_SHA,
+        TLS1_CK_DHE_DSS_WITH_SEED_SHA,
+        SSL_kEDH|SSL_aDSS|SSL_SEED|SSL_SHA1|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+        /* Cipher 9A */
+        {
+        1,
+        TLS1_TXT_DHE_RSA_WITH_SEED_SHA,
+        TLS1_CK_DHE_RSA_WITH_SEED_SHA,
+        SSL_kEDH|SSL_aRSA|SSL_SEED|SSL_SHA1|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+        /* Cipher 9B */
+        {
+        1,
+        TLS1_TXT_ADH_WITH_SEED_SHA,
+        TLS1_CK_ADH_WITH_SEED_SHA,
+        SSL_kEDH|SSL_aNULL|SSL_SEED|SSL_SHA1|SSL_TLSV1,
+        SSL_NOT_EXP|SSL_MEDIUM,
+        0,
+        128,
+        128,
+        SSL_ALL_CIPHERS,
+        SSL_ALL_STRENGTHS,
+        },
+
+#endif /* OPENSSL_NO_SEED */
+
+#ifndef OPENSSL_NO_ECDH
+        /* Cipher C001 */
             {
-            1,
-            TLS1_TXT_RSA_WITH_AES_128_SHA,
-            TLS1_CK_RSA_WITH_AES_128_SHA,
-            SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            128,
-            128,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 30 */
+            1,
+            TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA,
+            TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA,
+            SSL_kECDH|SSL_aECDSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            0,
+            0,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C002 */
             {
-            0,
-            TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
-            TLS1_CK_DH_DSS_WITH_AES_128_SHA,
-            SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            128,
-            128,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 31 */
+            1,
+            TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA,
+            TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA,
+            SSL_kECDH|SSL_aECDSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C003 */
             {
-            0,
-            TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
-            TLS1_CK_DH_RSA_WITH_AES_128_SHA,
-            SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            128,
-            128,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 32 */
+            1,
+            TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
+            TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
+            SSL_kECDH|SSL_aECDSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            168,
+            168,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C004 */
             {
-            1,
-            TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
-            TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
-            SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            128,
-            128,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 33 */
+            1,
+            TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+            TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+            SSL_kECDH|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C005 */
             {
-            1,
-            TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
-            TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
-            SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            128,
-            128,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 34 */
+            1,
+            TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+            TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+            SSL_kECDH|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            256,
+            256,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C006 */
             {
-            1,
-            TLS1_TXT_ADH_WITH_AES_128_SHA,
-            TLS1_CK_ADH_WITH_AES_128_SHA,
-            SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            128,
-            128,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-
-        /* Cipher 35 */
+            1,
+            TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
+            TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
+            SSL_kECDHE|SSL_aECDSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            0,
+            0,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C007 */
             {
-            1,
-            TLS1_TXT_RSA_WITH_AES_256_SHA,
-            TLS1_CK_RSA_WITH_AES_256_SHA,
-            SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            256,
-            256,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 36 */
+            1,
+            TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
+            TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
+            SSL_kECDHE|SSL_aECDSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C008 */
             {
-            0,
-            TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
-            TLS1_CK_DH_DSS_WITH_AES_256_SHA,
-            SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            256,
-            256,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 37 */
+            1,
+            TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
+            TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
+            SSL_kECDHE|SSL_aECDSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            168,
+            168,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C009 */
             {
-            0,
-            TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
-            TLS1_CK_DH_RSA_WITH_AES_256_SHA,
-            SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            256,
-            256,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 38 */
+            1,
+            TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+            TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+            SSL_kECDHE|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C00A */
             {
-            1,
-            TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
-            TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
-            SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            256,
-            256,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 39 */
+            1,
+            TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+            TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+            SSL_kECDHE|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            256,
+            256,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C00B */
             {
-            1,
-            TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
-            TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
-            SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            256,
-            256,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
-            },
-        /* Cipher 3A */
+            1,
+            TLS1_TXT_ECDH_RSA_WITH_NULL_SHA,
+            TLS1_CK_ECDH_RSA_WITH_NULL_SHA,
+            SSL_kECDH|SSL_aRSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            0,
+            0,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C00C */
             {
-            1,
-            TLS1_TXT_ADH_WITH_AES_256_SHA,
-            TLS1_CK_ADH_WITH_AES_256_SHA,
-            SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
-            SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-            0,
-            256,
-            256,
-            SSL_ALL_CIPHERS,
-            SSL_ALL_STRENGTHS,
+            1,
+            TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA,
+            TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA,
+            SSL_kECDH|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C00D */
+            {
+            1,
+            TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA,
+            TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA,
+            SSL_kECDH|SSL_aRSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            168,
+            168,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C00E */
+            {
+            1,
+            TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA,
+            TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA,
+            SSL_kECDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C00F */
+            {
+            1,
+            TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA,
+            TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA,
+            SSL_kECDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            256,
+            256,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C010 */
+            {
+            1,
+            TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
+            TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
+            SSL_kECDHE|SSL_aRSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            0,
+            0,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C011 */
+            {
+            1,
+            TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
+            TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
+            SSL_kECDHE|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C012 */
+            {
+            1,
+            TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
+            TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
+            SSL_kECDHE|SSL_aRSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            168,
+            168,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C013 */
+            {
+            1,
+            TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+            TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+            SSL_kECDHE|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C014 */
+            {
+            1,
+            TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+            TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+            SSL_kECDHE|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            256,
+            256,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C015 */
+            {
+            1,
+            TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
+            TLS1_CK_ECDH_anon_WITH_NULL_SHA,
+            SSL_kECDHE|SSL_aNULL|SSL_eNULL|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            0,
+            0,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
             },
 
+        /* Cipher C016 */
+            {
+            1,
+            TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
+            TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
+            SSL_kECDHE|SSL_aNULL|SSL_RC4|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C017 */
+            {
+            1,
+            TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
+            TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
+            SSL_kECDHE|SSL_aNULL|SSL_3DES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            168,
+            168,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C018 */
+            {
+            1,
+            TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
+            TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
+            SSL_kECDHE|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            128,
+            128,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+
+        /* Cipher C019 */
+            {
+            1,
+            TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
+            TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
+            SSL_kECDHE|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
+            SSL_NOT_EXP|SSL_HIGH,
+            0,
+            256,
+            256,
+            SSL_ALL_CIPHERS,
+            SSL_ALL_STRENGTHS,
+            },
+#endif  /* OPENSSL_NO_ECDH */
+
+
 /* end of list */
         };
 
-static SSL3_ENC_METHOD SSLv3_enc_data={
+SSL3_ENC_METHOD SSLv3_enc_data={
         ssl3_enc,
         ssl3_mac,
         ssl3_setup_key_block,
@@ -1004,45 +1621,17 @@ static SSL3_ENC_METHOD SSLv3_enc_data={
         ssl3_alert_code,
         };
 
-static SSL_METHOD SSLv3_data= {
-        SSL3_VERSION,
-        ssl3_new,
-        ssl3_clear,
-        ssl3_free,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl3_read,
-        ssl3_peek,
-        ssl3_write,
-        ssl3_shutdown,
-        ssl3_renegotiate,
-        ssl3_renegotiate_check,
-        ssl3_ctrl,
-        ssl3_ctx_ctrl,
-        ssl3_get_cipher_by_char,
-        ssl3_put_cipher_by_char,
-        ssl3_pending,
-        ssl3_num_ciphers,
-        ssl3_get_cipher,
-        ssl_bad_method,
-        ssl3_default_timeout,
-        &SSLv3_enc_data,
-        ssl_undefined_function,
-        ssl3_callback_ctrl,
-        ssl3_ctx_callback_ctrl,
-        };
-
-static long ssl3_default_timeout(void)
+long ssl3_default_timeout(void)
         {
         /* 2 hours, the 24 hours mentioned in the SSLv3 spec
          * is way too long for http, the cache would over fill */
         return(60*60*2);
         }
 
-SSL_METHOD *sslv3_base_method(void)
-        {
-        return(&SSLv3_data);
-        }
+IMPLEMENT_ssl3_meth_func(sslv3_base_method,
+                        ssl_undefined_function,
+                        ssl_undefined_function,
+                        ssl_bad_method)
 
 int ssl3_num_ciphers(void)
         {
@@ -1073,6 +1662,8 @@ int ssl3_new(SSL *s)
         memset(s3,0,sizeof *s3);
         EVP_MD_CTX_init(&s3->finish_dgst1);
         EVP_MD_CTX_init(&s3->finish_dgst2);
+        pq_64bit_init(&(s3->rrec.seq_num));
+        pq_64bit_init(&(s3->wrec.seq_num));
 
         s->s3=s3;
 
@@ -1098,10 +1689,18 @@ void ssl3_free(SSL *s)
         if (s->s3->tmp.dh != NULL)
                 DH_free(s->s3->tmp.dh);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        if (s->s3->tmp.ecdh != NULL)
+                EC_KEY_free(s->s3->tmp.ecdh);
+#endif
+
         if (s->s3->tmp.ca_names != NULL)
                 sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
         EVP_MD_CTX_cleanup(&s->s3->finish_dgst1);
         EVP_MD_CTX_cleanup(&s->s3->finish_dgst2);
+        pq_64bit_free(&(s->s3->rrec.seq_num));
+        pq_64bit_free(&(s->s3->wrec.seq_num));
+
         OPENSSL_cleanse(s->s3,sizeof *s->s3);
         OPENSSL_free(s->s3);
         s->s3=NULL;
@@ -1125,6 +1724,10 @@ void ssl3_clear(SSL *s)
         if (s->s3->tmp.dh != NULL)
                 DH_free(s->s3->tmp.dh);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        if (s->s3->tmp.ecdh != NULL)
+                EC_KEY_free(s->s3->tmp.ecdh);
+#endif
 
         rp = s->s3->rbuf.buf;
         wp = s->s3->wbuf.buf;
@@ -1263,13 +1866,122 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                 }
                 break;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        case SSL_CTRL_SET_TMP_ECDH:
+                {
+                EC_KEY *ecdh = NULL;
+                        
+                if (parg == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
+                        return(ret);
+                        }
+                if (!EC_KEY_up_ref((EC_KEY *)parg))
+                        {
+                        SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB);
+                        return(ret);
+                        }
+                ecdh = (EC_KEY *)parg;
+                if (!(s->options & SSL_OP_SINGLE_ECDH_USE))
+                        {
+                        if (!EC_KEY_generate_key(ecdh))
+                                {
+                                EC_KEY_free(ecdh);
+                                SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB);
+                                return(ret);
+                                }
+                        }
+                if (s->cert->ecdh_tmp != NULL)
+                        EC_KEY_free(s->cert->ecdh_tmp);
+                s->cert->ecdh_tmp = ecdh;
+                ret = 1;
+                }
+                break;
+        case SSL_CTRL_SET_TMP_ECDH_CB:
+                {
+                SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return(ret);
+                }
+                break;
+#endif /* !OPENSSL_NO_ECDH */
+#ifndef OPENSSL_NO_TLSEXT
+        case SSL_CTRL_SET_TLSEXT_HOSTNAME:
+                if (larg == TLSEXT_NAMETYPE_host_name)
+                        {
+                        if (s->tlsext_hostname != NULL) 
+                                OPENSSL_free(s->tlsext_hostname);
+                        s->tlsext_hostname = NULL;
+
+                        ret = 1;
+                        if (parg == NULL) 
+                                break;
+                        if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name)
+                                {
+                                SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
+                                return 0;
+                                }
+                        if ((s->tlsext_hostname = BUF_strdup((char *)parg)) == NULL)
+                                {
+                                SSLerr(SSL_F_SSL3_CTRL, ERR_R_INTERNAL_ERROR);
+                                return 0;
+                                }
+                        }
+                else
+                        {
+                        SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
+                        return 0;
+                        }
+                break;
+        case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
+                s->tlsext_debug_arg=parg;
+                ret = 1;
+                break;
+  
+        case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
+                s->tlsext_status_type=larg;
+                ret = 1;
+                break;
+
+        case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS:
+                *(STACK_OF(X509_EXTENSION) **)parg = s->tlsext_ocsp_exts;
+                ret = 1;
+                break;
+
+        case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS:
+                s->tlsext_ocsp_exts = parg;
+                ret = 1;
+                break;
+
+        case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS:
+                *(STACK_OF(OCSP_RESPID) **)parg = s->tlsext_ocsp_ids;
+                ret = 1;
+                break;
+
+        case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS:
+                s->tlsext_ocsp_ids = parg;
+                ret = 1;
+                break;
+
+        case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:
+                *(unsigned char **)parg = s->tlsext_ocsp_resp;
+                return s->tlsext_ocsp_resplen;
+                
+        case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:
+                if (s->tlsext_ocsp_resp)
+                        OPENSSL_free(s->tlsext_ocsp_resp);
+                s->tlsext_ocsp_resp = parg;
+                s->tlsext_ocsp_resplen = larg;
+                ret = 1;
+                break;
+
+#endif /* !OPENSSL_NO_TLSEXT */
         default:
                 break;
                 }
         return(ret);
         }
 
-long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)())
+long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
         {
         int ret=0;
 
@@ -1307,6 +2019,19 @@ long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)())
                 }
                 break;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        case SSL_CTRL_SET_TMP_ECDH_CB:
+                {
+                s->cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
+                }
+                break;
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+        case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
+                s->tlsext_debug_cb=(void (*)(SSL *,int ,int,
+                                        unsigned char *, int, void *))fp;
+                break;
+#endif
         default:
                 break;
                 }
@@ -1399,6 +2124,83 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
                 }
                 break;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        case SSL_CTRL_SET_TMP_ECDH:
+                {
+                EC_KEY *ecdh = NULL;
+                        
+                if (parg == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB);
+                        return 0;
+                        }
+                ecdh = EC_KEY_dup((EC_KEY *)parg);
+                if (ecdh == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_EC_LIB);
+                        return 0;
+                        }
+                if (!(ctx->options & SSL_OP_SINGLE_ECDH_USE))
+                        {
+                        if (!EC_KEY_generate_key(ecdh))
+                                {
+                                EC_KEY_free(ecdh);
+                                SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB);
+                                return 0;
+                                }
+                        }
+
+                if (cert->ecdh_tmp != NULL)
+                        {
+                        EC_KEY_free(cert->ecdh_tmp);
+                        }
+                cert->ecdh_tmp = ecdh;
+                return 1;
+                }
+                /* break; */
+        case SSL_CTRL_SET_TMP_ECDH_CB:
+                {
+                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                return(0);
+                }
+                break;
+#endif /* !OPENSSL_NO_ECDH */
+#ifndef OPENSSL_NO_TLSEXT
+        case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
+                ctx->tlsext_servername_arg=parg;
+                break;
+        case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
+        case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
+                {
+                unsigned char *keys = parg;
+                if (!keys)
+                        return 48;
+                if (larg != 48)
+                        {
+                        SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
+                        return 0;
+                        }
+                if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS)
+                        {
+                        memcpy(ctx->tlsext_tick_key_name, keys, 16);
+                        memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
+                        memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
+                        }
+                else
+                        {
+                        memcpy(keys, ctx->tlsext_tick_key_name, 16);
+                        memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16);
+                        memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16);
+                        }
+                return 1;
+                }
+  
+        case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
+                ctx->tlsext_status_arg=parg;
+                return 1;
+                break;
+
+#endif /* !OPENSSL_NO_TLSEXT */
         /* A Thawte special :-) */
         case SSL_CTRL_EXTRA_CHAIN_CERT:
                 if (ctx->extra_certs == NULL)
@@ -1415,7 +2217,7 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
         return(1);
         }
 
-long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
+long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
         {
         CERT *cert;
 
@@ -1437,6 +2239,30 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
                 }
                 break;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        case SSL_CTRL_SET_TMP_ECDH_CB:
+                {
+                cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
+                }
+                break;
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+        case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
+                ctx->tlsext_servername_callback=(int (*)(SSL *,int *,void *))fp;
+                break;
+  
+        case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
+                ctx->tlsext_status_cb=(int (*)(SSL *,void *))fp;
+                break;
+
+        case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
+                ctx->tlsext_ticket_key_cb=(int (*)(SSL *,unsigned char  *,
+                                                unsigned char *,
+                                                EVP_CIPHER_CTX *,
+                                                HMAC_CTX *, int))fp;
+                break;
+
+#endif
         default:
                 return(0);
                 }
@@ -1447,41 +2273,19 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
  * available */
 SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
         {
-        static int init=1;
-        static SSL_CIPHER *sorted[SSL3_NUM_CIPHERS];
-        SSL_CIPHER c,*cp= &c,**cpp;
+        SSL_CIPHER c,*cp;
         unsigned long id;
-        int i;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL);
-
-                if (init)
-                        {
-                        for (i=0; i<SSL3_NUM_CIPHERS; i++)
-                                sorted[i]= &(ssl3_ciphers[i]);
-
-                        qsort(sorted,
-                                SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER *),
-                                FP_ICC ssl_cipher_ptr_id_cmp);
-
-                        init=0;
-                        }
-                
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
-                }
 
         id=0x03000000L|((unsigned long)p[0]<<8L)|(unsigned long)p[1];
         c.id=id;
-        cpp=(SSL_CIPHER **)OBJ_bsearch((char *)&cp,
-                (char *)sorted,
-                SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER *),
-                FP_ICC ssl_cipher_ptr_id_cmp);
-        if ((cpp == NULL) || !(*cpp)->valid)
-                return(NULL);
+        cp = (SSL_CIPHER *)OBJ_bsearch((char *)&c,
+                (char *)ssl3_ciphers,
+                SSL3_NUM_CIPHERS,sizeof(SSL_CIPHER),
+                FP_ICC ssl_cipher_id_cmp);
+        if (cp == NULL || cp->valid == 0)
+                return NULL;
         else
-                return(*cpp);
+                return cp;
         }
 
 int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
@@ -1504,6 +2308,7 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
         SSL_CIPHER *c,*ret=NULL;
         STACK_OF(SSL_CIPHER) *prio, *allow;
         int i,j,ok;
+
         CERT *cert;
         unsigned long alg,mask,emask;
 
@@ -1584,7 +2389,6 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                         }
 
                 if (!ok) continue;
-        
                 j=sk_SSL_CIPHER_find(allow,c);
                 if (j >= 0)
                         {
@@ -1629,6 +2433,26 @@ int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
 #ifndef OPENSSL_NO_DSA
         p[ret++]=SSL3_CT_DSS_SIGN;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        /* We should ask for fixed ECDH certificates only
+         * for SSL_kECDH (and not SSL_kECDHE)
+         */
+        if ((alg & SSL_kECDH) && (s->version >= TLS1_VERSION))
+                {
+                p[ret++]=TLS_CT_RSA_FIXED_ECDH;
+                p[ret++]=TLS_CT_ECDSA_FIXED_ECDH;
+                }
+#endif
+
+#ifndef OPENSSL_NO_ECDSA
+        /* ECDSA certs can be used with RSA cipher suites as well 
+         * so we don't need to check for SSL_kECDH or SSL_kECDHE
+         */
+        if (s->version >= TLS1_VERSION)
+                {
+                p[ret++]=TLS_CT_ECDSA_SIGN;
+                }
+#endif  
         return(ret);
         }
 
@@ -1656,13 +2480,13 @@ int ssl3_shutdown(SSL *s)
                 {
                 /* resend it if not sent */
 #if 1
-                ssl3_dispatch_alert(s);
+                s->method->ssl_dispatch_alert(s);
 #endif
                 }
         else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
                 {
                 /* If we are waiting for a close from our peer, we are closed */
-                ssl3_read_bytes(s,0,NULL,0,0);
+                s->method->ssl_read_bytes(s,0,NULL,0,0);
                 }
 
         if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&
@@ -1717,8 +2541,8 @@ int ssl3_write(SSL *s, const void *buf, int len)
                 }
         else
                 {
-                ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA,
-                                     buf,len);
+                ret=s->method->ssl_write_bytes(s,SSL3_RT_APPLICATION_DATA,
+                        buf,len);
                 if (ret <= 0) return(ret);
                 }
 
@@ -1732,7 +2556,7 @@ static int ssl3_read_internal(SSL *s, void *buf, int len, int peek)
         clear_sys_error();
         if (s->s3->renegotiate) ssl3_renegotiate_check(s);
         s->s3->in_read_app_data=1;
-        ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
+        ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
         if ((ret == -1) && (s->s3->in_read_app_data == 2))
                 {
                 /* ssl3_read_bytes decided to call s->handshake_func, which
@@ -1741,7 +2565,7 @@ static int ssl3_read_internal(SSL *s, void *buf, int len, int peek)
                  * and thinks that application data makes sense here; so disable
                  * handshake processing and try to read application data again. */
                 s->in_handshake++;
-                ret=ssl3_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
+                ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
                 s->in_handshake--;
                 }
         else
diff --git a/src/lib/libssl/src/ssl/s3_meth.c b/src/lib/libssl/src/ssl/s3_meth.c
index 1fd7a96f87..6a6eb1c58f 100644
--- a/src/lib/libssl/src/ssl/s3_meth.c
+++ b/src/lib/libssl/src/ssl/s3_meth.c
@@ -69,27 +69,9 @@ static SSL_METHOD *ssl3_get_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *SSLv3_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv3_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-                
-                if (init)
-                        {
-                        memcpy((char *)&SSLv3_data,(char *)sslv3_base_method(),
-                                sizeof(SSL_METHOD));
-                        SSLv3_data.ssl_connect=ssl3_connect;
-                        SSLv3_data.ssl_accept=ssl3_accept;
-                        SSLv3_data.get_ssl_method=ssl3_get_method;
-                        init=0;
-                        }
+IMPLEMENT_ssl3_meth_func(SSLv3_method,
+                        ssl3_accept,
+                        ssl3_connect,
+                        ssl3_get_method)
 
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv3_data);
-        }
 
diff --git a/src/lib/libssl/src/ssl/s3_pkt.c b/src/lib/libssl/src/ssl/s3_pkt.c
index cb0b12b400..44c7c143fe 100644
--- a/src/lib/libssl/src/ssl/s3_pkt.c
+++ b/src/lib/libssl/src/ssl/s3_pkt.c
@@ -118,15 +118,9 @@
 
 static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
                          unsigned int len, int create_empty_fragment);
-static int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
-                              unsigned int len);
 static int ssl3_get_record(SSL *s);
-static int do_compress(SSL *ssl);
-static int do_uncompress(SSL *ssl);
-static int do_change_cipher_spec(SSL *ssl);
 
-/* used only by ssl3_get_record */
-static int ssl3_read_n(SSL *s, int n, int max, int extend)
+int ssl3_read_n(SSL *s, int n, int max, int extend)
         {
         /* If extend == 0, obtain new n-byte packet; if extend == 1, increase
          * packet by another n bytes.
@@ -147,6 +141,14 @@ static int ssl3_read_n(SSL *s, int n, int max, int extend)
                 /* ... now we can act as if 'extend' was set */
                 }
 
+        /* extend reads should not span multiple packets for DTLS */
+        if ( SSL_version(s) == DTLS1_VERSION &&
+                extend)
+                {
+                if ( s->s3->rbuf.left > 0 && n > s->s3->rbuf.left)
+                        n = s->s3->rbuf.left;
+                }
+
         /* if there is enough in the buffer from a previous read, take some */
         if (s->s3->rbuf.left >= (int)n)
                 {
@@ -275,11 +277,7 @@ again:
                 n2s(p,rr->length);
 
                 /* Lets check version */
-                if (s->first_packet)
-                        {
-                        s->first_packet=0;
-                        }
-                else
+                if (!s->first_packet)
                         {
                         if (version != s->version)
                                 {
@@ -434,7 +432,7 @@ printf("\n");
                         SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_COMPRESSED_LENGTH_TOO_LONG);
                         goto f_err;
                         }
-                if (!do_uncompress(s))
+                if (!ssl3_do_uncompress(s))
                         {
                         al=SSL_AD_DECOMPRESSION_FAILURE;
                         SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BAD_DECOMPRESSION);
@@ -472,8 +470,9 @@ err:
         return(ret);
         }
 
-static int do_uncompress(SSL *ssl)
+int ssl3_do_uncompress(SSL *ssl)
         {
+#ifndef OPENSSL_NO_COMP
         int i;
         SSL3_RECORD *rr;
 
@@ -485,12 +484,13 @@ static int do_uncompress(SSL *ssl)
         else
                 rr->length=i;
         rr->data=rr->comp;
-
+#endif
         return(1);
         }
 
-static int do_compress(SSL *ssl)
+int ssl3_do_compress(SSL *ssl)
         {
+#ifndef OPENSSL_NO_COMP
         int i;
         SSL3_RECORD *wr;
 
@@ -504,6 +504,7 @@ static int do_compress(SSL *ssl)
                 wr->length=i;
 
         wr->input=wr->data;
+#endif
         return(1);
         }
 
@@ -580,7 +581,7 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
         /* If we have an alert to send, lets send it */
         if (s->s3->alert_dispatch)
                 {
-                i=ssl3_dispatch_alert(s);
+                i=s->method->ssl_dispatch_alert(s);
                 if (i <= 0)
                         return(i);
                 /* if it went, fall through and send more stuff */
@@ -655,7 +656,7 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
         /* first we compress */
         if (s->compress != NULL)
                 {
-                if (!do_compress(s))
+                if (!ssl3_do_compress(s))
                         {
                         SSLerr(SSL_F_DO_SSL3_WRITE,SSL_R_COMPRESSION_FAILURE);
                         goto err;
@@ -716,8 +717,8 @@ err:
         }
 
 /* if s->s3->wbuf.left != 0, we need to call this */
-static int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
-                              unsigned int len)
+int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
+        unsigned int len)
         {
         int i;
 
@@ -1089,7 +1090,7 @@ start:
                 if (s->s3->tmp.new_cipher == NULL)
                         {
                         al=SSL_AD_UNEXPECTED_MESSAGE;
-                        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
+                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_CCS_RECEIVED_EARLY);
                         goto f_err;
                         }
 
@@ -1099,7 +1100,7 @@ start:
                         s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC, rr->data, 1, s, s->msg_callback_arg);
 
                 s->s3->change_cipher_spec=1;
-                if (!do_change_cipher_spec(s))
+                if (!ssl3_do_change_cipher_spec(s))
                         goto err;
                 else
                         goto start;
@@ -1211,7 +1212,7 @@ err:
         return(-1);
         }
 
-static int do_change_cipher_spec(SSL *s)
+int ssl3_do_change_cipher_spec(SSL *s)
         {
         int i;
         const char *sender;
@@ -1268,7 +1269,7 @@ void ssl3_send_alert(SSL *s, int level, int desc)
         s->s3->send_alert[0]=level;
         s->s3->send_alert[1]=desc;
         if (s->s3->wbuf.left == 0) /* data still being written out? */
-                ssl3_dispatch_alert(s);
+                s->method->ssl_dispatch_alert(s);
         /* else data is still being written out, we will get written
          * some time in the future */
         }
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c
index 36fc39d7f8..903522ab59 100644
--- a/src/lib/libssl/src/ssl/s3_srvr.c
+++ b/src/lib/libssl/src/ssl/s3_srvr.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -108,11 +108,23 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * ECC cipher suite support in OpenSSL originally written by
+ * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
+ *
+ */
 
 #define REUSE_CIPHER_BUG
 #define NETSCAPE_HANG_BUG
 
-
 #include <stdio.h>
 #include "ssl_locl.h"
 #include "kssl_lcl.h"
@@ -120,24 +132,21 @@
 #include <openssl/rand.h>
 #include <openssl/objects.h>
 #include <openssl/evp.h>
+#include <openssl/hmac.h>
 #include <openssl/x509.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
 #ifndef OPENSSL_NO_KRB5
 #include <openssl/krb5_asn.h>
 #endif
 #include <openssl/md5.h>
-#include <openssl/fips.h>
 
 static SSL_METHOD *ssl3_get_server_method(int ver);
-static int ssl3_get_client_hello(SSL *s);
-static int ssl3_check_client_hello(SSL *s);
-static int ssl3_send_server_hello(SSL *s);
-static int ssl3_send_server_key_exchange(SSL *s);
-static int ssl3_send_certificate_request(SSL *s);
-static int ssl3_send_server_done(SSL *s);
-static int ssl3_get_client_key_exchange(SSL *s);
-static int ssl3_get_client_certificate(SSL *s);
-static int ssl3_get_cert_verify(SSL *s);
-static int ssl3_send_hello_request(SSL *s);
+#ifndef OPENSSL_NO_ECDH
+static int nid2curve_id(int nid);
+#endif
 
 static SSL_METHOD *ssl3_get_server_method(int ver)
         {
@@ -147,28 +156,10 @@ static SSL_METHOD *ssl3_get_server_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *SSLv3_server_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD SSLv3_server_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&SSLv3_server_data,(char *)sslv3_base_method(),
-                                sizeof(SSL_METHOD));
-                        SSLv3_server_data.ssl_accept=ssl3_accept;
-                        SSLv3_server_data.get_ssl_method=ssl3_get_server_method;
-                        init=0;
-                        }
-                        
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&SSLv3_server_data);
-        }
+IMPLEMENT_ssl3_meth_func(SSLv3_server_method,
+                        ssl3_accept,
+                        ssl_undefined_function,
+                        ssl3_get_server_method)
 
 int ssl3_accept(SSL *s)
         {
@@ -299,9 +290,18 @@ int ssl3_accept(SSL *s)
                 case SSL3_ST_SW_SRVR_HELLO_B:
                         ret=ssl3_send_server_hello(s);
                         if (ret <= 0) goto end;
-
+#ifndef OPENSSL_NO_TLSEXT
                         if (s->hit)
-                                s->state=SSL3_ST_SW_CHANGE_A;
+                                {
+                                if (s->tlsext_ticket_expected)
+                                        s->state=SSL3_ST_SW_SESSION_TICKET_A;
+                                else
+                                        s->state=SSL3_ST_SW_CHANGE_A;
+                                }
+#else
+                        if (s->hit)
+                                        s->state=SSL3_ST_SW_CHANGE_A;
+#endif
                         else
                                 s->state=SSL3_ST_SW_CERT_A;
                         s->init_num=0;
@@ -309,15 +309,30 @@ int ssl3_accept(SSL *s)
 
                 case SSL3_ST_SW_CERT_A:
                 case SSL3_ST_SW_CERT_B:
-                        /* Check if it is anon DH */
-                        if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL))
+                        /* Check if it is anon DH or anon ECDH or KRB5 */
+                        if (!(s->s3->tmp.new_cipher->algorithms & SSL_aNULL)
+                                && !(s->s3->tmp.new_cipher->algorithms & SSL_aKRB5))
                                 {
                                 ret=ssl3_send_server_certificate(s);
                                 if (ret <= 0) goto end;
+#ifndef OPENSSL_NO_TLSEXT
+                                if (s->tlsext_status_expected)
+                                        s->state=SSL3_ST_SW_CERT_STATUS_A;
+                                else
+                                        s->state=SSL3_ST_SW_KEY_EXCH_A;
+                                }
+                        else
+                                {
+                                skip = 1;
+                                s->state=SSL3_ST_SW_KEY_EXCH_A;
+                                }
+#else
                                 }
                         else
                                 skip=1;
+
                         s->state=SSL3_ST_SW_KEY_EXCH_A;
+#endif
                         s->init_num=0;
                         break;
 
@@ -340,9 +355,18 @@ int ssl3_accept(SSL *s)
                         else
                                 s->s3->tmp.use_rsa_tmp=0;
 
+
                         /* only send if a DH key exchange, fortezza or
-                         * RSA but we have a sign only certificate */
+                         * RSA but we have a sign only certificate
+                         *
+                         * For ECC ciphersuites, we send a serverKeyExchange
+                         * message only if the cipher suite is either
+                         * ECDH-anon or ECDHE. In other cases, the
+                         * server certificate contains the server's 
+                         * public key for key exchange.
+                         */
                         if (s->s3->tmp.use_rsa_tmp
+                            || (l & SSL_kECDHE)
                             || (l & (SSL_DH|SSL_kFZA))
                             || ((l & SSL_kRSA)
                                 && (s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL
@@ -446,19 +470,33 @@ int ssl3_accept(SSL *s)
                 case SSL3_ST_SR_KEY_EXCH_A:
                 case SSL3_ST_SR_KEY_EXCH_B:
                         ret=ssl3_get_client_key_exchange(s);
-                        if (ret <= 0) goto end;
-                        s->state=SSL3_ST_SR_CERT_VRFY_A;
-                        s->init_num=0;
-
-                        /* We need to get hashes here so if there is
-                         * a client cert, it can be verified */ 
-                        s->method->ssl3_enc->cert_verify_mac(s,
-                                &(s->s3->finish_dgst1),
-                                &(s->s3->tmp.cert_verify_md[0]));
-                        s->method->ssl3_enc->cert_verify_mac(s,
-                                &(s->s3->finish_dgst2),
-                                &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]));
+                        if (ret <= 0) 
+                                goto end;
+                        if (ret == 2)
+                                {
+                                /* For the ECDH ciphersuites when
+                                 * the client sends its ECDH pub key in
+                                 * a certificate, the CertificateVerify
+                                 * message is not sent.
+                                 */
+                                s->state=SSL3_ST_SR_FINISHED_A;
+                                s->init_num = 0;
+                                }
+                        else   
+                                {
+                                s->state=SSL3_ST_SR_CERT_VRFY_A;
+                                s->init_num=0;
 
+                                /* We need to get hashes here so if there is
+                                 * a client cert, it can be verified
+                                 */ 
+                                s->method->ssl3_enc->cert_verify_mac(s,
+                                    &(s->s3->finish_dgst1),
+                                    &(s->s3->tmp.cert_verify_md[0]));
+                                s->method->ssl3_enc->cert_verify_mac(s,
+                                    &(s->s3->finish_dgst2),
+                                    &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]));
+                                }
                         break;
 
                 case SSL3_ST_SR_CERT_VRFY_A:
@@ -479,11 +517,34 @@ int ssl3_accept(SSL *s)
                         if (ret <= 0) goto end;
                         if (s->hit)
                                 s->state=SSL_ST_OK;
+#ifndef OPENSSL_NO_TLSEXT
+                        else if (s->tlsext_ticket_expected)
+                                s->state=SSL3_ST_SW_SESSION_TICKET_A;
+#endif
                         else
                                 s->state=SSL3_ST_SW_CHANGE_A;
                         s->init_num=0;
                         break;
 
+#ifndef OPENSSL_NO_TLSEXT
+                case SSL3_ST_SW_SESSION_TICKET_A:
+                case SSL3_ST_SW_SESSION_TICKET_B:
+                        ret=ssl3_send_newsession_ticket(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_SW_CHANGE_A;
+                        s->init_num=0;
+                        break;
+
+                case SSL3_ST_SW_CERT_STATUS_A:
+                case SSL3_ST_SW_CERT_STATUS_B:
+                        ret=ssl3_send_cert_status(s);
+                        if (ret <= 0) goto end;
+                        s->state=SSL3_ST_SW_KEY_EXCH_A;
+                        s->init_num=0;
+                        break;
+
+#endif
+
                 case SSL3_ST_SW_CHANGE_A:
                 case SSL3_ST_SW_CHANGE_B:
 
@@ -589,7 +650,7 @@ end:
         return(ret);
         }
 
-static int ssl3_send_hello_request(SSL *s)
+int ssl3_send_hello_request(SSL *s)
         {
         unsigned char *p;
 
@@ -611,14 +672,14 @@ static int ssl3_send_hello_request(SSL *s)
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
         }
 
-static int ssl3_check_client_hello(SSL *s)
+int ssl3_check_client_hello(SSL *s)
         {
         int ok;
         long n;
 
         /* this function is called when we really expect a Certificate message,
          * so permit appropriate message length */
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_SR_CERT_A,
                 SSL3_ST_SR_CERT_B,
                 -1,
@@ -644,14 +705,17 @@ static int ssl3_check_client_hello(SSL *s)
         return 1;
 }
 
-static int ssl3_get_client_hello(SSL *s)
+int ssl3_get_client_hello(SSL *s)
         {
         int i,j,ok,al,ret= -1;
+        unsigned int cookie_len;
         long n;
         unsigned long id;
         unsigned char *p,*d,*q;
         SSL_CIPHER *c;
+#ifndef OPENSSL_NO_COMP
         SSL_COMP *comp=NULL;
+#endif
         STACK_OF(SSL_CIPHER) *ciphers=NULL;
 
         /* We do this so that we will respond with our native type.
@@ -662,10 +726,10 @@ static int ssl3_get_client_hello(SSL *s)
          */
         if (s->state == SSL3_ST_SR_CLNT_HELLO_A)
                 {
-                s->first_packet=1;
                 s->state=SSL3_ST_SR_CLNT_HELLO_B;
                 }
-        n=ssl3_get_message(s,
+        s->first_packet=1;
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_SR_CLNT_HELLO_B,
                 SSL3_ST_SR_CLNT_HELLO_C,
                 SSL3_MT_CLIENT_HELLO,
@@ -673,6 +737,7 @@ static int ssl3_get_client_hello(SSL *s)
                 &ok);
 
         if (!ok) return((int)n);
+        s->first_packet=0;
         d=p=(unsigned char *)s->init_msg;
 
         /* use version from inside client hello, not from record header
@@ -680,7 +745,8 @@ static int ssl3_get_client_hello(SSL *s)
         s->client_version=(((int)p[0])<<8)|(int)p[1];
         p+=2;
 
-        if (s->client_version < s->version)
+        if ((s->version == DTLS1_VERSION && s->client_version > s->version) ||
+            (s->version != DTLS1_VERSION && s->client_version < s->version))
                 {
                 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_WRONG_VERSION_NUMBER);
                 if ((s->client_version>>8) == SSL3_VERSION_MAJOR) 
@@ -708,14 +774,14 @@ static int ssl3_get_client_hello(SSL *s)
          * might be written that become totally unsecure when compiled with
          * an earlier library version)
          */
-        if (j == 0 || (s->new_session && (s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION)))
+        if ((s->new_session && (s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION)))
                 {
                 if (!ssl_get_new_session(s,1))
                         goto err;
                 }
         else
                 {
-                i=ssl_get_prev_session(s,p,j);
+                i=ssl_get_prev_session(s, p, j, d + n);
                 if (i == 1)
                         { /* previous session */
                         s->hit=1;
@@ -730,6 +796,68 @@ static int ssl3_get_client_hello(SSL *s)
                 }
 
         p+=j;
+
+        if (s->version == DTLS1_VERSION)
+                {
+                /* cookie stuff */
+                cookie_len = *(p++);
+
+                if ( (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) &&
+                        s->d1->send_cookie == 0)
+                        {
+                        /* HelloVerifyMessage has already been sent */
+                        if ( cookie_len != s->d1->cookie_len)
+                                {
+                                al = SSL_AD_HANDSHAKE_FAILURE;
+                                SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_COOKIE_MISMATCH);
+                                goto f_err;
+                                }
+                        }
+
+                /* 
+                 * The ClientHello may contain a cookie even if the
+                 * HelloVerify message has not been sent--make sure that it
+                 * does not cause an overflow.
+                 */
+                if ( cookie_len > sizeof(s->d1->rcvd_cookie))
+                        {
+                        /* too much data */
+                        al = SSL_AD_DECODE_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_COOKIE_MISMATCH);
+                        goto f_err;
+                        }
+
+                /* verify the cookie if appropriate option is set. */
+                if ( (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) &&
+                        cookie_len > 0)
+                        {
+                        memcpy(s->d1->rcvd_cookie, p, cookie_len);
+
+                        if ( s->ctx->app_verify_cookie_cb != NULL)
+                                {
+                                if ( s->ctx->app_verify_cookie_cb(s, s->d1->rcvd_cookie,
+                                        cookie_len) == 0)
+                                        {
+                                        al=SSL_AD_HANDSHAKE_FAILURE;
+                                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 
+                                                SSL_R_COOKIE_MISMATCH);
+                                        goto f_err;
+                                        }
+                                /* else cookie verification succeeded */
+                                }
+                        else if ( memcmp(s->d1->rcvd_cookie, s->d1->cookie, 
+                                                  s->d1->cookie_len) != 0) /* default verification */
+                                {
+                                        al=SSL_AD_HANDSHAKE_FAILURE;
+                                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, 
+                                                SSL_R_COOKIE_MISMATCH);
+                                        goto f_err;
+                                }
+                        }
+
+                p += cookie_len;
+                }
+
         n2s(p,i);
         if ((i == 0) && (j != 0))
                 {
@@ -779,8 +907,7 @@ static int ssl3_get_client_hello(SSL *s)
                         if ((s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
                                 {
                                 /* Very bad for multi-threading.... */
-                                s->session->cipher=sk_SSL_CIPHER_value(ciphers,
-                                                                       0);
+                                s->session->cipher=sk_SSL_CIPHER_value(ciphers, 0);
                                 }
                         else
                                 {
@@ -817,10 +944,27 @@ static int ssl3_get_client_hello(SSL *s)
                 goto f_err;
                 }
 
+#ifndef OPENSSL_NO_TLSEXT
+        /* TLS extensions*/
+        if (s->version > SSL3_VERSION)
+                {
+                if (!ssl_parse_clienthello_tlsext(s,&p,d,n, &al))
+                        {
+                        /* 'al' set by ssl_parse_clienthello_tlsext */
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_PARSE_TLSEXT);
+                        goto f_err;
+                        }
+                }
+                if (ssl_check_clienthello_tlsext(s) <= 0) {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT);
+                        goto err;
+                }
+#endif
         /* Worst case, we will use the NULL compression, but if we have other
          * options, we will now look for them.  We have i-1 compression
          * algorithms from the client, starting at q. */
         s->s3->tmp.new_compression=NULL;
+#ifndef OPENSSL_NO_COMP
         if (s->ctx->comp_methods != NULL)
                 { /* See if we have a match */
                 int m,nn,o,v,done=0;
@@ -845,6 +989,7 @@ static int ssl3_get_client_hello(SSL *s)
                 else
                         comp=NULL;
                 }
+#endif
 
         /* TLS does not mind if there is extra stuff */
 #if 0   /* SSL 3.0 does not mind either, so we should disable this test
@@ -868,7 +1013,11 @@ static int ssl3_get_client_hello(SSL *s)
 
         if (!s->hit)
                 {
+#ifdef OPENSSL_NO_COMP
+                s->session->compress_meth=0;
+#else
                 s->session->compress_meth=(comp == NULL)?0:comp->id;
+#endif
                 if (s->session->ciphers != NULL)
                         sk_SSL_CIPHER_free(s->session->ciphers);
                 s->session->ciphers=ciphers;
@@ -943,7 +1092,7 @@ err:
         return(ret);
         }
 
-static int ssl3_send_server_hello(SSL *s)
+int ssl3_send_server_hello(SSL *s)
         {
         unsigned char *buf;
         unsigned char *p,*d;
@@ -956,7 +1105,7 @@ static int ssl3_send_server_hello(SSL *s)
                 p=s->s3->server_random;
                 Time=(unsigned long)time(NULL);                 /* Time */
                 l2n(Time,p);
-                if(RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
+                if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
                         return -1;
                 /* Do the message type and length last */
                 d=p= &(buf[4]);
@@ -975,12 +1124,20 @@ static int ssl3_send_server_hello(SSL *s)
                  * session-id if we want it to be single use.
                  * Currently I will not implement the '0' length session-id
                  * 12-Jan-98 - I'll now support the '0' length stuff.
+                 *
+                 * We also have an additional case where stateless session
+                 * resumption is successful: we always send back the old
+                 * session id. In this case s->hit is non zero: this can
+                 * only happen if stateless session resumption is succesful
+                 * if session caching is disabled so existing functionality
+                 * is unaffected.
                  */
-                if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER))
+                if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)
+                        && !s->hit)
                         s->session->session_id_length=0;
 
                 sl=s->session->session_id_length;
-                if (sl > sizeof s->session->session_id)
+                if (sl > (int)sizeof(s->session->session_id))
                         {
                         SSLerr(SSL_F_SSL3_SEND_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
                         return -1;
@@ -994,11 +1151,21 @@ static int ssl3_send_server_hello(SSL *s)
                 p+=i;
 
                 /* put the compression method */
+#ifdef OPENSSL_NO_COMP
+                        *(p++)=0;
+#else
                 if (s->s3->tmp.new_compression == NULL)
                         *(p++)=0;
                 else
                         *(p++)=s->s3->tmp.new_compression->id;
-
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+                if ((p = ssl_add_serverhello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_SEND_SERVER_HELLO,ERR_R_INTERNAL_ERROR);
+                        return -1;
+                        }
+#endif
                 /* do the header */
                 l=(p-d);
                 d=buf;
@@ -1015,7 +1182,7 @@ static int ssl3_send_server_hello(SSL *s)
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
         }
 
-static int ssl3_send_server_done(SSL *s)
+int ssl3_send_server_done(SSL *s)
         {
         unsigned char *p;
 
@@ -1039,7 +1206,7 @@ static int ssl3_send_server_done(SSL *s)
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
         }
 
-static int ssl3_send_server_key_exchange(SSL *s)
+int ssl3_send_server_key_exchange(SSL *s)
         {
 #ifndef OPENSSL_NO_RSA
         unsigned char *q;
@@ -1051,6 +1218,13 @@ static int ssl3_send_server_key_exchange(SSL *s)
 #ifndef OPENSSL_NO_DH
         DH *dh=NULL,*dhp;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *ecdh=NULL, *ecdhp;
+        unsigned char *encodedPoint = NULL;
+        int encodedlen = 0;
+        int curve_id = 0;
+        BN_CTX *bn_ctx = NULL; 
+#endif
         EVP_PKEY *pkey;
         unsigned char *p,*d;
         int al,i;
@@ -1159,6 +1333,134 @@ static int ssl3_send_server_key_exchange(SSL *s)
                         }
                 else 
 #endif
+#ifndef OPENSSL_NO_ECDH
+                        if (type & SSL_kECDHE)
+                        {
+                        const EC_GROUP *group;
+
+                        ecdhp=cert->ecdh_tmp;
+                        if ((ecdhp == NULL) && (s->cert->ecdh_tmp_cb != NULL))
+                                {
+                                ecdhp=s->cert->ecdh_tmp_cb(s,
+                                      SSL_C_IS_EXPORT(s->s3->tmp.new_cipher),
+                                      SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher));
+                                }
+                        if (ecdhp == NULL)
+                                {
+                                al=SSL_AD_HANDSHAKE_FAILURE;
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_MISSING_TMP_ECDH_KEY);
+                                goto f_err;
+                                }
+
+                        if (s->s3->tmp.ecdh != NULL)
+                                {
+                                EC_KEY_free(s->s3->tmp.ecdh); 
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
+
+                        /* Duplicate the ECDH structure. */
+                        if (ecdhp == NULL)
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+                        if (!EC_KEY_up_ref(ecdhp))
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+                        ecdh = ecdhp;
+
+                        s->s3->tmp.ecdh=ecdh;
+                        if ((EC_KEY_get0_public_key(ecdh) == NULL) ||
+                            (EC_KEY_get0_private_key(ecdh) == NULL) ||
+                            (s->options & SSL_OP_SINGLE_ECDH_USE))
+                                {
+                                if(!EC_KEY_generate_key(ecdh))
+                                    {
+                                    SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
+                                    goto err;
+                                    }
+                                }
+
+                        if (((group = EC_KEY_get0_group(ecdh)) == NULL) ||
+                            (EC_KEY_get0_public_key(ecdh)  == NULL) ||
+                            (EC_KEY_get0_private_key(ecdh) == NULL))
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+
+                        if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&
+                            (EC_GROUP_get_degree(group) > 163)) 
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER);
+                                goto err;
+                                }
+
+                        /* XXX: For now, we only support ephemeral ECDH
+                         * keys over named (not generic) curves. For 
+                         * supported named curves, curve_id is non-zero.
+                         */
+                        if ((curve_id = 
+                            nid2curve_id(EC_GROUP_get_curve_name(group)))
+                            == 0)
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNSUPPORTED_ELLIPTIC_CURVE);
+                                goto err;
+                                }
+
+                        /* Encode the public key.
+                         * First check the size of encoding and
+                         * allocate memory accordingly.
+                         */
+                        encodedlen = EC_POINT_point2oct(group, 
+                            EC_KEY_get0_public_key(ecdh),
+                            POINT_CONVERSION_UNCOMPRESSED, 
+                            NULL, 0, NULL);
+
+                        encodedPoint = (unsigned char *) 
+                            OPENSSL_malloc(encodedlen*sizeof(unsigned char)); 
+                        bn_ctx = BN_CTX_new();
+                        if ((encodedPoint == NULL) || (bn_ctx == NULL))
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+
+
+                        encodedlen = EC_POINT_point2oct(group, 
+                            EC_KEY_get0_public_key(ecdh), 
+                            POINT_CONVERSION_UNCOMPRESSED, 
+                            encodedPoint, encodedlen, bn_ctx);
+
+                        if (encodedlen == 0) 
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
+                                goto err;
+                                }
+
+                        BN_CTX_free(bn_ctx);  bn_ctx=NULL;
+
+                        /* XXX: For now, we only support named (not 
+                         * generic) curves in ECDH ephemeral key exchanges.
+                         * In this situation, we need four additional bytes
+                         * to encode the entire ServerECDHParams
+                         * structure. 
+                         */
+                        n = 4 + encodedlen;
+
+                        /* We'll generate the serverKeyExchange message
+                         * explicitly so we can set these to NULLs
+                         */
+                        r[0]=NULL;
+                        r[1]=NULL;
+                        r[2]=NULL;
+                        r[3]=NULL;
+                        }
+                else 
+#endif /* !OPENSSL_NO_ECDH */
                         {
                         al=SSL_AD_HANDSHAKE_FAILURE;
                         SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
@@ -1201,6 +1503,31 @@ static int ssl3_send_server_key_exchange(SSL *s)
                         p+=nr[i];
                         }
 
+#ifndef OPENSSL_NO_ECDH
+                if (type & SSL_kECDHE) 
+                        {
+                        /* XXX: For now, we only support named (not generic) curves.
+                         * In this situation, the serverKeyExchange message has:
+                         * [1 byte CurveType], [2 byte CurveName]
+                         * [1 byte length of encoded point], followed by
+                         * the actual encoded point itself
+                         */
+                        *p = NAMED_CURVE_TYPE;
+                        p += 1;
+                        *p = 0;
+                        p += 1;
+                        *p = curve_id;
+                        p += 1;
+                        *p = encodedlen;
+                        p += 1;
+                        memcpy((unsigned char*)p, 
+                            (unsigned char *)encodedPoint, 
+                            encodedlen);
+                        OPENSSL_free(encodedPoint);
+                        p += encodedlen;
+                        }
+#endif
+
                 /* not anonymous */
                 if (pkey != NULL)
                         {
@@ -1213,8 +1540,6 @@ static int ssl3_send_server_key_exchange(SSL *s)
                                 j=0;
                                 for (num=2; num > 0; num--)
                                         {
-                                        EVP_MD_CTX_set_flags(&md_ctx,
-                                                EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
                                         EVP_DigestInit_ex(&md_ctx,(num == 2)
                                                 ?s->ctx->md5:s->ctx->sha1, NULL);
                                         EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
@@ -1255,6 +1580,25 @@ static int ssl3_send_server_key_exchange(SSL *s)
                                 }
                         else
 #endif
+#if !defined(OPENSSL_NO_ECDSA)
+                                if (pkey->type == EVP_PKEY_EC)
+                                {
+                                /* let's do ECDSA */
+                                EVP_SignInit_ex(&md_ctx,EVP_ecdsa(), NULL);
+                                EVP_SignUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
+                                EVP_SignUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
+                                EVP_SignUpdate(&md_ctx,&(d[4]),n);
+                                if (!EVP_SignFinal(&md_ctx,&(p[2]),
+                                        (unsigned int *)&i,pkey))
+                                        {
+                                        SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_LIB_ECDSA);
+                                        goto err;
+                                        }
+                                s2n(i,p);
+                                n+=i+2;
+                                }
+                        else
+#endif
                                 {
                                 /* Is this error check actually needed? */
                                 al=SSL_AD_HANDSHAKE_FAILURE;
@@ -1278,11 +1622,15 @@ static int ssl3_send_server_key_exchange(SSL *s)
 f_err:
         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 err:
+#ifndef OPENSSL_NO_ECDH
+        if (encodedPoint != NULL) OPENSSL_free(encodedPoint);
+        BN_CTX_free(bn_ctx);
+#endif
         EVP_MD_CTX_cleanup(&md_ctx);
         return(-1);
         }
 
-static int ssl3_send_certificate_request(SSL *s)
+int ssl3_send_certificate_request(SSL *s)
         {
         unsigned char *p,*d;
         int i,j,nl,off,n;
@@ -1371,7 +1719,7 @@ err:
         return(-1);
         }
 
-static int ssl3_get_client_key_exchange(SSL *s)
+int ssl3_get_client_key_exchange(SSL *s)
         {
         int i,al,ok;
         long n;
@@ -1389,7 +1737,14 @@ static int ssl3_get_client_key_exchange(SSL *s)
         KSSL_ERR kssl_err;
 #endif /* OPENSSL_NO_KRB5 */
 
-        n=ssl3_get_message(s,
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *srvr_ecdh = NULL;
+        EVP_PKEY *clnt_pub_pkey = NULL;
+        EC_POINT *clnt_ecpoint = NULL;
+        BN_CTX *bn_ctx = NULL; 
+#endif
+
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_SR_KEY_EXCH_A,
                 SSL3_ST_SR_KEY_EXCH_B,
                 SSL3_MT_CLIENT_KEY_EXCHANGE,
@@ -1433,8 +1788,9 @@ static int ssl3_get_client_key_exchange(SSL *s)
                         rsa=pkey->pkey.rsa;
                         }
 
-                /* TLS */
-                if (s->version > SSL3_VERSION)
+                /* TLS and [incidentally] DTLS, including pre-0.9.8f */
+                if (s->version > SSL3_VERSION &&
+                    s->client_version != DTLS1_BAD_VER)
                         {
                         n2s(p,i);
                         if (n != i+2)
@@ -1495,7 +1851,7 @@ static int ssl3_get_client_key_exchange(SSL *s)
                         i = SSL_MAX_MASTER_KEY_LENGTH;
                         p[0] = s->client_version >> 8;
                         p[1] = s->client_version & 0xff;
-                        if(RAND_pseudo_bytes(p+2, i-2) <= 0)  /* should be RAND_bytes, but we cannot work around a failure */
+                        if (RAND_pseudo_bytes(p+2, i-2) <= 0) /* should be RAND_bytes, but we cannot work around a failure */
                                 goto err;
                         }
         
@@ -1594,7 +1950,7 @@ static int ssl3_get_client_key_exchange(SSL *s)
                 n2s(p,i);
                 enc_ticket.length = i;
 
-                if (n < (long)enc_ticket.length + 6)
+                if (n < (int)enc_ticket.length + 6)
                         {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                                 SSL_R_DATA_LENGTH_TOO_LONG);
@@ -1607,7 +1963,7 @@ static int ssl3_get_client_key_exchange(SSL *s)
                 n2s(p,i);
                 authenticator.length = i;
 
-                if (n < (long)(enc_ticket.length + authenticator.length + 6))
+                if (n < (int)(enc_ticket.length + authenticator.length) + 6)
                         {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                                 SSL_R_DATA_LENGTH_TOO_LONG);
@@ -1649,7 +2005,7 @@ static int ssl3_get_client_key_exchange(SSL *s)
                         if (kssl_err.text)
                                 printf("kssl_err text= %s\n", kssl_err.text);
 #endif  /* KSSL_DEBUG */
-                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                                 kssl_err.reason);
                         goto err;
                         }
@@ -1666,14 +2022,14 @@ static int ssl3_get_client_key_exchange(SSL *s)
                         if (kssl_err.text)
                                 printf("kssl_err text= %s\n", kssl_err.text);
 #endif  /* KSSL_DEBUG */
-                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                                 kssl_err.reason);
                         goto err;
                         }
 
                 if ((krb5rc = kssl_validate_times(authtime, &ttimes)) != 0)
                         {
-                        SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, krb5rc);
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, krb5rc);
                         goto err;
                         }
 
@@ -1719,6 +2075,24 @@ static int ssl3_get_client_key_exchange(SSL *s)
                                 SSL_R_DATA_LENGTH_TOO_LONG);
                         goto err;
                         }
+                if (!((pms[0] == (s->client_version>>8)) && (pms[1] == (s->client_version & 0xff))))
+                    {
+                    /* The premaster secret must contain the same version number as the
+                     * ClientHello to detect version rollback attacks (strangely, the
+                     * protocol does not offer such protection for DH ciphersuites).
+                     * However, buggy clients exist that send random bytes instead of
+                     * the protocol version.
+                     * If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such clients. 
+                     * (Perhaps we should have a separate BUG value for the Kerberos cipher)
+                     */
+                    if (!(s->options & SSL_OP_TLS_ROLLBACK_BUG))
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                               SSL_AD_DECODE_ERROR);
+                        goto err;
+                        }
+                    }
+
                 EVP_CIPHER_CTX_cleanup(&ciph_ctx);
 
                 s->session->master_key_length=
@@ -1727,7 +2101,7 @@ static int ssl3_get_client_key_exchange(SSL *s)
 
                 if (kssl_ctx->client_princ)
                         {
-                        int len = strlen(kssl_ctx->client_princ);
+                        size_t len = strlen(kssl_ctx->client_princ);
                         if ( len < SSL_MAX_KRB5_PRINCIPAL_LENGTH ) 
                                 {
                                 s->session->krb5_client_princ_len = len;
@@ -1744,6 +2118,156 @@ static int ssl3_get_client_key_exchange(SSL *s)
                 }
         else
 #endif  /* OPENSSL_NO_KRB5 */
+
+#ifndef OPENSSL_NO_ECDH
+                if ((l & SSL_kECDH) || (l & SSL_kECDHE))
+                {
+                int ret = 1;
+                int field_size = 0;
+                const EC_KEY   *tkey;
+                const EC_GROUP *group;
+                const BIGNUM *priv_key;
+
+                /* initialize structures for server's ECDH key pair */
+                if ((srvr_ecdh = EC_KEY_new()) == NULL) 
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                            ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+
+                /* Let's get server private key and group information */
+                if (l & SSL_kECDH) 
+                        { 
+                        /* use the certificate */
+                        tkey = s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec;
+                        }
+                else
+                        {
+                        /* use the ephermeral values we saved when
+                         * generating the ServerKeyExchange msg.
+                         */
+                        tkey = s->s3->tmp.ecdh;
+                        }
+
+                group    = EC_KEY_get0_group(tkey);
+                priv_key = EC_KEY_get0_private_key(tkey);
+
+                if (!EC_KEY_set_group(srvr_ecdh, group) ||
+                    !EC_KEY_set_private_key(srvr_ecdh, priv_key))
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                               ERR_R_EC_LIB);
+                        goto err;
+                        }
+
+                /* Let's get client's public key */
+                if ((clnt_ecpoint = EC_POINT_new(group)) == NULL)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                            ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+
+                if (n == 0L) 
+                        {
+                        /* Client Publickey was in Client Certificate */
+
+                         if (l & SSL_kECDHE) 
+                                 {
+                                 al=SSL_AD_HANDSHAKE_FAILURE;
+                                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_MISSING_TMP_ECDH_KEY);
+                                 goto f_err;
+                                 }
+                        if (((clnt_pub_pkey=X509_get_pubkey(s->session->peer))
+                            == NULL) || 
+                            (clnt_pub_pkey->type != EVP_PKEY_EC))
+                                {
+                                /* XXX: For now, we do not support client
+                                 * authentication using ECDH certificates
+                                 * so this branch (n == 0L) of the code is
+                                 * never executed. When that support is
+                                 * added, we ought to ensure the key 
+                                 * received in the certificate is 
+                                 * authorized for key agreement.
+                                 * ECDH_compute_key implicitly checks that
+                                 * the two ECDH shares are for the same
+                                 * group.
+                                 */
+                                al=SSL_AD_HANDSHAKE_FAILURE;
+                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                    SSL_R_UNABLE_TO_DECODE_ECDH_CERTS);
+                                goto f_err;
+                                }
+
+                        if (EC_POINT_copy(clnt_ecpoint,
+                            EC_KEY_get0_public_key(clnt_pub_pkey->pkey.ec)) == 0)
+                                {
+                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                        ERR_R_EC_LIB);
+                                goto err;
+                                }
+                        ret = 2; /* Skip certificate verify processing */
+                        }
+                else
+                        {
+                        /* Get client's public key from encoded point
+                         * in the ClientKeyExchange message.
+                         */
+                        if ((bn_ctx = BN_CTX_new()) == NULL)
+                                {
+                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_MALLOC_FAILURE);
+                                goto err;
+                                }
+
+                        /* Get encoded point length */
+                        i = *p; 
+                        p += 1;
+                        if (EC_POINT_oct2point(group, 
+                            clnt_ecpoint, p, i, bn_ctx) == 0)
+                                {
+                                SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_EC_LIB);
+                                goto err;
+                                }
+                        /* p is pointing to somewhere in the buffer
+                         * currently, so set it to the start 
+                         */ 
+                        p=(unsigned char *)s->init_buf->data;
+                        }
+
+                /* Compute the shared pre-master secret */
+                field_size = EC_GROUP_get_degree(group);
+                if (field_size <= 0)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, 
+                               ERR_R_ECDH_LIB);
+                        goto err;
+                        }
+                i = ECDH_compute_key(p, (field_size+7)/8, clnt_ecpoint, srvr_ecdh, NULL);
+                if (i <= 0)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                            ERR_R_ECDH_LIB);
+                        goto err;
+                        }
+
+                EVP_PKEY_free(clnt_pub_pkey);
+                EC_POINT_free(clnt_ecpoint);
+                if (srvr_ecdh != NULL) 
+                        EC_KEY_free(srvr_ecdh);
+                BN_CTX_free(bn_ctx);
+
+                /* Compute the master secret */
+                s->session->master_key_length = s->method->ssl3_enc-> \
+                    generate_master_secret(s, s->session->master_key, p, i);
+                
+                OPENSSL_cleanse(p, i);
+                return (ret);
+                }
+        else
+#endif
                 {
                 al=SSL_AD_HANDSHAKE_FAILURE;
                 SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
@@ -1754,13 +2278,20 @@ static int ssl3_get_client_key_exchange(SSL *s)
         return(1);
 f_err:
         ssl3_send_alert(s,SSL3_AL_FATAL,al);
-#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA)
+#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_ECDH)
 err:
 #endif
+#ifndef OPENSSL_NO_ECDH
+        EVP_PKEY_free(clnt_pub_pkey);
+        EC_POINT_free(clnt_ecpoint);
+        if (srvr_ecdh != NULL) 
+                EC_KEY_free(srvr_ecdh);
+        BN_CTX_free(bn_ctx);
+#endif
         return(-1);
         }
 
-static int ssl3_get_cert_verify(SSL *s)
+int ssl3_get_cert_verify(SSL *s)
         {
         EVP_PKEY *pkey=NULL;
         unsigned char *p;
@@ -1769,7 +2300,7 @@ static int ssl3_get_cert_verify(SSL *s)
         int type=0,i,j;
         X509 *peer;
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_SR_CERT_VRFY_A,
                 SSL3_ST_SR_CERT_VRFY_B,
                 -1,
@@ -1880,6 +2411,23 @@ static int ssl3_get_cert_verify(SSL *s)
                 }
         else
 #endif
+#ifndef OPENSSL_NO_ECDSA
+                if (pkey->type == EVP_PKEY_EC)
+                {
+                j=ECDSA_verify(pkey->save_type,
+                        &(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),
+                        SHA_DIGEST_LENGTH,p,i,pkey->pkey.ec);
+                if (j <= 0)
+                        {
+                        /* bad signature */
+                        al=SSL_AD_DECRYPT_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,
+                            SSL_R_BAD_ECDSA_SIGNATURE);
+                        goto f_err;
+                        }
+                }
+        else
+#endif
                 {
                 SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,ERR_R_INTERNAL_ERROR);
                 al=SSL_AD_UNSUPPORTED_CERTIFICATE;
@@ -1898,15 +2446,16 @@ end:
         return(ret);
         }
 
-static int ssl3_get_client_certificate(SSL *s)
+int ssl3_get_client_certificate(SSL *s)
         {
         int i,ok,al,ret= -1;
         X509 *x=NULL;
         unsigned long l,nc,llen,n;
-        unsigned char *p,*d,*q;
+        const unsigned char *p,*q;
+        unsigned char *d;
         STACK_OF(X509) *sk=NULL;
 
-        n=ssl3_get_message(s,
+        n=s->method->ssl_get_message(s,
                 SSL3_ST_SR_CERT_A,
                 SSL3_ST_SR_CERT_B,
                 -1,
@@ -1941,7 +2490,7 @@ static int ssl3_get_client_certificate(SSL *s)
                 SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_WRONG_MESSAGE_TYPE);
                 goto f_err;
                 }
-        d=p=(unsigned char *)s->init_msg;
+        p=d=(unsigned char *)s->init_msg;
 
         if ((sk=sk_X509_new_null()) == NULL)
                 {
@@ -2080,3 +2629,209 @@ int ssl3_send_server_certificate(SSL *s)
         /* SSL3_ST_SW_CERT_B */
         return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
         }
+
+
+#ifndef OPENSSL_NO_ECDH
+/* This is the complement of curve_id2nid in s3_clnt.c. */
+static int nid2curve_id(int nid)
+{
+        /* ECC curves from draft-ietf-tls-ecc-01.txt (Mar 15, 2001)
+         * (no changes in draft-ietf-tls-ecc-03.txt [June 2003]) */
+        switch (nid) {
+        case NID_sect163k1: /* sect163k1 (1) */
+                return 1;
+        case NID_sect163r1: /* sect163r1 (2) */
+                return 2;
+        case NID_sect163r2: /* sect163r2 (3) */
+                return 3;
+        case NID_sect193r1: /* sect193r1 (4) */ 
+                return 4;
+        case NID_sect193r2: /* sect193r2 (5) */ 
+                return 5;
+        case NID_sect233k1: /* sect233k1 (6) */
+                return 6;
+        case NID_sect233r1: /* sect233r1 (7) */ 
+                return 7;
+        case NID_sect239k1: /* sect239k1 (8) */ 
+                return 8;
+        case NID_sect283k1: /* sect283k1 (9) */
+                return 9;
+        case NID_sect283r1: /* sect283r1 (10) */ 
+                return 10;
+        case NID_sect409k1: /* sect409k1 (11) */ 
+                return 11;
+        case NID_sect409r1: /* sect409r1 (12) */
+                return 12;
+        case NID_sect571k1: /* sect571k1 (13) */ 
+                return 13;
+        case NID_sect571r1: /* sect571r1 (14) */ 
+                return 14;
+        case NID_secp160k1: /* secp160k1 (15) */
+                return 15;
+        case NID_secp160r1: /* secp160r1 (16) */ 
+                return 16;
+        case NID_secp160r2: /* secp160r2 (17) */ 
+                return 17;
+        case NID_secp192k1: /* secp192k1 (18) */
+                return 18;
+        case NID_X9_62_prime192v1: /* secp192r1 (19) */ 
+                return 19;
+        case NID_secp224k1: /* secp224k1 (20) */ 
+                return 20;
+        case NID_secp224r1: /* secp224r1 (21) */
+                return 21;
+        case NID_secp256k1: /* secp256k1 (22) */ 
+                return 22;
+        case NID_X9_62_prime256v1: /* secp256r1 (23) */ 
+                return 23;
+        case NID_secp384r1: /* secp384r1 (24) */
+                return 24;
+        case NID_secp521r1:  /* secp521r1 (25) */       
+                return 25;
+        default:
+                return 0;
+        }
+}
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+int ssl3_send_newsession_ticket(SSL *s)
+        {
+        if (s->state == SSL3_ST_SW_SESSION_TICKET_A)
+                {
+                unsigned char *p, *senc, *macstart;
+                int len, slen;
+                unsigned int hlen;
+                EVP_CIPHER_CTX ctx;
+                HMAC_CTX hctx;
+                unsigned char iv[EVP_MAX_IV_LENGTH];
+                unsigned char key_name[16];
+
+                /* get session encoding length */
+                slen = i2d_SSL_SESSION(s->session, NULL);
+                /* Some length values are 16 bits, so forget it if session is
+                 * too long
+                 */
+                if (slen > 0xFF00)
+                        return -1;
+                /* Grow buffer if need be: the length calculation is as
+                 * follows 1 (size of message name) + 3 (message length
+                 * bytes) + 4 (ticket lifetime hint) + 2 (ticket length) +
+                 * 16 (key name) + max_iv_len (iv length) +
+                 * session_length + max_enc_block_size (max encrypted session
+                 * length) + max_md_size (HMAC).
+                 */
+                if (!BUF_MEM_grow(s->init_buf,
+                        26 + EVP_MAX_IV_LENGTH + EVP_MAX_BLOCK_LENGTH +
+                        EVP_MAX_MD_SIZE + slen))
+                        return -1;
+                senc = OPENSSL_malloc(slen);
+                if (!senc)
+                        return -1;
+                p = senc;
+                i2d_SSL_SESSION(s->session, &p);
+
+                p=(unsigned char *)s->init_buf->data;
+                /* do the header */
+                *(p++)=SSL3_MT_NEWSESSION_TICKET;
+                /* Skip message length for now */
+                p += 3;
+                EVP_CIPHER_CTX_init(&ctx);
+                HMAC_CTX_init(&hctx);
+                /* Initialize HMAC and cipher contexts. If callback present
+                 * it does all the work otherwise use generated values
+                 * from parent ctx.
+                 */
+                if (s->ctx->tlsext_ticket_key_cb)
+                        {
+                        if (s->ctx->tlsext_ticket_key_cb(s, key_name, iv, &ctx,
+                                                         &hctx, 1) < 0)
+                                {
+                                OPENSSL_free(senc);
+                                return -1;
+                                }
+                        }
+                else
+                        {
+                        RAND_pseudo_bytes(iv, 16);
+                        EVP_EncryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
+                                        s->ctx->tlsext_tick_aes_key, iv);
+                        HMAC_Init_ex(&hctx, s->ctx->tlsext_tick_hmac_key, 16,
+                                        tlsext_tick_md(), NULL);
+                        memcpy(key_name, s->ctx->tlsext_tick_key_name, 16);
+                        }
+                l2n(s->session->tlsext_tick_lifetime_hint, p);
+                /* Skip ticket length for now */
+                p += 2;
+                /* Output key name */
+                macstart = p;
+                memcpy(p, key_name, 16);
+                p += 16;
+                /* output IV */
+                memcpy(p, iv, EVP_CIPHER_CTX_iv_length(&ctx));
+                p += EVP_CIPHER_CTX_iv_length(&ctx);
+                /* Encrypt session data */
+                EVP_EncryptUpdate(&ctx, p, &len, senc, slen);
+                p += len;
+                EVP_EncryptFinal(&ctx, p, &len);
+                p += len;
+                EVP_CIPHER_CTX_cleanup(&ctx);
+
+                HMAC_Update(&hctx, macstart, p - macstart);
+                HMAC_Final(&hctx, p, &hlen);
+                HMAC_CTX_cleanup(&hctx);
+
+                p += hlen;
+                /* Now write out lengths: p points to end of data written */
+                /* Total length */
+                len = p - (unsigned char *)s->init_buf->data;
+                p=(unsigned char *)s->init_buf->data + 1;
+                l2n3(len - 4, p); /* Message length */
+                p += 4;
+                s2n(len - 10, p);  /* Ticket length */
+
+                /* number of bytes to write */
+                s->init_num= len;
+                s->state=SSL3_ST_SW_SESSION_TICKET_B;
+                s->init_off=0;
+                OPENSSL_free(senc);
+                }
+
+        /* SSL3_ST_SW_SESSION_TICKET_B */
+        return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
+        }
+
+int ssl3_send_cert_status(SSL *s)
+        {
+        if (s->state == SSL3_ST_SW_CERT_STATUS_A)
+                {
+                unsigned char *p;
+                /* Grow buffer if need be: the length calculation is as
+                 * follows 1 (message type) + 3 (message length) +
+                 * 1 (ocsp response type) + 3 (ocsp response length)
+                 * + (ocsp response)
+                 */
+                if (!BUF_MEM_grow(s->init_buf, 8 + s->tlsext_ocsp_resplen))
+                        return -1;
+
+                p=(unsigned char *)s->init_buf->data;
+
+                /* do the header */
+                *(p++)=SSL3_MT_CERTIFICATE_STATUS;
+                /* message length */
+                l2n3(s->tlsext_ocsp_resplen + 4, p);
+                /* status type */
+                *(p++)= s->tlsext_status_type;
+                /* length of OCSP response */
+                l2n3(s->tlsext_ocsp_resplen, p);
+                /* actual response */
+                memcpy(p, s->tlsext_ocsp_resp, s->tlsext_ocsp_resplen);
+                /* number of bytes to write */
+                s->init_num = 8 + s->tlsext_ocsp_resplen;
+                s->state=SSL3_ST_SW_CERT_STATUS_B;
+                s->init_off = 0;
+                }
+
+        /* SSL3_ST_SW_CERT_STATUS_B */
+        return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
+        }
+#endif
diff --git a/src/lib/libssl/src/ssl/ssl-lib.com b/src/lib/libssl/src/ssl/ssl-lib.com
index f0665c6b86..fcd7ff774c 100644
--- a/src/lib/libssl/src/ssl/ssl-lib.com
+++ b/src/lib/libssl/src/ssl/ssl-lib.com
@@ -174,6 +174,8 @@ $ LIB_SSL = "s2_meth,s2_srvr,s2_clnt,s2_lib,s2_enc,s2_pkt,"+ -
             "s3_meth,s3_srvr,s3_clnt,s3_lib,s3_enc,s3_pkt,s3_both,"+ -
             "s23_meth,s23_srvr,s23_clnt,s23_lib,s23_pkt,"+ -
             "t1_meth,t1_srvr,t1_clnt,t1_lib,t1_enc,"+ -
+            "d1_meth,d1_srvr,d1_clnt,d1_lib,d1_pkt,"+ -
+            "d1_both,d1_enc,"+ -
             "ssl_lib,ssl_err2,ssl_cert,ssl_sess,"+ -
             "ssl_ciph,ssl_stat,ssl_rsa,"+ -
             "ssl_asn1,ssl_txt,ssl_algs,"+ -
diff --git a/src/lib/libssl/src/ssl/ssl.h b/src/lib/libssl/src/ssl/ssl.h
index 99e188086b..6df921f3c1 100644
--- a/src/lib/libssl/src/ssl/ssl.h
+++ b/src/lib/libssl/src/ssl/ssl.h
@@ -109,7 +109,7 @@
  *
  */
 /* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -161,6 +161,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #ifndef HEADER_SSL_H 
 #define HEADER_SSL_H 
@@ -173,9 +178,17 @@
 #ifndef OPENSSL_NO_BIO
 #include <openssl/bio.h>
 #endif
+#ifndef OPENSSL_NO_DEPRECATED
 #ifndef OPENSSL_NO_X509
 #include <openssl/x509.h>
 #endif
+#include <openssl/crypto.h>
+#include <openssl/lhash.h>
+#include <openssl/buffer.h>
+#endif
+#include <openssl/pem.h>
+#include <openssl/hmac.h>
+
 #include <openssl/kssl.h>
 #include <openssl/safestack.h>
 #include <openssl/symhacks.h>
@@ -239,7 +252,6 @@ extern "C" {
 #define SSL_TXT_LOW             "LOW"
 #define SSL_TXT_MEDIUM          "MEDIUM"
 #define SSL_TXT_HIGH            "HIGH"
-#define SSL_TXT_FIPS            "FIPS"
 #define SSL_TXT_kFZA            "kFZA"
 #define SSL_TXT_aFZA            "aFZA"
 #define SSL_TXT_eFZA            "eFZA"
@@ -270,7 +282,9 @@ extern "C" {
 #define SSL_TXT_RC4             "RC4"
 #define SSL_TXT_RC2             "RC2"
 #define SSL_TXT_IDEA            "IDEA"
+#define SSL_TXT_SEED            "SEED"
 #define SSL_TXT_AES             "AES"
+#define SSL_TXT_CAMELLIA        "CAMELLIA"
 #define SSL_TXT_MD5             "MD5"
 #define SSL_TXT_SHA1            "SHA1"
 #define SSL_TXT_SHA             "SHA"
@@ -282,6 +296,7 @@ extern "C" {
 #define SSL_TXT_SSLV3           "SSLv3"
 #define SSL_TXT_TLSV1           "TLSv1"
 #define SSL_TXT_ALL             "ALL"
+#define SSL_TXT_ECC             "ECCdraft" /* ECC ciphersuites are not yet official */
 
 /*
  * COMPLEMENTOF* definitions. These identifiers are used to (de-select)
@@ -303,7 +318,7 @@ extern "C" {
 /* The following cipher list is used by default.
  * It also is substituted when an application-defined cipher list string
  * starts with 'DEFAULT'. */
-#define SSL_DEFAULT_CIPHER_LIST "ALL:!ADH:+RC4:@STRENGTH" /* low priority for RC4 */
+#define SSL_DEFAULT_CIPHER_LIST "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH" /* low priority for RC4 */
 
 /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */
 #define SSL_SENT_SHUTDOWN       1
@@ -313,11 +328,6 @@ extern "C" {
 }
 #endif
 
-#include <openssl/crypto.h>
-#include <openssl/lhash.h>
-#include <openssl/buffer.h>
-#include <openssl/pem.h>
-
 #ifdef  __cplusplus
 extern "C" {
 #endif
@@ -369,6 +379,12 @@ typedef struct ssl_method_st
         int (*ssl_shutdown)(SSL *s);
         int (*ssl_renegotiate)(SSL *s);
         int (*ssl_renegotiate_check)(SSL *s);
+        long (*ssl_get_message)(SSL *s, int st1, int stn, int mt, long
+                max, int *ok);
+        int (*ssl_read_bytes)(SSL *s, int type, unsigned char *buf, int len, 
+                int peek);
+        int (*ssl_write_bytes)(SSL *s, int type, const void *buf_, int len);
+        int (*ssl_dispatch_alert)(SSL *s);
         long (*ssl_ctrl)(SSL *s,int cmd,long larg,void *parg);
         long (*ssl_ctx_ctrl)(SSL_CTX *ctx,int cmd,long larg,void *parg);
         SSL_CIPHER *(*get_cipher_by_char)(const unsigned char *ptr);
@@ -379,9 +395,9 @@ typedef struct ssl_method_st
         struct ssl_method_st *(*get_ssl_method)(int version);
         long (*get_timeout)(void);
         struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */
-        int (*ssl_version)();
-        long (*ssl_callback_ctrl)(SSL *s, int cb_id, void (*fp)());
-        long (*ssl_ctx_callback_ctrl)(SSL_CTX *s, int cb_id, void (*fp)());
+        int (*ssl_version)(void);
+        long (*ssl_callback_ctrl)(SSL *s, int cb_id, void (*fp)(void));
+        long (*ssl_ctx_callback_ctrl)(SSL_CTX *s, int cb_id, void (*fp)(void));
         } SSL_METHOD;
 
 /* Lets make this into an ASN.1 type structure as follows
@@ -459,6 +475,13 @@ typedef struct ssl_session_st
         /* These are used to make removal of session-ids more
          * efficient and to implement a maximum cache size. */
         struct ssl_session_st *prev,*next;
+#ifndef OPENSSL_NO_TLSEXT
+        char *tlsext_hostname;
+        /* RFC4507 info */
+        unsigned char *tlsext_tick;     /* Session ticket */
+        size_t  tlsext_ticklen;         /* Session ticket length */     
+        long tlsext_tick_lifetime_hint; /* Session lifetime hint in seconds */
+#endif
         } SSL_SESSION;
 
 
@@ -483,8 +506,17 @@ typedef struct ssl_session_st
  *             This used to be 0x000FFFFFL before 0.9.7. */
 #define SSL_OP_ALL                                      0x00000FFFL
 
+/* DTLS options */
+#define SSL_OP_NO_QUERY_MTU                 0x00001000L
+/* Turn on Cookie Exchange (on relevant for servers) */
+#define SSL_OP_COOKIE_EXCHANGE              0x00002000L
+/* Don't use RFC4507 ticket extension */
+#define SSL_OP_NO_TICKET                    0x00004000L
+
 /* As server, disallow session resumption on renegotiation */
 #define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION   0x00010000L
+/* If set, always create a new key when using tmp_ecdh parameters */
+#define SSL_OP_SINGLE_ECDH_USE                          0x00080000L
 /* If set, always create a new key when using tmp_dh parameters */
 #define SSL_OP_SINGLE_DH_USE                            0x00100000L
 /* Set to always use the tmp_rsa key when doing RSA operations,
@@ -546,6 +578,8 @@ typedef struct ssl_session_st
         SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL)
 #define SSL_get_mode(ssl) \
         SSL_ctrl((ssl),SSL_CTRL_MODE,0,NULL)
+#define SSL_set_mtu(ssl, mtu) \
+        SSL_ctrl((ssl),SSL_CTRL_SET_MTU,(mtu),NULL)
 
 
 void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg));
@@ -582,7 +616,7 @@ typedef int (*GEN_SESSION_CB)(const SSL *ssl, unsigned char *id,
 typedef struct ssl_comp_st
         {
         int id;
-        char *name;
+        const char *name;
 #ifndef OPENSSL_NO_COMP
         COMP_METHOD *method;
 #else
@@ -670,6 +704,14 @@ struct ssl_ctx_st
         /* get client cert callback */
         int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
 
+    /* cookie generate callback */
+    int (*app_gen_cookie_cb)(SSL *ssl, unsigned char *cookie, 
+        unsigned int *cookie_len);
+
+    /* verify cookie callback */
+    int (*app_verify_cookie_cb)(SSL *ssl, unsigned char *cookie, 
+        unsigned int cookie_len);
+
         CRYPTO_EX_DATA ex_data;
 
         const EVP_MD *rsa_md5;/* For SSLv2 - name is 'ssl2-md5' */
@@ -702,7 +744,6 @@ struct ssl_ctx_st
         void *msg_callback_arg;
 
         int verify_mode;
-        int verify_depth;
         unsigned int sid_ctx_length;
         unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
         int (*default_verify_callback)(int ok,X509_STORE_CTX *ctx); /* called 'verify_callback' in the SSL */
@@ -710,10 +751,35 @@ struct ssl_ctx_st
         /* Default generate session ID callback. */
         GEN_SESSION_CB generate_session_id;
 
+        X509_VERIFY_PARAM *param;
+
+#if 0
         int purpose;            /* Purpose setting */
         int trust;              /* Trust setting */
+#endif
 
         int quiet_shutdown;
+
+#ifndef OPENSSL_NO_TLSEXT
+        /* TLS extensions servername callback */
+        int (*tlsext_servername_callback)(SSL*, int *, void *);
+        void *tlsext_servername_arg;
+        /* RFC 4507 session ticket keys */
+        unsigned char tlsext_tick_key_name[16];
+        unsigned char tlsext_tick_hmac_key[16];
+        unsigned char tlsext_tick_aes_key[16];
+        /* Callback to support customisation of ticket key setting */
+        int (*tlsext_ticket_key_cb)(SSL *ssl,
+                                        unsigned char *name, unsigned char *iv,
+                                        EVP_CIPHER_CTX *ectx,
+                                        HMAC_CTX *hctx, int enc);
+
+        /* certificate status request info */
+        /* Callback for status request */
+        int (*tlsext_status_cb)(SSL *ssl, void *arg);
+        void *tlsext_status_arg;
+#endif
+
         };
 
 #define SSL_SESS_CACHE_OFF                      0x0000
@@ -753,16 +819,18 @@ struct ssl_ctx_st
 #define SSL_CTX_sess_cache_full(ctx) \
         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CACHE_FULL,0,NULL)
 
-#define SSL_CTX_sess_set_new_cb(ctx,cb) ((ctx)->new_session_cb=(cb))
-#define SSL_CTX_sess_get_new_cb(ctx)    ((ctx)->new_session_cb)
-#define SSL_CTX_sess_set_remove_cb(ctx,cb)      ((ctx)->remove_session_cb=(cb))
-#define SSL_CTX_sess_get_remove_cb(ctx) ((ctx)->remove_session_cb)
-#define SSL_CTX_sess_set_get_cb(ctx,cb) ((ctx)->get_session_cb=(cb))
-#define SSL_CTX_sess_get_get_cb(ctx)    ((ctx)->get_session_cb)
-#define SSL_CTX_set_info_callback(ctx,cb)       ((ctx)->info_callback=(cb))
-#define SSL_CTX_get_info_callback(ctx)          ((ctx)->info_callback)
-#define SSL_CTX_set_client_cert_cb(ctx,cb)      ((ctx)->client_cert_cb=(cb))
-#define SSL_CTX_get_client_cert_cb(ctx)         ((ctx)->client_cert_cb)
+void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx, int (*new_session_cb)(struct ssl_st *ssl,SSL_SESSION *sess));
+int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(struct ssl_st *ssl, SSL_SESSION *sess);
+void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx, void (*remove_session_cb)(struct ssl_ctx_st *ctx,SSL_SESSION *sess));
+void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(struct ssl_ctx_st *ctx, SSL_SESSION *sess);
+void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx, SSL_SESSION *(*get_session_cb)(struct ssl_st *ssl, unsigned char *data,int len,int *copy));
+SSL_SESSION *(*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(struct ssl_st *ssl, unsigned char *Data, int len, int *copy);
+void SSL_CTX_set_info_callback(SSL_CTX *ctx, void (*cb)(const SSL *ssl,int type,int val));
+void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl,int type,int val);
+void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey));
+int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
+void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, int (*app_gen_cookie_cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len));
+void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, int (*app_verify_cookie_cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len));
 
 #define SSL_NOTHING     1
 #define SSL_WRITING     2
@@ -778,7 +846,7 @@ struct ssl_ctx_st
 struct ssl_st
         {
         /* protocol version
-         * (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION)
+         * (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION, DTLS1_VERSION)
          */
         int version;
         int type; /* SSL_ST_CONNECT or SSL_ST_ACCEPT */
@@ -807,7 +875,7 @@ struct ssl_st
 
         /* true when we are actually in SSL_accept() or SSL_connect() */
         int in_handshake;
-        int (*handshake_func)();
+        int (*handshake_func)(SSL *);
 
         /* Imagine that here's a boolean member "init" that is
          * switched as soon as SSL_set_{accept/connect}_state
@@ -842,6 +910,7 @@ struct ssl_st
 
         struct ssl2_state_st *s2; /* SSLv2 variables */
         struct ssl3_state_st *s3; /* SSLv3 variables */
+        struct dtls1_state_st *d1; /* DTLSv1 variables */
 
         int read_ahead;         /* Read as many input bytes as possible
                                  * (for non-blocking reads) */
@@ -852,8 +921,12 @@ struct ssl_st
 
         int hit;                /* reusing a previous session */
 
+        X509_VERIFY_PARAM *param;
+
+#if 0
         int purpose;            /* Purpose setting */
         int trust;              /* Trust setting */
+#endif
 
         /* crypto */
         STACK_OF(SSL_CIPHER) *cipher_list;
@@ -898,7 +971,6 @@ struct ssl_st
         /* Used in SSL2 and SSL3 */
         int verify_mode;        /* 0 don't care about verify failure.
                                  * 1 fail if verify fails */
-        int verify_depth;
         int (*verify_callback)(int ok,X509_STORE_CTX *ctx); /* fail if callback returns 0 */
 
         void (*info_callback)(const SSL *ssl,int type,int val); /* optional informational callback */
@@ -929,6 +1001,37 @@ struct ssl_st
         int first_packet;
         int client_version;     /* what was passed, used for
                                  * SSLv3/TLS rollback check */
+#ifndef OPENSSL_NO_TLSEXT
+        /* TLS extension debug callback */
+        void (*tlsext_debug_cb)(SSL *s, int client_server, int type,
+                                        unsigned char *data, int len,
+                                        void *arg);
+        void *tlsext_debug_arg;
+        char *tlsext_hostname;
+        int servername_done;   /* no further mod of servername 
+                                  0 : call the servername extension callback.
+                                  1 : prepare 2, allow last ack just after in server callback.
+                                  2 : don't call servername callback, no ack in server hello
+                               */
+        /* certificate status request info */
+        /* Status type or -1 if no status type */
+        int tlsext_status_type;
+        /* Expect OCSP CertificateStatus message */
+        int tlsext_status_expected;
+        /* OCSP status request only */
+        STACK_OF(OCSP_RESPID) *tlsext_ocsp_ids;
+        X509_EXTENSIONS *tlsext_ocsp_exts;
+        /* OCSP response received or to be sent */
+        unsigned char *tlsext_ocsp_resp;
+        int tlsext_ocsp_resplen;
+
+        /* RFC4507 session ticket expected to be received or sent */
+        int tlsext_ticket_expected;
+        SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */
+#define session_ctx initial_ctx
+#else
+#define session_ctx ctx
+#endif
         };
 
 #ifdef __cplusplus
@@ -938,6 +1041,7 @@ struct ssl_st
 #include <openssl/ssl2.h>
 #include <openssl/ssl3.h>
 #include <openssl/tls1.h> /* This is mostly sslv3 with a few tweaks */
+#include <openssl/dtls1.h> /* Datagram TLS */
 #include <openssl/ssl23.h>
 
 #ifdef  __cplusplus
@@ -1035,21 +1139,16 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
 #define SSL_set_timeout(a,b)    SSL_SESSION_set_timeout((a),(b))
 
 #if 1 /*SSLEAY_MACROS*/
-#define d2i_SSL_SESSION_bio(bp,s_id) (SSL_SESSION *)ASN1_d2i_bio( \
-        (char *(*)())SSL_SESSION_new,(char *(*)())d2i_SSL_SESSION, \
-        (bp),(unsigned char **)(s_id))
-#define i2d_SSL_SESSION_bio(bp,s_id) ASN1_i2d_bio(i2d_SSL_SESSION, \
-        bp,(unsigned char *)s_id)
+#define d2i_SSL_SESSION_bio(bp,s_id) ASN1_d2i_bio_of(SSL_SESSION,SSL_SESSION_new,d2i_SSL_SESSION,bp,s_id)
+#define i2d_SSL_SESSION_bio(bp,s_id) ASN1_i2d_bio_of(SSL_SESSION,i2d_SSL_SESSION,bp,s_id)
 #define PEM_read_SSL_SESSION(fp,x,cb,u) (SSL_SESSION *)PEM_ASN1_read( \
         (char *(*)())d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,fp,(char **)x,cb,u)
-#define PEM_read_bio_SSL_SESSION(bp,x,cb,u) (SSL_SESSION *)PEM_ASN1_read_bio( \
-        (char *(*)())d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,bp,(char **)x,cb,u)
+#define PEM_read_bio_SSL_SESSION(bp,x,cb,u) PEM_ASN1_read_bio_of(SSL_SESSION,d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,bp,x,cb,u)
 #define PEM_write_SSL_SESSION(fp,x) \
         PEM_ASN1_write((int (*)())i2d_SSL_SESSION, \
                 PEM_STRING_SSL_SESSION,fp, (char *)x, NULL,NULL,0,NULL,NULL)
 #define PEM_write_bio_SSL_SESSION(bp,x) \
-        PEM_ASN1_write_bio((int (*)())i2d_SSL_SESSION, \
-                PEM_STRING_SSL_SESSION,bp, (char *)x, NULL,NULL,0,NULL,NULL)
+        PEM_ASN1_write_bio_of(SSL_SESSION,i2d_SSL_SESSION,PEM_STRING_SSL_SESSION,bp,x,NULL,NULL,0,NULL,NULL)
 #endif
 
 #define SSL_AD_REASON_OFFSET            1000
@@ -1078,6 +1177,10 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
 #define SSL_AD_INTERNAL_ERROR           TLS1_AD_INTERNAL_ERROR  /* fatal */
 #define SSL_AD_USER_CANCELLED           TLS1_AD_USER_CANCELLED
 #define SSL_AD_NO_RENEGOTIATION         TLS1_AD_NO_RENEGOTIATION
+#define SSL_AD_UNSUPPORTED_EXTENSION    TLS1_AD_UNSUPPORTED_EXTENSION
+#define SSL_AD_CERTIFICATE_UNOBTAINABLE TLS1_AD_CERTIFICATE_UNOBTAINABLE
+#define SSL_AD_UNRECOGNIZED_NAME        TLS1_AD_UNRECOGNIZED_NAME
+#define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE
 
 #define SSL_ERROR_NONE                  0
 #define SSL_ERROR_SSL                   1
@@ -1092,20 +1195,24 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
 #define SSL_CTRL_NEED_TMP_RSA                   1
 #define SSL_CTRL_SET_TMP_RSA                    2
 #define SSL_CTRL_SET_TMP_DH                     3
-#define SSL_CTRL_SET_TMP_RSA_CB                 4
-#define SSL_CTRL_SET_TMP_DH_CB                  5
-
-#define SSL_CTRL_GET_SESSION_REUSED             6
-#define SSL_CTRL_GET_CLIENT_CERT_REQUEST        7
-#define SSL_CTRL_GET_NUM_RENEGOTIATIONS         8
-#define SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS       9
-#define SSL_CTRL_GET_TOTAL_RENEGOTIATIONS       10
-#define SSL_CTRL_GET_FLAGS                      11
-#define SSL_CTRL_EXTRA_CHAIN_CERT               12
-
-#define SSL_CTRL_SET_MSG_CALLBACK               13
-#define SSL_CTRL_SET_MSG_CALLBACK_ARG           14
-
+#define SSL_CTRL_SET_TMP_ECDH                   4
+#define SSL_CTRL_SET_TMP_RSA_CB                 5
+#define SSL_CTRL_SET_TMP_DH_CB                  6
+#define SSL_CTRL_SET_TMP_ECDH_CB                7
+
+#define SSL_CTRL_GET_SESSION_REUSED             8
+#define SSL_CTRL_GET_CLIENT_CERT_REQUEST        9
+#define SSL_CTRL_GET_NUM_RENEGOTIATIONS         10
+#define SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS       11
+#define SSL_CTRL_GET_TOTAL_RENEGOTIATIONS       12
+#define SSL_CTRL_GET_FLAGS                      13
+#define SSL_CTRL_EXTRA_CHAIN_CERT               14
+
+#define SSL_CTRL_SET_MSG_CALLBACK               15
+#define SSL_CTRL_SET_MSG_CALLBACK_ARG           16
+
+/* only applies to datagram connections */
+#define SSL_CTRL_SET_MTU                17
 /* Stats */
 #define SSL_CTRL_SESS_NUMBER                    20
 #define SSL_CTRL_SESS_CONNECT                   21
@@ -1132,6 +1239,29 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
 #define SSL_CTRL_GET_MAX_CERT_LIST              50
 #define SSL_CTRL_SET_MAX_CERT_LIST              51
 
+/* see tls1.h for macros based on these */
+#ifndef OPENSSL_NO_TLSEXT
+#define SSL_CTRL_SET_TLSEXT_SERVERNAME_CB       53
+#define SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG      54
+#define SSL_CTRL_SET_TLSEXT_HOSTNAME            55
+#define SSL_CTRL_SET_TLSEXT_DEBUG_CB            56
+#define SSL_CTRL_SET_TLSEXT_DEBUG_ARG           57
+#define SSL_CTRL_GET_TLSEXT_TICKET_KEYS         58
+#define SSL_CTRL_SET_TLSEXT_TICKET_KEYS         59
+
+#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB       63
+#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG   64
+#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE     65
+#define SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS     66
+#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS     67
+#define SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS      68
+#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS      69
+#define SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP        70
+#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP        71
+
+#define SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB       72
+#endif
+
 #define SSL_session_reused(ssl) \
         SSL_ctrl((ssl),SSL_CTRL_GET_SESSION_REUSED,0,NULL)
 #define SSL_num_renegotiations(ssl) \
@@ -1147,6 +1277,8 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_RSA,0,(char *)rsa)
 #define SSL_CTX_set_tmp_dh(ctx,dh) \
         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH,0,(char *)dh)
+#define SSL_CTX_set_tmp_ecdh(ctx,ecdh) \
+        SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH,0,(char *)ecdh)
 
 #define SSL_need_tmp_RSA(ssl) \
         SSL_ctrl(ssl,SSL_CTRL_NEED_TMP_RSA,0,NULL)
@@ -1154,6 +1286,8 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
         SSL_ctrl(ssl,SSL_CTRL_SET_TMP_RSA,0,(char *)rsa)
 #define SSL_set_tmp_dh(ssl,dh) \
         SSL_ctrl(ssl,SSL_CTRL_SET_TMP_DH,0,(char *)dh)
+#define SSL_set_tmp_ecdh(ssl,ecdh) \
+        SSL_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH,0,(char *)ecdh)
 
 #define SSL_CTX_add_extra_chain_cert(ctx,x509) \
         SSL_CTX_ctrl(ctx,SSL_CTRL_EXTRA_CHAIN_CERT,0,(char *)x509)
@@ -1215,9 +1349,9 @@ int	SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa);
 #endif
 int     SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len);
 int     SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey);
-int     SSL_use_PrivateKey_ASN1(int pk,SSL *ssl, unsigned char *d, long len);
+int     SSL_use_PrivateKey_ASN1(int pk,SSL *ssl, const unsigned char *d, long len);
 int     SSL_use_certificate(SSL *ssl, X509 *x);
-int     SSL_use_certificate_ASN1(SSL *ssl, unsigned char *d, int len);
+int     SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len);
 
 #ifndef OPENSSL_NO_STDIO
 int     SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type);
@@ -1253,6 +1387,7 @@ void	SSL_copy_session_id(SSL *to,const SSL *from);
 SSL_SESSION *SSL_SESSION_new(void);
 unsigned long SSL_SESSION_hash(const SSL_SESSION *a);
 int     SSL_SESSION_cmp(const SSL_SESSION *a,const SSL_SESSION *b);
+const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s, unsigned int *len);
 #ifndef OPENSSL_NO_FP_API
 int     SSL_SESSION_print_fp(FILE *fp,const SSL_SESSION *ses);
 #endif
@@ -1268,7 +1403,7 @@ int	SSL_CTX_set_generate_session_id(SSL_CTX *, GEN_SESSION_CB);
 int     SSL_set_generate_session_id(SSL *, GEN_SESSION_CB);
 int     SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
                                         unsigned int id_len);
-SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a,const unsigned char * const *pp,
+SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a,const unsigned char **pp,
                              long length);
 
 #ifdef HEADER_X509_H
@@ -1287,12 +1422,12 @@ void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, int (*cb)(X509_STORE_CTX *,v
 #ifndef OPENSSL_NO_RSA
 int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa);
 #endif
-int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, unsigned char *d, long len);
+int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len);
 int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey);
 int SSL_CTX_use_PrivateKey_ASN1(int pk,SSL_CTX *ctx,
-        unsigned char *d, long len);
+        const unsigned char *d, long len);
 int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x);
-int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, unsigned char *d);
+int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d);
 
 void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb);
 void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u);
@@ -1319,9 +1454,9 @@ int 	SSL_read(SSL *ssl,void *buf,int num);
 int     SSL_peek(SSL *ssl,void *buf,int num);
 int     SSL_write(SSL *ssl,const void *buf,int num);
 long    SSL_ctrl(SSL *ssl,int cmd, long larg, void *parg);
-long    SSL_callback_ctrl(SSL *, int, void (*)());
+long    SSL_callback_ctrl(SSL *, int, void (*)(void));
 long    SSL_CTX_ctrl(SSL_CTX *ctx,int cmd, long larg, void *parg);
-long    SSL_CTX_callback_ctrl(SSL_CTX *, int, void (*)());
+long    SSL_CTX_callback_ctrl(SSL_CTX *, int, void (*)(void));
 
 int     SSL_get_error(const SSL *s,int ret_code);
 const char *SSL_get_version(const SSL *s);
@@ -1345,6 +1480,10 @@ SSL_METHOD *TLSv1_method(void);		/* TLSv1.0 */
 SSL_METHOD *TLSv1_server_method(void);  /* TLSv1.0 */
 SSL_METHOD *TLSv1_client_method(void);  /* TLSv1.0 */
 
+SSL_METHOD *DTLSv1_method(void);                /* DTLSv1.0 */
+SSL_METHOD *DTLSv1_server_method(void); /* DTLSv1.0 */
+SSL_METHOD *DTLSv1_client_method(void); /* DTLSv1.0 */
+
 STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s);
 
 int SSL_do_handshake(SSL *s);
@@ -1395,6 +1534,7 @@ int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
 SSL_SESSION *SSL_get_session(const SSL *ssl);
 SSL_SESSION *SSL_get1_session(SSL *ssl); /* obtain a reference count */
 SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl);
+SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx);
 void SSL_set_info_callback(SSL *ssl,
                            void (*cb)(const SSL *ssl,int type,int val));
 void (*SSL_get_info_callback(const SSL *ssl))(const SSL *ssl,int type,int val);
@@ -1462,11 +1602,27 @@ void SSL_set_tmp_dh_callback(SSL *ssl,
                                  DH *(*dh)(SSL *ssl,int is_export,
                                            int keylength));
 #endif
+#ifndef OPENSSL_NO_ECDH
+void SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx,
+                                 EC_KEY *(*ecdh)(SSL *ssl,int is_export,
+                                           int keylength));
+void SSL_set_tmp_ecdh_callback(SSL *ssl,
+                                 EC_KEY *(*ecdh)(SSL *ssl,int is_export,
+                                           int keylength));
+#endif
 
 #ifndef OPENSSL_NO_COMP
+const COMP_METHOD *SSL_get_current_compression(SSL *s);
+const COMP_METHOD *SSL_get_current_expansion(SSL *s);
+const char *SSL_COMP_get_name(const COMP_METHOD *comp);
+STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void);
 int SSL_COMP_add_compression_method(int id,COMP_METHOD *cm);
 #else
-int SSL_COMP_add_compression_method(int id,char *cm);
+const void *SSL_get_current_compression(SSL *s);
+const void *SSL_get_current_expansion(SSL *s);
+const char *SSL_COMP_get_name(const void *comp);
+void *SSL_COMP_get_compression_methods(void);
+int SSL_COMP_add_compression_method(int id,void *cm);
 #endif
 
 /* BEGIN ERROR CODES */
@@ -1479,11 +1635,36 @@ void ERR_load_SSL_strings(void);
 
 /* Function codes. */
 #define SSL_F_CLIENT_CERTIFICATE                         100
-#define SSL_F_CLIENT_FINISHED                            238
+#define SSL_F_CLIENT_FINISHED                            167
 #define SSL_F_CLIENT_HELLO                               101
 #define SSL_F_CLIENT_MASTER_KEY                          102
 #define SSL_F_D2I_SSL_SESSION                            103
+#define SSL_F_DO_DTLS1_WRITE                             245
 #define SSL_F_DO_SSL3_WRITE                              104
+#define SSL_F_DTLS1_ACCEPT                               246
+#define SSL_F_DTLS1_BUFFER_RECORD                        247
+#define SSL_F_DTLS1_CLIENT_HELLO                         248
+#define SSL_F_DTLS1_CONNECT                              249
+#define SSL_F_DTLS1_ENC                                  250
+#define SSL_F_DTLS1_GET_HELLO_VERIFY                     251
+#define SSL_F_DTLS1_GET_MESSAGE                          252
+#define SSL_F_DTLS1_GET_MESSAGE_FRAGMENT                 253
+#define SSL_F_DTLS1_GET_RECORD                           254
+#define SSL_F_DTLS1_OUTPUT_CERT_CHAIN                    255
+#define SSL_F_DTLS1_PREPROCESS_FRAGMENT                  277
+#define SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE           256
+#define SSL_F_DTLS1_PROCESS_RECORD                       257
+#define SSL_F_DTLS1_READ_BYTES                           258
+#define SSL_F_DTLS1_READ_FAILED                          259
+#define SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST             260
+#define SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE              261
+#define SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE             262
+#define SSL_F_DTLS1_SEND_CLIENT_VERIFY                   263
+#define SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST            264
+#define SSL_F_DTLS1_SEND_SERVER_CERTIFICATE              265
+#define SSL_F_DTLS1_SEND_SERVER_HELLO                    266
+#define SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE             267
+#define SSL_F_DTLS1_WRITE_APP_DATA_BYTES                 268
 #define SSL_F_GET_CLIENT_FINISHED                        105
 #define SSL_F_GET_CLIENT_HELLO                           106
 #define SSL_F_GET_CLIENT_MASTER_KEY                      107
@@ -1524,6 +1705,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL3_ENC                                   134
 #define SSL_F_SSL3_GENERATE_KEY_BLOCK                    238
 #define SSL_F_SSL3_GET_CERTIFICATE_REQUEST               135
+#define SSL_F_SSL3_GET_CERT_STATUS                       288
 #define SSL_F_SSL3_GET_CERT_VERIFY                       136
 #define SSL_F_SSL3_GET_CLIENT_CERTIFICATE                137
 #define SSL_F_SSL3_GET_CLIENT_HELLO                      138
@@ -1531,10 +1713,12 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL3_GET_FINISHED                          140
 #define SSL_F_SSL3_GET_KEY_EXCHANGE                      141
 #define SSL_F_SSL3_GET_MESSAGE                           142
+#define SSL_F_SSL3_GET_NEW_SESSION_TICKET                283
 #define SSL_F_SSL3_GET_RECORD                            143
 #define SSL_F_SSL3_GET_SERVER_CERTIFICATE                144
 #define SSL_F_SSL3_GET_SERVER_DONE                       145
 #define SSL_F_SSL3_GET_SERVER_HELLO                      146
+#define SSL_F_SSL3_NEW_SESSION_TICKET                    284
 #define SSL_F_SSL3_OUTPUT_CERT_CHAIN                     147
 #define SSL_F_SSL3_PEEK                                  235
 #define SSL_F_SSL3_READ_BYTES                            148
@@ -1550,8 +1734,10 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL3_SETUP_KEY_BLOCK                       157
 #define SSL_F_SSL3_WRITE_BYTES                           158
 #define SSL_F_SSL3_WRITE_PENDING                         159
+#define SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT                 272
 #define SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK         215
 #define SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK        216
+#define SSL_F_SSL_ADD_SERVERHELLO_TLSEXT                 273
 #define SSL_F_SSL_BAD_METHOD                             160
 #define SSL_F_SSL_BYTES_TO_CIPHER_LIST                   161
 #define SSL_F_SSL_CERT_DUP                               221
@@ -1559,6 +1745,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL_CERT_INSTANTIATE                       214
 #define SSL_F_SSL_CERT_NEW                               162
 #define SSL_F_SSL_CHECK_PRIVATE_KEY                      163
+#define SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT               274
 #define SSL_F_SSL_CIPHER_PROCESS_RULESTR                 230
 #define SSL_F_SSL_CIPHER_STRENGTH_SORT                   231
 #define SSL_F_SSL_CLEAR                                  164
@@ -1590,6 +1777,9 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL_INIT_WBIO_BUFFER                       184
 #define SSL_F_SSL_LOAD_CLIENT_CA_FILE                    185
 #define SSL_F_SSL_NEW                                    186
+#define SSL_F_SSL_PEEK                                   270
+#define SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT             275
+#define SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT             276
 #define SSL_F_SSL_READ                                   223
 #define SSL_F_SSL_RSA_PRIVATE_DECRYPT                    187
 #define SSL_F_SSL_RSA_PUBLIC_ENCRYPT                     188
@@ -1609,6 +1799,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL_SHUTDOWN                               224
 #define SSL_F_SSL_UNDEFINED_CONST_FUNCTION               243
 #define SSL_F_SSL_UNDEFINED_FUNCTION                     197
+#define SSL_F_SSL_UNDEFINED_VOID_FUNCTION                244
 #define SSL_F_SSL_USE_CERTIFICATE                        198
 #define SSL_F_SSL_USE_CERTIFICATE_ASN1                   199
 #define SSL_F_SSL_USE_CERTIFICATE_FILE                   200
@@ -1639,6 +1830,9 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_BAD_DH_P_LENGTH                            110
 #define SSL_R_BAD_DIGEST_LENGTH                          111
 #define SSL_R_BAD_DSA_SIGNATURE                          112
+#define SSL_R_BAD_ECC_CERT                               304
+#define SSL_R_BAD_ECDSA_SIGNATURE                        305
+#define SSL_R_BAD_ECPOINT                                306
 #define SSL_R_BAD_HELLO_REQUEST                          105
 #define SSL_R_BAD_LENGTH                                 271
 #define SSL_R_BAD_MAC_DECODE                             113
@@ -1668,17 +1862,22 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_CIPHER_CODE_WRONG_LENGTH                   137
 #define SSL_R_CIPHER_OR_HASH_UNAVAILABLE                 138
 #define SSL_R_CIPHER_TABLE_SRC_ERROR                     139
+#define SSL_R_CLIENTHELLO_TLSEXT                         157
 #define SSL_R_COMPRESSED_LENGTH_TOO_LONG                 140
 #define SSL_R_COMPRESSION_FAILURE                        141
+#define SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE    307
 #define SSL_R_COMPRESSION_LIBRARY_ERROR                  142
 #define SSL_R_CONNECTION_ID_IS_DIFFERENT                 143
 #define SSL_R_CONNECTION_TYPE_NOT_SET                    144
+#define SSL_R_COOKIE_MISMATCH                            308
 #define SSL_R_DATA_BETWEEN_CCS_AND_FINISHED              145
 #define SSL_R_DATA_LENGTH_TOO_LONG                       146
 #define SSL_R_DECRYPTION_FAILED                          147
 #define SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC        281
 #define SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG            148
 #define SSL_R_DIGEST_CHECK_FAILED                        149
+#define SSL_R_DUPLICATE_COMPRESSION_ID                   309
+#define SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER               310
 #define SSL_R_ENCRYPTED_LENGTH_TOO_LONG                  150
 #define SSL_R_ERROR_GENERATING_TMP_RSA_KEY               282
 #define SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST              151
@@ -1691,6 +1890,8 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_INVALID_CHALLENGE_LENGTH                   158
 #define SSL_R_INVALID_COMMAND                            280
 #define SSL_R_INVALID_PURPOSE                            278
+#define SSL_R_INVALID_STATUS_RESPONSE                    316
+#define SSL_R_INVALID_TICKET_KEYS_LENGTH                 275
 #define SSL_R_INVALID_TRUST                              279
 #define SSL_R_KEY_ARG_TOO_LONG                           284
 #define SSL_R_KRB5                                       285
@@ -1719,6 +1920,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_MISSING_RSA_ENCRYPTING_CERT                169
 #define SSL_R_MISSING_RSA_SIGNING_CERT                   170
 #define SSL_R_MISSING_TMP_DH_KEY                         171
+#define SSL_R_MISSING_TMP_ECDH_KEY                       311
 #define SSL_R_MISSING_TMP_RSA_KEY                        172
 #define SSL_R_MISSING_TMP_RSA_PKEY                       173
 #define SSL_R_MISSING_VERIFY_MESSAGE                     174
@@ -1747,6 +1949,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED            197
 #define SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE              297
 #define SSL_R_PACKET_LENGTH_TOO_LONG                     198
+#define SSL_R_PARSE_TLSEXT                               223
 #define SSL_R_PATH_TOO_LONG                              270
 #define SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE          199
 #define SSL_R_PEER_ERROR                                 200
@@ -1761,6 +1964,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_PUBLIC_KEY_IS_NOT_RSA                      209
 #define SSL_R_PUBLIC_KEY_NOT_RSA                         210
 #define SSL_R_READ_BIO_NOT_SET                           211
+#define SSL_R_READ_TIMEOUT_EXPIRED                       312
 #define SSL_R_READ_WRONG_PACKET_TYPE                     212
 #define SSL_R_RECORD_LENGTH_MISMATCH                     213
 #define SSL_R_RECORD_TOO_LARGE                           214
@@ -1769,11 +1973,14 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_REUSE_CERT_LENGTH_NOT_ZERO                 216
 #define SSL_R_REUSE_CERT_TYPE_NOT_ZERO                   217
 #define SSL_R_REUSE_CIPHER_LIST_NOT_ZERO                 218
+#define SSL_R_SERVERHELLO_TLSEXT                         224
 #define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED           277
 #define SSL_R_SHORT_READ                                 219
 #define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE      220
 #define SSL_R_SSL23_DOING_SESSION_ID_REUSE               221
 #define SSL_R_SSL2_CONNECTION_ID_TOO_LONG                299
+#define SSL_R_SSL3_EXT_INVALID_SERVERNAME                225
+#define SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE           226
 #define SSL_R_SSL3_SESSION_ID_TOO_LONG                   300
 #define SSL_R_SSL3_SESSION_ID_TOO_SHORT                  222
 #define SSL_R_SSLV3_ALERT_BAD_CERTIFICATE                1042
@@ -1808,12 +2015,15 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_TLSV1_ALERT_UNKNOWN_CA                     1048
 #define SSL_R_TLSV1_ALERT_USER_CANCELLED                 1090
 #define SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER       232
+#define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST             227
 #define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233
 #define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG    234
 #define SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER            235
 #define SSL_R_UNABLE_TO_DECODE_DH_CERTS                  236
+#define SSL_R_UNABLE_TO_DECODE_ECDH_CERTS                313
 #define SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY               237
 #define SSL_R_UNABLE_TO_FIND_DH_PARAMETERS               238
+#define SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS             314
 #define SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS       239
 #define SSL_R_UNABLE_TO_FIND_SSL_METHOD                  240
 #define SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES           241
@@ -1834,8 +2044,10 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_UNKNOWN_STATE                              255
 #define SSL_R_UNSUPPORTED_CIPHER                         256
 #define SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM          257
+#define SSL_R_UNSUPPORTED_ELLIPTIC_CURVE                 315
 #define SSL_R_UNSUPPORTED_PROTOCOL                       258
 #define SSL_R_UNSUPPORTED_SSL_VERSION                    259
+#define SSL_R_UNSUPPORTED_STATUS_TYPE                    329
 #define SSL_R_WRITE_BIO_NOT_SET                          260
 #define SSL_R_WRONG_CIPHER_RETURNED                      261
 #define SSL_R_WRONG_MESSAGE_TYPE                         262
diff --git a/src/lib/libssl/src/ssl/ssl3.h b/src/lib/libssl/src/ssl/ssl3.h
index 1153aeda74..4b1e2e9834 100644
--- a/src/lib/libssl/src/ssl/ssl3.h
+++ b/src/lib/libssl/src/ssl/ssl3.h
@@ -108,6 +108,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #ifndef HEADER_SSL3_H 
 #define HEADER_SSL3_H 
@@ -118,6 +123,7 @@
 #include <openssl/buffer.h>
 #include <openssl/evp.h>
 #include <openssl/ssl.h>
+#include <openssl/pq_compat.h>
 
 #ifdef  __cplusplus
 extern "C" {
@@ -248,7 +254,11 @@ extern "C" {
 #endif
 
 #define SSL3_RT_MAX_PLAIN_LENGTH                16384
+#ifdef OPENSSL_NO_COMP
+#define SSL3_RT_MAX_COMPRESSED_LENGTH   SSL3_RT_MAX_PLAIN_LENGTH
+#else
 #define SSL3_RT_MAX_COMPRESSED_LENGTH   (1024+SSL3_RT_MAX_PLAIN_LENGTH)
+#endif
 #define SSL3_RT_MAX_ENCRYPTED_LENGTH    (1024+SSL3_RT_MAX_COMPRESSED_LENGTH)
 #define SSL3_RT_MAX_PACKET_SIZE         (SSL3_RT_MAX_ENCRYPTED_LENGTH+SSL3_RT_HEADER_LENGTH)
 #define SSL3_RT_MAX_DATA_SIZE                   (1024*1024)
@@ -289,6 +299,8 @@ typedef struct ssl3_record_st
 /*rw*/  unsigned char *data;    /* pointer to the record data */
 /*rw*/  unsigned char *input;   /* where the decode bytes are */
 /*r */  unsigned char *comp;    /* only used with decompression - malloc()ed */
+/*r */  unsigned long epoch;    /* epoch number, needed by DTLS1 */
+/*r */  PQ_64BIT seq_num;       /* sequence number, needed by DTLS1 */
         } SSL3_RECORD;
 
 typedef struct ssl3_buffer_st
@@ -307,7 +319,12 @@ typedef struct ssl3_buffer_st
 #define SSL3_CT_RSA_EPHEMERAL_DH                5
 #define SSL3_CT_DSS_EPHEMERAL_DH                6
 #define SSL3_CT_FORTEZZA_DMS                    20
-#define SSL3_CT_NUMBER                          7
+/* SSL3_CT_NUMBER is used to size arrays and it must be large
+ * enough to contain all of the cert types defined either for
+ * SSLv3 and TLSv1.
+ */
+#define SSL3_CT_NUMBER                  7
+
 
 #define SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS       0x0001
 #define SSL3_FLAGS_DELAY_CLIENT_FINISHED        0x0002
@@ -392,6 +409,11 @@ typedef struct ssl3_state_st
 #ifndef OPENSSL_NO_DH
                 DH *dh;
 #endif
+
+#ifndef OPENSSL_NO_ECDH
+                EC_KEY *ecdh; /* holds short lived ECDH key */
+#endif
+
                 /* used when SSL_ST_FLUSH_DATA is entered */
                 int next_state;                 
 
@@ -420,6 +442,7 @@ typedef struct ssl3_state_st
 
         } SSL3_STATE;
 
+
 /* SSLv3 */
 /*client */
 /* extra state */
@@ -430,6 +453,8 @@ typedef struct ssl3_state_st
 /* read from server */
 #define SSL3_ST_CR_SRVR_HELLO_A         (0x120|SSL_ST_CONNECT)
 #define SSL3_ST_CR_SRVR_HELLO_B         (0x121|SSL_ST_CONNECT)
+#define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A (0x126|SSL_ST_CONNECT)
+#define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B (0x127|SSL_ST_CONNECT)
 #define SSL3_ST_CR_CERT_A               (0x130|SSL_ST_CONNECT)
 #define SSL3_ST_CR_CERT_B               (0x131|SSL_ST_CONNECT)
 #define SSL3_ST_CR_KEY_EXCH_A           (0x140|SSL_ST_CONNECT)
@@ -456,6 +481,10 @@ typedef struct ssl3_state_st
 #define SSL3_ST_CR_CHANGE_B             (0x1C1|SSL_ST_CONNECT)
 #define SSL3_ST_CR_FINISHED_A           (0x1D0|SSL_ST_CONNECT)
 #define SSL3_ST_CR_FINISHED_B           (0x1D1|SSL_ST_CONNECT)
+#define SSL3_ST_CR_SESSION_TICKET_A     (0x1E0|SSL_ST_CONNECT)
+#define SSL3_ST_CR_SESSION_TICKET_B     (0x1E1|SSL_ST_CONNECT)
+#define SSL3_ST_CR_CERT_STATUS_A        (0x1F0|SSL_ST_CONNECT)
+#define SSL3_ST_CR_CERT_STATUS_B        (0x1F1|SSL_ST_CONNECT)
 
 /* server */
 /* extra state */
@@ -466,6 +495,8 @@ typedef struct ssl3_state_st
 #define SSL3_ST_SR_CLNT_HELLO_B         (0x111|SSL_ST_ACCEPT)
 #define SSL3_ST_SR_CLNT_HELLO_C         (0x112|SSL_ST_ACCEPT)
 /* write to client */
+#define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A (0x113|SSL_ST_ACCEPT)
+#define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B (0x114|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_HELLO_REQ_A          (0x120|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_HELLO_REQ_B          (0x121|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_HELLO_REQ_C          (0x122|SSL_ST_ACCEPT)
@@ -495,10 +526,15 @@ typedef struct ssl3_state_st
 #define SSL3_ST_SW_CHANGE_B             (0x1D1|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_FINISHED_A           (0x1E0|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_FINISHED_B           (0x1E1|SSL_ST_ACCEPT)
+#define SSL3_ST_SW_SESSION_TICKET_A     (0x1F0|SSL_ST_ACCEPT)
+#define SSL3_ST_SW_SESSION_TICKET_B     (0x1F1|SSL_ST_ACCEPT)
+#define SSL3_ST_SW_CERT_STATUS_A        (0x200|SSL_ST_ACCEPT)
+#define SSL3_ST_SW_CERT_STATUS_B        (0x201|SSL_ST_ACCEPT)
 
 #define SSL3_MT_HELLO_REQUEST                   0
 #define SSL3_MT_CLIENT_HELLO                    1
 #define SSL3_MT_SERVER_HELLO                    2
+#define SSL3_MT_NEWSESSION_TICKET               4
 #define SSL3_MT_CERTIFICATE                     11
 #define SSL3_MT_SERVER_KEY_EXCHANGE             12
 #define SSL3_MT_CERTIFICATE_REQUEST             13
@@ -506,6 +542,9 @@ typedef struct ssl3_state_st
 #define SSL3_MT_CERTIFICATE_VERIFY              15
 #define SSL3_MT_CLIENT_KEY_EXCHANGE             16
 #define SSL3_MT_FINISHED                        20
+#define SSL3_MT_CERTIFICATE_STATUS              22
+#define DTLS1_MT_HELLO_VERIFY_REQUEST    3
+
 
 #define SSL3_MT_CCS                             1
 
diff --git a/src/lib/libssl/src/ssl/ssl_algs.c b/src/lib/libssl/src/ssl/ssl_algs.c
index 3d1299ee7b..4717c0e6e1 100644
--- a/src/lib/libssl/src/ssl/ssl_algs.c
+++ b/src/lib/libssl/src/ssl/ssl_algs.c
@@ -82,6 +82,16 @@ int SSL_library_init(void)
         EVP_add_cipher(EVP_aes_192_cbc());
         EVP_add_cipher(EVP_aes_256_cbc());
 #endif
+
+#ifndef OPENSSL_NO_CAMELLIA
+        EVP_add_cipher(EVP_camellia_128_cbc());
+        EVP_add_cipher(EVP_camellia_256_cbc());
+#endif
+
+#ifndef OPENSSL_NO_SEED
+        EVP_add_cipher(EVP_seed_cbc());
+#endif
+
 #ifndef OPENSSL_NO_MD2
         EVP_add_digest(EVP_md2());
 #endif
@@ -101,11 +111,22 @@ int SSL_library_init(void)
         EVP_add_digest_alias(SN_dsaWithSHA1,"DSS1");
         EVP_add_digest_alias(SN_dsaWithSHA1,"dss1");
 #endif
+#ifndef OPENSSL_NO_ECDSA
+        EVP_add_digest(EVP_ecdsa());
+#endif
         /* If you want support for phased out ciphers, add the following */
 #if 0
         EVP_add_digest(EVP_sha());
         EVP_add_digest(EVP_dss());
 #endif
+#ifndef OPENSSL_NO_COMP
+        /* This will initialise the built-in compression algorithms.
+           The value returned is a STACK_OF(SSL_COMP), but that can
+           be discarded safely */
+        (void)SSL_COMP_get_compression_methods();
+#endif
+        /* initialize cipher/digest methods table */
+        ssl_load_ciphers();
         return(1);
         }
 
diff --git a/src/lib/libssl/src/ssl/ssl_asn1.c b/src/lib/libssl/src/ssl/ssl_asn1.c
index fc5fcce108..6e14f4d834 100644
--- a/src/lib/libssl/src/ssl/ssl_asn1.c
+++ b/src/lib/libssl/src/ssl/ssl_asn1.c
@@ -78,6 +78,11 @@ typedef struct ssl_session_asn1_st
         ASN1_INTEGER time;
         ASN1_INTEGER timeout;
         ASN1_INTEGER verify_result;
+#ifndef OPENSSL_NO_TLSEXT
+        ASN1_OCTET_STRING tlsext_hostname;
+        ASN1_INTEGER tlsext_tick_lifetime;
+        ASN1_OCTET_STRING tlsext_tick;
+#endif /* OPENSSL_NO_TLSEXT */
         } SSL_SESSION_ASN1;
 
 int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
@@ -86,6 +91,10 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
         int v1=0,v2=0,v3=0,v4=0,v5=0;
         unsigned char buf[4],ibuf1[LSIZE2],ibuf2[LSIZE2];
         unsigned char ibuf3[LSIZE2],ibuf4[LSIZE2],ibuf5[LSIZE2];
+#ifndef OPENSSL_NO_TLSEXT
+        int v6=0,v9=0,v10=0;
+        unsigned char ibuf6[LSIZE2];
+#endif
         long l;
         SSL_SESSION_ASN1 a;
         M_ASN1_I2D_vars(in);
@@ -178,7 +187,33 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
                 ASN1_INTEGER_set(&a.verify_result,in->verify_result);
                 }
 
-
+#ifndef OPENSSL_NO_TLSEXT
+        if (in->tlsext_hostname)
+                {
+                a.tlsext_hostname.length=strlen(in->tlsext_hostname);
+                a.tlsext_hostname.type=V_ASN1_OCTET_STRING;
+                a.tlsext_hostname.data=(unsigned char *)in->tlsext_hostname;
+                }
+        if (in->tlsext_tick)
+                {
+                a.tlsext_tick.length= in->tlsext_ticklen;
+                a.tlsext_tick.type=V_ASN1_OCTET_STRING;
+                a.tlsext_tick.data=(unsigned char *)in->tlsext_tick;
+                /* If we have a ticket set session ID to empty because
+                 * it will be bogus. If liftime hint is -1 treat as a special
+                 * case because the session is being used as a container
+                 */
+                if (in->tlsext_ticklen && (in->tlsext_tick_lifetime_hint != -1))
+                        a.session_id.length=0;
+                }
+        if (in->tlsext_tick_lifetime_hint > 0)
+                {
+                a.tlsext_tick_lifetime.length=LSIZE2;
+                a.tlsext_tick_lifetime.type=V_ASN1_INTEGER;
+                a.tlsext_tick_lifetime.data=ibuf6;
+                ASN1_INTEGER_set(&a.tlsext_tick_lifetime,in->tlsext_tick_lifetime_hint);
+                }
+#endif /* OPENSSL_NO_TLSEXT */
         M_ASN1_I2D_len(&(a.version),            i2d_ASN1_INTEGER);
         M_ASN1_I2D_len(&(a.ssl_version),        i2d_ASN1_INTEGER);
         M_ASN1_I2D_len(&(a.cipher),             i2d_ASN1_OCTET_STRING);
@@ -200,6 +235,14 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
         if (in->verify_result != X509_V_OK)
                 M_ASN1_I2D_len_EXP_opt(&(a.verify_result),i2d_ASN1_INTEGER,5,v5);
 
+#ifndef OPENSSL_NO_TLSEXT
+        if (in->tlsext_tick_lifetime_hint > 0)
+                M_ASN1_I2D_len_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER,9,v9);
+        if (in->tlsext_tick)
+                M_ASN1_I2D_len_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING,10,v10);
+        if (in->tlsext_hostname)
+                M_ASN1_I2D_len_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING,6,v6);
+#endif /* OPENSSL_NO_TLSEXT */
         M_ASN1_I2D_seq_total();
 
         M_ASN1_I2D_put(&(a.version),            i2d_ASN1_INTEGER);
@@ -223,10 +266,18 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
                                v4);
         if (in->verify_result != X509_V_OK)
                 M_ASN1_I2D_put_EXP_opt(&a.verify_result,i2d_ASN1_INTEGER,5,v5);
+#ifndef OPENSSL_NO_TLSEXT
+        if (in->tlsext_hostname)
+                M_ASN1_I2D_put_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING,6,v6);
+        if (in->tlsext_tick_lifetime_hint > 0)
+                M_ASN1_I2D_put_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER,9,v9);
+        if (in->tlsext_tick)
+                M_ASN1_I2D_put_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING,10,v10);
+#endif /* OPENSSL_NO_TLSEXT */
         M_ASN1_I2D_finish();
         }
 
-SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char * const *pp,
+SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
              long length)
         {
         int version,ssl_version=0,i;
@@ -242,18 +293,18 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char * const *pp,
         M_ASN1_D2I_start_sequence();
 
         ai.data=NULL; ai.length=0;
-        M_ASN1_D2I_get(aip,d2i_ASN1_INTEGER);
+        M_ASN1_D2I_get_x(ASN1_INTEGER,aip,d2i_ASN1_INTEGER);
         version=(int)ASN1_INTEGER_get(aip);
         if (ai.data != NULL) { OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; }
 
         /* we don't care about the version right now :-) */
-        M_ASN1_D2I_get(aip,d2i_ASN1_INTEGER);
+        M_ASN1_D2I_get_x(ASN1_INTEGER,aip,d2i_ASN1_INTEGER);
         ssl_version=(int)ASN1_INTEGER_get(aip);
         ret->ssl_version=ssl_version;
         if (ai.data != NULL) { OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; }
 
         os.data=NULL; os.length=0;
-        M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_x(ASN1_OCTET_STRING,osp,d2i_ASN1_OCTET_STRING);
         if (ssl_version == SSL2_VERSION)
                 {
                 if (os.length != 3)
@@ -286,22 +337,22 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char * const *pp,
         ret->cipher=NULL;
         ret->cipher_id=id;
 
-        M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_x(ASN1_OCTET_STRING,osp,d2i_ASN1_OCTET_STRING);
         if ((ssl_version>>8) == SSL3_VERSION_MAJOR)
                 i=SSL3_MAX_SSL_SESSION_ID_LENGTH;
-        else /* if (ssl_version == SSL2_VERSION_MAJOR) */
+        else /* if (ssl_version>>8 == SSL2_VERSION_MAJOR) */
                 i=SSL2_MAX_SSL_SESSION_ID_LENGTH;
 
         if (os.length > i)
                 os.length = i;
-        if (os.length > sizeof ret->session_id) /* can't happen */
-                os.length = sizeof ret->session_id;
+        if (os.length > (int)sizeof(ret->session_id)) /* can't happen */
+                os.length = sizeof(ret->session_id);
 
         ret->session_id_length=os.length;
-        OPENSSL_assert(os.length <= sizeof ret->session_id);
+        OPENSSL_assert(os.length <= (int)sizeof(ret->session_id));
         memcpy(ret->session_id,os.data,os.length);
 
-        M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_x(ASN1_OCTET_STRING,osp,d2i_ASN1_OCTET_STRING);
         if (ret->master_key_length > SSL_MAX_MASTER_KEY_LENGTH)
                 ret->master_key_length=SSL_MAX_MASTER_KEY_LENGTH;
         else
@@ -394,5 +445,56 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char * const *pp,
         else
                 ret->verify_result=X509_V_OK;
 
+#ifndef OPENSSL_NO_TLSEXT
+        os.length=0;
+        os.data=NULL;
+        M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,6);
+        if (os.data)
+                {
+                ret->tlsext_hostname = BUF_strndup((char *)os.data, os.length);
+                OPENSSL_free(os.data);
+                os.data = NULL;
+                os.length = 0;
+                }
+        else
+                ret->tlsext_hostname=NULL;
+        ai.length=0;
+        M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,9);
+        if (ai.data != NULL)
+                {
+                ret->tlsext_tick_lifetime_hint=ASN1_INTEGER_get(aip);
+                OPENSSL_free(ai.data); ai.data=NULL; ai.length=0;
+                }
+        else if (ret->tlsext_ticklen && ret->session_id_length)
+                ret->tlsext_tick_lifetime_hint = -1;
+        else
+                ret->tlsext_tick_lifetime_hint = 0;
+        os.length=0;
+        os.data=NULL;
+        M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,10);
+        if (os.data)
+                {
+                ret->tlsext_tick = os.data;
+                ret->tlsext_ticklen = os.length;
+                os.data = NULL;
+                os.length = 0;
+#if 0
+                /* There are two ways to detect a resumed ticket sesion.
+                 * One is to set a random session ID and then the server
+                 * must return a match in ServerHello. This allows the normal
+                 * client session ID matching to work.
+                 */ 
+                if (ret->session_id_length == 0)
+                        {
+                        ret->session_id_length=SSL3_MAX_SSL_SESSION_ID_LENGTH;
+                        RAND_pseudo_bytes(ret->session_id,
+                                                ret->session_id_length);
+                        }
+#endif
+                }
+        else
+                ret->tlsext_tick=NULL;
+#endif /* OPENSSL_NO_TLSEXT */
+
         M_ASN1_D2I_Finish(a,SSL_SESSION_free,SSL_F_D2I_SSL_SESSION);
         }
diff --git a/src/lib/libssl/src/ssl/ssl_cert.c b/src/lib/libssl/src/ssl/ssl_cert.c
index b779e6bb4d..a32b2d4446 100644
--- a/src/lib/libssl/src/ssl/ssl_cert.c
+++ b/src/lib/libssl/src/ssl/ssl_cert.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -73,12 +73,12 @@
  * 3. All advertising materials mentioning features or use of this
  *    software must display the following acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  *
  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  *    endorse or promote products derived from this software without
  *    prior written permission. For written permission, please contact
- *    openssl-core@OpenSSL.org.
+ *    openssl-core@openssl.org.
  *
  * 5. Products derived from this software may not be called "OpenSSL"
  *    nor may "OpenSSL" appear in their names without prior written
@@ -87,7 +87,7 @@
  * 6. Redistributions of any form whatsoever must retain the following
  *    acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  *
  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
@@ -102,6 +102,16 @@
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  * OF THE POSSIBILITY OF SUCH DAMAGE.
  * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
  */
 
 #include <stdio.h>
@@ -111,45 +121,42 @@
 # include <sys/types.h>
 #endif
 
-#if !defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_SYS_VMS) && !defined(NeXT) && !defined(MAC_OS_pre_X)
-#include <dirent.h>
-#endif
-
-#if defined(WIN32)
-#include <windows.h>
-#include <tchar.h>
-#endif
-
-#ifdef NeXT
-#include <sys/dir.h>
-#define dirent direct
-#endif
-
+#include "o_dir.h"
 #include <openssl/objects.h>
 #include <openssl/bio.h>
 #include <openssl/pem.h>
 #include <openssl/x509v3.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
 #include "ssl_locl.h"
-#include <openssl/fips.h>
 
 int SSL_get_ex_data_X509_STORE_CTX_idx(void)
         {
         static volatile int ssl_x509_store_ctx_idx= -1;
+        int got_write_lock = 0;
+
+        CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
 
         if (ssl_x509_store_ctx_idx < 0)
                 {
-                /* any write lock will do; usually this branch
-                 * will only be taken once anyway */
+                CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
                 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
+                got_write_lock = 1;
                 
                 if (ssl_x509_store_ctx_idx < 0)
                         {
                         ssl_x509_store_ctx_idx=X509_STORE_CTX_get_ex_new_index(
                                 0,"SSL for verify callback",NULL,NULL,NULL);
                         }
-                
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
                 }
+
+        if (got_write_lock)
+                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
+        else
+                CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
+        
         return ssl_x509_store_ctx_idx;
         }
 
@@ -205,7 +212,6 @@ CERT *ssl_cert_dup(CERT *cert)
 #ifndef OPENSSL_NO_DH
         if (cert->dh_tmp != NULL)
                 {
-                /* DH parameters don't have a reference count */
                 ret->dh_tmp = DHparams_dup(cert->dh_tmp);
                 if (ret->dh_tmp == NULL)
                         {
@@ -236,6 +242,19 @@ CERT *ssl_cert_dup(CERT *cert)
         ret->dh_tmp_cb = cert->dh_tmp_cb;
 #endif
 
+#ifndef OPENSSL_NO_ECDH
+        if (cert->ecdh_tmp)
+                {
+                ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp);
+                if (ret->ecdh_tmp == NULL)
+                        {
+                        SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                }
+        ret->ecdh_tmp_cb = cert->ecdh_tmp_cb;
+#endif
+
         for (i = 0; i < SSL_PKEY_NUM; i++)
                 {
                 if (cert->pkeys[i].x509 != NULL)
@@ -270,7 +289,11 @@ CERT *ssl_cert_dup(CERT *cert)
                         case SSL_PKEY_DH_DSA:
                                 /* We have a DH key. */
                                 break;
-                                
+
+                        case SSL_PKEY_ECC:
+                                /* We have an ECC key */
+                                break;
+
                         default:
                                 /* Can't happen. */
                                 SSLerr(SSL_F_SSL_CERT_DUP, SSL_R_LIBRARY_BUG);
@@ -285,7 +308,7 @@ CERT *ssl_cert_dup(CERT *cert)
 
         return(ret);
         
-#ifndef OPENSSL_NO_DH /* avoid 'unreferenced label' warning if OPENSSL_NO_DH is defined */
+#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ECDH)
 err:
 #endif
 #ifndef OPENSSL_NO_RSA
@@ -296,6 +319,10 @@ err:
         if (ret->dh_tmp != NULL)
                 DH_free(ret->dh_tmp);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        if (ret->ecdh_tmp != NULL)
+                EC_KEY_free(ret->ecdh_tmp);
+#endif
 
         for (i = 0; i < SSL_PKEY_NUM; i++)
                 {
@@ -335,6 +362,9 @@ void ssl_cert_free(CERT *c)
 #ifndef OPENSSL_NO_DH
         if (c->dh_tmp) DH_free(c->dh_tmp);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        if (c->ecdh_tmp) EC_KEY_free(c->ecdh_tmp);
+#endif
 
         for (i=0; i<SSL_PKEY_NUM; i++)
                 {
@@ -441,6 +471,10 @@ void ssl_sess_cert_free(SESS_CERT *sc)
         if (sc->peer_dh_tmp != NULL)
                 DH_free(sc->peer_dh_tmp);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        if (sc->peer_ecdh_tmp != NULL)
+                EC_KEY_free(sc->peer_ecdh_tmp);
+#endif
 
         OPENSSL_free(sc);
         }
@@ -466,20 +500,22 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
                 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,ERR_R_X509_LIB);
                 return(0);
                 }
+        if (s->param)
+                X509_VERIFY_PARAM_inherit(X509_STORE_CTX_get0_param(&ctx),
+                                                s->param);
+#if 0
         if (SSL_get_verify_depth(s) >= 0)
                 X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s));
+#endif
         X509_STORE_CTX_set_ex_data(&ctx,SSL_get_ex_data_X509_STORE_CTX_idx(),s);
 
-        /* We need to set the verify purpose. The purpose can be determined by
+        /* We need to inherit the verify parameters. These can be determined by
          * the context: if its a server it will verify SSL client certificates
          * or vice versa.
          */
-        if (s->server)
-                i = X509_PURPOSE_SSL_CLIENT;
-        else
-                i = X509_PURPOSE_SSL_SERVER;
 
-        X509_STORE_CTX_purpose_inherit(&ctx, i, s->purpose, s->trust);
+        X509_STORE_CTX_set_default(&ctx,
+                                s->server ? "ssl_client" : "ssl_server");
 
         if (s->verify_callback)
                 X509_STORE_CTX_set_verify_cb(&ctx, s->verify_callback);
@@ -726,7 +762,7 @@ err:
         if(x != NULL)
                 X509_free(x);
         
-        sk_X509_NAME_set_cmp_func(stack,oldcmp);
+        (void)sk_X509_NAME_set_cmp_func(stack,oldcmp);
 
         return ret;
         }
@@ -742,157 +778,52 @@ err:
  * certs may have been added to \c stack.
  */
 
-#ifndef OPENSSL_SYS_WIN32
-#ifndef OPENSSL_SYS_VMS         /* XXXX This may be fixed in the future */
-#ifndef OPENSSL_SYS_MACINTOSH_CLASSIC /* XXXXX: Better scheme needed! */
-
 int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
                                        const char *dir)
         {
-        DIR *d;
-        struct dirent *dstruct;
+        OPENSSL_DIR_CTX *d = NULL;
+        const char *filename;
         int ret = 0;
 
         CRYPTO_w_lock(CRYPTO_LOCK_READDIR);
-        d = opendir(dir);
 
         /* Note that a side effect is that the CAs will be sorted by name */
-        if(!d)
-                {
-                SYSerr(SYS_F_OPENDIR, get_last_sys_error());
-                ERR_add_error_data(3, "opendir('", dir, "')");
-                SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB);
-                goto err;
-                }
-        
-        while((dstruct=readdir(d)))
+
+        while((filename = OPENSSL_DIR_read(&d, dir)))
                 {
                 char buf[1024];
                 int r;
-                
-                if(strlen(dir)+strlen(dstruct->d_name)+2 > sizeof buf)
+
+                if(strlen(dir)+strlen(filename)+2 > sizeof buf)
                         {
                         SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG);
                         goto err;
                         }
-                
-                r = BIO_snprintf(buf,sizeof buf,"%s/%s",dir,dstruct->d_name);
-                if (r <= 0 || r >= sizeof buf)
+
+#ifdef OPENSSL_SYS_VMS
+                r = BIO_snprintf(buf,sizeof buf,"%s%s",dir,filename);
+#else
+                r = BIO_snprintf(buf,sizeof buf,"%s/%s",dir,filename);
+#endif
+                if (r <= 0 || r >= (int)sizeof(buf))
                         goto err;
                 if(!SSL_add_file_cert_subjects_to_stack(stack,buf))
                         goto err;
                 }
-        ret = 1;
-
-err:    
-        if (d) closedir(d);
-        CRYPTO_w_unlock(CRYPTO_LOCK_READDIR);
-        return ret;
-        }
-
-#endif
-#endif
-
-#else /* OPENSSL_SYS_WIN32 */
-
-#if defined(_WIN32_WCE)
-# ifndef UNICODE
-#  error "WinCE comes in UNICODE flavor only..."
-# endif
-# if _WIN32_WCE<101 && !defined(OPENSSL_NO_MULTIBYTE)
-#  define OPENSSL_NO_MULTIBYTE
-# endif
-# ifndef  FindFirstFile
-#  define FindFirstFile FindFirstFileW
-# endif
-# ifndef  FindNextFile
-#  define FindNextFile FindNextFileW
-# endif
-#endif
-
-int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
-                                       const char *dir)
-        {
-        WIN32_FIND_DATA FindFileData;
-        HANDLE hFind;
-        int    ret = 0;
-        TCHAR *wdir = NULL;
-        size_t i,len_0 = strlen(dir)+1; /* len_0 accounts for trailing 0 */
-        char   buf[1024],*slash;
-
-        if (len_0 > (sizeof(buf)-14))   /* 14 is just some value... */
-                {
-                SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG);
-                return ret;
-                }
-
-        CRYPTO_w_lock(CRYPTO_LOCK_READDIR);
-
-        if (sizeof(TCHAR) != sizeof(char))
-                {
-                wdir = (TCHAR *)malloc(len_0*sizeof(TCHAR));
-                if (wdir == NULL)
-                        goto err_noclose;
-#ifndef OPENSSL_NO_MULTIBYTE
-                if (!MultiByteToWideChar(CP_ACP,0,dir,len_0,
-                                        (WCHAR *)wdir,len_0))
-#endif
-                        for (i=0;i<len_0;i++) wdir[i]=(TCHAR)dir[i];
-
-                hFind = FindFirstFile(wdir, &FindFileData);
-                }
-        else    hFind = FindFirstFile((const TCHAR *)dir, &FindFileData);
 
-        /* Note that a side effect is that the CAs will be sorted by name */
-        if(hFind == INVALID_HANDLE_VALUE)
+        if (errno)
                 {
                 SYSerr(SYS_F_OPENDIR, get_last_sys_error());
-                ERR_add_error_data(3, "opendir('", dir, "')");
+                ERR_add_error_data(3, "OPENSSL_DIR_read(&ctx, '", dir, "')");
                 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB);
-                goto err_noclose;
+                goto err;
                 }
 
-        strncpy(buf,dir,sizeof(buf));   /* strcpy is safe too... */
-        buf[len_0-1]='/';               /* no trailing zero!     */
-        slash=buf+len_0;
-
-        do      {
-                const TCHAR *fnam=FindFileData.cFileName;
-                size_t flen_0=_tcslen(fnam)+1;
-
-                if (flen_0 > (sizeof(buf)-len_0))
-                        {
-                        SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG);
-                        goto err;
-                        }
-                /* else strcpy would be safe too... */
-
-                if (sizeof(TCHAR) != sizeof(char))
-                        {
-#ifndef OPENSSL_NO_MULTIBYTE
-                        if (!WideCharToMultiByte(CP_ACP,0,
-                                                (WCHAR *)fnam,flen_0,
-                                                slash,sizeof(buf)-len_0,
-                                                NULL,0))
-#endif
-                                for (i=0;i<flen_0;i++) slash[i]=(char)fnam[i];
-                        }
-                else    strncpy(slash,(const char *)fnam,sizeof(buf)-len_0);
-
-                if(!SSL_add_file_cert_subjects_to_stack(stack,buf))
-                        goto err;
-                }
-        while (FindNextFile(hFind, &FindFileData) != FALSE);
         ret = 1;
 
-err:    
-        FindClose(hFind);
-err_noclose:
-        if (wdir != NULL)
-                free(wdir);
-
+err:
+        if (d) OPENSSL_DIR_end(&d);
         CRYPTO_w_unlock(CRYPTO_LOCK_READDIR);
         return ret;
         }
 
-#endif
diff --git a/src/lib/libssl/src/ssl/ssl_ciph.c b/src/lib/libssl/src/ssl/ssl_ciph.c
index f622180c69..71b645da14 100644
--- a/src/lib/libssl/src/ssl/ssl_ciph.c
+++ b/src/lib/libssl/src/ssl/ssl_ciph.c
@@ -55,11 +55,67 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
-
+/* ====================================================================
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 #include <stdio.h>
 #include <openssl/objects.h>
 #include <openssl/comp.h>
-#include <openssl/fips.h>
 #include "ssl_locl.h"
 
 #define SSL_ENC_DES_IDX         0
@@ -71,12 +127,20 @@
 #define SSL_ENC_NULL_IDX        6
 #define SSL_ENC_AES128_IDX      7
 #define SSL_ENC_AES256_IDX      8
-#define SSL_ENC_NUM_IDX         9
+#define SSL_ENC_CAMELLIA128_IDX 9
+#define SSL_ENC_CAMELLIA256_IDX 10
+#define SSL_ENC_SEED_IDX        11
+#define SSL_ENC_NUM_IDX         12
+
 
 static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]={
         NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL
         };
 
+#define SSL_COMP_NULL_IDX       0
+#define SSL_COMP_ZLIB_IDX       1
+#define SSL_COMP_NUM_IDX        2
+
 static STACK_OF(SSL_COMP) *ssl_comp_methods=NULL;
 
 #define SSL_MD_MD5_IDX  0
@@ -102,18 +166,20 @@ typedef struct cipher_order_st
 
 static const SSL_CIPHER cipher_aliases[]={
         /* Don't include eNULL unless specifically enabled. */
-        {0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL}, /* must be first */
-        {0,SSL_TXT_CMPALL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0},  /* COMPLEMENT OF ALL */
+        /* Don't include ECC in ALL because these ciphers are not yet official. */
+        {0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL & ~SSL_kECDH & ~SSL_kECDHE, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL}, /* must be first */
+        /* TODO: COMPLEMENT OF ALL and COMPLEMENT OF DEFAULT do not have ECC cipher suites handled properly. */
+        {0,SSL_TXT_CMPALL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0},  /* COMPLEMENT OF ALL */
         {0,SSL_TXT_CMPDEF,0,SSL_ADH, 0,0,0,0,SSL_AUTH_MASK,0},
-        {0,SSL_TXT_kKRB5,0,SSL_kKRB5,0,0,0,0,SSL_MKEY_MASK,0},  /* VRS Kerberos5 */
+        {0,SSL_TXT_kKRB5,0,SSL_kKRB5,0,0,0,0,SSL_MKEY_MASK,0},  /* VRS Kerberos5 */
         {0,SSL_TXT_kRSA,0,SSL_kRSA,  0,0,0,0,SSL_MKEY_MASK,0},
         {0,SSL_TXT_kDHr,0,SSL_kDHr,  0,0,0,0,SSL_MKEY_MASK,0},
         {0,SSL_TXT_kDHd,0,SSL_kDHd,  0,0,0,0,SSL_MKEY_MASK,0},
         {0,SSL_TXT_kEDH,0,SSL_kEDH,  0,0,0,0,SSL_MKEY_MASK,0},
         {0,SSL_TXT_kFZA,0,SSL_kFZA,  0,0,0,0,SSL_MKEY_MASK,0},
         {0,SSL_TXT_DH,  0,SSL_DH,    0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_ECC, 0,(SSL_kECDH|SSL_kECDHE), 0,0,0,0,SSL_MKEY_MASK,0},
         {0,SSL_TXT_EDH, 0,SSL_EDH,   0,0,0,0,SSL_MKEY_MASK|SSL_AUTH_MASK,0},
-
         {0,SSL_TXT_aKRB5,0,SSL_aKRB5,0,0,0,0,SSL_AUTH_MASK,0},  /* VRS Kerberos5 */
         {0,SSL_TXT_aRSA,0,SSL_aRSA,  0,0,0,0,SSL_AUTH_MASK,0},
         {0,SSL_TXT_aDSS,0,SSL_aDSS,  0,0,0,0,SSL_AUTH_MASK,0},
@@ -129,9 +195,11 @@ static const SSL_CIPHER cipher_aliases[]={
 #ifndef OPENSSL_NO_IDEA
         {0,SSL_TXT_IDEA,0,SSL_IDEA,  0,0,0,0,SSL_ENC_MASK,0},
 #endif
+        {0,SSL_TXT_SEED,0,SSL_SEED,  0,0,0,0,SSL_ENC_MASK,0},
         {0,SSL_TXT_eNULL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0},
         {0,SSL_TXT_eFZA,0,SSL_eFZA,  0,0,0,0,SSL_ENC_MASK,0},
         {0,SSL_TXT_AES, 0,SSL_AES,   0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_CAMELLIA,0,SSL_CAMELLIA, 0,0,0,0,SSL_ENC_MASK,0},
 
         {0,SSL_TXT_MD5, 0,SSL_MD5,   0,0,0,0,SSL_MAC_MASK,0},
         {0,SSL_TXT_SHA1,0,SSL_SHA1,  0,0,0,0,SSL_MAC_MASK,0},
@@ -154,12 +222,9 @@ static const SSL_CIPHER cipher_aliases[]={
         {0,SSL_TXT_LOW,   0, 0,   SSL_LOW, 0,0,0,0,SSL_STRONG_MASK},
         {0,SSL_TXT_MEDIUM,0, 0,SSL_MEDIUM, 0,0,0,0,SSL_STRONG_MASK},
         {0,SSL_TXT_HIGH,  0, 0,  SSL_HIGH, 0,0,0,0,SSL_STRONG_MASK},
-        {0,SSL_TXT_FIPS,  0, 0,  SSL_FIPS, 0,0,0,0,SSL_FIPS|SSL_STRONG_NONE},
         };
 
-static int init_ciphers=1;
-
-static void load_ciphers(void)
+void ssl_load_ciphers(void)
         {
         ssl_cipher_methods[SSL_ENC_DES_IDX]= 
                 EVP_get_cipherbyname(SN_des_cbc);
@@ -179,14 +244,73 @@ static void load_ciphers(void)
           EVP_get_cipherbyname(SN_aes_128_cbc);
         ssl_cipher_methods[SSL_ENC_AES256_IDX]=
           EVP_get_cipherbyname(SN_aes_256_cbc);
+        ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX]=
+          EVP_get_cipherbyname(SN_camellia_128_cbc);
+        ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX]=
+          EVP_get_cipherbyname(SN_camellia_256_cbc);
+        ssl_cipher_methods[SSL_ENC_SEED_IDX]=
+          EVP_get_cipherbyname(SN_seed_cbc);
 
         ssl_digest_methods[SSL_MD_MD5_IDX]=
                 EVP_get_digestbyname(SN_md5);
         ssl_digest_methods[SSL_MD_SHA1_IDX]=
                 EVP_get_digestbyname(SN_sha1);
-        init_ciphers=0;
         }
 
+
+#ifndef OPENSSL_NO_COMP
+
+static int sk_comp_cmp(const SSL_COMP * const *a,
+                        const SSL_COMP * const *b)
+        {
+        return((*a)->id-(*b)->id);
+        }
+
+static void load_builtin_compressions(void)
+        {
+        int got_write_lock = 0;
+
+        CRYPTO_r_lock(CRYPTO_LOCK_SSL);
+        if (ssl_comp_methods == NULL)
+                {
+                CRYPTO_r_unlock(CRYPTO_LOCK_SSL);
+                CRYPTO_w_lock(CRYPTO_LOCK_SSL);
+                got_write_lock = 1;
+                
+                if (ssl_comp_methods == NULL)
+                        {
+                        SSL_COMP *comp = NULL;
+
+                        MemCheck_off();
+                        ssl_comp_methods=sk_SSL_COMP_new(sk_comp_cmp);
+                        if (ssl_comp_methods != NULL)
+                                {
+                                comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
+                                if (comp != NULL)
+                                        {
+                                        comp->method=COMP_zlib();
+                                        if (comp->method
+                                                && comp->method->type == NID_undef)
+                                                OPENSSL_free(comp);
+                                        else
+                                                {
+                                                comp->id=SSL_COMP_ZLIB_IDX;
+                                                comp->name=comp->method->name;
+                                                sk_SSL_COMP_push(ssl_comp_methods,comp);
+                                                }
+                                        }
+                                }
+                        MemCheck_on();
+                        }
+                }
+        
+        if (got_write_lock)
+                CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
+        else
+                CRYPTO_r_unlock(CRYPTO_LOCK_SSL);
+        }
+#endif
+
 int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
              const EVP_MD **md, SSL_COMP **comp)
         {
@@ -198,18 +322,14 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
         if (comp != NULL)
                 {
                 SSL_COMP ctmp;
+#ifndef OPENSSL_NO_COMP
+                load_builtin_compressions();
+#endif
 
-                if (s->compress_meth == 0)
-                        *comp=NULL;
-                else if (ssl_comp_methods == NULL)
+                *comp=NULL;
+                ctmp.id=s->compress_meth;
+                if (ssl_comp_methods != NULL)
                         {
-                        /* bad */
-                        *comp=NULL;
-                        }
-                else
-                        {
-
-                        ctmp.id=s->compress_meth;
                         i=sk_SSL_COMP_find(ssl_comp_methods,&ctmp);
                         if (i >= 0)
                                 *comp=sk_SSL_COMP_value(ssl_comp_methods,i);
@@ -248,6 +368,18 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
                 default: i=-1; break;
                         }
                 break;
+        case SSL_CAMELLIA:
+                switch(c->alg_bits)
+                        {
+                case 128: i=SSL_ENC_CAMELLIA128_IDX; break;
+                case 256: i=SSL_ENC_CAMELLIA256_IDX; break;
+                default: i=-1; break;
+                        }
+                break;
+        case SSL_SEED:
+                i=SSL_ENC_SEED_IDX;
+                break;
+
         default:
                 i= -1;
                 break;
@@ -305,9 +437,18 @@ static void ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr,
         *tail=curr;
         }
 
-static unsigned long ssl_cipher_get_disabled(void)
+struct disabled_masks { /* This is a kludge no longer needed with OpenSSL 0.9.9,
+                         * where 128-bit and 256-bit algorithms simply will get
+                         * separate bits. */
+  unsigned long mask; /* everything except m256 */
+  unsigned long m256; /* applies to 256-bit algorithms only */
+};
+
+static struct disabled_masks ssl_cipher_get_disabled(void)
         {
         unsigned long mask;
+        unsigned long m256;
+        struct disabled_masks ret;
 
         mask = SSL_kFZA;
 #ifdef OPENSSL_NO_RSA
@@ -322,7 +463,9 @@ static unsigned long ssl_cipher_get_disabled(void)
 #ifdef OPENSSL_NO_KRB5
         mask |= SSL_kKRB5|SSL_aKRB5;
 #endif
-
+#ifdef OPENSSL_NO_ECDH
+        mask |= SSL_kECDH|SSL_kECDHE;
+#endif
 #ifdef SSL_FORBID_ENULL
         mask |= SSL_eNULL;
 #endif
@@ -333,17 +476,27 @@ static unsigned long ssl_cipher_get_disabled(void)
         mask |= (ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL) ? SSL_RC2 :0;
         mask |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA:0;
         mask |= (ssl_cipher_methods[SSL_ENC_eFZA_IDX] == NULL) ? SSL_eFZA:0;
-        mask |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES:0;
+        mask |= (ssl_cipher_methods[SSL_ENC_SEED_IDX] == NULL) ? SSL_SEED:0;
 
         mask |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 :0;
         mask |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1:0;
 
-        return(mask);
+        /* finally consider algorithms where mask and m256 differ */
+        m256 = mask;
+        mask |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES:0;
+        mask |= (ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX] == NULL) ? SSL_CAMELLIA:0;
+        m256 |= (ssl_cipher_methods[SSL_ENC_AES256_IDX] == NULL) ? SSL_AES:0;
+        m256 |= (ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX] == NULL) ? SSL_CAMELLIA:0;
+
+        ret.mask = mask;
+        ret.m256 = m256;
+        return ret;
         }
 
 static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
-                int num_of_ciphers, unsigned long mask, CIPHER_ORDER *co_list,
-                CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
+                int num_of_ciphers, unsigned long mask, unsigned long m256,
+                CIPHER_ORDER *co_list, CIPHER_ORDER **head_p,
+                CIPHER_ORDER **tail_p)
         {
         int i, co_list_num;
         SSL_CIPHER *c;
@@ -360,13 +513,9 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
         for (i = 0; i < num_of_ciphers; i++)
                 {
                 c = ssl_method->get_cipher(i);
+#define IS_MASKED(c) ((c)->algorithms & (((c)->alg_bits == 256) ? m256 : mask))
                 /* drop those that use any of that is not available */
-#ifdef OPENSSL_FIPS
-                if ((c != NULL) && c->valid && !(c->algorithms & mask)
-                        && (!FIPS_mode() || (c->algo_strength & SSL_FIPS)))
-#else
-                if ((c != NULL) && c->valid && !(c->algorithms & mask))
-#endif
+                if ((c != NULL) && c->valid && !IS_MASKED(c))
                         {
                         co_list[co_list_num].cipher = c;
                         co_list[co_list_num].next = NULL;
@@ -440,7 +589,8 @@ static void ssl_cipher_collect_aliases(SSL_CIPHER **ca_list,
         *ca_curr = NULL;        /* end of list */
         }
 
-static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
+static void ssl_cipher_apply_rule(unsigned long cipher_id, unsigned long ssl_version,
+                unsigned long algorithms, unsigned long mask,
                 unsigned long algo_strength, unsigned long mask_strength,
                 int rule, int strength_bits, CIPHER_ORDER *co_list,
                 CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
@@ -466,11 +616,20 @@ static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
 
                 cp = curr->cipher;
 
+                /* If explicit cipher suite, match only that one for its own protocol version.
+                 * Usual selection criteria will be used for similar ciphersuites from other version! */
+
+                if (cipher_id && (cp->algorithms & SSL_SSL_MASK) == ssl_version)
+                        {
+                        if (cp->id != cipher_id)
+                                continue;
+                        }
+
                 /*
                  * Selection criteria is either the number of strength_bits
                  * or the algorithm used.
                  */
-                if (strength_bits == -1)
+                else if (strength_bits == -1)
                         {
                         ma = mask & cp->algorithms;
                         ma_s = mask_strength & cp->algo_strength;
@@ -501,8 +660,22 @@ static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
                         {
                         if (!curr->active)
                                 {
-                                ll_append_tail(&head, curr, &tail);
-                                curr->active = 1;
+                                int add_this_cipher = 1;
+
+                                if (((cp->algorithms & (SSL_kECDHE|SSL_kECDH|SSL_aECDSA)) != 0))
+                                        {
+                                        /* Make sure "ECCdraft" ciphersuites are activated only if
+                                         * *explicitly* requested, but not implicitly (such as
+                                         * as part of the "AES" alias). */
+
+                                        add_this_cipher = (mask & (SSL_kECDHE|SSL_kECDH|SSL_aECDSA)) != 0 || cipher_id != 0;
+                                        }
+                                
+                                if (add_this_cipher)
+                                        {
+                                        ll_append_tail(&head, curr, &tail);
+                                        curr->active = 1;
+                                        }
                                 }
                         }
                 /* Move the added cipher to this location */
@@ -583,7 +756,7 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER *co_list,
          */
         for (i = max_strength_bits; i >= 0; i--)
                 if (number_uses[i] > 0)
-                        ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i,
+                        ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, CIPHER_ORD, i,
                                         co_list, head_p, tail_p);
 
         OPENSSL_free(number_uses);
@@ -597,6 +770,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
         unsigned long algorithms, mask, algo_strength, mask_strength;
         const char *l, *start, *buf;
         int j, multi, found, rule, retval, ok, buflen;
+        unsigned long cipher_id = 0, ssl_version = 0;
         char ch;
 
         retval = 1;
@@ -686,6 +860,8 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                          * use strcmp(), because buf is not '\0' terminated.)
                          */
                          j = found = 0;
+                         cipher_id = 0;
+                         ssl_version = 0;
                          while (ca_list[j])
                                 {
                                 if (!strncmp(buf, ca_list[j]->name, buflen) &&
@@ -714,6 +890,14 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                                         (algo_strength & ca_list[j]->algo_strength);
                         mask_strength |= ca_list[j]->mask_strength;
 
+                        /* explicit ciphersuite found */
+                        if (ca_list[j]->valid)
+                                {
+                                cipher_id = ca_list[j]->id;
+                                ssl_version = ca_list[j]->algorithms & SSL_SSL_MASK;
+                                break;
+                                }
+
                         if (!multi) break;
                         }
 
@@ -738,18 +922,18 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                          * rest of the command, if any left, until
                          * end or ':' is found.
                          */
-                        while ((*l != '\0') && ITEM_SEP(*l))
+                        while ((*l != '\0') && !ITEM_SEP(*l))
                                 l++;
                         }
                 else if (found)
                         {
-                        ssl_cipher_apply_rule(algorithms, mask,
+                        ssl_cipher_apply_rule(cipher_id, ssl_version, algorithms, mask,
                                 algo_strength, mask_strength, rule, -1,
                                 co_list, head_p, tail_p);
                         }
                 else
                         {
-                        while ((*l != '\0') && ITEM_SEP(*l))
+                        while ((*l != '\0') && !ITEM_SEP(*l))
                                 l++;
                         }
                 if (*l == '\0') break; /* done */
@@ -765,6 +949,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         {
         int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
         unsigned long disabled_mask;
+        unsigned long disabled_m256;
         STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;
         const char *rule_p;
         CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
@@ -776,18 +961,16 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         if (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)
                 return NULL;
 
-        if (init_ciphers)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL);
-                if (init_ciphers) load_ciphers();
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
-                }
-
         /*
          * To reduce the work to do we only want to process the compiled
          * in algorithms, so we first get the mask of disabled ciphers.
          */
-        disabled_mask = ssl_cipher_get_disabled();
+        {
+                struct disabled_masks d;
+                d = ssl_cipher_get_disabled();
+                disabled_mask = d.mask;
+                disabled_m256 = d.m256;
+        }
 
         /*
          * Now we have to collect the available ciphers from the compiled
@@ -806,7 +989,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
                 }
 
         ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, disabled_mask,
-                                   co_list, &head, &tail);
+                                   disabled_m256, co_list, &head, &tail);
 
         /*
          * We also need cipher aliases for selecting based on the rule_str.
@@ -826,8 +1009,8 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
                 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
                 return(NULL);   /* Failure */
                 }
-        ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, disabled_mask,
-                                   head);
+        ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
+                                   (disabled_mask & disabled_m256), head);
 
         /*
          * If the rule_string begins with DEFAULT, apply the default rule
@@ -871,11 +1054,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
          */
         for (curr = head; curr != NULL; curr = curr->next)
                 {
-#ifdef OPENSSL_FIPS
-                if (curr->active && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS))
-#else
                 if (curr->active)
-#endif
                         {
                         sk_SSL_CIPHER_push(cipherstack, curr->cipher);
 #ifdef CIPHER_DEBUG
@@ -897,7 +1076,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         if (*cipher_list_by_id != NULL)
                 sk_SSL_CIPHER_free(*cipher_list_by_id);
         *cipher_list_by_id = tmp_cipher_list;
-        sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);
+        (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);
 
         return(cipherstack);
         }
@@ -905,13 +1084,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
 char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
         {
         int is_export,pkl,kl;
-        char *ver,*exp_str;
-        char *kx,*au,*enc,*mac;
+        const char *ver,*exp_str;
+        const char *kx,*au,*enc,*mac;
         unsigned long alg,alg2,alg_s;
 #ifdef KSSL_DEBUG
-        static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx\n";
+        static const char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx\n";
 #else
-        static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
+        static const char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
 #endif /* KSSL_DEBUG */
 
         alg=cipher->algorithms;
@@ -922,7 +1101,7 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
         pkl=SSL_C_EXPORT_PKEYLENGTH(cipher);
         kl=SSL_C_EXPORT_KEYLENGTH(cipher);
         exp_str=is_export?" export":"";
-
+        
         if (alg & SSL_SSLV2)
                 ver="SSLv2";
         else if (alg & SSL_SSLV3)
@@ -951,6 +1130,10 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
         case SSL_kEDH:
                 kx=is_export?(pkl == 512 ? "DH(512)" : "DH(1024)"):"DH";
                 break;
+        case SSL_kECDH:
+        case SSL_kECDHE:
+                kx=is_export?"ECDH(<=163)":"ECDH";
+                break;
         default:
                 kx="unknown";
                 }
@@ -974,6 +1157,9 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
         case SSL_aNULL:
                 au="None";
                 break;
+        case SSL_aECDSA:
+                au="ECDSA";
+                break;
         default:
                 au="unknown";
                 break;
@@ -1012,6 +1198,18 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
                 default: enc="AES(?""?""?)"; break;
                         }
                 break;
+        case SSL_CAMELLIA:
+                switch(cipher->strength_bits)
+                        {
+                case 128: enc="Camellia(128)"; break;
+                case 256: enc="Camellia(256)"; break;
+                default: enc="Camellia(?""?""?)"; break;
+                        }
+                break;
+        case SSL_SEED:
+                enc="SEED(128)";
+                break;
+
         default:
                 enc="unknown";
                 break;
@@ -1098,35 +1296,63 @@ SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n)
         return(NULL);
         }
 
-static int sk_comp_cmp(const SSL_COMP * const *a,
-                        const SSL_COMP * const *b)
+#ifdef OPENSSL_NO_COMP
+void *SSL_COMP_get_compression_methods(void)
         {
-        return((*a)->id-(*b)->id);
+        return NULL;
+        }
+int SSL_COMP_add_compression_method(int id, void *cm)
+        {
+        return 1;
         }
 
+const char *SSL_COMP_get_name(const void *comp)
+        {
+        return NULL;
+        }
+#else
 STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void)
         {
+        load_builtin_compressions();
         return(ssl_comp_methods);
         }
 
 int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
         {
         SSL_COMP *comp;
-        STACK_OF(SSL_COMP) *sk;
 
         if (cm == NULL || cm->type == NID_undef)
                 return 1;
 
+        /* According to draft-ietf-tls-compression-04.txt, the
+           compression number ranges should be the following:
+
+           0 to 63:    methods defined by the IETF
+           64 to 192:  external party methods assigned by IANA
+           193 to 255: reserved for private use */
+        if (id < 193 || id > 255)
+                {
+                SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE);
+                return 0;
+                }
+
         MemCheck_off();
         comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
         comp->id=id;
         comp->method=cm;
-        if (ssl_comp_methods == NULL)
-                sk=ssl_comp_methods=sk_SSL_COMP_new(sk_comp_cmp);
-        else
-                sk=ssl_comp_methods;
-        if ((sk == NULL) || !sk_SSL_COMP_push(sk,comp))
+        load_builtin_compressions();
+        if (ssl_comp_methods
+                && !sk_SSL_COMP_find(ssl_comp_methods,comp))
                 {
+                OPENSSL_free(comp);
+                MemCheck_on();
+                SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_DUPLICATE_COMPRESSION_ID);
+                return(1);
+                }
+        else if ((ssl_comp_methods == NULL)
+                || !sk_SSL_COMP_push(ssl_comp_methods,comp))
+                {
+                OPENSSL_free(comp);
                 MemCheck_on();
                 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE);
                 return(1);
@@ -1137,3 +1363,12 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
                 return(0);
                 }
         }
+
+const char *SSL_COMP_get_name(const COMP_METHOD *comp)
+        {
+        if (comp)
+                return comp->name;
+        return NULL;
+        }
+
+#endif
diff --git a/src/lib/libssl/src/ssl/ssl_err.c b/src/lib/libssl/src/ssl/ssl_err.c
index 4bcf591298..50779c1632 100644
--- a/src/lib/libssl/src/ssl/ssl_err.c
+++ b/src/lib/libssl/src/ssl/ssl_err.c
@@ -1,6 +1,6 @@
 /* ssl/ssl_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -75,7 +75,32 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_CLIENT_HELLO),  "CLIENT_HELLO"},
 {ERR_FUNC(SSL_F_CLIENT_MASTER_KEY),     "CLIENT_MASTER_KEY"},
 {ERR_FUNC(SSL_F_D2I_SSL_SESSION),       "d2i_SSL_SESSION"},
+{ERR_FUNC(SSL_F_DO_DTLS1_WRITE),        "DO_DTLS1_WRITE"},
 {ERR_FUNC(SSL_F_DO_SSL3_WRITE), "DO_SSL3_WRITE"},
+{ERR_FUNC(SSL_F_DTLS1_ACCEPT),  "DTLS1_ACCEPT"},
+{ERR_FUNC(SSL_F_DTLS1_BUFFER_RECORD),   "DTLS1_BUFFER_RECORD"},
+{ERR_FUNC(SSL_F_DTLS1_CLIENT_HELLO),    "DTLS1_CLIENT_HELLO"},
+{ERR_FUNC(SSL_F_DTLS1_CONNECT), "DTLS1_CONNECT"},
+{ERR_FUNC(SSL_F_DTLS1_ENC),     "DTLS1_ENC"},
+{ERR_FUNC(SSL_F_DTLS1_GET_HELLO_VERIFY),        "DTLS1_GET_HELLO_VERIFY"},
+{ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE),     "DTLS1_GET_MESSAGE"},
+{ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT),    "DTLS1_GET_MESSAGE_FRAGMENT"},
+{ERR_FUNC(SSL_F_DTLS1_GET_RECORD),      "DTLS1_GET_RECORD"},
+{ERR_FUNC(SSL_F_DTLS1_OUTPUT_CERT_CHAIN),       "DTLS1_OUTPUT_CERT_CHAIN"},
+{ERR_FUNC(SSL_F_DTLS1_PREPROCESS_FRAGMENT),     "DTLS1_PREPROCESS_FRAGMENT"},
+{ERR_FUNC(SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE),      "DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE"},
+{ERR_FUNC(SSL_F_DTLS1_PROCESS_RECORD),  "DTLS1_PROCESS_RECORD"},
+{ERR_FUNC(SSL_F_DTLS1_READ_BYTES),      "DTLS1_READ_BYTES"},
+{ERR_FUNC(SSL_F_DTLS1_READ_FAILED),     "DTLS1_READ_FAILED"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST),        "DTLS1_SEND_CERTIFICATE_REQUEST"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE), "DTLS1_SEND_CLIENT_CERTIFICATE"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE),        "DTLS1_SEND_CLIENT_KEY_EXCHANGE"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_VERIFY),      "DTLS1_SEND_CLIENT_VERIFY"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST),       "DTLS1_SEND_HELLO_VERIFY_REQUEST"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE), "DTLS1_SEND_SERVER_CERTIFICATE"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_HELLO),       "DTLS1_SEND_SERVER_HELLO"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE),        "DTLS1_SEND_SERVER_KEY_EXCHANGE"},
+{ERR_FUNC(SSL_F_DTLS1_WRITE_APP_DATA_BYTES),    "DTLS1_WRITE_APP_DATA_BYTES"},
 {ERR_FUNC(SSL_F_GET_CLIENT_FINISHED),   "GET_CLIENT_FINISHED"},
 {ERR_FUNC(SSL_F_GET_CLIENT_HELLO),      "GET_CLIENT_HELLO"},
 {ERR_FUNC(SSL_F_GET_CLIENT_MASTER_KEY), "GET_CLIENT_MASTER_KEY"},
@@ -116,6 +141,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL3_ENC),      "SSL3_ENC"},
 {ERR_FUNC(SSL_F_SSL3_GENERATE_KEY_BLOCK),       "SSL3_GENERATE_KEY_BLOCK"},
 {ERR_FUNC(SSL_F_SSL3_GET_CERTIFICATE_REQUEST),  "SSL3_GET_CERTIFICATE_REQUEST"},
+{ERR_FUNC(SSL_F_SSL3_GET_CERT_STATUS),  "SSL3_GET_CERT_STATUS"},
 {ERR_FUNC(SSL_F_SSL3_GET_CERT_VERIFY),  "SSL3_GET_CERT_VERIFY"},
 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_CERTIFICATE),   "SSL3_GET_CLIENT_CERTIFICATE"},
 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_HELLO), "SSL3_GET_CLIENT_HELLO"},
@@ -123,10 +149,12 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL3_GET_FINISHED),     "SSL3_GET_FINISHED"},
 {ERR_FUNC(SSL_F_SSL3_GET_KEY_EXCHANGE), "SSL3_GET_KEY_EXCHANGE"},
 {ERR_FUNC(SSL_F_SSL3_GET_MESSAGE),      "SSL3_GET_MESSAGE"},
+{ERR_FUNC(SSL_F_SSL3_GET_NEW_SESSION_TICKET),   "SSL3_GET_NEW_SESSION_TICKET"},
 {ERR_FUNC(SSL_F_SSL3_GET_RECORD),       "SSL3_GET_RECORD"},
 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_CERTIFICATE),   "SSL3_GET_SERVER_CERTIFICATE"},
 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_DONE),  "SSL3_GET_SERVER_DONE"},
 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_HELLO), "SSL3_GET_SERVER_HELLO"},
+{ERR_FUNC(SSL_F_SSL3_NEW_SESSION_TICKET),       "SSL3_NEW_SESSION_TICKET"},
 {ERR_FUNC(SSL_F_SSL3_OUTPUT_CERT_CHAIN),        "SSL3_OUTPUT_CERT_CHAIN"},
 {ERR_FUNC(SSL_F_SSL3_PEEK),     "SSL3_PEEK"},
 {ERR_FUNC(SSL_F_SSL3_READ_BYTES),       "SSL3_READ_BYTES"},
@@ -142,8 +170,10 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL3_SETUP_KEY_BLOCK),  "SSL3_SETUP_KEY_BLOCK"},
 {ERR_FUNC(SSL_F_SSL3_WRITE_BYTES),      "SSL3_WRITE_BYTES"},
 {ERR_FUNC(SSL_F_SSL3_WRITE_PENDING),    "SSL3_WRITE_PENDING"},
+{ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT),    "SSL_ADD_CLIENTHELLO_TLSEXT"},
 {ERR_FUNC(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK),    "SSL_add_dir_cert_subjects_to_stack"},
 {ERR_FUNC(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK),   "SSL_add_file_cert_subjects_to_stack"},
+{ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT),    "SSL_ADD_SERVERHELLO_TLSEXT"},
 {ERR_FUNC(SSL_F_SSL_BAD_METHOD),        "SSL_BAD_METHOD"},
 {ERR_FUNC(SSL_F_SSL_BYTES_TO_CIPHER_LIST),      "SSL_BYTES_TO_CIPHER_LIST"},
 {ERR_FUNC(SSL_F_SSL_CERT_DUP),  "SSL_CERT_DUP"},
@@ -151,6 +181,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL_CERT_INSTANTIATE),  "SSL_CERT_INSTANTIATE"},
 {ERR_FUNC(SSL_F_SSL_CERT_NEW),  "SSL_CERT_NEW"},
 {ERR_FUNC(SSL_F_SSL_CHECK_PRIVATE_KEY), "SSL_check_private_key"},
+{ERR_FUNC(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT),  "SSL_CHECK_SERVERHELLO_TLSEXT"},
 {ERR_FUNC(SSL_F_SSL_CIPHER_PROCESS_RULESTR),    "SSL_CIPHER_PROCESS_RULESTR"},
 {ERR_FUNC(SSL_F_SSL_CIPHER_STRENGTH_SORT),      "SSL_CIPHER_STRENGTH_SORT"},
 {ERR_FUNC(SSL_F_SSL_CLEAR),     "SSL_clear"},
@@ -182,6 +213,9 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL_INIT_WBIO_BUFFER),  "SSL_INIT_WBIO_BUFFER"},
 {ERR_FUNC(SSL_F_SSL_LOAD_CLIENT_CA_FILE),       "SSL_load_client_CA_file"},
 {ERR_FUNC(SSL_F_SSL_NEW),       "SSL_new"},
+{ERR_FUNC(SSL_F_SSL_PEEK),      "SSL_peek"},
+{ERR_FUNC(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT),        "SSL_PREPARE_CLIENTHELLO_TLSEXT"},
+{ERR_FUNC(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT),        "SSL_PREPARE_SERVERHELLO_TLSEXT"},
 {ERR_FUNC(SSL_F_SSL_READ),      "SSL_read"},
 {ERR_FUNC(SSL_F_SSL_RSA_PRIVATE_DECRYPT),       "SSL_RSA_PRIVATE_DECRYPT"},
 {ERR_FUNC(SSL_F_SSL_RSA_PUBLIC_ENCRYPT),        "SSL_RSA_PUBLIC_ENCRYPT"},
@@ -201,6 +235,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL_SHUTDOWN),  "SSL_shutdown"},
 {ERR_FUNC(SSL_F_SSL_UNDEFINED_CONST_FUNCTION),  "SSL_UNDEFINED_CONST_FUNCTION"},
 {ERR_FUNC(SSL_F_SSL_UNDEFINED_FUNCTION),        "SSL_UNDEFINED_FUNCTION"},
+{ERR_FUNC(SSL_F_SSL_UNDEFINED_VOID_FUNCTION),   "SSL_UNDEFINED_VOID_FUNCTION"},
 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE),   "SSL_use_certificate"},
 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_ASN1),      "SSL_use_certificate_ASN1"},
 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_FILE),      "SSL_use_certificate_file"},
@@ -234,6 +269,9 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_BAD_DH_P_LENGTH)       ,"bad dh p length"},
 {ERR_REASON(SSL_R_BAD_DIGEST_LENGTH)     ,"bad digest length"},
 {ERR_REASON(SSL_R_BAD_DSA_SIGNATURE)     ,"bad dsa signature"},
+{ERR_REASON(SSL_R_BAD_ECC_CERT)          ,"bad ecc cert"},
+{ERR_REASON(SSL_R_BAD_ECDSA_SIGNATURE)   ,"bad ecdsa signature"},
+{ERR_REASON(SSL_R_BAD_ECPOINT)           ,"bad ecpoint"},
 {ERR_REASON(SSL_R_BAD_HELLO_REQUEST)     ,"bad hello request"},
 {ERR_REASON(SSL_R_BAD_LENGTH)            ,"bad length"},
 {ERR_REASON(SSL_R_BAD_MAC_DECODE)        ,"bad mac decode"},
@@ -263,17 +301,22 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_CIPHER_CODE_WRONG_LENGTH),"cipher code wrong length"},
 {ERR_REASON(SSL_R_CIPHER_OR_HASH_UNAVAILABLE),"cipher or hash unavailable"},
 {ERR_REASON(SSL_R_CIPHER_TABLE_SRC_ERROR),"cipher table src error"},
+{ERR_REASON(SSL_R_CLIENTHELLO_TLSEXT)    ,"clienthello tlsext"},
 {ERR_REASON(SSL_R_COMPRESSED_LENGTH_TOO_LONG),"compressed length too long"},
 {ERR_REASON(SSL_R_COMPRESSION_FAILURE)   ,"compression failure"},
+{ERR_REASON(SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE),"compression id not within private range"},
 {ERR_REASON(SSL_R_COMPRESSION_LIBRARY_ERROR),"compression library error"},
 {ERR_REASON(SSL_R_CONNECTION_ID_IS_DIFFERENT),"connection id is different"},
 {ERR_REASON(SSL_R_CONNECTION_TYPE_NOT_SET),"connection type not set"},
+{ERR_REASON(SSL_R_COOKIE_MISMATCH)       ,"cookie mismatch"},
 {ERR_REASON(SSL_R_DATA_BETWEEN_CCS_AND_FINISHED),"data between ccs and finished"},
 {ERR_REASON(SSL_R_DATA_LENGTH_TOO_LONG)  ,"data length too long"},
 {ERR_REASON(SSL_R_DECRYPTION_FAILED)     ,"decryption failed"},
 {ERR_REASON(SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC),"decryption failed or bad record mac"},
 {ERR_REASON(SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG),"dh public value length is wrong"},
 {ERR_REASON(SSL_R_DIGEST_CHECK_FAILED)   ,"digest check failed"},
+{ERR_REASON(SSL_R_DUPLICATE_COMPRESSION_ID),"duplicate compression id"},
+{ERR_REASON(SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER),"ecgroup too large for cipher"},
 {ERR_REASON(SSL_R_ENCRYPTED_LENGTH_TOO_LONG),"encrypted length too long"},
 {ERR_REASON(SSL_R_ERROR_GENERATING_TMP_RSA_KEY),"error generating tmp rsa key"},
 {ERR_REASON(SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST),"error in received cipher list"},
@@ -286,6 +329,8 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH),"invalid challenge length"},
 {ERR_REASON(SSL_R_INVALID_COMMAND)       ,"invalid command"},
 {ERR_REASON(SSL_R_INVALID_PURPOSE)       ,"invalid purpose"},
+{ERR_REASON(SSL_R_INVALID_STATUS_RESPONSE),"invalid status response"},
+{ERR_REASON(SSL_R_INVALID_TICKET_KEYS_LENGTH),"invalid ticket keys length"},
 {ERR_REASON(SSL_R_INVALID_TRUST)         ,"invalid trust"},
 {ERR_REASON(SSL_R_KEY_ARG_TOO_LONG)      ,"key arg too long"},
 {ERR_REASON(SSL_R_KRB5)                  ,"krb5"},
@@ -314,6 +359,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_MISSING_RSA_ENCRYPTING_CERT),"missing rsa encrypting cert"},
 {ERR_REASON(SSL_R_MISSING_RSA_SIGNING_CERT),"missing rsa signing cert"},
 {ERR_REASON(SSL_R_MISSING_TMP_DH_KEY)    ,"missing tmp dh key"},
+{ERR_REASON(SSL_R_MISSING_TMP_ECDH_KEY)  ,"missing tmp ecdh key"},
 {ERR_REASON(SSL_R_MISSING_TMP_RSA_KEY)   ,"missing tmp rsa key"},
 {ERR_REASON(SSL_R_MISSING_TMP_RSA_PKEY)  ,"missing tmp rsa pkey"},
 {ERR_REASON(SSL_R_MISSING_VERIFY_MESSAGE),"missing verify message"},
@@ -342,6 +388,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED),"old session cipher not returned"},
 {ERR_REASON(SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE),"only tls allowed in fips mode"},
 {ERR_REASON(SSL_R_PACKET_LENGTH_TOO_LONG),"packet length too long"},
+{ERR_REASON(SSL_R_PARSE_TLSEXT)          ,"parse tlsext"},
 {ERR_REASON(SSL_R_PATH_TOO_LONG)         ,"path too long"},
 {ERR_REASON(SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE),"peer did not return a certificate"},
 {ERR_REASON(SSL_R_PEER_ERROR)            ,"peer error"},
@@ -356,6 +403,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_PUBLIC_KEY_IS_NOT_RSA) ,"public key is not rsa"},
 {ERR_REASON(SSL_R_PUBLIC_KEY_NOT_RSA)    ,"public key not rsa"},
 {ERR_REASON(SSL_R_READ_BIO_NOT_SET)      ,"read bio not set"},
+{ERR_REASON(SSL_R_READ_TIMEOUT_EXPIRED)  ,"read timeout expired"},
 {ERR_REASON(SSL_R_READ_WRONG_PACKET_TYPE),"read wrong packet type"},
 {ERR_REASON(SSL_R_RECORD_LENGTH_MISMATCH),"record length mismatch"},
 {ERR_REASON(SSL_R_RECORD_TOO_LARGE)      ,"record too large"},
@@ -364,11 +412,14 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_REUSE_CERT_LENGTH_NOT_ZERO),"reuse cert length not zero"},
 {ERR_REASON(SSL_R_REUSE_CERT_TYPE_NOT_ZERO),"reuse cert type not zero"},
 {ERR_REASON(SSL_R_REUSE_CIPHER_LIST_NOT_ZERO),"reuse cipher list not zero"},
+{ERR_REASON(SSL_R_SERVERHELLO_TLSEXT)    ,"serverhello tlsext"},
 {ERR_REASON(SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED),"session id context uninitialized"},
 {ERR_REASON(SSL_R_SHORT_READ)            ,"short read"},
 {ERR_REASON(SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE),"signature for non signing certificate"},
 {ERR_REASON(SSL_R_SSL23_DOING_SESSION_ID_REUSE),"ssl23 doing session id reuse"},
 {ERR_REASON(SSL_R_SSL2_CONNECTION_ID_TOO_LONG),"ssl2 connection id too long"},
+{ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME),"ssl3 ext invalid servername"},
+{ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE),"ssl3 ext invalid servername type"},
 {ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_LONG),"ssl3 session id too long"},
 {ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_SHORT),"ssl3 session id too short"},
 {ERR_REASON(SSL_R_SSLV3_ALERT_BAD_CERTIFICATE),"sslv3 alert bad certificate"},
@@ -403,12 +454,15 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_TLSV1_ALERT_UNKNOWN_CA),"tlsv1 alert unknown ca"},
 {ERR_REASON(SSL_R_TLSV1_ALERT_USER_CANCELLED),"tlsv1 alert user cancelled"},
 {ERR_REASON(SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER),"tls client cert req with anon cipher"},
+{ERR_REASON(SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST),"tls invalid ecpointformat list"},
 {ERR_REASON(SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST),"tls peer did not respond with certificate list"},
 {ERR_REASON(SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG),"tls rsa encrypted value length is wrong"},
 {ERR_REASON(SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER),"tried to use unsupported cipher"},
 {ERR_REASON(SSL_R_UNABLE_TO_DECODE_DH_CERTS),"unable to decode dh certs"},
+{ERR_REASON(SSL_R_UNABLE_TO_DECODE_ECDH_CERTS),"unable to decode ecdh certs"},
 {ERR_REASON(SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY),"unable to extract public key"},
 {ERR_REASON(SSL_R_UNABLE_TO_FIND_DH_PARAMETERS),"unable to find dh parameters"},
+{ERR_REASON(SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS),"unable to find ecdh parameters"},
 {ERR_REASON(SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS),"unable to find public key parameters"},
 {ERR_REASON(SSL_R_UNABLE_TO_FIND_SSL_METHOD),"unable to find ssl method"},
 {ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES),"unable to load ssl2 md5 routines"},
@@ -429,8 +483,10 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_UNKNOWN_STATE)         ,"unknown state"},
 {ERR_REASON(SSL_R_UNSUPPORTED_CIPHER)    ,"unsupported cipher"},
 {ERR_REASON(SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM),"unsupported compression algorithm"},
+{ERR_REASON(SSL_R_UNSUPPORTED_ELLIPTIC_CURVE),"unsupported elliptic curve"},
 {ERR_REASON(SSL_R_UNSUPPORTED_PROTOCOL)  ,"unsupported protocol"},
 {ERR_REASON(SSL_R_UNSUPPORTED_SSL_VERSION),"unsupported ssl version"},
+{ERR_REASON(SSL_R_UNSUPPORTED_STATUS_TYPE),"unsupported status type"},
 {ERR_REASON(SSL_R_WRITE_BIO_NOT_SET)     ,"write bio not set"},
 {ERR_REASON(SSL_R_WRONG_CIPHER_RETURNED) ,"wrong cipher returned"},
 {ERR_REASON(SSL_R_WRONG_MESSAGE_TYPE)    ,"wrong message type"},
@@ -448,15 +504,12 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 
 void ERR_load_SSL_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(SSL_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,SSL_str_functs);
                 ERR_load_strings(0,SSL_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index 0f4b7a475b..31f6318357 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -110,7 +110,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
-
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #ifdef REF_CHECK
 #  include <assert.h>
@@ -121,7 +125,11 @@
 #include <openssl/objects.h>
 #include <openssl/lhash.h>
 #include <openssl/x509v3.h>
-#include <openssl/fips.h>
+#include <openssl/rand.h>
+#include <openssl/ocsp.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
 
 const char *SSL_version_str=OPENSSL_VERSION_TEXT;
 
@@ -132,7 +140,14 @@ SSL3_ENC_METHOD ssl3_undef_enc_method={
         ssl_undefined_function,
         (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function,
         (int (*)(SSL*, int))ssl_undefined_function,
-        (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function
+        (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function,
+        0,      /* finish_mac_length */
+        (int (*)(SSL *, EVP_MD_CTX *, unsigned char *))ssl_undefined_function,
+        NULL,   /* client_finished_label */
+        0,      /* client_finished_label_len */
+        NULL,   /* server_finished_label */
+        0,      /* server_finished_label_len */
+        (int (*)(int))ssl_undefined_function
         };
 
 int SSL_clear(SSL *s)
@@ -272,19 +287,40 @@ SSL *SSL_new(SSL_CTX *ctx)
         s->msg_callback=ctx->msg_callback;
         s->msg_callback_arg=ctx->msg_callback_arg;
         s->verify_mode=ctx->verify_mode;
+#if 0
         s->verify_depth=ctx->verify_depth;
+#endif
         s->sid_ctx_length=ctx->sid_ctx_length;
         OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);
         memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx));
         s->verify_callback=ctx->default_verify_callback;
         s->generate_session_id=ctx->generate_session_id;
+
+        s->param = X509_VERIFY_PARAM_new();
+        if (!s->param)
+                goto err;
+        X509_VERIFY_PARAM_inherit(s->param, ctx->param);
+#if 0
         s->purpose = ctx->purpose;
         s->trust = ctx->trust;
+#endif
         s->quiet_shutdown=ctx->quiet_shutdown;
 
         CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
         s->ctx=ctx;
-
+#ifndef OPENSSL_NO_TLSEXT
+        s->tlsext_debug_cb = 0;
+        s->tlsext_debug_arg = NULL;
+        s->tlsext_ticket_expected = 0;
+        s->tlsext_status_type = -1;
+        s->tlsext_status_expected = 0;
+        s->tlsext_ocsp_ids = NULL;
+        s->tlsext_ocsp_exts = NULL;
+        s->tlsext_ocsp_resp = NULL;
+        s->tlsext_ocsp_resplen = -1;
+        CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
+        s->initial_ctx=ctx;
+#endif
         s->verify_result=X509_V_OK;
 
         s->method=ctx->method;
@@ -393,22 +429,22 @@ int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
 
 int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
         {
-        return X509_PURPOSE_set(&s->purpose, purpose);
+        return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
         }
 
 int SSL_set_purpose(SSL *s, int purpose)
         {
-        return X509_PURPOSE_set(&s->purpose, purpose);
+        return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
         }
 
 int SSL_CTX_set_trust(SSL_CTX *s, int trust)
         {
-        return X509_TRUST_set(&s->trust, trust);
+        return X509_VERIFY_PARAM_set_trust(s->param, trust);
         }
 
 int SSL_set_trust(SSL *s, int trust)
         {
-        return X509_TRUST_set(&s->trust, trust);
+        return X509_VERIFY_PARAM_set_trust(s->param, trust);
         }
 
 void SSL_free(SSL *s)
@@ -431,6 +467,9 @@ void SSL_free(SSL *s)
                 }
 #endif
 
+        if (s->param)
+                X509_VERIFY_PARAM_free(s->param);
+
         CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
 
         if (s->bbio != NULL)
@@ -467,7 +506,16 @@ void SSL_free(SSL *s)
         /* Free up if allocated */
 
         if (s->ctx) SSL_CTX_free(s->ctx);
-
+#ifndef OPENSSL_NO_TLSEXT
+        if (s->initial_ctx) SSL_CTX_free(s->initial_ctx);
+        if (s->tlsext_ocsp_exts)
+                sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
+                                                X509_EXTENSION_free);
+        if (s->tlsext_ocsp_ids)
+                sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free);
+        if (s->tlsext_ocsp_resp)
+                OPENSSL_free(s->tlsext_ocsp_resp);
+#endif
         if (s->client_CA != NULL)
                 sk_X509_NAME_pop_free(s->client_CA,X509_NAME_free);
 
@@ -643,7 +691,7 @@ int SSL_get_verify_mode(const SSL *s)
 
 int SSL_get_verify_depth(const SSL *s)
         {
-        return(s->verify_depth);
+        return X509_VERIFY_PARAM_get_depth(s->param);
         }
 
 int (*SSL_get_verify_callback(const SSL *s))(int,X509_STORE_CTX *)
@@ -658,7 +706,7 @@ int SSL_CTX_get_verify_mode(const SSL_CTX *ctx)
 
 int SSL_CTX_get_verify_depth(const SSL_CTX *ctx)
         {
-        return(ctx->verify_depth);
+        return X509_VERIFY_PARAM_get_depth(ctx->param);
         }
 
 int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx))(int,X509_STORE_CTX *)
@@ -676,7 +724,7 @@ void SSL_set_verify(SSL *s,int mode,
 
 void SSL_set_verify_depth(SSL *s,int depth)
         {
-        s->verify_depth=depth;
+        X509_VERIFY_PARAM_set_depth(s->param, depth);
         }
 
 void SSL_set_read_ahead(SSL *s,int yes)
@@ -850,7 +898,7 @@ int SSL_peek(SSL *s,void *buf,int num)
         {
         if (s->handshake_func == 0)
                 {
-                SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED);
+                SSLerr(SSL_F_SSL_PEEK, SSL_R_UNINITIALIZED);
                 return -1;
                 }
 
@@ -941,12 +989,19 @@ long SSL_ctrl(SSL *s,int cmd,long larg,void *parg)
                 l=s->max_cert_list;
                 s->max_cert_list=larg;
                 return(l);
+        case SSL_CTRL_SET_MTU:
+                if (SSL_version(s) == DTLS1_VERSION)
+                        {
+                        s->d1->mtu = larg;
+                        return larg;
+                        }
+                return 0;
         default:
                 return(s->method->ssl_ctrl(s,cmd,larg,parg));
                 }
         }
 
-long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)())
+long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
         {
         switch(cmd)
                 {
@@ -1034,7 +1089,7 @@ long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,void *parg)
                 }
         }
 
-long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
+long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
         {
         switch(cmd)
                 {
@@ -1269,6 +1324,29 @@ err:
         return(NULL);
         }
 
+#ifndef OPENSSL_NO_TLSEXT
+/** return a servername extension value if provided in Client Hello, or NULL.
+ * So far, only host_name types are defined (RFC 3546).
+ */
+
+const char *SSL_get_servername(const SSL *s, const int type)
+        {
+        if (type != TLSEXT_NAMETYPE_host_name)
+                return NULL;
+
+        return s->session && !s->tlsext_hostname ?
+                s->session->tlsext_hostname :
+                s->tlsext_hostname;
+        }
+
+int SSL_get_servername_type(const SSL *s)
+        {
+        if (s->session && (!s->tlsext_hostname ? s->session->tlsext_hostname : s->tlsext_hostname))
+                return TLSEXT_NAMETYPE_host_name;
+        return -1;
+        }
+#endif
+
 unsigned long SSL_SESSION_hash(const SSL_SESSION *a)
         {
         unsigned long l;
@@ -1312,14 +1390,6 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
                 return(NULL);
                 }
 
-#ifdef OPENSSL_FIPS
-        if (FIPS_mode() && (meth->version < TLS1_VERSION))      
-                {
-                SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
-                return NULL;
-                }
-#endif
-
         if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0)
                 {
                 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
@@ -1368,7 +1438,9 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
         ret->msg_callback=0;
         ret->msg_callback_arg=NULL;
         ret->verify_mode=SSL_VERIFY_NONE;
+#if 0
         ret->verify_depth=-1; /* Don't impose a limit (but x509_lu.c does) */
+#endif
         ret->sid_ctx_length=0;
         ret->default_verify_callback=NULL;
         if ((ret->cert=ssl_cert_new()) == NULL)
@@ -1377,6 +1449,8 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
         ret->default_passwd_callback=0;
         ret->default_passwd_callback_userdata=NULL;
         ret->client_cert_cb=0;
+        ret->app_gen_cookie_cb=0;
+        ret->app_verify_cookie_cb=0;
 
         ret->sessions=lh_new(LHASH_HASH_FN(SSL_SESSION_hash),
                         LHASH_COMP_FN(SSL_SESSION_cmp));
@@ -1394,6 +1468,10 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
                 goto err2;
                 }
 
+        ret->param = X509_VERIFY_PARAM_new();
+        if (!ret->param)
+                goto err;
+
         if ((ret->rsa_md5=EVP_get_digestbyname("ssl2-md5")) == NULL)
                 {
                 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES);
@@ -1418,6 +1496,20 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
         ret->extra_certs=NULL;
         ret->comp_methods=SSL_COMP_get_compression_methods();
 
+#ifndef OPENSSL_NO_TLSEXT
+        ret->tlsext_servername_callback = 0;
+        ret->tlsext_servername_arg = NULL;
+        /* Setup RFC4507 ticket keys */
+        if ((RAND_pseudo_bytes(ret->tlsext_tick_key_name, 16) <= 0)
+                || (RAND_bytes(ret->tlsext_tick_hmac_key, 16) <= 0)
+                || (RAND_bytes(ret->tlsext_tick_aes_key, 16) <= 0))
+                ret->options |= SSL_OP_NO_TICKET;
+
+        ret->tlsext_status_cb = 0;
+        ret->tlsext_status_arg = NULL;
+
+#endif
+
         return(ret);
 err:
         SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);
@@ -1450,6 +1542,9 @@ void SSL_CTX_free(SSL_CTX *a)
                 }
 #endif
 
+        if (a->param)
+                X509_VERIFY_PARAM_free(a->param);
+
         /*
          * Free internal session cache. However: the remove_cb() may reference
          * the ex_data of SSL_CTX, thus the ex_data store can only be removed
@@ -1512,7 +1607,7 @@ void SSL_CTX_set_verify(SSL_CTX *ctx,int mode,int (*cb)(int, X509_STORE_CTX *))
 
 void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth)
         {
-        ctx->verify_depth=depth;
+        X509_VERIFY_PARAM_set_depth(ctx->param, depth);
         }
 
 void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
@@ -1522,6 +1617,13 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
         int rsa_enc_export,dh_rsa_export,dh_dsa_export;
         int rsa_tmp_export,dh_tmp_export,kl;
         unsigned long mask,emask;
+        int have_ecc_cert, ecdh_ok, ecdsa_ok, ecc_pkey_size;
+#ifndef OPENSSL_NO_ECDH
+        int have_ecdh_tmp;
+#endif
+        X509 *x = NULL;
+        EVP_PKEY *ecc_pkey = NULL;
+        int signature_nid = 0;
 
         if (c == NULL) return;
 
@@ -1542,6 +1644,9 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
         dh_tmp=dh_tmp_export=0;
 #endif
 
+#ifndef OPENSSL_NO_ECDH
+        have_ecdh_tmp=(c->ecdh_tmp != NULL || c->ecdh_tmp_cb != NULL);
+#endif
         cpk= &(c->pkeys[SSL_PKEY_RSA_ENC]);
         rsa_enc= (cpk->x509 != NULL && cpk->privatekey != NULL);
         rsa_enc_export=(rsa_enc && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
@@ -1556,7 +1661,8 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
 /* FIX THIS EAY EAY EAY */
         dh_dsa=  (cpk->x509 != NULL && cpk->privatekey != NULL);
         dh_dsa_export=(dh_dsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
-
+        cpk= &(c->pkeys[SSL_PKEY_ECC]);
+        have_ecc_cert= (cpk->x509 != NULL && cpk->privatekey != NULL);
         mask=0;
         emask=0;
 
@@ -1613,11 +1719,127 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
         emask|=SSL_kKRB5|SSL_aKRB5;
 #endif
 
+        /* An ECC certificate may be usable for ECDH and/or
+         * ECDSA cipher suites depending on the key usage extension.
+         */
+        if (have_ecc_cert)
+                {
+                /* This call populates extension flags (ex_flags) */
+                x = (c->pkeys[SSL_PKEY_ECC]).x509;
+                X509_check_purpose(x, -1, 0);
+                ecdh_ok = (x->ex_flags & EXFLAG_KUSAGE) ?
+                    (x->ex_kusage & X509v3_KU_KEY_AGREEMENT) : 1;
+                ecdsa_ok = (x->ex_flags & EXFLAG_KUSAGE) ?
+                    (x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE) : 1;
+                ecc_pkey = X509_get_pubkey(x);
+                ecc_pkey_size = (ecc_pkey != NULL) ? 
+                    EVP_PKEY_bits(ecc_pkey) : 0;
+                EVP_PKEY_free(ecc_pkey);
+                if ((x->sig_alg) && (x->sig_alg->algorithm))
+                        signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
+#ifndef OPENSSL_NO_ECDH
+                if (ecdh_ok)
+                        {
+                        if ((signature_nid == NID_md5WithRSAEncryption) ||
+                            (signature_nid == NID_md4WithRSAEncryption) ||
+                            (signature_nid == NID_md2WithRSAEncryption))
+                                {
+                                mask|=SSL_kECDH|SSL_aRSA;
+                                if (ecc_pkey_size <= 163)
+                                        emask|=SSL_kECDH|SSL_aRSA;
+                                }
+                        if (signature_nid == NID_ecdsa_with_SHA1)
+                                {
+                                mask|=SSL_kECDH|SSL_aECDSA;
+                                if (ecc_pkey_size <= 163)
+                                        emask|=SSL_kECDH|SSL_aECDSA;
+                                }
+                        }
+#endif
+#ifndef OPENSSL_NO_ECDSA
+                if (ecdsa_ok)
+                        {
+                        mask|=SSL_aECDSA;
+                        emask|=SSL_aECDSA;
+                        }
+#endif
+                }
+
+#ifndef OPENSSL_NO_ECDH
+        if (have_ecdh_tmp)
+                {
+                mask|=SSL_kECDHE;
+                emask|=SSL_kECDHE;
+                }
+#endif
         c->mask=mask;
         c->export_mask=emask;
         c->valid=1;
         }
 
+/* This handy macro borrowed from crypto/x509v3/v3_purp.c */
+#define ku_reject(x, usage) \
+        (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
+
+int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs)
+        {
+        unsigned long alg = cs->algorithms;
+        EVP_PKEY *pkey = NULL;
+        int keysize = 0;
+        int signature_nid = 0;
+
+        if (SSL_C_IS_EXPORT(cs))
+                {
+                /* ECDH key length in export ciphers must be <= 163 bits */
+                pkey = X509_get_pubkey(x);
+                if (pkey == NULL) return 0;
+                keysize = EVP_PKEY_bits(pkey);
+                EVP_PKEY_free(pkey);
+                if (keysize > 163) return 0;
+                }
+
+        /* This call populates the ex_flags field correctly */
+        X509_check_purpose(x, -1, 0);
+        if ((x->sig_alg) && (x->sig_alg->algorithm))
+                signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
+        if (alg & SSL_kECDH) 
+                {
+                /* key usage, if present, must allow key agreement */
+                if (ku_reject(x, X509v3_KU_KEY_AGREEMENT))
+                        {
+                        return 0;
+                        }
+                if (alg & SSL_aECDSA) 
+                        {
+                        /* signature alg must be ECDSA */
+                        if (signature_nid != NID_ecdsa_with_SHA1)
+                                {
+                                return 0;
+                                }
+                        }
+                if (alg & SSL_aRSA)
+                        {
+                        /* signature alg must be RSA */
+                        if ((signature_nid != NID_md5WithRSAEncryption) &&
+                            (signature_nid != NID_md4WithRSAEncryption) &&
+                            (signature_nid != NID_md2WithRSAEncryption))
+                                {
+                                return 0;
+                                }
+                        }
+                } 
+        else if (alg & SSL_aECDSA)
+                {
+                /* key usage, if present, must allow signing */
+                if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE))
+                        {
+                        return 0;
+                        }
+                }
+
+        return 1;  /* all checks are ok */
+        }
+
 /* THIS NEEDS CLEANING UP */
 X509 *ssl_get_server_send_cert(SSL *s)
         {
@@ -1632,7 +1854,26 @@ X509 *ssl_get_server_send_cert(SSL *s)
         mask=is_export?c->export_mask:c->mask;
         kalg=alg&(SSL_MKEY_MASK|SSL_AUTH_MASK);
 
-        if      (kalg & SSL_kDHr)
+        if (kalg & SSL_kECDH)
+                {
+                /* we don't need to look at SSL_kECDHE 
+                 * since no certificate is needed for
+                 * anon ECDH and for authenticated
+                 * ECDHE, the check for the auth 
+                 * algorithm will set i correctly
+                 * NOTE: For ECDH-RSA, we need an ECC
+                 * not an RSA cert but for ECDHE-RSA
+                 * we need an RSA cert. Placing the
+                 * checks for SSL_kECDH before RSA
+                 * checks ensures the correct cert is chosen.
+                 */
+                i=SSL_PKEY_ECC;
+                }
+        else if (kalg & SSL_aECDSA)
+                {
+                i=SSL_PKEY_ECC;
+                }
+        else if (kalg & SSL_kDHr)
                 i=SSL_PKEY_DH_RSA;
         else if (kalg & SSL_kDHd)
                 i=SSL_PKEY_DH_DSA;
@@ -1656,6 +1897,7 @@ X509 *ssl_get_server_send_cert(SSL *s)
                 return(NULL);
                 }
         if (c->pkeys[i].x509 == NULL) return(NULL);
+
         return(c->pkeys[i].x509);
         }
 
@@ -1679,6 +1921,9 @@ EVP_PKEY *ssl_get_sign_pkey(SSL *s,SSL_CIPHER *cipher)
                 else
                         return(NULL);
                 }
+        else if ((alg & SSL_aECDSA) &&
+                 (c->pkeys[SSL_PKEY_ECC].privatekey != NULL))
+                return(c->pkeys[SSL_PKEY_ECC].privatekey);
         else /* if (alg & SSL_aNULL) */
                 {
                 SSLerr(SSL_F_SSL_GET_SIGN_PKEY,ERR_R_INTERNAL_ERROR);
@@ -1884,6 +2129,12 @@ int ssl_undefined_function(SSL *s)
         return(0);
         }
 
+int ssl_undefined_void_function(void)
+        {
+        SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+        return(0);
+        }
+
 int ssl_undefined_const_function(const SSL *s)
         {
         SSLerr(SSL_F_SSL_UNDEFINED_CONST_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
@@ -1999,8 +2250,8 @@ SSL *SSL_dup(SSL *s)
         ret->rstate=s->rstate;
         ret->init_num = 0; /* would have to copy ret->init_buf, ret->init_msg, ret->init_num, ret->init_off */
         ret->hit=s->hit;
-        ret->purpose=s->purpose;
-        ret->trust=s->trust;
+
+        X509_VERIFY_PARAM_inherit(ret->param, s->param);
 
         /* dup the cipher_list and cipher_list_by_id stacks */
         if (s->cipher_list != NULL)
@@ -2052,6 +2303,7 @@ void ssl_clear_cipher_ctx(SSL *s)
                 OPENSSL_free(s->enc_write_ctx);
                 s->enc_write_ctx=NULL;
                 }
+#ifndef OPENSSL_NO_COMP
         if (s->expand != NULL)
                 {
                 COMP_CTX_free(s->expand);
@@ -2062,6 +2314,7 @@ void ssl_clear_cipher_ctx(SSL *s)
                 COMP_CTX_free(s->compress);
                 s->compress=NULL;
                 }
+#endif
         }
 
 /* Fix this function so that it takes an optional type parameter */
@@ -2088,6 +2341,31 @@ SSL_CIPHER *SSL_get_current_cipher(const SSL *s)
                 return(s->session->cipher);
         return(NULL);
         }
+#ifdef OPENSSL_NO_COMP
+const void *SSL_get_current_compression(SSL *s)
+        {
+        return NULL;
+        }
+const void *SSL_get_current_expansion(SSL *s)
+        {
+        return NULL;
+        }
+#else
+
+const COMP_METHOD *SSL_get_current_compression(SSL *s)
+        {
+        if (s->compress != NULL)
+                return(s->compress->meth);
+        return(NULL);
+        }
+
+const COMP_METHOD *SSL_get_current_expansion(SSL *s)
+        {
+        if (s->expand != NULL)
+                return(s->expand->meth);
+        return(NULL);
+        }
+#endif
 
 int ssl_init_wbio_buffer(SSL *s,int push)
         {
@@ -2181,6 +2459,24 @@ SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl)
         return(ssl->ctx);
         }
 
+SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx)
+        {
+        if (ssl->ctx == ctx)
+                return ssl->ctx;
+#ifndef OPENSSL_NO_TLSEXT
+        if (ctx == NULL)
+                ctx = ssl->initial_ctx;
+#endif
+        if (ssl->cert != NULL)
+                ssl_cert_free(ssl->cert);
+        ssl->cert = ssl_cert_dup(ctx->cert);
+        CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
+        if (ssl->ctx != NULL)
+                SSL_CTX_free(ssl->ctx); /* decrement reference count */
+        ssl->ctx = ctx;
+        return(ssl->ctx);
+        }
+
 #ifndef OPENSSL_NO_STDIO
 int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
         {
@@ -2190,19 +2486,19 @@ int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
 int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
                 const char *CApath)
         {
-        int r;
-        r=X509_STORE_load_locations(ctx->cert_store,CAfile,CApath);
-        return r;
+        return(X509_STORE_load_locations(ctx->cert_store,CAfile,CApath));
         }
 #endif
 
 void SSL_set_info_callback(SSL *ssl,
-                           void (*cb)(const SSL *ssl,int type,int val))
+        void (*cb)(const SSL *ssl,int type,int val))
         {
         ssl->info_callback=cb;
         }
 
-void (*SSL_get_info_callback(const SSL *ssl))(const SSL *ssl,int type,int val)
+/* One compiler (Diab DCC) doesn't like argument names in returned
+   function pointer.  */
+void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /*ssl*/,int /*type*/,int /*val*/) 
         {
         return ssl->info_callback;
         }
@@ -2289,14 +2585,14 @@ void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,RSA *(*cb)(SSL *ssl,
                                                           int is_export,
                                                           int keylength))
     {
-    SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb);
+    SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,(void (*)(void))cb);
     }
 
 void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,
                                                   int is_export,
                                                   int keylength))
     {
-    SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb);
+    SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,(void (*)(void))cb);
     }
 #endif
 
@@ -2325,24 +2621,38 @@ RSA *cb(SSL *ssl,int is_export,int keylength)
 void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export,
                                                         int keylength))
         {
-        SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh);
+        SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh);
         }
 
 void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export,
                                                 int keylength))
         {
-        SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh);
+        SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh);
+        }
+#endif
+
+#ifndef OPENSSL_NO_ECDH
+void SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx,EC_KEY *(*ecdh)(SSL *ssl,int is_export,
+                                                        int keylength))
+        {
+        SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh);
+        }
+
+void SSL_set_tmp_ecdh_callback(SSL *ssl,EC_KEY *(*ecdh)(SSL *ssl,int is_export,
+                                                int keylength))
+        {
+        SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh);
         }
 #endif
 
 
 void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))
         {
-        SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)())cb);
+        SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
         }
 void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))
         {
-        SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)())cb);
+        SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
         }
 
 
diff --git a/src/lib/libssl/src/ssl/ssl_locl.h b/src/lib/libssl/src/ssl/ssl_locl.h
index 6a0b7595f4..de94c0d0c7 100644
--- a/src/lib/libssl/src/ssl/ssl_locl.h
+++ b/src/lib/libssl/src/ssl/ssl_locl.h
@@ -108,6 +108,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #ifndef HEADER_SSL_LOCL_H
 #define HEADER_SSL_LOCL_H
@@ -121,10 +126,13 @@
 #include <openssl/buffer.h>
 #include <openssl/comp.h>
 #include <openssl/bio.h>
-#include <openssl/crypto.h>
-#include <openssl/evp.h>
 #include <openssl/stack.h>
-#include <openssl/x509.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 #include <openssl/symhacks.h>
@@ -172,6 +180,20 @@
                          *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                          *((c)++)=(unsigned char)(((l)    )&0xff))
 
+#define l2n6(l,c)       (*((c)++)=(unsigned char)(((l)>>40)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>>32)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>>24)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
+                         *((c)++)=(unsigned char)(((l)    )&0xff))
+
+#define n2l6(c,l)       (l =((BN_ULLONG)(*((c)++)))<<40, \
+                         l|=((BN_ULLONG)(*((c)++)))<<32, \
+                         l|=((BN_ULLONG)(*((c)++)))<<24, \
+                         l|=((BN_ULLONG)(*((c)++)))<<16, \
+                         l|=((BN_ULLONG)(*((c)++)))<< 8, \
+                         l|=((BN_ULLONG)(*((c)++))))
+
 /* NOTE - c is not incremented as per l2c */
 #define l2cn(l1,l2,c,n) { \
                         c+=n; \
@@ -227,52 +249,58 @@
  * that the different entities within are mutually exclusive:
  * ONLY ONE BIT PER MASK CAN BE SET AT A TIME.
  */
-#define SSL_MKEY_MASK           0x0000003FL
+#define SSL_MKEY_MASK           0x000000FFL
 #define SSL_kRSA                0x00000001L /* RSA key exchange */
 #define SSL_kDHr                0x00000002L /* DH cert RSA CA cert */
 #define SSL_kDHd                0x00000004L /* DH cert DSA CA cert */
 #define SSL_kFZA                0x00000008L
 #define SSL_kEDH                0x00000010L /* tmp DH key no DH cert */
 #define SSL_kKRB5               0x00000020L /* Kerberos5 key exchange */
+#define SSL_kECDH               0x00000040L /* ECDH w/ long-term keys */
+#define SSL_kECDHE              0x00000080L /* ephemeral ECDH */
 #define SSL_EDH                 (SSL_kEDH|(SSL_AUTH_MASK^SSL_aNULL))
 
-#define SSL_AUTH_MASK           0x00000FC0L
-#define SSL_aRSA                0x00000040L /* Authenticate with RSA */
-#define SSL_aDSS                0x00000080L /* Authenticate with DSS */
+#define SSL_AUTH_MASK           0x00007F00L
+#define SSL_aRSA                0x00000100L /* Authenticate with RSA */
+#define SSL_aDSS                0x00000200L /* Authenticate with DSS */
 #define SSL_DSS                 SSL_aDSS
-#define SSL_aFZA                0x00000100L
-#define SSL_aNULL               0x00000200L /* no Authenticate, ADH */
-#define SSL_aDH                 0x00000400L /* no Authenticate, ADH */
-#define SSL_aKRB5               0x00000800L /* Authenticate with KRB5 */
+#define SSL_aFZA                0x00000400L
+#define SSL_aNULL               0x00000800L /* no Authenticate, ADH */
+#define SSL_aDH                 0x00001000L /* no Authenticate, ADH */
+#define SSL_aKRB5               0x00002000L /* Authenticate with KRB5 */
+#define SSL_aECDSA              0x00004000L /* Authenticate with ECDSA */
 
 #define SSL_NULL                (SSL_eNULL)
 #define SSL_ADH                 (SSL_kEDH|SSL_aNULL)
 #define SSL_RSA                 (SSL_kRSA|SSL_aRSA)
 #define SSL_DH                  (SSL_kDHr|SSL_kDHd|SSL_kEDH)
+#define SSL_ECDH                (SSL_kECDH|SSL_kECDHE)
 #define SSL_FZA                 (SSL_aFZA|SSL_kFZA|SSL_eFZA)
 #define SSL_KRB5                (SSL_kKRB5|SSL_aKRB5)
 
-#define SSL_ENC_MASK            0x0087F000L
-#define SSL_DES                 0x00001000L
-#define SSL_3DES                0x00002000L
-#define SSL_RC4                 0x00004000L
-#define SSL_RC2                 0x00008000L
-#define SSL_IDEA                0x00010000L
-#define SSL_eFZA                0x00020000L
-#define SSL_eNULL               0x00040000L
-#define SSL_AES                 0x00800000L
-
-#define SSL_MAC_MASK            0x00180000L
-#define SSL_MD5                 0x00080000L
-#define SSL_SHA1                0x00100000L
+#define SSL_ENC_MASK            0x1C3F8000L
+#define SSL_DES                 0x00008000L
+#define SSL_3DES                0x00010000L
+#define SSL_RC4                 0x00020000L
+#define SSL_RC2                 0x00040000L
+#define SSL_IDEA                0x00080000L
+#define SSL_eFZA                0x00100000L
+#define SSL_eNULL               0x00200000L
+#define SSL_AES                 0x04000000L
+#define SSL_CAMELLIA            0x08000000L
+#define SSL_SEED                0x10000000L
+
+#define SSL_MAC_MASK            0x00c00000L
+#define SSL_MD5                 0x00400000L
+#define SSL_SHA1                0x00800000L
 #define SSL_SHA                 (SSL_SHA1)
 
-#define SSL_SSL_MASK            0x00600000L
-#define SSL_SSLV2               0x00200000L
-#define SSL_SSLV3               0x00400000L
+#define SSL_SSL_MASK            0x03000000L
+#define SSL_SSLV2               0x01000000L
+#define SSL_SSLV3               0x02000000L
 #define SSL_TLSV1               SSL_SSLV3       /* for now */
 
-/* we have used 007fffff - 9 bits left to go */
+/* we have used 1fffffff - 3 bits left to go. */
 
 /*
  * Export and cipher strength information. For each cipher we have to decide
@@ -302,9 +330,8 @@
 #define SSL_LOW                 0x00000020L
 #define SSL_MEDIUM              0x00000040L
 #define SSL_HIGH                0x00000080L
-#define SSL_FIPS                0x00000100L
 
-/* we have used 000001ff - 23 bits left to go */
+/* we have used 000000ff - 24 bits left to go */
 
 /*
  * Macros to check the export status and cipher strength for export ciphers.
@@ -345,7 +372,8 @@
 #define SSL_PKEY_DSA_SIGN       2
 #define SSL_PKEY_DH_RSA         3
 #define SSL_PKEY_DH_DSA         4
-#define SSL_PKEY_NUM            5
+#define SSL_PKEY_ECC            5
+#define SSL_PKEY_NUM            6
 
 /* SSL_kRSA <- RSA_ENC | (RSA_TMP & RSA_SIGN) |
  *          <- (EXPORT & (RSA_ENC | RSA_TMP) & RSA_SIGN)
@@ -361,6 +389,15 @@
 #define CERT_PRIVATE_KEY        2
 */
 
+#ifndef OPENSSL_NO_EC
+/* From ECC-TLS draft, used in encoding the curve type in 
+ * ECParameters
+ */
+#define EXPLICIT_PRIME_CURVE_TYPE  1   
+#define EXPLICIT_CHAR2_CURVE_TYPE  2
+#define NAMED_CURVE_TYPE           3
+#endif  /* OPENSSL_NO_EC */
+
 typedef struct cert_pkey_st
         {
         X509 *x509;
@@ -387,6 +424,11 @@ typedef struct cert_st
         DH *dh_tmp;
         DH *(*dh_tmp_cb)(SSL *ssl,int is_export,int keysize);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *ecdh_tmp;
+        /* Callback for generating ephemeral ECDH keys */
+        EC_KEY *(*ecdh_tmp_cb)(SSL *ssl,int is_export,int keysize);
+#endif
 
         CERT_PKEY pkeys[SSL_PKEY_NUM];
 
@@ -412,6 +454,9 @@ typedef struct sess_cert_st
 #ifndef OPENSSL_NO_DH
         DH *peer_dh_tmp; /* not used for SSL 2 */
 #endif
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *peer_ecdh_tmp;
+#endif
 
         int references; /* actually always 1 at the moment */
         } SESS_CERT;
@@ -466,17 +511,201 @@ extern SSL3_ENC_METHOD ssl3_undef_enc_method;
 OPENSSL_EXTERN SSL_CIPHER ssl2_ciphers[];
 OPENSSL_EXTERN SSL_CIPHER ssl3_ciphers[];
 
-#ifdef OPENSSL_SYS_VMS
-#undef SSL_COMP_get_compression_methods
-#define SSL_COMP_get_compression_methods        SSL_COMP_get_compress_methods
-#endif
-
 
 SSL_METHOD *ssl_bad_method(int ver);
 SSL_METHOD *sslv2_base_method(void);
 SSL_METHOD *sslv23_base_method(void);
 SSL_METHOD *sslv3_base_method(void);
 
+extern SSL3_ENC_METHOD TLSv1_enc_data;
+extern SSL3_ENC_METHOD SSLv3_enc_data;
+extern SSL3_ENC_METHOD DTLSv1_enc_data;
+
+#define IMPLEMENT_tls1_meth_func(func_name, s_accept, s_connect, s_get_meth) \
+SSL_METHOD *func_name(void)  \
+        { \
+        static SSL_METHOD func_name##_data= { \
+                TLS1_VERSION, \
+                tls1_new, \
+                tls1_clear, \
+                tls1_free, \
+                s_accept, \
+                s_connect, \
+                ssl3_read, \
+                ssl3_peek, \
+                ssl3_write, \
+                ssl3_shutdown, \
+                ssl3_renegotiate, \
+                ssl3_renegotiate_check, \
+                ssl3_get_message, \
+                ssl3_read_bytes, \
+                ssl3_write_bytes, \
+                ssl3_dispatch_alert, \
+                ssl3_ctrl, \
+                ssl3_ctx_ctrl, \
+                ssl3_get_cipher_by_char, \
+                ssl3_put_cipher_by_char, \
+                ssl3_pending, \
+                ssl3_num_ciphers, \
+                ssl3_get_cipher, \
+                s_get_meth, \
+                tls1_default_timeout, \
+                &TLSv1_enc_data, \
+                ssl_undefined_void_function, \
+                ssl3_callback_ctrl, \
+                ssl3_ctx_callback_ctrl, \
+        }; \
+        return &func_name##_data; \
+        }
+
+#define IMPLEMENT_ssl3_meth_func(func_name, s_accept, s_connect, s_get_meth) \
+SSL_METHOD *func_name(void)  \
+        { \
+        static SSL_METHOD func_name##_data= { \
+                SSL3_VERSION, \
+                ssl3_new, \
+                ssl3_clear, \
+                ssl3_free, \
+                s_accept, \
+                s_connect, \
+                ssl3_read, \
+                ssl3_peek, \
+                ssl3_write, \
+                ssl3_shutdown, \
+                ssl3_renegotiate, \
+                ssl3_renegotiate_check, \
+                ssl3_get_message, \
+                ssl3_read_bytes, \
+                ssl3_write_bytes, \
+                ssl3_dispatch_alert, \
+                ssl3_ctrl, \
+                ssl3_ctx_ctrl, \
+                ssl3_get_cipher_by_char, \
+                ssl3_put_cipher_by_char, \
+                ssl3_pending, \
+                ssl3_num_ciphers, \
+                ssl3_get_cipher, \
+                s_get_meth, \
+                ssl3_default_timeout, \
+                &SSLv3_enc_data, \
+                ssl_undefined_void_function, \
+                ssl3_callback_ctrl, \
+                ssl3_ctx_callback_ctrl, \
+        }; \
+        return &func_name##_data; \
+        }
+
+#define IMPLEMENT_ssl23_meth_func(func_name, s_accept, s_connect, s_get_meth) \
+SSL_METHOD *func_name(void)  \
+        { \
+        static SSL_METHOD func_name##_data= { \
+        TLS1_VERSION, \
+        tls1_new, \
+        tls1_clear, \
+        tls1_free, \
+        s_accept, \
+        s_connect, \
+        ssl23_read, \
+        ssl23_peek, \
+        ssl23_write, \
+        ssl_undefined_function, \
+        ssl_undefined_function, \
+        ssl_ok, \
+        ssl3_get_message, \
+        ssl3_read_bytes, \
+        ssl3_write_bytes, \
+        ssl3_dispatch_alert, \
+        ssl3_ctrl, \
+        ssl3_ctx_ctrl, \
+        ssl23_get_cipher_by_char, \
+        ssl23_put_cipher_by_char, \
+        ssl_undefined_const_function, \
+        ssl23_num_ciphers, \
+        ssl23_get_cipher, \
+        s_get_meth, \
+        ssl23_default_timeout, \
+        &ssl3_undef_enc_method, \
+        ssl_undefined_void_function, \
+        ssl3_callback_ctrl, \
+        ssl3_ctx_callback_ctrl, \
+        }; \
+        return &func_name##_data; \
+        }
+
+#define IMPLEMENT_ssl2_meth_func(func_name, s_accept, s_connect, s_get_meth) \
+SSL_METHOD *func_name(void)  \
+        { \
+        static SSL_METHOD func_name##_data= { \
+                SSL2_VERSION, \
+                ssl2_new,       /* local */ \
+                ssl2_clear,     /* local */ \
+                ssl2_free,      /* local */ \
+                s_accept, \
+                s_connect, \
+                ssl2_read, \
+                ssl2_peek, \
+                ssl2_write, \
+                ssl2_shutdown, \
+                ssl_ok, /* NULL - renegotiate */ \
+                ssl_ok, /* NULL - check renegotiate */ \
+                NULL, /* NULL - ssl_get_message */ \
+                NULL, /* NULL - ssl_get_record */ \
+                NULL, /* NULL - ssl_write_bytes */ \
+                NULL, /* NULL - dispatch_alert */ \
+                ssl2_ctrl,      /* local */ \
+                ssl2_ctx_ctrl,  /* local */ \
+                ssl2_get_cipher_by_char, \
+                ssl2_put_cipher_by_char, \
+                ssl2_pending, \
+                ssl2_num_ciphers, \
+                ssl2_get_cipher, \
+                s_get_meth, \
+                ssl2_default_timeout, \
+                &ssl3_undef_enc_method, \
+                ssl_undefined_void_function, \
+                ssl2_callback_ctrl,     /* local */ \
+                ssl2_ctx_callback_ctrl, /* local */ \
+        }; \
+        return &func_name##_data; \
+        }
+
+#define IMPLEMENT_dtls1_meth_func(func_name, s_accept, s_connect, s_get_meth) \
+SSL_METHOD *func_name(void)  \
+        { \
+        static SSL_METHOD func_name##_data= { \
+                DTLS1_VERSION, \
+                dtls1_new, \
+                dtls1_clear, \
+                dtls1_free, \
+                s_accept, \
+                s_connect, \
+                ssl3_read, \
+                ssl3_peek, \
+                ssl3_write, \
+                ssl3_shutdown, \
+                ssl3_renegotiate, \
+                ssl3_renegotiate_check, \
+                dtls1_get_message, \
+                dtls1_read_bytes, \
+                dtls1_write_app_data_bytes, \
+                dtls1_dispatch_alert, \
+                ssl3_ctrl, \
+                ssl3_ctx_ctrl, \
+                ssl3_get_cipher_by_char, \
+                ssl3_put_cipher_by_char, \
+                ssl3_pending, \
+                ssl3_num_ciphers, \
+                dtls1_get_cipher, \
+                s_get_meth, \
+                dtls1_default_timeout, \
+                &DTLSv1_enc_data, \
+                ssl_undefined_void_function, \
+                ssl3_callback_ctrl, \
+                ssl3_ctx_callback_ctrl, \
+        }; \
+        return &func_name##_data; \
+        }
+
 void ssl_clear_cipher_ctx(SSL *s);
 int ssl_clear_bad_session(SSL *s);
 CERT *ssl_cert_new(void);
@@ -487,7 +716,7 @@ SESS_CERT *ssl_sess_cert_new(void);
 void ssl_sess_cert_free(SESS_CERT *sc);
 int ssl_set_peer_cert_type(SESS_CERT *c, int type);
 int ssl_get_new_session(SSL *s, int session);
-int ssl_get_prev_session(SSL *s, unsigned char *session,int len);
+int ssl_get_prev_session(SSL *s, unsigned char *session,int len, const unsigned char *limit);
 int ssl_cipher_id_cmp(const SSL_CIPHER *a,const SSL_CIPHER *b);
 int ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap,
                         const SSL_CIPHER * const *bp);
@@ -504,6 +733,7 @@ int ssl_cipher_get_evp(const SSL_SESSION *s,const EVP_CIPHER **enc,
                        const EVP_MD **md,SSL_COMP **comp);
 int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk);
 int ssl_undefined_function(SSL *s);
+int ssl_undefined_void_function(void);
 int ssl_undefined_const_function(const SSL *s);
 X509 *ssl_get_server_send_cert(SSL *);
 EVP_PKEY *ssl_get_sign_pkey(SSL *,SSL_CIPHER *);
@@ -511,6 +741,7 @@ int ssl_cert_type(X509 *x,EVP_PKEY *pkey);
 void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher);
 STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
 int ssl_verify_alarm_type(long type);
+void ssl_load_ciphers(void);
 
 int ssl2_enc_init(SSL *s, int client);
 int ssl2_generate_key_material(SSL *s);
@@ -520,7 +751,7 @@ SSL_CIPHER *ssl2_get_cipher_by_char(const unsigned char *p);
 int ssl2_put_cipher_by_char(const SSL_CIPHER *c,unsigned char *p);
 int ssl2_part_read(SSL *s, unsigned long f, int i);
 int ssl2_do_write(SSL *s);
-int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data);
+int ssl2_set_certificate(SSL *s, int type, int len, const unsigned char *data);
 void ssl2_return_error(SSL *s,int reason);
 void ssl2_write_error(SSL *s);
 int ssl2_num_ciphers(void);
@@ -536,14 +767,17 @@ int	ssl2_shutdown(SSL *s);
 void    ssl2_clear(SSL *s);
 long    ssl2_ctrl(SSL *s,int cmd, long larg, void *parg);
 long    ssl2_ctx_ctrl(SSL_CTX *s,int cmd, long larg, void *parg);
-long    ssl2_callback_ctrl(SSL *s,int cmd, void (*fp)());
-long    ssl2_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)());
+long    ssl2_callback_ctrl(SSL *s,int cmd, void (*fp)(void));
+long    ssl2_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)(void));
 int     ssl2_pending(const SSL *s);
+long    ssl2_default_timeout(void );
 
 SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p);
 int ssl3_put_cipher_by_char(const SSL_CIPHER *c,unsigned char *p);
 void ssl3_init_finished_mac(SSL *s);
 int ssl3_send_server_certificate(SSL *s);
+int ssl3_send_newsession_ticket(SSL *s);
+int ssl3_send_cert_status(SSL *s);
 int ssl3_get_finished(SSL *s,int state_a,int state_b);
 int ssl3_setup_key_block(SSL *s);
 int ssl3_send_change_cipher_spec(SSL *s,int state_a,int state_b);
@@ -584,10 +818,94 @@ int	ssl3_shutdown(SSL *s);
 void    ssl3_clear(SSL *s);
 long    ssl3_ctrl(SSL *s,int cmd, long larg, void *parg);
 long    ssl3_ctx_ctrl(SSL_CTX *s,int cmd, long larg, void *parg);
-long    ssl3_callback_ctrl(SSL *s,int cmd, void (*fp)());
-long    ssl3_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)());
+long    ssl3_callback_ctrl(SSL *s,int cmd, void (*fp)(void));
+long    ssl3_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)(void));
 int     ssl3_pending(const SSL *s);
 
+void ssl3_record_sequence_update(unsigned char *seq);
+int ssl3_do_change_cipher_spec(SSL *ssl);
+long ssl3_default_timeout(void );
+
+int ssl23_num_ciphers(void );
+SSL_CIPHER *ssl23_get_cipher(unsigned int u);
+int ssl23_read(SSL *s, void *buf, int len);
+int ssl23_peek(SSL *s, void *buf, int len);
+int ssl23_write(SSL *s, const void *buf, int len);
+int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p);
+SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p);
+long ssl23_default_timeout(void );
+
+long tls1_default_timeout(void);
+int dtls1_do_write(SSL *s,int type);
+int ssl3_read_n(SSL *s, int n, int max, int extend);
+int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek);
+int ssl3_do_compress(SSL *ssl);
+int ssl3_do_uncompress(SSL *ssl);
+int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
+        unsigned int len);
+unsigned char *dtls1_set_message_header(SSL *s, 
+        unsigned char *p, unsigned char mt,     unsigned long len, 
+        unsigned long frag_off, unsigned long frag_len);
+
+int dtls1_write_app_data_bytes(SSL *s, int type, const void *buf, int len);
+int dtls1_write_bytes(SSL *s, int type, const void *buf, int len);
+
+int dtls1_send_change_cipher_spec(SSL *s, int a, int b);
+int dtls1_send_finished(SSL *s, int a, int b, const char *sender, int slen);
+unsigned long dtls1_output_cert_chain(SSL *s, X509 *x);
+int dtls1_read_failed(SSL *s, int code);
+int dtls1_buffer_message(SSL *s, int ccs);
+int dtls1_retransmit_message(SSL *s, unsigned short seq, 
+        unsigned long frag_off, int *found);
+void dtls1_clear_record_buffer(SSL *s);
+void dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr);
+void dtls1_get_ccs_header(unsigned char *data, struct ccs_header_st *ccs_hdr);
+void dtls1_reset_seq_numbers(SSL *s, int rw);
+long dtls1_default_timeout(void);
+SSL_CIPHER *dtls1_get_cipher(unsigned int u);
+
+
+
+/* some client-only functions */
+int ssl3_client_hello(SSL *s);
+int ssl3_get_server_hello(SSL *s);
+int ssl3_get_certificate_request(SSL *s);
+int ssl3_get_new_session_ticket(SSL *s);
+int ssl3_get_cert_status(SSL *s);
+int ssl3_get_server_done(SSL *s);
+int ssl3_send_client_verify(SSL *s);
+int ssl3_send_client_certificate(SSL *s);
+int ssl3_send_client_key_exchange(SSL *s);
+int ssl3_get_key_exchange(SSL *s);
+int ssl3_get_server_certificate(SSL *s);
+int ssl3_check_cert_and_algorithm(SSL *s);
+
+int dtls1_client_hello(SSL *s);
+int dtls1_send_client_certificate(SSL *s);
+int dtls1_send_client_key_exchange(SSL *s);
+int dtls1_send_client_verify(SSL *s);
+
+/* some server-only functions */
+int ssl3_get_client_hello(SSL *s);
+int ssl3_send_server_hello(SSL *s);
+int ssl3_send_hello_request(SSL *s);
+int ssl3_send_server_key_exchange(SSL *s);
+int ssl3_send_certificate_request(SSL *s);
+int ssl3_send_server_done(SSL *s);
+int ssl3_check_client_hello(SSL *s);
+int ssl3_get_client_certificate(SSL *s);
+int ssl3_get_client_key_exchange(SSL *s);
+int ssl3_get_cert_verify(SSL *s);
+
+int dtls1_send_hello_request(SSL *s);
+int dtls1_send_server_hello(SSL *s);
+int dtls1_send_server_certificate(SSL *s);
+int dtls1_send_server_key_exchange(SSL *s);
+int dtls1_send_certificate_request(SSL *s);
+int dtls1_send_server_done(SSL *s);
+
+
+
 int ssl23_accept(SSL *s);
 int ssl23_connect(SSL *s);
 int ssl23_read_bytes(SSL *s, int n);
@@ -597,9 +915,24 @@ int tls1_new(SSL *s);
 void tls1_free(SSL *s);
 void tls1_clear(SSL *s);
 long tls1_ctrl(SSL *s,int cmd, long larg, void *parg);
-long tls1_callback_ctrl(SSL *s,int cmd, void (*fp)());
+long tls1_callback_ctrl(SSL *s,int cmd, void (*fp)(void));
 SSL_METHOD *tlsv1_base_method(void );
 
+int dtls1_new(SSL *s);
+int     dtls1_accept(SSL *s);
+int     dtls1_connect(SSL *s);
+void dtls1_free(SSL *s);
+void dtls1_clear(SSL *s);
+long dtls1_ctrl(SSL *s,int cmd, long larg, void *parg);
+SSL_METHOD *dtlsv1_base_method(void );
+
+long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok);
+int dtls1_get_record(SSL *s);
+int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
+        unsigned int len, int create_empty_fragement);
+int dtls1_dispatch_alert(SSL *s);
+int dtls1_enc(SSL *s, int snd);
+
 int ssl_init_wbio_buffer(SSL *s, int push);
 void ssl_free_wbio_buffer(SSL *s);
 
@@ -616,8 +949,28 @@ int tls1_alert_code(int code);
 int ssl3_alert_code(int code);
 int ssl_ok(SSL *s);
 
+int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs);
+
 SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n);
-STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void);
 
+#ifndef OPENSSL_NO_TLSEXT
+unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit); 
+unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit); 
+int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **data, unsigned char *d, int n, int *al);
+int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **data, unsigned char *d, int n, int *al);
+int ssl_prepare_clienthello_tlsext(SSL *s);
+int ssl_prepare_serverhello_tlsext(SSL *s);
+int ssl_check_clienthello_tlsext(SSL *s);
+int ssl_check_serverhello_tlsext(SSL *s);
+#ifdef OPENSSL_NO_SHA256
+#define tlsext_tick_md  EVP_sha1
+#else
+#define tlsext_tick_md  EVP_sha256
+#endif
+int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
+                                const unsigned char *limit, SSL_SESSION **ret);
+EVP_MD_CTX* ssl_replace_hash(EVP_MD_CTX **hash,const EVP_MD *md) ;
+void ssl_clear_hash_ctx(EVP_MD_CTX **hash);
+#endif
 
 #endif
diff --git a/src/lib/libssl/src/ssl/ssl_rsa.c b/src/lib/libssl/src/ssl/ssl_rsa.c
index fb0bd4d045..27113eba50 100644
--- a/src/lib/libssl/src/ssl/ssl_rsa.c
+++ b/src/lib/libssl/src/ssl/ssl_rsa.c
@@ -131,7 +131,7 @@ end:
         }
 #endif
 
-int SSL_use_certificate_ASN1(SSL *ssl, unsigned char *d, int len)
+int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len)
         {
         X509 *x;
         int ret;
@@ -181,7 +181,7 @@ int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa)
 
 static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
         {
-        int i,ok=0,bad=0;
+        int i;
 
         i=ssl_cert_type(NULL,pkey);
         if (i < 0)
@@ -202,47 +202,18 @@ static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
                 /* Don't check the public/private key, this is mostly
                  * for smart cards. */
                 if ((pkey->type == EVP_PKEY_RSA) &&
-                        (RSA_flags(pkey->pkey.rsa) &
-                         RSA_METHOD_FLAG_NO_CHECK))
-                         ok=1;
+                        (RSA_flags(pkey->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK))
+                        ;
                 else
 #endif
-                     if (!X509_check_private_key(c->pkeys[i].x509,pkey))
+                if (!X509_check_private_key(c->pkeys[i].x509,pkey))
                         {
-                        if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA))
-                                {
-                                i=(i == SSL_PKEY_DH_RSA)?
-                                        SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA;
-
-                                if (c->pkeys[i].x509 == NULL)
-                                        ok=1;
-                                else
-                                        {
-                                        if (!X509_check_private_key(
-                                                c->pkeys[i].x509,pkey))
-                                                bad=1;
-                                        else
-                                                ok=1;
-                                        }
-                                }
-                        else
-                                bad=1;
+                        X509_free(c->pkeys[i].x509);
+                        c->pkeys[i].x509 = NULL;
+                        return 0;
                         }
-                else
-                        ok=1;
-                }
-        else
-                ok=1;
-
-        if (bad)
-                {
-                X509_free(c->pkeys[i].x509);
-                c->pkeys[i].x509=NULL;
-                return(0);
                 }
 
-        ERR_clear_error(); /* make sure no error from X509_check_private_key()
-                            * is left if we have chosen to ignore it */
         if (c->pkeys[i].privatekey != NULL)
                 EVP_PKEY_free(c->pkeys[i].privatekey);
         CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
@@ -364,6 +335,11 @@ int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type)
                 pkey=PEM_read_bio_PrivateKey(in,NULL,
                         ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
                 }
+        else if (type == SSL_FILETYPE_ASN1)
+                {
+                j = ERR_R_ASN1_LIB;
+                pkey = d2i_PrivateKey_bio(in,NULL);
+                }
         else
                 {
                 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
@@ -382,10 +358,10 @@ end:
         }
 #endif
 
-int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, unsigned char *d, long len)
+int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, long len)
         {
         int ret;
-        unsigned char *p;
+        const unsigned char *p;
         EVP_PKEY *pkey;
 
         p=d;
@@ -418,7 +394,7 @@ int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x)
 static int ssl_set_cert(CERT *c, X509 *x)
         {
         EVP_PKEY *pkey;
-        int i,ok=0,bad=0;
+        int i;
 
         pkey=X509_get_pubkey(x);
         if (pkey == NULL)
@@ -446,44 +422,23 @@ static int ssl_set_cert(CERT *c, X509 *x)
                 if ((c->pkeys[i].privatekey->type == EVP_PKEY_RSA) &&
                         (RSA_flags(c->pkeys[i].privatekey->pkey.rsa) &
                          RSA_METHOD_FLAG_NO_CHECK))
-                         ok=1;
+                         ;
                 else
-#endif
-                {
+#endif /* OPENSSL_NO_RSA */
                 if (!X509_check_private_key(x,c->pkeys[i].privatekey))
                         {
-                        if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA))
-                                {
-                                i=(i == SSL_PKEY_DH_RSA)?
-                                        SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA;
-
-                                if (c->pkeys[i].privatekey == NULL)
-                                        ok=1;
-                                else
-                                        {
-                                        if (!X509_check_private_key(x,
-                                                c->pkeys[i].privatekey))
-                                                bad=1;
-                                        else
-                                                ok=1;
-                                        }
-                                }
-                        else
-                                bad=1;
+                        /* don't fail for a cert/key mismatch, just free
+                         * current private key (when switching to a different
+                         * cert & key, first this function should be used,
+                         * then ssl_set_pkey */
+                        EVP_PKEY_free(c->pkeys[i].privatekey);
+                        c->pkeys[i].privatekey=NULL;
+                        /* clear error queue */
+                        ERR_clear_error();
                         }
-                else
-                        ok=1;
-                } /* OPENSSL_NO_RSA */
                 }
-        else
-                ok=1;
 
         EVP_PKEY_free(pkey);
-        if (bad)
-                {
-                EVP_PKEY_free(c->pkeys[i].privatekey);
-                c->pkeys[i].privatekey=NULL;
-                }
 
         if (c->pkeys[i].x509 != NULL)
                 X509_free(c->pkeys[i].x509);
@@ -545,7 +500,7 @@ end:
         }
 #endif
 
-int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, unsigned char *d)
+int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d)
         {
         X509 *x;
         int ret;
@@ -640,7 +595,7 @@ end:
         }
 #endif
 
-int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, unsigned char *d, long len)
+int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len)
         {
         int ret;
         const unsigned char *p;
@@ -699,6 +654,11 @@ int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type)
                 pkey=PEM_read_bio_PrivateKey(in,NULL,
                         ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
                 }
+        else if (type == SSL_FILETYPE_ASN1)
+                {
+                j = ERR_R_ASN1_LIB;
+                pkey = d2i_PrivateKey_bio(in,NULL);
+                }
         else
                 {
                 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
@@ -717,11 +677,11 @@ end:
         }
 #endif
 
-int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, unsigned char *d,
+int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const unsigned char *d,
              long len)
         {
         int ret;
-        unsigned char *p;
+        const unsigned char *p;
         EVP_PKEY *pkey;
 
         p=d;
@@ -748,6 +708,8 @@ int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
         int ret=0;
         X509 *x=NULL;
 
+        ERR_clear_error(); /* clear error stack for SSL_CTX_use_certificate() */
+
         in=BIO_new(BIO_s_file_internal());
         if (in == NULL)
                 {
diff --git a/src/lib/libssl/src/ssl/ssl_sess.c b/src/lib/libssl/src/ssl/ssl_sess.c
index 2ba8b9612e..ee88be2b88 100644
--- a/src/lib/libssl/src/ssl/ssl_sess.c
+++ b/src/lib/libssl/src/ssl/ssl_sess.c
@@ -122,10 +122,20 @@ SSL_SESSION *SSL_SESSION_new(void)
         ss->prev=NULL;
         ss->next=NULL;
         ss->compress_meth=0;
+#ifndef OPENSSL_NO_TLSEXT
+        ss->tlsext_hostname = NULL; 
+#endif
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data);
         return(ss);
         }
 
+const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s, unsigned int *len)
+        {
+        if(len)
+                *len = s->session_id_length;
+        return s->session_id;
+        }
+
 /* Even with SSLv2, we have 16 bytes (128 bits) of session ID space. SSLv3/TLSv1
  * has 32 bytes (256 bits). As such, filling the ID with random gunk repeatedly
  * until we have no conflict is going to complete in one iteration pretty much
@@ -141,7 +151,7 @@ static int def_generate_session_id(const SSL *ssl, unsigned char *id,
 {
         unsigned int retry = 0;
         do
-                if(RAND_pseudo_bytes(id, *id_len) <= 0)
+                if (RAND_pseudo_bytes(id, *id_len) <= 0)
                         return 0;
         while(SSL_has_matching_session_id(ssl, id, *id_len) &&
                 (++retry < MAX_SESS_ID_ATTEMPTS));
@@ -198,12 +208,25 @@ int ssl_get_new_session(SSL *s, int session)
                         ss->ssl_version=TLS1_VERSION;
                         ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
                         }
+                else if (s->version == DTLS1_VERSION)
+                        {
+                        ss->ssl_version=DTLS1_VERSION;
+                        ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
+                        }
                 else
                         {
                         SSLerr(SSL_F_SSL_GET_NEW_SESSION,SSL_R_UNSUPPORTED_SSL_VERSION);
                         SSL_SESSION_free(ss);
                         return(0);
                         }
+#ifndef OPENSSL_NO_TLSEXT
+                /* If RFC4507 ticket use empty session ID */
+                if (s->tlsext_ticket_expected)
+                        {
+                        ss->session_id_length = 0;
+                        goto sess_id_done;
+                        }
+#endif
                 /* Choose which callback will set the session ID */
                 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
                 if(s->generate_session_id)
@@ -245,6 +268,17 @@ int ssl_get_new_session(SSL *s, int session)
                         SSL_SESSION_free(ss);
                         return(0);
                         }
+#ifndef OPENSSL_NO_TLSEXT
+                sess_id_done:
+                if (s->tlsext_hostname) {
+                        ss->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
+                        if (ss->tlsext_hostname == NULL) {
+                                SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR);
+                                SSL_SESSION_free(ss);
+                                return 0;
+                                }
+                        }
+#endif
                 }
         else
                 {
@@ -266,21 +300,41 @@ int ssl_get_new_session(SSL *s, int session)
         return(1);
         }
 
-int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
+int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
+                        const unsigned char *limit)
         {
         /* This is used only by servers. */
 
-        SSL_SESSION *ret=NULL,data;
+        SSL_SESSION *ret=NULL;
         int fatal = 0;
-
-        data.ssl_version=s->version;
-        data.session_id_length=len;
+#ifndef OPENSSL_NO_TLSEXT
+        int r;
+#endif
+  
         if (len > SSL_MAX_SSL_SESSION_ID_LENGTH)
                 goto err;
-        memcpy(data.session_id,session_id,len);
-
+#ifndef OPENSSL_NO_TLSEXT
+        r = tls1_process_ticket(s, session_id, len, limit, &ret);
+        if (r == -1)
+                {
+                fatal = 1;
+                goto err;
+                }
+        else if (r == 0 || (!ret && !len))
+                goto err;
+        else if (!ret && !(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
+#else
+        if (len == 0)
+                goto err;
         if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
+#endif
                 {
+                SSL_SESSION data;
+                data.ssl_version=s->version;
+                data.session_id_length=len;
+                if (len == 0)
+                        return 0;
+                memcpy(data.session_id,session_id,len);
                 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
                 ret=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,&data);
                 if (ret != NULL)
@@ -322,33 +376,35 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
 
         /* Now ret is non-NULL, and we own one of its reference counts. */
 
-        if((s->verify_mode&SSL_VERIFY_PEER)
-           && (!s->sid_ctx_length || ret->sid_ctx_length != s->sid_ctx_length
-               || memcmp(ret->sid_ctx,s->sid_ctx,ret->sid_ctx_length)))
-            {
+        if (ret->sid_ctx_length != s->sid_ctx_length
+            || memcmp(ret->sid_ctx,s->sid_ctx,ret->sid_ctx_length))
+                {
                 /* We've found the session named by the client, but we don't
                  * want to use it in this context. */
-                
-                if (s->sid_ctx_length == 0)
-                        {
-                        /* application should have used SSL[_CTX]_set_session_id_context
-                         * -- we could tolerate this and just pretend we never heard
-                         * of this session, but then applications could effectively
-                         * disable the session cache by accident without anyone noticing */
 
-                        SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED);
-                        fatal = 1;
-                        goto err;
-                        }
-                else
-                        {
 #if 0 /* The client cannot always know when a session is not appropriate,
-           * so we shouldn't generate an error message. */
+       * so we shouldn't generate an error message. */
 
-                        SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
+                SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
 #endif
-                        goto err; /* treat like cache miss */
-                        }
+                goto err; /* treat like cache miss */
+                }
+        
+        if((s->verify_mode & SSL_VERIFY_PEER) && s->sid_ctx_length == 0)
+                {
+                /* We can't be sure if this session is being used out of
+                 * context, which is especially important for SSL_VERIFY_PEER.
+                 * The application should have used SSL[_CTX]_set_session_id_context.
+                 *
+                 * For this error case, we generate an error instead of treating
+                 * the event like a cache miss (otherwise it would be easy for
+                 * applications to effectively disable the session cache by
+                 * accident without anyone noticing).
+                 */
+                
+                SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED);
+                fatal = 1;
+                goto err;
                 }
 
         if (ret->cipher == NULL)
@@ -534,6 +590,10 @@ void SSL_SESSION_free(SSL_SESSION *ss)
         if (ss->sess_cert != NULL) ssl_sess_cert_free(ss->sess_cert);
         if (ss->peer != NULL) X509_free(ss->peer);
         if (ss->ciphers != NULL) sk_SSL_CIPHER_free(ss->ciphers);
+#ifndef OPENSSL_NO_TLSEXT
+        if (ss->tlsext_hostname != NULL) OPENSSL_free(ss->tlsext_hostname);
+        if (ss->tlsext_tick != NULL) OPENSSL_free(ss->tlsext_tick);
+#endif
         OPENSSL_cleanse(ss,sizeof(*ss));
         OPENSSL_free(ss);
         }
@@ -568,7 +628,7 @@ int SSL_set_session(SSL *s, SSL_SESSION *session)
                 if (s->kssl_ctx && !s->kssl_ctx->client_princ &&
                     session->krb5_client_princ_len > 0)
                 {
-                    s->kssl_ctx->client_princ = (char *)malloc(session->krb5_client_princ_len + 1);
+                    s->kssl_ctx->client_princ = (char *)OPENSSL_malloc(session->krb5_client_princ_len + 1);
                     memcpy(s->kssl_ctx->client_princ,session->krb5_client_princ,
                             session->krb5_client_princ_len);
                     s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0';
@@ -753,3 +813,72 @@ static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s)
                 }
         }
 
+void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx,
+        int (*cb)(struct ssl_st *ssl,SSL_SESSION *sess))
+        {
+        ctx->new_session_cb=cb;
+        }
+
+int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(SSL *ssl, SSL_SESSION *sess)
+        {
+        return ctx->new_session_cb;
+        }
+
+void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx,
+        void (*cb)(SSL_CTX *ctx,SSL_SESSION *sess))
+        {
+        ctx->remove_session_cb=cb;
+        }
+
+void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(SSL_CTX * ctx,SSL_SESSION *sess)
+        {
+        return ctx->remove_session_cb;
+        }
+
+void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx,
+        SSL_SESSION *(*cb)(struct ssl_st *ssl,
+                 unsigned char *data,int len,int *copy))
+        {
+        ctx->get_session_cb=cb;
+        }
+
+SSL_SESSION * (*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(SSL *ssl,
+                 unsigned char *data,int len,int *copy)
+        {
+        return ctx->get_session_cb;
+        }
+
+void SSL_CTX_set_info_callback(SSL_CTX *ctx, 
+        void (*cb)(const SSL *ssl,int type,int val))
+        {
+        ctx->info_callback=cb;
+        }
+
+void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl,int type,int val)
+        {
+        return ctx->info_callback;
+        }
+
+void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx,
+        int (*cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey))
+        {
+        ctx->client_cert_cb=cb;
+        }
+
+int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL * ssl, X509 ** x509 , EVP_PKEY **pkey)
+        {
+        return ctx->client_cert_cb;
+        }
+
+void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx,
+        int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len))
+        {
+        ctx->app_gen_cookie_cb=cb;
+        }
+
+void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx,
+        int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len))
+        {
+        ctx->app_verify_cookie_cb=cb;
+        }
+
diff --git a/src/lib/libssl/src/ssl/ssl_stat.c b/src/lib/libssl/src/ssl/ssl_stat.c
index b16d253081..73b02509d4 100644
--- a/src/lib/libssl/src/ssl/ssl_stat.c
+++ b/src/lib/libssl/src/ssl/ssl_stat.c
@@ -127,6 +127,8 @@ case SSL3_ST_CR_KEY_EXCH_A:	str="SSLv3 read server key exchange A"; break;
 case SSL3_ST_CR_KEY_EXCH_B:     str="SSLv3 read server key exchange B"; break;
 case SSL3_ST_CR_CERT_REQ_A:     str="SSLv3 read server certificate request A"; break;
 case SSL3_ST_CR_CERT_REQ_B:     str="SSLv3 read server certificate request B"; break;
+case SSL3_ST_CR_SESSION_TICKET_A: str="SSLv3 read server session ticket A";break;
+case SSL3_ST_CR_SESSION_TICKET_B: str="SSLv3 read server session ticket B";break;
 case SSL3_ST_CR_SRVR_DONE_A:    str="SSLv3 read server done A"; break;
 case SSL3_ST_CR_SRVR_DONE_B:    str="SSLv3 read server done B"; break;
 case SSL3_ST_CW_CERT_A:         str="SSLv3 write client certificate A"; break;
@@ -172,6 +174,8 @@ case SSL3_ST_SW_KEY_EXCH_A:	str="SSLv3 write key exchange A"; break;
 case SSL3_ST_SW_KEY_EXCH_B:     str="SSLv3 write key exchange B"; break;
 case SSL3_ST_SW_CERT_REQ_A:     str="SSLv3 write certificate request A"; break;
 case SSL3_ST_SW_CERT_REQ_B:     str="SSLv3 write certificate request B"; break;
+case SSL3_ST_SW_SESSION_TICKET_A: str="SSLv3 write session ticket A"; break;
+case SSL3_ST_SW_SESSION_TICKET_B: str="SSLv3 write session ticket B"; break;
 case SSL3_ST_SW_SRVR_DONE_A:    str="SSLv3 write server done A"; break;
 case SSL3_ST_SW_SRVR_DONE_B:    str="SSLv3 write server done B"; break;
 case SSL3_ST_SR_CERT_A:         str="SSLv3 read client certificate A"; break;
diff --git a/src/lib/libssl/src/ssl/ssl_txt.c b/src/lib/libssl/src/ssl/ssl_txt.c
index 8655a31333..06b86750fd 100644
--- a/src/lib/libssl/src/ssl/ssl_txt.c
+++ b/src/lib/libssl/src/ssl/ssl_txt.c
@@ -81,7 +81,7 @@ int SSL_SESSION_print_fp(FILE *fp, const SSL_SESSION *x)
 int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
         {
         unsigned int i;
-        char *s;
+        const char *s;
 
         if (x == NULL) goto err;
         if (BIO_puts(bp,"SSL-Session:\n") <= 0) goto err;
@@ -151,9 +151,25 @@ int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
                         if (BIO_printf(bp,"%02X",x->krb5_client_princ[i]) <= 0) goto err;
                         }
 #endif /* OPENSSL_NO_KRB5 */
+#ifndef OPENSSL_NO_TLSEXT
+        if (x->tlsext_tick_lifetime_hint)
+                {
+                if (BIO_printf(bp,
+                        "\n    TLS session ticket lifetime hint: %ld (seconds)",
+                        x->tlsext_tick_lifetime_hint) <=0)
+                        goto err;
+                }
+        if (x->tlsext_tick)
+                {
+                if (BIO_puts(bp, "\n    TLS session ticket:\n") <= 0) goto err;
+                if (BIO_dump_indent(bp, (char *)x->tlsext_tick, x->tlsext_ticklen, 4) <= 0)
+                        goto err;
+                }
+#endif
+#ifndef OPENSSL_NO_COMP
         if (x->compress_meth != 0)
                 {
-                SSL_COMP *comp;
+                SSL_COMP *comp = NULL;
 
                 ssl_cipher_get_evp(x,NULL,NULL,&comp);
                 if (comp == NULL)
@@ -165,6 +181,7 @@ int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
                         if (BIO_printf(bp,"\n   Compression: %d (%s)", comp->id,comp->method->name) <= 0) goto err;
                         }
                 }       
+#endif
         if (x->time != 0L)
                 {
                 if (BIO_printf(bp, "\n    Start Time: %ld",x->time) <= 0) goto err;
diff --git a/src/lib/libssl/src/ssl/ssltest.c b/src/lib/libssl/src/ssl/ssltest.c
index 9381c435d5..e786b428cd 100644
--- a/src/lib/libssl/src/ssl/ssltest.c
+++ b/src/lib/libssl/src/ssl/ssltest.c
@@ -108,6 +108,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #define _BSD_SOURCE 1           /* Or gethostname won't be declared properly
                                    on Linux and GNU platforms. */
@@ -140,7 +145,16 @@
 #endif
 #include <openssl/err.h>
 #include <openssl/rand.h>
-#include <openssl/fips.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
 
 #define _XOPEN_SOURCE_EXTENDED  1 /* Or gethostname won't be declared properly
                                      on Compaq platforms (at least with DEC C).
@@ -160,6 +174,9 @@
 #elif defined(OPENSSL_SYS_WINCE)
 #  define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
 #  define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
+#elif defined(OPENSSL_SYS_NETWARE)
+#  define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"
+#  define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"
 #else
 #  define TEST_SERVER_CERT "../apps/server.pem"
 #  define TEST_CLIENT_CERT "../apps/client.pem"
@@ -167,8 +184,8 @@
 
 /* There is really no standard for this, so let's assign some tentative
    numbers.  In any case, these numbers are only for this test */
-#define COMP_RLE        1
-#define COMP_ZLIB       2
+#define COMP_RLE        255
+#define COMP_ZLIB       1
 
 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 #ifndef OPENSSL_NO_RSA
@@ -209,13 +226,11 @@ static const char rnd_seed[] = "string to make the random number generator think
 
 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
+static int do_test_cipherlist(void);
 static void sv_usage(void)
         {
         fprintf(stderr,"usage: ssltest [args ...]\n");
         fprintf(stderr,"\n");
-#ifdef OPENSSL_FIPS
-        fprintf(stderr,"-F             - run test in FIPS mode\n");
-#endif
         fprintf(stderr," -server_auth  - check server certificate\n");
         fprintf(stderr," -client_auth  - do client authentication\n");
         fprintf(stderr," -proxy        - allow proxy certificates\n");
@@ -231,6 +246,9 @@ static void sv_usage(void)
         fprintf(stderr," -dhe1024dsa   - use 1024 bit key (with 160-bit subprime) for DHE\n");
         fprintf(stderr," -no_dhe       - disable DHE\n");
 #endif
+#ifndef OPENSSL_NO_ECDH
+        fprintf(stderr," -no_ecdhe     - disable ECDHE\n");
+#endif
 #ifndef OPENSSL_NO_SSL2
         fprintf(stderr," -ssl2         - use SSLv2\n");
 #endif
@@ -251,7 +269,13 @@ static void sv_usage(void)
         fprintf(stderr," -f            - Test even cases that can't work\n");
         fprintf(stderr," -time         - measure processor time used by client and server\n");
         fprintf(stderr," -zlib         - use zlib compression\n");
-        fprintf(stderr," -time         - use rle compression\n");
+        fprintf(stderr," -rle          - use rle compression\n");
+#ifndef OPENSSL_NO_ECDH
+        fprintf(stderr," -named_curve arg  - Elliptic curve name to use for ephemeral ECDH keys.\n" \
+                       "                 Use \"openssl ecparam -list_curves\" for all names\n"  \
+                       "                 (default is sect163r2).\n");
+#endif
+        fprintf(stderr," -test_cipherlist - verifies the order of the ssl cipher lists\n");
         }
 
 static void print_details(SSL *c_ssl, const char *prefix)
@@ -361,6 +385,7 @@ static void lock_dbg_cb(int mode, int type, const char *file, int line)
                 }
         }
 
+
 int main(int argc, char *argv[])
         {
         char *CApath=NULL,*CAfile=NULL;
@@ -376,24 +401,32 @@ int main(int argc, char *argv[])
         char *server_key=NULL;
         char *client_cert=TEST_CLIENT_CERT;
         char *client_key=NULL;
+#ifndef OPENSSL_NO_ECDH
+        char *named_curve = NULL;
+#endif
         SSL_CTX *s_ctx=NULL;
         SSL_CTX *c_ctx=NULL;
         SSL_METHOD *meth=NULL;
         SSL *c_ssl,*s_ssl;
         int number=1,reuse=0;
-        long bytes=1L;
+        long bytes=256L;
 #ifndef OPENSSL_NO_DH
         DH *dh;
         int dhe1024 = 0, dhe1024dsa = 0;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *ecdh = NULL;
+#endif
         int no_dhe = 0;
+        int no_ecdhe = 0;
         int print_time = 0;
         clock_t s_time = 0, c_time = 0;
         int comp = 0;
+#ifndef OPENSSL_NO_COMP
         COMP_METHOD *cm = NULL;
-#ifdef OPENSSL_FIPS
-        int fips_mode=0;
 #endif
+        STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
+        int test_cipherlist = 0;
 
         verbose = 0;
         debug = 0;
@@ -425,16 +458,7 @@ int main(int argc, char *argv[])
 
         while (argc >= 1)
                 {
-                if(!strcmp(*argv,"-F"))
-                        {
-#ifdef OPENSSL_FIPS
-                        fips_mode=1;
-#else
-                        fprintf(stderr,"not compiled with FIPS support, so exitting without running.\n");
-                        EXIT(0);
-#endif
-                        }
-                else if (strcmp(*argv,"-server_auth") == 0)
+                if      (strcmp(*argv,"-server_auth") == 0)
                         server_auth=1;
                 else if (strcmp(*argv,"-client_auth") == 0)
                         client_auth=1;
@@ -472,6 +496,8 @@ int main(int argc, char *argv[])
                         }
                 else if (strcmp(*argv,"-no_dhe") == 0)
                         no_dhe=1;
+                else if (strcmp(*argv,"-no_ecdhe") == 0)
+                        no_ecdhe=1;
                 else if (strcmp(*argv,"-ssl2") == 0)
                         ssl2=1;
                 else if (strcmp(*argv,"-tls1") == 0)
@@ -558,6 +584,16 @@ int main(int argc, char *argv[])
                         {
                         comp = COMP_RLE;
                         }
+                else if (strcmp(*argv,"-named_curve") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+#ifndef OPENSSL_NO_ECDH         
+                        named_curve = *(++argv);
+#else
+                        fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");
+                        ++argv;
+#endif
+                        }
                 else if (strcmp(*argv,"-app_verify") == 0)
                         {
                         app_verify_arg.app_verify = 1;
@@ -566,6 +602,10 @@ int main(int argc, char *argv[])
                         {
                         app_verify_arg.allow_proxy_certs = 1;
                         }
+                else if (strcmp(*argv,"-test_cipherlist") == 0)
+                        {
+                        test_cipherlist = 1;
+                        }
                 else
                         {
                         fprintf(stderr,"unknown option %s\n",*argv);
@@ -582,6 +622,14 @@ bad:
                 goto end;
                 }
 
+        if (test_cipherlist == 1)
+                {
+                /* ensure that the cipher list are correctly sorted and exit */
+                if (do_test_cipherlist() == 0)
+                        EXIT(1);
+                ret = 0;
+                goto end;
+                }
 
         if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
                 {
@@ -592,20 +640,6 @@ bad:
                 EXIT(1);
                 }
 
-#ifdef OPENSSL_FIPS
-        if(fips_mode)
-                {
-                if(!FIPS_mode_set(1))
-                        {
-                        ERR_load_crypto_strings();
-                        ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));
-                        EXIT(1);
-                        }
-                else
-                        fprintf(stderr,"*** IN FIPS MODE ***\n");
-                }
-#endif
-
         if (print_time)
                 {
                 if (!bio_pair)
@@ -622,6 +656,7 @@ bad:
         SSL_library_init();
         SSL_load_error_strings();
 
+#ifndef OPENSSL_NO_COMP
         if (comp == COMP_ZLIB) cm = COMP_zlib();
         if (comp == COMP_RLE) cm = COMP_rle();
         if (cm != NULL)
@@ -645,6 +680,20 @@ bad:
                         ERR_print_errors_fp(stderr);
                         }
                 }
+        ssl_comp_methods = SSL_COMP_get_compression_methods();
+        fprintf(stderr, "Available compression methods:\n");
+        {
+        int j, n = sk_SSL_COMP_num(ssl_comp_methods);
+        if (n == 0)
+                fprintf(stderr, "  NONE\n");
+        else
+                for (j = 0; j < n; j++)
+                        {
+                        SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
+                        fprintf(stderr, "  %d: %s\n", c->id, c->name);
+                        }
+        }
+#endif
 
 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
         if (ssl2)
@@ -699,6 +748,38 @@ bad:
         (void)no_dhe;
 #endif
 
+#ifndef OPENSSL_NO_ECDH
+        if (!no_ecdhe)
+                {
+                int nid;
+
+                if (named_curve != NULL)
+                        {
+                        nid = OBJ_sn2nid(named_curve);
+                        if (nid == 0)
+                        {
+                                BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);
+                                goto end;
+                                }
+                        }
+                else
+                        nid = NID_sect163r2;
+
+                ecdh = EC_KEY_new_by_curve_name(nid);
+                if (ecdh == NULL)
+                        {
+                        BIO_printf(bio_err, "unable to create curve\n");
+                        goto end;
+                        }
+
+                SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
+                SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);
+                EC_KEY_free(ecdh);
+                }
+#else
+        (void)no_ecdhe;
+#endif
+
 #ifndef OPENSSL_NO_RSA
         SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
 #endif
@@ -835,6 +916,7 @@ end:
         CRYPTO_mem_leaks(bio_err);
         if (bio_err != NULL) BIO_free(bio_err);
         EXIT(ret);
+        return ret;
         }
 
 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
@@ -1325,8 +1407,8 @@ int doit(SSL *s_ssl, SSL *c_ssl, long count)
                         {
                         if (c_write)
                                 {
-                                j=(cw_num > (long)sizeof(cbuf))
-                                        ?sizeof(cbuf):(int)cw_num;
+                                j = (cw_num > (long)sizeof(cbuf)) ?
+                                        (int)sizeof(cbuf) : (int)cw_num;
                                 i=BIO_write(c_bio,cbuf,j);
                                 if (i < 0)
                                         {
@@ -1456,8 +1538,8 @@ int doit(SSL *s_ssl, SSL *c_ssl, long count)
                                 }
                         else
                                 {
-                                j=(sw_num > (long)sizeof(sbuf))?
-                                        sizeof(sbuf):(int)sw_num;
+                                j = (sw_num > (long)sizeof(sbuf)) ?
+                                        (int)sizeof(sbuf) : (int)sw_num;
                                 i=BIO_write(s_bio,sbuf,j);
                                 if (i < 0)
                                         {
@@ -1644,7 +1726,7 @@ static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
                                         fprintf(stderr, "  Certificate proxy rights = %*.*s", i, i, s);
                                         while(i-- > 0)
                                                 {
-                                                char c = *s++;
+                                                int c = *s++;
                                                 if (isascii(c) && isalpha(c))
                                                         {
                                                         if (islower(c))
@@ -1705,11 +1787,11 @@ static int process_proxy_cond_adders(unsigned int letters[26],
 static int process_proxy_cond_val(unsigned int letters[26],
         const char *cond, const char **cond_end, int *pos, int indent)
         {
-        char c;
+        int c;
         int ok = 1;
         int negate = 0;
 
-        while(isspace(*cond))
+        while(isspace((int)*cond))
                 {
                 cond++; (*pos)++;
                 }
@@ -1724,7 +1806,7 @@ static int process_proxy_cond_val(unsigned int letters[26],
                 {
                 negate = !negate;
                 cond++; (*pos)++;
-                while(isspace(*cond))
+                while(isspace((int)*cond))
                         {
                         cond++; (*pos)++;
                         }
@@ -1739,7 +1821,7 @@ static int process_proxy_cond_val(unsigned int letters[26],
                 cond = *cond_end;
                 if (ok < 0)
                         goto end;
-                while(isspace(*cond))
+                while(isspace((int)*cond))
                         {
                         cond++; (*pos)++;
                         }
@@ -1799,7 +1881,7 @@ static int process_proxy_cond_multipliers(unsigned int letters[26],
 
         while(ok >= 0)
                 {
-                while(isspace(*cond))
+                while(isspace((int)*cond))
                         {
                         cond++; (*pos)++;
                         }
@@ -1866,7 +1948,7 @@ static int process_proxy_cond_adders(unsigned int letters[26],
 
         while(ok >= 0)
                 {
-                while(isspace(*cond))
+                while(isspace((int)*cond))
                         {
                         cond++; (*pos)++;
                         }
@@ -1949,7 +2031,7 @@ static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
                         letters[i] = 0;
                 for(sp = cb_arg->proxy_auth; *sp; sp++)
                         {
-                        char c = *sp;
+                        int c = *sp;
                         if (isascii(c) && isalpha(c))
                                 {
                                 if (islower(c))
@@ -1979,7 +2061,15 @@ static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
                 }
 
 #ifndef OPENSSL_NO_X509_VERIFY
+# ifdef OPENSSL_FIPS
+        if(s->version == TLS1_VERSION)
+                FIPS_allow_md5(1);
+# endif
         ok = X509_verify_cert(ctx);
+# ifdef OPENSSL_FIPS
+        if(s->version == TLS1_VERSION)
+                FIPS_allow_md5(0);
+# endif
 #endif
 
         if (cb_arg->proxy_auth)
@@ -2014,14 +2104,29 @@ static RSA *rsa_tmp=NULL;
 
 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
         {
+        BIGNUM *bn = NULL;
         if (rsa_tmp == NULL)
                 {
+                bn = BN_new();
+                rsa_tmp = RSA_new();
+                if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))
+                        {
+                        BIO_printf(bio_err, "Memory error...");
+                        goto end;
+                        }
                 BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
                 (void)BIO_flush(bio_err);
-                rsa_tmp=RSA_generate_key(keylength,RSA_F4,NULL,NULL);
+                if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))
+                        {
+                        BIO_printf(bio_err, "Error generating key.");
+                        RSA_free(rsa_tmp);
+                        rsa_tmp = NULL;
+                        }
+end:
                 BIO_printf(bio_err,"\n");
                 (void)BIO_flush(bio_err);
                 }
+        if(bn) BN_free(bn);
         return(rsa_tmp);
         }
 
@@ -2132,3 +2237,60 @@ static DH *get_dh1024dsa()
         return(dh);
         }
 #endif
+
+static int do_test_cipherlist(void)
+        {
+        int i = 0;
+        const SSL_METHOD *meth;
+        SSL_CIPHER *ci, *tci = NULL;
+
+#ifndef OPENSSL_NO_SSL2
+        fprintf(stderr, "testing SSLv2 cipher list order: ");
+        meth = SSLv2_method();
+        while ((ci = meth->get_cipher(i++)) != NULL)
+                {
+                if (tci != NULL)
+                        if (ci->id >= tci->id)
+                                {
+                                fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
+                                return 0;
+                                }
+                tci = ci;
+                }
+        fprintf(stderr, "ok\n");
+#endif
+#ifndef OPENSSL_NO_SSL3
+        fprintf(stderr, "testing SSLv3 cipher list order: ");
+        meth = SSLv3_method();
+        tci = NULL;
+        while ((ci = meth->get_cipher(i++)) != NULL)
+                {
+                if (tci != NULL)
+                        if (ci->id >= tci->id)
+                                {
+                                fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
+                                return 0;
+                                }
+                tci = ci;
+                }
+        fprintf(stderr, "ok\n");
+#endif
+#ifndef OPENSSL_NO_TLS1
+        fprintf(stderr, "testing TLSv1 cipher list order: ");
+        meth = TLSv1_method();
+        tci = NULL;
+        while ((ci = meth->get_cipher(i++)) != NULL)
+                {
+                if (tci != NULL)
+                        if (ci->id >= tci->id)
+                                {
+                                fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
+                                return 0;
+                                }
+                tci = ci;
+                }
+        fprintf(stderr, "ok\n");
+#endif
+
+        return 1;
+        }
diff --git a/src/lib/libssl/src/ssl/t1_clnt.c b/src/lib/libssl/src/ssl/t1_clnt.c
index 57205fb429..4d1e198cdc 100644
--- a/src/lib/libssl/src/ssl/t1_clnt.c
+++ b/src/lib/libssl/src/ssl/t1_clnt.c
@@ -72,26 +72,8 @@ static SSL_METHOD *tls1_get_client_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *TLSv1_client_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD TLSv1_client_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&TLSv1_client_data,(char *)tlsv1_base_method(),
-                                sizeof(SSL_METHOD));
-                        TLSv1_client_data.ssl_connect=ssl3_connect;
-                        TLSv1_client_data.get_ssl_method=tls1_get_client_method;
-                        init=0;
-                        }
-                
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&TLSv1_client_data);
-        }
+IMPLEMENT_tls1_meth_func(TLSv1_client_method,
+                        ssl_undefined_function,
+                        ssl3_connect,
+                        tls1_get_client_method)
 
diff --git a/src/lib/libssl/src/ssl/t1_enc.c b/src/lib/libssl/src/ssl/t1_enc.c
index 2c6246abf5..ed5a4a7255 100644
--- a/src/lib/libssl/src/ssl/t1_enc.c
+++ b/src/lib/libssl/src/ssl/t1_enc.c
@@ -115,7 +115,6 @@
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/md5.h>
-#include <openssl/fips.h>
 
 static void tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
                         int sec_len, unsigned char *seed, int seed_len,
@@ -132,8 +131,6 @@ static void tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
 
         HMAC_CTX_init(&ctx);
         HMAC_CTX_init(&ctx_tmp);
-        HMAC_CTX_set_flags(&ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-        HMAC_CTX_set_flags(&ctx_tmp, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
         HMAC_Init_ex(&ctx,sec,sec_len,md, NULL);
         HMAC_Init_ex(&ctx_tmp,sec,sec_len,md, NULL);
         HMAC_Update(&ctx,seed,seed_len);
@@ -180,6 +177,7 @@ static void tls1_PRF(const EVP_MD *md5, const EVP_MD *sha1,
         S2= &(sec[len]);
         len+=(slen&1); /* add for odd, make longer */
 
+        
         tls1_P_hash(md5 ,S1,len,label,label_len,out1,olen);
         tls1_P_hash(sha1,S2,len,label,label_len,out2,olen);
 
@@ -233,7 +231,9 @@ int tls1_change_cipher_state(SSL *s, int which)
         int client_write;
         EVP_CIPHER_CTX *dd;
         const EVP_CIPHER *c;
+#ifndef OPENSSL_NO_COMP
         const SSL_COMP *comp;
+#endif
         const EVP_MD *m;
         int is_export,n,i,j,k,exp_label_len,cl;
         int reuse_dd = 0;
@@ -241,7 +241,9 @@ int tls1_change_cipher_state(SSL *s, int which)
         is_export=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
         c=s->s3->tmp.new_sym_enc;
         m=s->s3->tmp.new_hash;
+#ifndef OPENSSL_NO_COMP
         comp=s->s3->tmp.new_compression;
+#endif
         key_block=s->s3->tmp.key_block;
 
 #ifdef KSSL_DEBUG
@@ -265,8 +267,12 @@ int tls1_change_cipher_state(SSL *s, int which)
                         reuse_dd = 1;
                 else if ((s->enc_read_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
                         goto err;
+                else
+                        /* make sure it's intialized in case we exit later with an error */
+                        EVP_CIPHER_CTX_init(s->enc_read_ctx);
                 dd= s->enc_read_ctx;
                 s->read_hash=m;
+#ifndef OPENSSL_NO_COMP
                 if (s->expand != NULL)
                         {
                         COMP_CTX_free(s->expand);
@@ -286,7 +292,10 @@ int tls1_change_cipher_state(SSL *s, int which)
                         if (s->s3->rrec.comp == NULL)
                                 goto err;
                         }
-                memset(&(s->s3->read_sequence[0]),0,8);
+#endif
+                /* this is done by dtls1_reset_seq_numbers for DTLS1_VERSION */
+                if (s->version != DTLS1_VERSION)
+                        memset(&(s->s3->read_sequence[0]),0,8);
                 mac_secret= &(s->s3->read_mac_secret[0]);
                 }
         else
@@ -295,12 +304,12 @@ int tls1_change_cipher_state(SSL *s, int which)
                         reuse_dd = 1;
                 else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
                         goto err;
-                if ((s->enc_write_ctx == NULL) &&
-                        ((s->enc_write_ctx=(EVP_CIPHER_CTX *)
-                        OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
-                        goto err;
+                else
+                        /* make sure it's intialized in case we exit later with an error */
+                        EVP_CIPHER_CTX_init(s->enc_write_ctx);
                 dd= s->enc_write_ctx;
                 s->write_hash=m;
+#ifndef OPENSSL_NO_COMP
                 if (s->compress != NULL)
                         {
                         COMP_CTX_free(s->compress);
@@ -315,13 +324,15 @@ int tls1_change_cipher_state(SSL *s, int which)
                                 goto err2;
                                 }
                         }
-                memset(&(s->s3->write_sequence[0]),0,8);
+#endif
+                /* this is done by dtls1_reset_seq_numbers for DTLS1_VERSION */
+                if (s->version != DTLS1_VERSION)
+                        memset(&(s->s3->write_sequence[0]),0,8);
                 mac_secret= &(s->s3->write_mac_secret[0]);
                 }
 
         if (reuse_dd)
                 EVP_CIPHER_CTX_cleanup(dd);
-        EVP_CIPHER_CTX_init(dd);
 
         p=s->s3->tmp.key_block;
         i=EVP_MD_size(m);
@@ -503,7 +514,7 @@ printf("\nkey block\n");
 #endif
                         }
                 }
-
+                
         return(1);
 err:
         SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE);
@@ -618,7 +629,15 @@ int tls1_enc(SSL *s, int send)
                         {
                         ii=i=rec->data[l-1]; /* padding_length */
                         i++;
-                        if (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
+                        /* NB: if compression is in operation the first packet
+                         * may not be of even length so the padding bug check
+                         * cannot be performed. This bug workaround has been
+                         * around since SSLeay so hopefully it is either fixed
+                         * now or no buggy implementation supports compression 
+                         * [steve]
+                         */
+                        if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
+                                && !s->expand)
                                 {
                                 /* First packet is even in size, so check */
                                 if ((memcmp(s->s3->read_sequence,
@@ -719,15 +738,35 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
         md_size=EVP_MD_size(hash);
 
         buf[0]=rec->type;
-        buf[1]=TLS1_VERSION_MAJOR;
-        buf[2]=TLS1_VERSION_MINOR;
+        if (ssl->version == DTLS1_VERSION && ssl->client_version == DTLS1_BAD_VER)
+                {
+                buf[1]=TLS1_VERSION_MAJOR;
+                buf[2]=TLS1_VERSION_MINOR;
+                }
+        else    {
+                buf[1]=(unsigned char)(ssl->version>>8);
+                buf[2]=(unsigned char)(ssl->version);
+                }
+
         buf[3]=rec->length>>8;
         buf[4]=rec->length&0xff;
 
         /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
         HMAC_CTX_init(&hmac);
         HMAC_Init_ex(&hmac,mac_sec,EVP_MD_size(hash),hash,NULL);
-        HMAC_Update(&hmac,seq,8);
+
+        if (ssl->version == DTLS1_VERSION && ssl->client_version != DTLS1_BAD_VER)
+                {
+                unsigned char dtlsseq[8],*p=dtlsseq;
+
+                s2n(send?ssl->d1->w_epoch:ssl->d1->r_epoch, p);
+                memcpy (p,&seq[2],6);
+
+                HMAC_Update(&hmac,dtlsseq,8);
+                }
+        else
+                HMAC_Update(&hmac,seq,8);
+
         HMAC_Update(&hmac,buf,5);
         HMAC_Update(&hmac,rec->input,rec->length);
         HMAC_Final(&hmac,md,&md_size);
@@ -744,10 +783,13 @@ printf("rec=");
 {unsigned int z; for (z=0; z<rec->length; z++) printf("%02X ",buf[z]); printf("\n"); }
 #endif
 
-        for (i=7; i>=0; i--)
+        if ( SSL_version(ssl) != DTLS1_VERSION)
                 {
-                ++seq[i];
-                if (seq[i] != 0) break; 
+                for (i=7; i>=0; i--)
+                        {
+                        ++seq[i];
+                        if (seq[i] != 0) break; 
+                        }
                 }
 
 #ifdef TLS_DEBUG
@@ -810,6 +852,8 @@ int tls1_alert_code(int code)
         case SSL_AD_INTERNAL_ERROR:     return(TLS1_AD_INTERNAL_ERROR);
         case SSL_AD_USER_CANCELLED:     return(TLS1_AD_USER_CANCELLED);
         case SSL_AD_NO_RENEGOTIATION:   return(TLS1_AD_NO_RENEGOTIATION);
+        case DTLS1_AD_MISSING_HANDSHAKE_MESSAGE: return 
+                                          (DTLS1_AD_MISSING_HANDSHAKE_MESSAGE);
         default:                        return(-1);
                 }
         }
diff --git a/src/lib/libssl/src/ssl/t1_lib.c b/src/lib/libssl/src/ssl/t1_lib.c
index ca6c03d5af..35f04afa4a 100644
--- a/src/lib/libssl/src/ssl/t1_lib.c
+++ b/src/lib/libssl/src/ssl/t1_lib.c
@@ -58,13 +58,20 @@
 
 #include <stdio.h>
 #include <openssl/objects.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/ocsp.h>
 #include "ssl_locl.h"
 
-const char *tls1_version_str="TLSv1" OPENSSL_VERSION_PTEXT;
+const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 
-static long tls1_default_timeout(void);
+#ifndef OPENSSL_NO_TLSEXT
+static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
+                                const unsigned char *sess_id, int sesslen,
+                                SSL_SESSION **psess);
+#endif
 
-static SSL3_ENC_METHOD TLSv1_enc_data={
+SSL3_ENC_METHOD TLSv1_enc_data={
         tls1_enc,
         tls1_mac,
         tls1_setup_key_block,
@@ -78,45 +85,17 @@ static SSL3_ENC_METHOD TLSv1_enc_data={
         tls1_alert_code,
         };
 
-static SSL_METHOD TLSv1_data= {
-        TLS1_VERSION,
-        tls1_new,
-        tls1_clear,
-        tls1_free,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl3_read,
-        ssl3_peek,
-        ssl3_write,
-        ssl3_shutdown,
-        ssl3_renegotiate,
-        ssl3_renegotiate_check,
-        ssl3_ctrl,
-        ssl3_ctx_ctrl,
-        ssl3_get_cipher_by_char,
-        ssl3_put_cipher_by_char,
-        ssl3_pending,
-        ssl3_num_ciphers,
-        ssl3_get_cipher,
-        ssl_bad_method,
-        tls1_default_timeout,
-        &TLSv1_enc_data,
-        ssl_undefined_function,
-        ssl3_callback_ctrl,
-        ssl3_ctx_callback_ctrl,
-        };
-
-static long tls1_default_timeout(void)
+long tls1_default_timeout(void)
         {
         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
          * is way too long for http, the cache would over fill */
         return(60*60*2);
         }
 
-SSL_METHOD *tlsv1_base_method(void)
-        {
-        return(&TLSv1_data);
-        }
+IMPLEMENT_tls1_meth_func(tlsv1_base_method,
+                        ssl_undefined_function,
+                        ssl_undefined_function,
+                        ssl_bad_method)
 
 int tls1_new(SSL *s)
         {
@@ -147,3 +126,751 @@ long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)())
         return(0);
         }
 #endif
+
+#ifndef OPENSSL_NO_TLSEXT
+unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
+        {
+        int extdatalen=0;
+        unsigned char *ret = p;
+
+        ret+=2;
+
+        if (ret>=limit) return NULL; /* this really never occurs, but ... */
+
+        if (s->tlsext_hostname != NULL)
+                { 
+                /* Add TLS extension servername to the Client Hello message */
+                unsigned long size_str;
+                long lenmax; 
+
+                /* check for enough space.
+                   4 for the servername type and entension length
+                   2 for servernamelist length
+                   1 for the hostname type
+                   2 for hostname length
+                   + hostname length 
+                */
+                   
+                if ((lenmax = limit - ret - 9) < 0 
+                || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax) 
+                        return NULL;
+                        
+                /* extension type and length */
+                s2n(TLSEXT_TYPE_server_name,ret); 
+                s2n(size_str+5,ret);
+                
+                /* length of servername list */
+                s2n(size_str+3,ret);
+        
+                /* hostname type, length and hostname */
+                *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
+                s2n(size_str,ret);
+                memcpy(ret, s->tlsext_hostname, size_str);
+                ret+=size_str;
+
+                }
+
+        if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
+                {
+                int ticklen;
+                if (s->session && s->session->tlsext_tick)
+                        ticklen = s->session->tlsext_ticklen;
+                else
+                        ticklen = 0;
+                /* Check for enough room 2 for extension type, 2 for len
+                 * rest for ticket
+                 */
+                if (limit - ret - 4 - ticklen < 0)
+                        return NULL;
+                s2n(TLSEXT_TYPE_session_ticket,ret); 
+                s2n(ticklen,ret);
+                if (ticklen)
+                        {
+                        memcpy(ret, s->session->tlsext_tick, ticklen);
+                        ret += ticklen;
+                        }
+                }
+
+        if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
+                {
+                int i;
+                long extlen, idlen, itmp;
+                OCSP_RESPID *id;
+
+                idlen = 0;
+                for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
+                        {
+                        id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
+                        itmp = i2d_OCSP_RESPID(id, NULL);
+                        if (itmp <= 0)
+                                return NULL;
+                        idlen += itmp + 2;
+                        }
+
+                if (s->tlsext_ocsp_exts)
+                        {
+                        extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
+                        if (extlen < 0)
+                                return NULL;
+                        }
+                else
+                        extlen = 0;
+                        
+                if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
+                s2n(TLSEXT_TYPE_status_request, ret);
+                if (extlen + idlen > 0xFFF0)
+                        return NULL;
+                s2n(extlen + idlen + 5, ret);
+                *(ret++) = TLSEXT_STATUSTYPE_ocsp;
+                s2n(idlen, ret);
+                for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
+                        {
+                        /* save position of id len */
+                        unsigned char *q = ret;
+                        id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
+                        /* skip over id len */
+                        ret += 2;
+                        itmp = i2d_OCSP_RESPID(id, &ret);
+                        /* write id len */
+                        s2n(itmp, q);
+                        }
+                s2n(extlen, ret);
+                if (extlen > 0)
+                        i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
+                }
+
+        if ((extdatalen = ret-p-2)== 0) 
+                return p;
+
+        s2n(extdatalen,p);
+        return ret;
+        }
+
+unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
+        {
+        int extdatalen=0;
+        unsigned char *ret = p;
+
+        ret+=2;
+        if (ret>=limit) return NULL; /* this really never occurs, but ... */
+
+        if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
+                { 
+                if (limit - ret - 4 < 0) return NULL; 
+
+                s2n(TLSEXT_TYPE_server_name,ret);
+                s2n(0,ret);
+                }
+        
+        if (s->tlsext_ticket_expected
+                && !(SSL_get_options(s) & SSL_OP_NO_TICKET)) 
+                { 
+                if (limit - ret - 4 < 0) return NULL; 
+                s2n(TLSEXT_TYPE_session_ticket,ret);
+                s2n(0,ret);
+                }
+
+        if (s->tlsext_status_expected)
+                { 
+                if ((long)(limit - ret - 4) < 0) return NULL; 
+                s2n(TLSEXT_TYPE_status_request,ret);
+                s2n(0,ret);
+                }
+
+        if ((extdatalen = ret-p-2)== 0) 
+                return p;
+
+        s2n(extdatalen,p);
+        return ret;
+        }
+
+int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
+        {
+        unsigned short type;
+        unsigned short size;
+        unsigned short len;
+        unsigned char *data = *p;
+        s->servername_done = 0;
+        s->tlsext_status_type = -1;
+
+        if (data >= (d+n-2))
+                return 1;
+        n2s(data,len);
+
+        if (data > (d+n-len)) 
+                return 1;
+
+        while (data <= (d+n-4))
+                {
+                n2s(data,type);
+                n2s(data,size);
+
+                if (data+size > (d+n))
+                        return 1;
+
+                if (s->tlsext_debug_cb)
+                        s->tlsext_debug_cb(s, 0, type, data, size,
+                                                s->tlsext_debug_arg);
+/* The servername extension is treated as follows:
+
+   - Only the hostname type is supported with a maximum length of 255.
+   - The servername is rejected if too long or if it contains zeros,
+     in which case an fatal alert is generated.
+   - The servername field is maintained together with the session cache.
+   - When a session is resumed, the servername call back invoked in order
+     to allow the application to position itself to the right context. 
+   - The servername is acknowledged if it is new for a session or when 
+     it is identical to a previously used for the same session. 
+     Applications can control the behaviour.  They can at any time
+     set a 'desirable' servername for a new SSL object. This can be the
+     case for example with HTTPS when a Host: header field is received and
+     a renegotiation is requested. In this case, a possible servername
+     presented in the new client hello is only acknowledged if it matches
+     the value of the Host: field. 
+   - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
+     if they provide for changing an explicit servername context for the session,
+     i.e. when the session has been established with a servername extension. 
+   - On session reconnect, the servername extension may be absent. 
+
+*/      
+
+                if (type == TLSEXT_TYPE_server_name)
+                        {
+                        unsigned char *sdata;
+                        int servname_type;
+                        int dsize; 
+                
+                        if (size < 2) 
+                                {
+                                *al = SSL_AD_DECODE_ERROR;
+                                return 0;
+                                }
+                        n2s(data,dsize);  
+                        size -= 2;
+                        if (dsize > size  ) 
+                                {
+                                *al = SSL_AD_DECODE_ERROR;
+                                return 0;
+                                } 
+
+                        sdata = data;
+                        while (dsize > 3) 
+                                {
+                                servname_type = *(sdata++); 
+                                n2s(sdata,len);
+                                dsize -= 3;
+
+                                if (len > dsize) 
+                                        {
+                                        *al = SSL_AD_DECODE_ERROR;
+                                        return 0;
+                                        }
+                                if (s->servername_done == 0)
+                                switch (servname_type)
+                                        {
+                                case TLSEXT_NAMETYPE_host_name:
+                                        if (s->session->tlsext_hostname == NULL)
+                                                {
+                                                if (len > TLSEXT_MAXLEN_host_name || 
+                                                        ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
+                                                        {
+                                                        *al = TLS1_AD_UNRECOGNIZED_NAME;
+                                                        return 0;
+                                                        }
+                                                memcpy(s->session->tlsext_hostname, sdata, len);
+                                                s->session->tlsext_hostname[len]='\0';
+                                                if (strlen(s->session->tlsext_hostname) != len) {
+                                                        OPENSSL_free(s->session->tlsext_hostname);
+                                                        s->session->tlsext_hostname = NULL;
+                                                        *al = TLS1_AD_UNRECOGNIZED_NAME;
+                                                        return 0;
+                                                }
+                                                s->servername_done = 1; 
+
+                                                }
+                                        else 
+                                                s->servername_done = strlen(s->session->tlsext_hostname) == len 
+                                                        && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
+                                        
+                                        break;
+
+                                default:
+                                        break;
+                                        }
+                                 
+                                dsize -= len;
+                                }
+                        if (dsize != 0) 
+                                {
+                                *al = SSL_AD_DECODE_ERROR;
+                                return 0;
+                                }
+
+                        }
+                else if (type == TLSEXT_TYPE_status_request
+                                                && s->ctx->tlsext_status_cb)
+                        {
+                
+                        if (size < 5) 
+                                {
+                                *al = SSL_AD_DECODE_ERROR;
+                                return 0;
+                                }
+
+                        s->tlsext_status_type = *data++;
+                        size--;
+                        if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
+                                {
+                                const unsigned char *sdata;
+                                int dsize;
+                                /* Read in responder_id_list */
+                                n2s(data,dsize);
+                                size -= 2;
+                                if (dsize > size  ) 
+                                        {
+                                        *al = SSL_AD_DECODE_ERROR;
+                                        return 0;
+                                        }
+                                while (dsize > 0)
+                                        {
+                                        OCSP_RESPID *id;
+                                        int idsize;
+                                        if (dsize < 4)
+                                                {
+                                                *al = SSL_AD_DECODE_ERROR;
+                                                return 0;
+                                                }
+                                        n2s(data, idsize);
+                                        dsize -= 2 + idsize;
+                                        if (dsize < 0)
+                                                {
+                                                *al = SSL_AD_DECODE_ERROR;
+                                                return 0;
+                                                }
+                                        sdata = data;
+                                        data += idsize;
+                                        id = d2i_OCSP_RESPID(NULL,
+                                                                &sdata, idsize);
+                                        if (!id)
+                                                {
+                                                *al = SSL_AD_DECODE_ERROR;
+                                                return 0;
+                                                }
+                                        if (data != sdata)
+                                                {
+                                                OCSP_RESPID_free(id);
+                                                *al = SSL_AD_DECODE_ERROR;
+                                                return 0;
+                                                }
+                                        if (!s->tlsext_ocsp_ids
+                                                && !(s->tlsext_ocsp_ids =
+                                                sk_OCSP_RESPID_new_null()))
+                                                {
+                                                OCSP_RESPID_free(id);
+                                                *al = SSL_AD_INTERNAL_ERROR;
+                                                return 0;
+                                                }
+                                        if (!sk_OCSP_RESPID_push(
+                                                        s->tlsext_ocsp_ids, id))
+                                                {
+                                                OCSP_RESPID_free(id);
+                                                *al = SSL_AD_INTERNAL_ERROR;
+                                                return 0;
+                                                }
+                                        }
+
+                                /* Read in request_extensions */
+                                n2s(data,dsize);
+                                size -= 2;
+                                if (dsize > size) 
+                                        {
+                                        *al = SSL_AD_DECODE_ERROR;
+                                        return 0;
+                                        }
+                                sdata = data;
+                                if (dsize > 0)
+                                        {
+                                        s->tlsext_ocsp_exts =
+                                                d2i_X509_EXTENSIONS(NULL,
+                                                        &sdata, dsize);
+                                        if (!s->tlsext_ocsp_exts
+                                                || (data + dsize != sdata))
+                                                {
+                                                *al = SSL_AD_DECODE_ERROR;
+                                                return 0;
+                                                }
+                                        }
+                                }
+                                /* We don't know what to do with any other type
+                                * so ignore it.
+                                */
+                                else
+                                        s->tlsext_status_type = -1;
+                        }
+                /* session ticket processed earlier */
+
+                data+=size;             
+                }
+
+        *p = data;
+        return 1;
+        }
+
+int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
+        {
+        unsigned short type;
+        unsigned short size;
+        unsigned short len;  
+        unsigned char *data = *p;
+
+        int tlsext_servername = 0;
+
+        if (data >= (d+n-2))
+                return 1;
+
+        n2s(data,len);
+
+        while(data <= (d+n-4))
+                {
+                n2s(data,type);
+                n2s(data,size);
+
+                if (data+size > (d+n))
+                        return 1;
+
+                if (s->tlsext_debug_cb)
+                        s->tlsext_debug_cb(s, 1, type, data, size,
+                                                s->tlsext_debug_arg);
+
+                if (type == TLSEXT_TYPE_server_name)
+                        {
+                        if (s->tlsext_hostname == NULL || size > 0)
+                                {
+                                *al = TLS1_AD_UNRECOGNIZED_NAME;
+                                return 0;
+                                }
+                        tlsext_servername = 1;   
+                        }
+                else if (type == TLSEXT_TYPE_session_ticket)
+                        {
+                        if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
+                                || (size > 0))
+                                {
+                                *al = TLS1_AD_UNSUPPORTED_EXTENSION;
+                                return 0;
+                                }
+                        s->tlsext_ticket_expected = 1;
+                        }
+                else if (type == TLSEXT_TYPE_status_request)
+                        {
+                        /* MUST be empty and only sent if we've requested
+                         * a status request message.
+                         */ 
+                        if ((s->tlsext_status_type == -1) || (size > 0))
+                                {
+                                *al = TLS1_AD_UNSUPPORTED_EXTENSION;
+                                return 0;
+                                }
+                        /* Set flag to expect CertificateStatus message */
+                        s->tlsext_status_expected = 1;
+                        }
+
+                data+=size;             
+                }
+
+        if (data != d+n)
+                {
+                *al = SSL_AD_DECODE_ERROR;
+                return 0;
+                }
+
+        if (!s->hit && tlsext_servername == 1)
+                {
+                if (s->tlsext_hostname)
+                        {
+                        if (s->session->tlsext_hostname == NULL)
+                                {
+                                s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);   
+                                if (!s->session->tlsext_hostname)
+                                        {
+                                        *al = SSL_AD_UNRECOGNIZED_NAME;
+                                        return 0;
+                                        }
+                                }
+                        else 
+                                {
+                                *al = SSL_AD_DECODE_ERROR;
+                                return 0;
+                                }
+                        }
+                }
+
+        *p = data;
+        return 1;
+        }
+
+int ssl_check_clienthello_tlsext(SSL *s)
+        {
+        int ret=SSL_TLSEXT_ERR_NOACK;
+        int al = SSL_AD_UNRECOGNIZED_NAME;
+
+        if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 
+                ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
+        else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)             
+                ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
+
+        /* If status request then ask callback what to do.
+         * Note: this must be called after servername callbacks in case 
+         * the certificate has changed.
+         */
+        if ((s->tlsext_status_type != -1) && s->ctx->tlsext_status_cb)
+                {
+                int r;
+                r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
+                switch (r)
+                        {
+                        /* We don't want to send a status request response */
+                        case SSL_TLSEXT_ERR_NOACK:
+                                s->tlsext_status_expected = 0;
+                                break;
+                        /* status request response should be sent */
+                        case SSL_TLSEXT_ERR_OK:
+                                if (s->tlsext_ocsp_resp)
+                                        s->tlsext_status_expected = 1;
+                                else
+                                        s->tlsext_status_expected = 0;
+                                break;
+                        /* something bad happened */
+                        case SSL_TLSEXT_ERR_ALERT_FATAL:
+                                ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+                                al = SSL_AD_INTERNAL_ERROR;
+                                goto err;
+                        }
+                }
+        else
+                s->tlsext_status_expected = 0;
+        err:
+        switch (ret)
+                {
+                case SSL_TLSEXT_ERR_ALERT_FATAL:
+                        ssl3_send_alert(s,SSL3_AL_FATAL,al); 
+                        return -1;
+
+                case SSL_TLSEXT_ERR_ALERT_WARNING:
+                        ssl3_send_alert(s,SSL3_AL_WARNING,al);
+                        return 1; 
+                                        
+                case SSL_TLSEXT_ERR_NOACK:
+                        s->servername_done=0;
+                        default:
+                return 1;
+                }
+        }
+
+int ssl_check_serverhello_tlsext(SSL *s)
+        {
+        int ret=SSL_TLSEXT_ERR_NOACK;
+        int al = SSL_AD_UNRECOGNIZED_NAME;
+
+        if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 
+                ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
+        else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)             
+                ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
+
+        /* If we've requested certificate status and we wont get one
+         * tell the callback
+         */
+        if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
+                        && s->ctx->tlsext_status_cb)
+                {
+                int r;
+                /* Set resp to NULL, resplen to -1 so callback knows
+                 * there is no response.
+                 */
+                if (s->tlsext_ocsp_resp)
+                        {
+                        OPENSSL_free(s->tlsext_ocsp_resp);
+                        s->tlsext_ocsp_resp = NULL;
+                        }
+                s->tlsext_ocsp_resplen = -1;
+                r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
+                if (r == 0)
+                        {
+                        al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
+                        ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+                        }
+                if (r < 0)
+                        {
+                        al = SSL_AD_INTERNAL_ERROR;
+                        ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+                        }
+                }
+
+        switch (ret)
+                {
+                case SSL_TLSEXT_ERR_ALERT_FATAL:
+                        ssl3_send_alert(s,SSL3_AL_FATAL,al); 
+                        return -1;
+
+                case SSL_TLSEXT_ERR_ALERT_WARNING:
+                        ssl3_send_alert(s,SSL3_AL_WARNING,al);
+                        return 1; 
+                                        
+                case SSL_TLSEXT_ERR_NOACK:
+                        s->servername_done=0;
+                        default:
+                return 1;
+                }
+        }
+
+/* Since the server cache lookup is done early on in the processing of client
+ * hello and other operations depend on the result we need to handle any TLS
+ * session ticket extension at the same time.
+ */
+
+int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
+                                const unsigned char *limit, SSL_SESSION **ret)
+        {
+        /* Point after session ID in client hello */
+        const unsigned char *p = session_id + len;
+        unsigned short i;
+        if ((s->version <= SSL3_VERSION) || !limit)
+                return 1;
+        if (p >= limit)
+                return -1;
+        /* Skip past cipher list */
+        n2s(p, i);
+        p+= i;
+        if (p >= limit)
+                return -1;
+        /* Skip past compression algorithm list */
+        i = *(p++);
+        p += i;
+        if (p > limit)
+                return -1;
+        /* Now at start of extensions */
+        if ((p + 2) >= limit)
+                return 1;
+        n2s(p, i);
+        while ((p + 4) <= limit)
+                {
+                unsigned short type, size;
+                n2s(p, type);
+                n2s(p, size);
+                if (p + size > limit)
+                        return 1;
+                if (type == TLSEXT_TYPE_session_ticket)
+                        {
+                        /* If tickets disabled indicate cache miss which will
+                         * trigger a full handshake
+                         */
+                        if (SSL_get_options(s) & SSL_OP_NO_TICKET)
+                                return 0;
+                        /* If zero length not client will accept a ticket
+                         * and indicate cache miss to trigger full handshake
+                         */
+                        if (size == 0)
+                                {
+                                s->tlsext_ticket_expected = 1;
+                                return 0;       /* Cache miss */
+                                }
+                        return tls_decrypt_ticket(s, p, size, session_id, len,
+                                                                        ret);
+                        }
+                p += size;
+                }
+        return 1;
+        }
+
+static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
+                                const unsigned char *sess_id, int sesslen,
+                                SSL_SESSION **psess)
+        {
+        SSL_SESSION *sess;
+        unsigned char *sdec;
+        const unsigned char *p;
+        int slen, mlen, renew_ticket = 0;
+        unsigned char tick_hmac[EVP_MAX_MD_SIZE];
+        HMAC_CTX hctx;
+        EVP_CIPHER_CTX ctx;
+        /* Need at least keyname + iv + some encrypted data */
+        if (eticklen < 48)
+                goto tickerr;
+        /* Initialize session ticket encryption and HMAC contexts */
+        HMAC_CTX_init(&hctx);
+        EVP_CIPHER_CTX_init(&ctx);
+        if (s->ctx->tlsext_ticket_key_cb)
+                {
+                unsigned char *nctick = (unsigned char *)etick;
+                int rv = s->ctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
+                                                        &ctx, &hctx, 0);
+                if (rv < 0)
+                        return -1;
+                if (rv == 0)
+                        goto tickerr;
+                if (rv == 2)
+                        renew_ticket = 1;
+                }
+        else
+                {
+                /* Check key name matches */
+                if (memcmp(etick, s->ctx->tlsext_tick_key_name, 16))
+                        goto tickerr;
+                HMAC_Init_ex(&hctx, s->ctx->tlsext_tick_hmac_key, 16,
+                                        tlsext_tick_md(), NULL);
+                EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
+                                s->ctx->tlsext_tick_aes_key, etick + 16);
+                }
+        /* Attempt to process session ticket, first conduct sanity and
+         * integrity checks on ticket.
+         */
+        mlen = HMAC_size(&hctx);
+        eticklen -= mlen;
+        /* Check HMAC of encrypted ticket */
+        HMAC_Update(&hctx, etick, eticklen);
+        HMAC_Final(&hctx, tick_hmac, NULL);
+        HMAC_CTX_cleanup(&hctx);
+        if (memcmp(tick_hmac, etick + eticklen, mlen))
+                goto tickerr;
+        /* Attempt to decrypt session data */
+        /* Move p after IV to start of encrypted ticket, update length */
+        p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
+        eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
+        sdec = OPENSSL_malloc(eticklen);
+        if (!sdec)
+                {
+                EVP_CIPHER_CTX_cleanup(&ctx);
+                return -1;
+                }
+        EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
+        if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
+                goto tickerr;
+        slen += mlen;
+        EVP_CIPHER_CTX_cleanup(&ctx);
+        p = sdec;
+                
+        sess = d2i_SSL_SESSION(NULL, &p, slen);
+        OPENSSL_free(sdec);
+        if (sess)
+                {
+                /* The session ID if non-empty is used by some clients to
+                 * detect that the ticket has been accepted. So we copy it to
+                 * the session structure. If it is empty set length to zero
+                 * as required by standard.
+                 */
+                if (sesslen)
+                        memcpy(sess->session_id, sess_id, sesslen);
+                sess->session_id_length = sesslen;
+                *psess = sess;
+                s->tlsext_ticket_expected = renew_ticket;
+                return 1;
+                }
+        /* If session decrypt failure indicate a cache miss and set state to
+         * send a new ticket
+         */
+        tickerr:        
+        s->tlsext_ticket_expected = 1;
+        return 0;
+        }
+
+#endif
diff --git a/src/lib/libssl/src/ssl/t1_meth.c b/src/lib/libssl/src/ssl/t1_meth.c
index fcc243f782..f5d8df634e 100644
--- a/src/lib/libssl/src/ssl/t1_meth.c
+++ b/src/lib/libssl/src/ssl/t1_meth.c
@@ -69,28 +69,8 @@ static SSL_METHOD *tls1_get_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *TLSv1_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD TLSv1_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-                
-                if (init)
-                        {
-                        memcpy((char *)&TLSv1_data,(char *)tlsv1_base_method(),
-                                sizeof(SSL_METHOD));
-                        TLSv1_data.ssl_connect=ssl3_connect;
-                        TLSv1_data.ssl_accept=ssl3_accept;
-                        TLSv1_data.get_ssl_method=tls1_get_method;
-                        init=0;
-                        }
-
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        
-        return(&TLSv1_data);
-        }
+IMPLEMENT_tls1_meth_func(TLSv1_method,
+                        ssl3_accept,
+                        ssl3_connect,
+                        tls1_get_method)
 
diff --git a/src/lib/libssl/src/ssl/t1_srvr.c b/src/lib/libssl/src/ssl/t1_srvr.c
index 1c1149e49f..b75636abba 100644
--- a/src/lib/libssl/src/ssl/t1_srvr.c
+++ b/src/lib/libssl/src/ssl/t1_srvr.c
@@ -73,26 +73,8 @@ static SSL_METHOD *tls1_get_server_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *TLSv1_server_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD TLSv1_server_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&TLSv1_server_data,(char *)tlsv1_base_method(),
-                                sizeof(SSL_METHOD));
-                        TLSv1_server_data.ssl_accept=ssl3_accept;
-                        TLSv1_server_data.get_ssl_method=tls1_get_server_method;
-                        init=0;
-                        }
-                        
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&TLSv1_server_data);
-        }
+IMPLEMENT_tls1_meth_func(TLSv1_server_method,
+                        ssl3_accept,
+                        ssl_undefined_function,
+                        tls1_get_server_method)
 
diff --git a/src/lib/libssl/src/ssl/tls1.h b/src/lib/libssl/src/ssl/tls1.h
index 38838ea9a5..2d1d293e1a 100644
--- a/src/lib/libssl/src/ssl/tls1.h
+++ b/src/lib/libssl/src/ssl/tls1.h
@@ -55,6 +55,19 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * ECC cipher suite support in OpenSSL originally written by
+ * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
+ *
+ */
 
 #ifndef HEADER_TLS1_H 
 #define HEADER_TLS1_H 
@@ -65,7 +78,7 @@
 extern "C" {
 #endif
 
-#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES    1
+#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES    0
 
 #define TLS1_VERSION                    0x0301
 #define TLS1_VERSION_MAJOR              0x03
@@ -83,6 +96,93 @@ extern "C" {
 #define TLS1_AD_INTERNAL_ERROR          80      /* fatal */
 #define TLS1_AD_USER_CANCELLED          90
 #define TLS1_AD_NO_RENEGOTIATION        100
+/* codes 110-114 are from RFC3546 */
+#define TLS1_AD_UNSUPPORTED_EXTENSION   110
+#define TLS1_AD_CERTIFICATE_UNOBTAINABLE 111
+#define TLS1_AD_UNRECOGNIZED_NAME       112
+#define TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE 113
+#define TLS1_AD_BAD_CERTIFICATE_HASH_VALUE 114
+#define TLS1_AD_UNKNOWN_PSK_IDENTITY    115     /* fatal */
+
+/* ExtensionType values from RFC 3546 */
+#define TLSEXT_TYPE_server_name                 0
+#define TLSEXT_TYPE_max_fragment_length         1
+#define TLSEXT_TYPE_client_certificate_url      2
+#define TLSEXT_TYPE_trusted_ca_keys             3
+#define TLSEXT_TYPE_truncated_hmac              4
+#define TLSEXT_TYPE_status_request              5
+#define TLSEXT_TYPE_elliptic_curves             10
+#define TLSEXT_TYPE_ec_point_formats            11
+#define TLSEXT_TYPE_session_ticket              35
+
+/* NameType value from RFC 3546 */
+#define TLSEXT_NAMETYPE_host_name 0
+/* status request value from RFC 3546 */
+#define TLSEXT_STATUSTYPE_ocsp 1
+
+#ifndef OPENSSL_NO_TLSEXT
+
+#define TLSEXT_MAXLEN_host_name 255
+
+const char *SSL_get_servername(const SSL *s, const int type) ;
+int SSL_get_servername_type(const SSL *s) ;
+
+#define SSL_set_tlsext_host_name(s,name) \
+SSL_ctrl(s,SSL_CTRL_SET_TLSEXT_HOSTNAME,TLSEXT_NAMETYPE_host_name,(char *)name)
+
+#define SSL_set_tlsext_debug_callback(ssl, cb) \
+SSL_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_DEBUG_CB,(void (*)(void))cb)
+
+#define SSL_set_tlsext_debug_arg(ssl, arg) \
+SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_DEBUG_ARG,0, (void *)arg)
+
+#define SSL_set_tlsext_status_type(ssl, type) \
+SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE,type, NULL)
+
+#define SSL_get_tlsext_status_exts(ssl, arg) \
+SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS,0, (void *)arg)
+
+#define SSL_set_tlsext_status_exts(ssl, arg) \
+SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS,0, (void *)arg)
+
+#define SSL_get_tlsext_status_ids(ssl, arg) \
+SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS,0, (void *)arg)
+
+#define SSL_set_tlsext_status_ids(ssl, arg) \
+SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS,0, (void *)arg)
+
+#define SSL_get_tlsext_status_ocsp_resp(ssl, arg) \
+SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP,0, (void *)arg)
+
+#define SSL_set_tlsext_status_ocsp_resp(ssl, arg, arglen) \
+SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP,arglen, (void *)arg)
+
+#define SSL_CTX_set_tlsext_servername_callback(ctx, cb) \
+SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SERVERNAME_CB,(void (*)(void))cb)
+
+#define SSL_TLSEXT_ERR_OK 0
+#define SSL_TLSEXT_ERR_ALERT_WARNING 1
+#define SSL_TLSEXT_ERR_ALERT_FATAL 2
+#define SSL_TLSEXT_ERR_NOACK 3
+
+#define SSL_CTX_set_tlsext_servername_arg(ctx, arg) \
+SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG,0, (void *)arg)
+
+#define SSL_CTX_get_tlsext_ticket_keys(ctx, keys, keylen) \
+        SSL_CTX_ctrl((ctx),SSL_CTRL_GET_TLXEXT_TICKET_KEYS,(keylen),(keys))
+#define SSL_CTX_set_tlsext_ticket_keys(ctx, keys, keylen) \
+        SSL_CTX_ctrl((ctx),SSL_CTRL_SET_TLXEXT_TICKET_KEYS,(keylen),(keys))
+
+#define SSL_CTX_set_tlsext_status_cb(ssl, cb) \
+SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB,(void (*)(void))cb)
+
+#define SSL_CTX_set_tlsext_status_arg(ssl, arg) \
+SSL_CTX_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG,0, (void *)arg)
+
+#define SSL_CTX_set_tlsext_ticket_key_cb(ssl, cb) \
+SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
+
+#endif
 
 /* Additional TLS ciphersuites from draft-ietf-tls-56-bit-ciphersuites-00.txt
  * (available if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES is defined, see
@@ -112,6 +212,60 @@ extern "C" {
 #define TLS1_CK_DHE_RSA_WITH_AES_256_SHA                0x03000039
 #define TLS1_CK_ADH_WITH_AES_256_SHA                    0x0300003A
 
+/* Camellia ciphersuites from RFC4132 */
+#define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA           0x03000041
+#define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA        0x03000042
+#define TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA        0x03000043
+#define TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA       0x03000044
+#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA       0x03000045
+#define TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA           0x03000046
+
+#define TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA           0x03000084
+#define TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA        0x03000085
+#define TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA        0x03000086
+#define TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA       0x03000087
+#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA       0x03000088
+#define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA           0x03000089
+
+/* SEED ciphersuites from RFC4162 */
+#define TLS1_CK_RSA_WITH_SEED_SHA                       0x03000096
+#define TLS1_CK_DH_DSS_WITH_SEED_SHA                    0x03000097
+#define TLS1_CK_DH_RSA_WITH_SEED_SHA                    0x03000098
+#define TLS1_CK_DHE_DSS_WITH_SEED_SHA                   0x03000099
+#define TLS1_CK_DHE_RSA_WITH_SEED_SHA                   0x0300009A
+#define TLS1_CK_ADH_WITH_SEED_SHA                       0x0300009B
+
+/* ECC ciphersuites from draft-ietf-tls-ecc-12.txt with changes soon to be in draft 13 */
+#define TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA                0x0300C001
+#define TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA             0x0300C002
+#define TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA        0x0300C003
+#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA         0x0300C004
+#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA         0x0300C005
+
+#define TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA               0x0300C006
+#define TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA            0x0300C007
+#define TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA       0x0300C008
+#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA        0x0300C009
+#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA        0x0300C00A
+
+#define TLS1_CK_ECDH_RSA_WITH_NULL_SHA                  0x0300C00B
+#define TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA               0x0300C00C
+#define TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA          0x0300C00D
+#define TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA           0x0300C00E
+#define TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA           0x0300C00F
+
+#define TLS1_CK_ECDHE_RSA_WITH_NULL_SHA                 0x0300C010
+#define TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA              0x0300C011
+#define TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA         0x0300C012
+#define TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA          0x0300C013
+#define TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA          0x0300C014
+
+#define TLS1_CK_ECDH_anon_WITH_NULL_SHA                 0x0300C015
+#define TLS1_CK_ECDH_anon_WITH_RC4_128_SHA              0x0300C016
+#define TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA         0x0300C017
+#define TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA          0x0300C018
+#define TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA          0x0300C019
+
 /* XXX
  * Inconsistency alert:
  * The OpenSSL names of ciphers with ephemeral DH here include the string
@@ -142,12 +296,68 @@ extern "C" {
 #define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA               "DHE-RSA-AES256-SHA"
 #define TLS1_TXT_ADH_WITH_AES_256_SHA                   "ADH-AES256-SHA"
 
+/* ECC ciphersuites from draft-ietf-tls-ecc-01.txt (Mar 15, 2001) */
+#define TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA               "ECDH-ECDSA-NULL-SHA"
+#define TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA            "ECDH-ECDSA-RC4-SHA"
+#define TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA       "ECDH-ECDSA-DES-CBC3-SHA"
+#define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA        "ECDH-ECDSA-AES128-SHA"
+#define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA        "ECDH-ECDSA-AES256-SHA"
+
+#define TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA              "ECDHE-ECDSA-NULL-SHA"
+#define TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA           "ECDHE-ECDSA-RC4-SHA"
+#define TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA      "ECDHE-ECDSA-DES-CBC3-SHA"
+#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA       "ECDHE-ECDSA-AES128-SHA"
+#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA       "ECDHE-ECDSA-AES256-SHA"
+
+#define TLS1_TXT_ECDH_RSA_WITH_NULL_SHA                 "ECDH-RSA-NULL-SHA"
+#define TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA              "ECDH-RSA-RC4-SHA"
+#define TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA         "ECDH-RSA-DES-CBC3-SHA"
+#define TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA          "ECDH-RSA-AES128-SHA"
+#define TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA          "ECDH-RSA-AES256-SHA"
+
+#define TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA                "ECDHE-RSA-NULL-SHA"
+#define TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA             "ECDHE-RSA-RC4-SHA"
+#define TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA        "ECDHE-RSA-DES-CBC3-SHA"
+#define TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA         "ECDHE-RSA-AES128-SHA"
+#define TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA         "ECDHE-RSA-AES256-SHA"
+
+#define TLS1_TXT_ECDH_anon_WITH_NULL_SHA                "AECDH-NULL-SHA"
+#define TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA             "AECDH-RC4-SHA"
+#define TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA        "AECDH-DES-CBC3-SHA"
+#define TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA         "AECDH-AES128-SHA"
+#define TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA         "AECDH-AES256-SHA"
+
+/* Camellia ciphersuites from RFC4132 */
+#define TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA          "CAMELLIA128-SHA"
+#define TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA       "DH-DSS-CAMELLIA128-SHA"
+#define TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA       "DH-RSA-CAMELLIA128-SHA"
+#define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA      "DHE-DSS-CAMELLIA128-SHA"
+#define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA      "DHE-RSA-CAMELLIA128-SHA"
+#define TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA          "ADH-CAMELLIA128-SHA"
+
+#define TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA          "CAMELLIA256-SHA"
+#define TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA       "DH-DSS-CAMELLIA256-SHA"
+#define TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA       "DH-RSA-CAMELLIA256-SHA"
+#define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA      "DHE-DSS-CAMELLIA256-SHA"
+#define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA      "DHE-RSA-CAMELLIA256-SHA"
+#define TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA          "ADH-CAMELLIA256-SHA"
+
+/* SEED ciphersuites from RFC4162 */
+#define TLS1_TXT_RSA_WITH_SEED_SHA                      "SEED-SHA"
+#define TLS1_TXT_DH_DSS_WITH_SEED_SHA                   "DH-DSS-SEED-SHA"
+#define TLS1_TXT_DH_RSA_WITH_SEED_SHA                   "DH-RSA-SEED-SHA"
+#define TLS1_TXT_DHE_DSS_WITH_SEED_SHA                  "DHE-DSS-SEED-SHA"
+#define TLS1_TXT_DHE_RSA_WITH_SEED_SHA                  "DHE-RSA-SEED-SHA"
+#define TLS1_TXT_ADH_WITH_SEED_SHA                      "ADH-SEED-SHA"
 
 #define TLS_CT_RSA_SIGN                 1
 #define TLS_CT_DSS_SIGN                 2
 #define TLS_CT_RSA_FIXED_DH             3
 #define TLS_CT_DSS_FIXED_DH             4
-#define TLS_CT_NUMBER                   4
+#define TLS_CT_ECDSA_SIGN               64
+#define TLS_CT_RSA_FIXED_ECDH           65
+#define TLS_CT_ECDSA_FIXED_ECDH         66
+#define TLS_CT_NUMBER                   7
 
 #define TLS1_FINISH_MAC_LENGTH          12
 
@@ -193,3 +403,5 @@ extern "C" {
 #endif
 #endif
 
+
+
diff --git a/src/lib/libssl/src/test/bctest b/src/lib/libssl/src/test/bctest
index e81fc0733a..bdb3218f7a 100644
--- a/src/lib/libssl/src/test/bctest
+++ b/src/lib/libssl/src/test/bctest
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-# This script is used by test/Makefile to check whether a sane 'bc'
+# This script is used by test/Makefile.ssl to check whether a sane 'bc'
 # is installed.
 # ('make test_bn' should not try to run 'bc' if it does not exist or if
 # it is a broken 'bc' version that is known to cause trouble.)
diff --git a/src/lib/libssl/src/test/maketests.com b/src/lib/libssl/src/test/maketests.com
index 94621a655b..14cbf06088 100644
--- a/src/lib/libssl/src/test/maketests.com
+++ b/src/lib/libssl/src/test/maketests.com
@@ -127,9 +127,11 @@ $ GOSUB CHECK_OPT_FILE
 $!
 $! Define The TEST Files.
 $!
-$ TEST_FILES = "BNTEST,ECTEST,IDEATEST,MD2TEST,MD4TEST,MD5TEST,HMACTEST,"+ -
+$ TEST_FILES = "BNTEST,ECTEST,ECDSATEST,ECDHTEST,IDEATEST,"+ -
+               "MD2TEST,MD4TEST,MD5TEST,HMACTEST,"+ -
                "RC2TEST,RC4TEST,RC5TEST,"+ -
-               "DESTEST,SHATEST,SHA1TEST,MDC2TEST,RMDTEST,"+ -
+               "DESTEST,SHATEST,SHA1TEST,SHA256T,SHA512T,"+ -
+               "MDC2TEST,RMDTEST,"+ -
                "RANDTEST,DHTEST,ENGINETEST,"+ -
                "BFTEST,CASTTEST,SSLTEST,EXPTEST,DSATEST,RSA_TEST,"+ -
                "EVP_TEST"
diff --git a/src/lib/libssl/src/test/tcrl b/src/lib/libssl/src/test/tcrl
index 3ffed12a03..055269eab8 100644
--- a/src/lib/libssl/src/test/tcrl
+++ b/src/lib/libssl/src/test/tcrl
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 cmd='../util/shlib_wrap.sh ../apps/openssl crl'
 
 if [ "$1"x != "x" ]; then
diff --git a/src/lib/libssl/src/test/testca b/src/lib/libssl/src/test/testca
index 5b2faa78f1..b109cfe271 100644
--- a/src/lib/libssl/src/test/testca
+++ b/src/lib/libssl/src/test/testca
@@ -2,16 +2,16 @@
 
 SH="/bin/sh"
 if test "$OSTYPE" = msdosdjgpp; then
-    PATH=./apps\;../apps\;$PATH
+    PATH="../apps\;$PATH"
 else
-    PATH=../apps:$PATH
+    PATH="../apps:$PATH"
 fi
 export SH PATH
 
 SSLEAY_CONFIG="-config CAss.cnf"
 export SSLEAY_CONFIG
 
-OPENSSL="`pwd`/../util/shlib_wrap.sh openssl"
+OPENSSL="`pwd`/../util/opensslwrap.sh"
 export OPENSSL
 
 /bin/rm -fr demoCA
diff --git a/src/lib/libssl/src/test/testenc b/src/lib/libssl/src/test/testenc
index 4571ea2875..f5ce7c0c45 100644
--- a/src/lib/libssl/src/test/testenc
+++ b/src/lib/libssl/src/test/testenc
@@ -7,8 +7,8 @@ cmd="../util/shlib_wrap.sh ../apps/openssl"
 cat $testsrc >$test;
 
 echo cat
-$cmd enc -non-fips-allow < $test > $test.cipher
-$cmd enc -non-fips-allow < $test.cipher >$test.clear
+$cmd enc < $test > $test.cipher
+$cmd enc < $test.cipher >$test.clear
 cmp $test $test.clear
 if [ $? != 0 ]
 then
@@ -17,8 +17,8 @@ else
         /bin/rm $test.cipher $test.clear
 fi
 echo base64
-$cmd enc -non-fips-allow -a -e < $test > $test.cipher
-$cmd enc -non-fips-allow -a -d < $test.cipher >$test.clear
+$cmd enc -a -e < $test > $test.cipher
+$cmd enc -a -d < $test.cipher >$test.clear
 cmp $test $test.clear
 if [ $? != 0 ]
 then
@@ -30,8 +30,8 @@ fi
 for i in `$cmd list-cipher-commands`
 do
         echo $i
-        $cmd $i -non-fips-allow -bufsize 113 -e -k test < $test > $test.$i.cipher
-        $cmd $i -non-fips-allow -bufsize 157 -d -k test < $test.$i.cipher >$test.$i.clear
+        $cmd $i -bufsize 113 -e -k test < $test > $test.$i.cipher
+        $cmd $i -bufsize 157 -d -k test < $test.$i.cipher >$test.$i.clear
         cmp $test $test.$i.clear
         if [ $? != 0 ]
         then
@@ -41,8 +41,8 @@ do
         fi
 
         echo $i base64
-        $cmd $i -non-fips-allow -bufsize 113 -a -e -k test < $test > $test.$i.cipher
-        $cmd $i -non-fips-allow -bufsize 157 -a -d -k test < $test.$i.cipher >$test.$i.clear
+        $cmd $i -bufsize 113 -a -e -k test < $test > $test.$i.cipher
+        $cmd $i -bufsize 157 -a -d -k test < $test.$i.cipher >$test.$i.clear
         cmp $test $test.$i.clear
         if [ $? != 0 ]
         then
diff --git a/src/lib/libssl/src/test/tests.com b/src/lib/libssl/src/test/tests.com
index 07a3c7f16d..056082e7fe 100644
--- a/src/lib/libssl/src/test/tests.com
+++ b/src/lib/libssl/src/test/tests.com
@@ -22,14 +22,17 @@ $	    tests := -
         test_des,test_idea,test_sha,test_md4,test_md5,test_hmac,-
         test_md2,test_mdc2,-
         test_rmd,test_rc2,test_rc4,test_rc5,test_bf,test_cast,test_rd,-
-        test_rand,test_bn,test_ec,test_enc,test_x509,test_rsa,test_crl,test_sid,-
+        test_rand,test_bn,test_ec,test_ecdsa,test_ecdh,-
+        test_enc,test_x509,test_rsa,test_crl,test_sid,-
         test_gen,test_req,test_pkcs7,test_verify,test_dh,test_dsa,-
-        test_ss,test_ca,test_engine,test_ssl,test_evp
+        test_ss,test_ca,test_engine,test_evp,test_ssl
 $       endif
 $       tests = f$edit(tests,"COLLAPSE")
 $
 $       BNTEST :=       bntest
 $       ECTEST :=       ectest
+$       ECDSATEST :=    ecdsatest
+$       ECDHTEST :=     ecdhtest
 $       EXPTEST :=      exptest
 $       IDEATEST :=     ideatest
 $       SHATEST :=      shatest
@@ -182,6 +185,14 @@ $ test_ec:
 $       write sys$output "test elliptic curves"
 $       mcr 'texe_dir''ectest'
 $       return
+$ test_ecdsa:
+$       write sys$output "test ecdsa"
+$       mcr 'texe_dir''ecdsatest'
+$       return
+$ test_ecdh:
+$       write sys$output "test ecdh"
+$       mcr 'texe_dir''ecdhtest'
+$       return
 $ test_verify:
 $       write sys$output "The following command should have some OK's and some failures"
 $       write sys$output "There are definitly a few expired certificates"
diff --git a/src/lib/libssl/src/test/tpkcs7 b/src/lib/libssl/src/test/tpkcs7
index 79bb6e0edf..3e435ffbf9 100644
--- a/src/lib/libssl/src/test/tpkcs7
+++ b/src/lib/libssl/src/test/tpkcs7
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 cmd='../util/shlib_wrap.sh ../apps/openssl pkcs7'
 
 if [ "$1"x != "x" ]; then
diff --git a/src/lib/libssl/src/test/tpkcs7d b/src/lib/libssl/src/test/tpkcs7d
index 20394b34c4..64fc28e88f 100644
--- a/src/lib/libssl/src/test/tpkcs7d
+++ b/src/lib/libssl/src/test/tpkcs7d
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 cmd='../util/shlib_wrap.sh ../apps/openssl pkcs7'
 
 if [ "$1"x != "x" ]; then
diff --git a/src/lib/libssl/src/test/treq b/src/lib/libssl/src/test/treq
index 7e020210a5..77f37dcf3a 100644
--- a/src/lib/libssl/src/test/treq
+++ b/src/lib/libssl/src/test/treq
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 cmd='../util/shlib_wrap.sh ../apps/openssl req -config ../apps/openssl.cnf'
 
 if [ "$1"x != "x" ]; then
@@ -15,7 +8,7 @@ else
         t=testreq.pem
 fi
 
-if $cmd -in $t -inform p -noout -text | fgrep 'Unknown Public Key'; then
+if $cmd -in $t -inform p -noout -text 2>&1 | fgrep -i 'Unknown Public Key'; then
   echo "skipping req conversion test for $t"
   exit 0
 fi
diff --git a/src/lib/libssl/src/test/trsa b/src/lib/libssl/src/test/trsa
index 67b4a98841..249ac1ddcc 100644
--- a/src/lib/libssl/src/test/trsa
+++ b/src/lib/libssl/src/test/trsa
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 if ../util/shlib_wrap.sh ../apps/openssl no-rsa; then
   echo skipping rsa conversion test
   exit 0
diff --git a/src/lib/libssl/src/test/tsid b/src/lib/libssl/src/test/tsid
index fb4a7213b9..6adbd531ce 100644
--- a/src/lib/libssl/src/test/tsid
+++ b/src/lib/libssl/src/test/tsid
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 cmd='../util/shlib_wrap.sh ../apps/openssl sess_id'
 
 if [ "$1"x != "x" ]; then
diff --git a/src/lib/libssl/src/test/tx509 b/src/lib/libssl/src/test/tx509
index 1b9c8661f3..4a15b98d17 100644
--- a/src/lib/libssl/src/test/tx509
+++ b/src/lib/libssl/src/test/tx509
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 cmd='../util/shlib_wrap.sh ../apps/openssl x509'
 
 if [ "$1"x != "x" ]; then
diff --git a/src/lib/libssl/src/util/ck_errf.pl b/src/lib/libssl/src/util/ck_errf.pl
index 7a24d6c5a2..344b422c34 100644
--- a/src/lib/libssl/src/util/ck_errf.pl
+++ b/src/lib/libssl/src/util/ck_errf.pl
@@ -13,16 +13,21 @@ foreach $file (@ARGV)
         $func="";
         while (<IN>)
                 {
-                if (/^[a-zA-Z].+[\s*]([A-Za-z_0-9]+)\(.*\)/)
+                if (!/;$/ && /^([a-zA-Z].*[\s*])?([A-Za-z_0-9]+)\(.*[),]/)
                         {
-                        $func=$1;
+                        /^([^()]*(\([^()]*\)[^()]*)*)\(/;
+                        $1 =~ /([A-Za-z_0-9]*)$/;
+                        $func = $1;
                         $func =~ tr/A-Z/a-z/;
                         }
                 if (/([A-Z0-9]+)err\(([^,]+)/)
                         {
-                        next if ($func eq "");
                         $errlib=$1;
                         $n=$2;
+
+                        if ($func eq "")
+                                { print "$file:$.:???:$n\n"; next; }
+
                         if ($n !~ /([^_]+)_F_(.+)$/)
                                 {
                 #               print "check -$file:$.:$func:$n\n";
@@ -32,7 +37,7 @@ foreach $file (@ARGV)
                         $n=$2;
 
                         if ($lib ne $errlib)
-                                { print "$file:$.:$func:$n\n"; next; }
+                                { print "$file:$.:$func:$n [${errlib}err]\n"; next; }
 
                         $n =~ tr/A-Z/a-z/;
                         if (($n ne $func) && ($errlib ne "SYS"))
diff --git a/src/lib/libssl/src/util/clean-depend.pl b/src/lib/libssl/src/util/clean-depend.pl
index 6c485d1e2f..2b2bdb4048 100644
--- a/src/lib/libssl/src/util/clean-depend.pl
+++ b/src/lib/libssl/src/util/clean-depend.pl
@@ -37,8 +37,11 @@ foreach $file (sort keys %files) {
     $file=~s/^\.\///;
     push @{$files{$file}},$origfile;
     my $prevdep="";
-    foreach $dep (sort @{$files{$file}}) {
-        $dep=~s/^\.\///;
+
+    # Remove leading ./ before sorting
+    my @deps = map { $_ =~ s/^\.\///; $_ } @{$files{$file}};
+
+    foreach $dep (sort @deps) {
         next if $prevdep eq $dep; # to exterminate duplicates...
         $prevdep = $dep;
         $len=0 if $len+length($dep)+1 >= 80;
diff --git a/src/lib/libssl/src/util/cygwin.sh b/src/lib/libssl/src/util/cygwin.sh
index 7f791d47f4..89d1dda95b 100644
--- a/src/lib/libssl/src/util/cygwin.sh
+++ b/src/lib/libssl/src/util/cygwin.sh
@@ -47,6 +47,14 @@ function doc_install()
   create_cygwin_readme
 }
 
+function certs_install()
+{
+  CERTS_DIR=${INSTALL_PREFIX}/usr/ssl/certs
+
+  mkdir -p ${CERTS_DIR}
+  cp -rp certs/* ${CERTS_DIR}
+}
+
 function create_cygwin_readme()
 {
   README_DIR=${INSTALL_PREFIX}/usr/share/doc/Cygwin
@@ -104,19 +112,25 @@ base_install
 
 doc_install
 
+certs_install
+
 create_cygwin_readme
 
 create_profile_files
 
 cd ${INSTALL_PREFIX}
-strip usr/bin/*.exe usr/bin/*.dll
+chmod u+w usr/lib/engines/*.so
+strip usr/bin/*.exe usr/bin/*.dll usr/lib/engines/*.so
+chmod u-w usr/lib/engines/*.so
 
 # Runtime package
-find etc usr/bin usr/share/doc usr/ssl/certs usr/ssl/man/man[157] \
-     usr/ssl/misc usr/ssl/openssl.cnf usr/ssl/private -empty -o \! -type d |
+find etc usr/bin usr/lib/engines usr/share/doc usr/ssl/certs \
+     usr/ssl/man/man[157] usr/ssl/misc usr/ssl/openssl.cnf usr/ssl/private \
+     -empty -o \! -type d |
 tar cjfT openssl-${VERSION}-${SUBVERSION}.tar.bz2 -
 # Development package
-find usr/include usr/lib usr/ssl/man/man3 -empty -o \! -type d |
+find usr/include usr/lib/*.a usr/lib/pkgconfig usr/ssl/man/man3 \
+     -empty -o \! -type d |
 tar cjfT openssl-devel-${VERSION}-${SUBVERSION}.tar.bz2 -
 
 ls -l openssl-${VERSION}-${SUBVERSION}.tar.bz2
diff --git a/src/lib/libssl/src/util/domd b/src/lib/libssl/src/util/domd
index 5610521f0b..691be7a440 100644
--- a/src/lib/libssl/src/util/domd
+++ b/src/lib/libssl/src/util/domd
@@ -26,7 +26,7 @@ if [ "$MAKEDEPEND" = "gcc" ]; then
     ${PERL} $TOP/util/clean-depend.pl < Makefile.tmp > Makefile.new
     rm -f Makefile.tmp
 else
-    ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND -f Makefile $@
+    ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND $@
     ${PERL} $TOP/util/clean-depend.pl < Makefile > Makefile.new
 fi
 mv Makefile.new Makefile
diff --git a/src/lib/libssl/src/util/libeay.num b/src/lib/libssl/src/util/libeay.num
index 4222bef6d6..2989500c4b 100644
--- a/src/lib/libssl/src/util/libeay.num
+++ b/src/lib/libssl/src/util/libeay.num
@@ -123,10 +123,10 @@ BN_dup                                  128	EXIST::FUNCTION:
 BN_free                                 129     EXIST::FUNCTION:
 BN_from_montgomery                      130     EXIST::FUNCTION:
 BN_gcd                                  131     EXIST::FUNCTION:
-BN_generate_prime                       132     EXIST::FUNCTION:
+BN_generate_prime                       132     EXIST::FUNCTION:DEPRECATED
 BN_get_word                             133     EXIST::FUNCTION:
 BN_is_bit_set                           134     EXIST::FUNCTION:
-BN_is_prime                             135     EXIST::FUNCTION:
+BN_is_prime                             135     EXIST::FUNCTION:DEPRECATED
 BN_lshift                               136     EXIST::FUNCTION:
 BN_lshift1                              137     EXIST::FUNCTION:
 BN_mask_bits                            138     EXIST::FUNCTION:
@@ -193,14 +193,14 @@ DH_check                                200	EXIST::FUNCTION:DH
 DH_compute_key                          201     EXIST::FUNCTION:DH
 DH_free                                 202     EXIST::FUNCTION:DH
 DH_generate_key                         203     EXIST::FUNCTION:DH
-DH_generate_parameters                  204     EXIST::FUNCTION:DH
+DH_generate_parameters                  204     EXIST::FUNCTION:DEPRECATED,DH
 DH_new                                  205     EXIST::FUNCTION:DH
 DH_size                                 206     EXIST::FUNCTION:DH
 DHparams_print                          207     EXIST::FUNCTION:BIO,DH
 DHparams_print_fp                       208     EXIST::FUNCTION:DH,FP_API
 DSA_free                                209     EXIST::FUNCTION:DSA
 DSA_generate_key                        210     EXIST::FUNCTION:DSA
-DSA_generate_parameters                 211     EXIST::FUNCTION:DSA
+DSA_generate_parameters                 211     EXIST::FUNCTION:DEPRECATED,DSA
 DSA_is_prime                            212     NOEXIST::FUNCTION:
 DSA_new                                 213     EXIST::FUNCTION:DSA
 DSA_print                               214     EXIST::FUNCTION:BIO,DSA
@@ -474,7 +474,7 @@ RSAPrivateKey_dup                       481	EXIST::FUNCTION:RSA
 RSAPublicKey_dup                        482     EXIST::FUNCTION:RSA
 RSA_PKCS1_SSLeay                        483     EXIST::FUNCTION:RSA
 RSA_free                                484     EXIST::FUNCTION:RSA
-RSA_generate_key                        485     EXIST::FUNCTION:RSA
+RSA_generate_key                        485     EXIST::FUNCTION:DEPRECATED,RSA
 RSA_new                                 486     EXIST::FUNCTION:RSA
 RSA_new_method                          487     EXIST::FUNCTION:RSA
 RSA_print                               488     EXIST::FUNCTION:BIO,RSA
@@ -802,7 +802,7 @@ DES_set_odd_parity                      809	EXIST::FUNCTION:DES
 DES_string_to_2keys                     810     EXIST::FUNCTION:DES
 DES_string_to_key                       811     EXIST::FUNCTION:DES
 DES_xcbc_encrypt                        812     EXIST::FUNCTION:DES
-DES_xwhite_in2out                       813     EXIST::FUNCTION:DES
+DES_xwhite_in2out                       813     NOEXIST::FUNCTION:
 fcrypt_body                             814     NOEXIST::FUNCTION:
 i2a_ASN1_INTEGER                        815     EXIST::FUNCTION:BIO
 i2a_ASN1_OBJECT                         816     EXIST::FUNCTION:BIO
@@ -1104,7 +1104,7 @@ BN_RECP_CTX_set                         1131	EXIST::FUNCTION:
 BN_mod_mul_reciprocal                   1132    EXIST::FUNCTION:
 BN_mod_exp_recp                         1133    EXIST::FUNCTION:
 BN_div_recp                             1134    EXIST::FUNCTION:
-BN_CTX_init                             1135    EXIST::FUNCTION:
+BN_CTX_init                             1135    EXIST::FUNCTION:DEPRECATED
 BN_MONT_CTX_init                        1136    EXIST::FUNCTION:
 RAND_get_rand_method                    1137    EXIST::FUNCTION:
 PKCS7_add_attribute                     1138    EXIST::FUNCTION:
@@ -1221,8 +1221,8 @@ BIO_f_reliable                          1244	EXIST::FUNCTION:BIO
 PKCS7_dataFinal                         1245    EXIST::FUNCTION:
 PKCS7_dataDecode                        1246    EXIST::FUNCTION:
 X509V3_EXT_CRL_add_conf                 1247    EXIST::FUNCTION:
-BN_set_params                           1248    EXIST::FUNCTION:
-BN_get_params                           1249    EXIST::FUNCTION:
+BN_set_params                           1248    EXIST::FUNCTION:DEPRECATED
+BN_get_params                           1249    EXIST::FUNCTION:DEPRECATED
 BIO_get_ex_num                          1250    NOEXIST::FUNCTION:
 BIO_set_ex_free_func                    1251    NOEXIST::FUNCTION:
 EVP_ripemd160                           1252    EXIST::FUNCTION:RIPEMD
@@ -1744,7 +1744,7 @@ X509_REQ_add1_attr_by_txt               2217	EXIST::FUNCTION:
 X509_ATTRIBUTE_create_by_txt            2218    EXIST::FUNCTION:
 X509at_add1_attr_by_txt                 2219    EXIST::FUNCTION:
 BN_pseudo_rand                          2239    EXIST::FUNCTION:
-BN_is_prime_fasttest                    2240    EXIST::FUNCTION:
+BN_is_prime_fasttest                    2240    EXIST::FUNCTION:DEPRECATED
 BN_CTX_end                              2241    EXIST::FUNCTION:
 BN_CTX_start                            2242    EXIST::FUNCTION:
 BN_CTX_get                              2243    EXIST::FUNCTION:
@@ -2071,7 +2071,7 @@ PKCS7_ATTR_SIGN_it                      2632	EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTI
 UI_add_error_string                     2633    EXIST::FUNCTION:
 KRB5_CHECKSUM_free                      2634    EXIST::FUNCTION:
 OCSP_REQUEST_get_ext                    2635    EXIST::FUNCTION:
-ENGINE_load_ubsec                       2636    EXIST::FUNCTION:ENGINE
+ENGINE_load_ubsec                       2636    EXIST::FUNCTION:ENGINE,STATIC_ENGINE
 ENGINE_register_all_digests             2637    EXIST::FUNCTION:ENGINE
 PKEY_USAGE_PERIOD_it                    2638    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
 PKEY_USAGE_PERIOD_it                    2638    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
@@ -2089,7 +2089,7 @@ OCSP_BASICRESP_get_ext_by_crit          2646	EXIST:VMS:FUNCTION:
 OCSP_cert_status_str                    2647    EXIST::FUNCTION:
 d2i_OCSP_REQUEST                        2648    EXIST::FUNCTION:
 UI_dup_info_string                      2649    EXIST::FUNCTION:
-_ossl_old_des_xwhite_in2out             2650    EXIST::FUNCTION:DES
+_ossl_old_des_xwhite_in2out             2650    NOEXIST::FUNCTION:
 PKCS12_it                               2651    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
 PKCS12_it                               2651    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
 OCSP_SINGLERESP_get_ext_by_critical     2652    EXIST:!VMS:FUNCTION:
@@ -2419,7 +2419,7 @@ UI_get_string_type                      2916	EXIST::FUNCTION:
 ENGINE_unregister_DH                    2917    EXIST::FUNCTION:ENGINE
 ENGINE_register_all_DSA                 2918    EXIST::FUNCTION:ENGINE
 OCSP_ONEREQ_get_ext_by_critical         2919    EXIST::FUNCTION:
-bn_dup_expand                           2920    EXIST::FUNCTION:
+bn_dup_expand                           2920    EXIST::FUNCTION:DEPRECATED
 OCSP_cert_id_new                        2921    EXIST::FUNCTION:
 BASIC_CONSTRAINTS_it                    2922    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
 BASIC_CONSTRAINTS_it                    2922    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
@@ -2545,7 +2545,7 @@ OCSP_RESPONSE_new                       3023	EXIST::FUNCTION:
 AES_set_encrypt_key                     3024    EXIST::FUNCTION:AES
 OCSP_resp_count                         3025    EXIST::FUNCTION:
 KRB5_CHECKSUM_new                       3026    EXIST::FUNCTION:
-ENGINE_load_cswift                      3027    EXIST::FUNCTION:ENGINE
+ENGINE_load_cswift                      3027    EXIST::FUNCTION:ENGINE,STATIC_ENGINE
 OCSP_onereq_get0_id                     3028    EXIST::FUNCTION:
 ENGINE_set_default_ciphers              3029    EXIST::FUNCTION:ENGINE
 NOTICEREF_it                            3030    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
@@ -2576,7 +2576,7 @@ ASN1_primitive_free                     3051	EXIST::FUNCTION:
 i2d_EXTENDED_KEY_USAGE                  3052    EXIST::FUNCTION:
 i2d_OCSP_SIGNATURE                      3053    EXIST::FUNCTION:
 asn1_enc_save                           3054    EXIST::FUNCTION:
-ENGINE_load_nuron                       3055    EXIST::FUNCTION:ENGINE
+ENGINE_load_nuron                       3055    EXIST::FUNCTION:ENGINE,STATIC_ENGINE
 _ossl_old_des_pcbc_encrypt              3056    EXIST::FUNCTION:DES
 PKCS12_MAC_DATA_it                      3057    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
 PKCS12_MAC_DATA_it                      3057    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
@@ -2600,7 +2600,7 @@ asn1_get_choice_selector                3071	EXIST::FUNCTION:
 i2d_KRB5_CHECKSUM                       3072    EXIST::FUNCTION:
 ENGINE_set_table_flags                  3073    EXIST::FUNCTION:ENGINE
 AES_options                             3074    EXIST::FUNCTION:AES
-ENGINE_load_chil                        3075    EXIST::FUNCTION:ENGINE
+ENGINE_load_chil                        3075    EXIST::FUNCTION:ENGINE,STATIC_ENGINE
 OCSP_id_cmp                             3076    EXIST::FUNCTION:
 OCSP_BASICRESP_new                      3077    EXIST::FUNCTION:
 OCSP_REQUEST_get_ext_by_NID             3078    EXIST::FUNCTION:
@@ -2667,7 +2667,7 @@ OCSP_CRLID_it                           3127	EXIST:!EXPORT_VAR_AS_FUNCTION:VARIA
 OCSP_CRLID_it                           3127    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
 i2d_KRB5_AUTHENTBODY                    3128    EXIST::FUNCTION:
 OCSP_REQUEST_get_ext_count              3129    EXIST::FUNCTION:
-ENGINE_load_atalla                      3130    EXIST::FUNCTION:ENGINE
+ENGINE_load_atalla                      3130    EXIST::FUNCTION:ENGINE,STATIC_ENGINE
 X509_NAME_it                            3131    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
 X509_NAME_it                            3131    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
 USERNOTICE_it                           3132    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
@@ -2762,8 +2762,8 @@ DES_read_2passwords                     3206	EXIST::FUNCTION:DES
 DES_read_password                       3207    EXIST::FUNCTION:DES
 UI_UTIL_read_pw                         3208    EXIST::FUNCTION:
 UI_UTIL_read_pw_string                  3209    EXIST::FUNCTION:
-ENGINE_load_aep                         3210    EXIST::FUNCTION:ENGINE
-ENGINE_load_sureware                    3211    EXIST::FUNCTION:ENGINE
+ENGINE_load_aep                         3210    EXIST::FUNCTION:ENGINE,STATIC_ENGINE
+ENGINE_load_sureware                    3211    EXIST::FUNCTION:ENGINE,STATIC_ENGINE
 OPENSSL_add_all_algorithms_noconf       3212    EXIST:!VMS:FUNCTION:
 OPENSSL_add_all_algo_noconf             3212    EXIST:VMS:FUNCTION:
 OPENSSL_add_all_algorithms_conf         3213    EXIST:!VMS:FUNCTION:
@@ -2772,7 +2772,7 @@ OPENSSL_load_builtin_modules            3214	EXIST::FUNCTION:
 AES_ofb128_encrypt                      3215    EXIST::FUNCTION:AES
 AES_ctr128_encrypt                      3216    EXIST::FUNCTION:AES
 AES_cfb128_encrypt                      3217    EXIST::FUNCTION:AES
-ENGINE_load_4758cca                     3218    EXIST::FUNCTION:ENGINE
+ENGINE_load_4758cca                     3218    EXIST::FUNCTION:ENGINE,STATIC_ENGINE
 _ossl_096_des_random_seed               3219    EXIST::FUNCTION:DES
 EVP_aes_256_ofb                         3220    EXIST::FUNCTION:AES
 EVP_aes_192_ofb                         3221    EXIST::FUNCTION:AES
@@ -2804,57 +2804,57 @@ OPENSSL_cleanse                         3245	EXIST::FUNCTION:
 ENGINE_setup_bsd_cryptodev              3246    EXIST:__FreeBSD__:FUNCTION:ENGINE
 ERR_release_err_state_table             3247    EXIST::FUNCTION:LHASH
 EVP_aes_128_cfb8                        3248    EXIST::FUNCTION:AES
-FIPS_corrupt_rsa                        3249    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_selftest_des                       3250    EXIST:OPENSSL_FIPS:FUNCTION:
+FIPS_corrupt_rsa                        3249    NOEXIST::FUNCTION:
+FIPS_selftest_des                       3250    NOEXIST::FUNCTION:
 EVP_aes_128_cfb1                        3251    EXIST::FUNCTION:AES
 EVP_aes_192_cfb8                        3252    EXIST::FUNCTION:AES
-FIPS_mode_set                           3253    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_selftest_dsa                       3254    EXIST:OPENSSL_FIPS:FUNCTION:
+FIPS_mode_set                           3253    NOEXIST::FUNCTION:
+FIPS_selftest_dsa                       3254    NOEXIST::FUNCTION:
 EVP_aes_256_cfb8                        3255    EXIST::FUNCTION:AES
 FIPS_allow_md5                          3256    NOEXIST::FUNCTION:
 DES_ede3_cfb_encrypt                    3257    EXIST::FUNCTION:DES
 EVP_des_ede3_cfb8                       3258    EXIST::FUNCTION:DES
-FIPS_rand_seeded                        3259    EXIST:OPENSSL_FIPS:FUNCTION:
+FIPS_rand_seeded                        3259    NOEXIST::FUNCTION:
 AES_cfbr_encrypt_block                  3260    EXIST::FUNCTION:AES
 AES_cfb8_encrypt                        3261    EXIST::FUNCTION:AES
-FIPS_rand_seed                          3262    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_corrupt_des                        3263    EXIST:OPENSSL_FIPS:FUNCTION:
+FIPS_rand_seed                          3262    NOEXIST::FUNCTION:
+FIPS_corrupt_des                        3263    NOEXIST::FUNCTION:
 EVP_aes_192_cfb1                        3264    EXIST::FUNCTION:AES
-FIPS_selftest_aes                       3265    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_set_prng_key                       3266    EXIST:OPENSSL_FIPS:FUNCTION:
+FIPS_selftest_aes                       3265    NOEXIST::FUNCTION:
+FIPS_set_prng_key                       3266    NOEXIST::FUNCTION:
 EVP_des_cfb8                            3267    EXIST::FUNCTION:DES
-FIPS_corrupt_dsa                        3268    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_test_mode                          3269    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_rand_method                        3270    EXIST:OPENSSL_FIPS:FUNCTION:
+FIPS_corrupt_dsa                        3268    NOEXIST::FUNCTION:
+FIPS_test_mode                          3269    NOEXIST::FUNCTION:
+FIPS_rand_method                        3270    NOEXIST::FUNCTION:
 EVP_aes_256_cfb1                        3271    EXIST::FUNCTION:AES
-ERR_load_FIPS_strings                   3272    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_corrupt_aes                        3273    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_selftest_sha1                      3274    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_selftest_rsa                       3275    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_corrupt_sha1                       3276    EXIST:OPENSSL_FIPS:FUNCTION:
+ERR_load_FIPS_strings                   3272    NOEXIST::FUNCTION:
+FIPS_corrupt_aes                        3273    NOEXIST::FUNCTION:
+FIPS_selftest_sha1                      3274    NOEXIST::FUNCTION:
+FIPS_selftest_rsa                       3275    NOEXIST::FUNCTION:
+FIPS_corrupt_sha1                       3276    NOEXIST::FUNCTION:
 EVP_des_cfb1                            3277    EXIST::FUNCTION:DES
-FIPS_dsa_check                          3278    EXIST:OPENSSL_FIPS:FUNCTION:
+FIPS_dsa_check                          3278    NOEXIST::FUNCTION:
 AES_cfb1_encrypt                        3279    EXIST::FUNCTION:AES
 EVP_des_ede3_cfb1                       3280    EXIST::FUNCTION:DES
-FIPS_rand_check                         3281    EXIST:OPENSSL_FIPS:FUNCTION:
+FIPS_rand_check                         3281    NOEXIST::FUNCTION:
 FIPS_md5_allowed                        3282    NOEXIST::FUNCTION:
-FIPS_mode                               3283    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_selftest_failed                    3284    EXIST:OPENSSL_FIPS:FUNCTION:
+FIPS_mode                               3283    NOEXIST::FUNCTION:
+FIPS_selftest_failed                    3284    NOEXIST::FUNCTION:
 sk_is_sorted                            3285    EXIST::FUNCTION:
 X509_check_ca                           3286    EXIST::FUNCTION:
-private_idea_set_encrypt_key            3287    EXIST:OPENSSL_FIPS:FUNCTION:IDEA
-HMAC_CTX_set_flags                      3288    EXIST::FUNCTION:HMAC
-private_SHA_Init                        3289    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA0
-private_CAST_set_key                    3290    EXIST:OPENSSL_FIPS:FUNCTION:CAST
-private_RIPEMD160_Init                  3291    EXIST:OPENSSL_FIPS:FUNCTION:RIPEMD
-private_RC5_32_set_key                  3292    EXIST:OPENSSL_FIPS:FUNCTION:RC5
-private_MD5_Init                        3293    EXIST:OPENSSL_FIPS:FUNCTION:MD5
-private_RC4_set_key                     3294    EXIST:OPENSSL_FIPS:FUNCTION:RC4
-private_MDC2_Init                       3295    EXIST:OPENSSL_FIPS:FUNCTION:MDC2
-private_RC2_set_key                     3296    EXIST:OPENSSL_FIPS:FUNCTION:RC2
-private_MD4_Init                        3297    EXIST:OPENSSL_FIPS:FUNCTION:MD4
-private_BF_set_key                      3298    EXIST:OPENSSL_FIPS:FUNCTION:BF
-private_MD2_Init                        3299    EXIST:OPENSSL_FIPS:FUNCTION:MD2
+private_idea_set_encrypt_key            3287    NOEXIST::FUNCTION:
+HMAC_CTX_set_flags                      3288    NOEXIST::FUNCTION:
+private_SHA_Init                        3289    NOEXIST::FUNCTION:
+private_CAST_set_key                    3290    NOEXIST::FUNCTION:
+private_RIPEMD160_Init                  3291    NOEXIST::FUNCTION:
+private_RC5_32_set_key                  3292    NOEXIST::FUNCTION:
+private_MD5_Init                        3293    NOEXIST::FUNCTION:
+private_RC4_set_key                     3294    NOEXIST::FUNCTION:
+private_MDC2_Init                       3295    NOEXIST::FUNCTION:
+private_RC2_set_key                     3296    NOEXIST::FUNCTION:
+private_MD4_Init                        3297    NOEXIST::FUNCTION:
+private_BF_set_key                      3298    NOEXIST::FUNCTION:
+private_MD2_Init                        3299    NOEXIST::FUNCTION:
 d2i_PROXY_CERT_INFO_EXTENSION           3300    EXIST::FUNCTION:
 PROXY_POLICY_it                         3301    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
 PROXY_POLICY_it                         3301    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
@@ -2868,13 +2868,13 @@ PROXY_CERT_INFO_EXTENSION_it            3307	EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTI
 PROXY_POLICY_free                       3308    EXIST::FUNCTION:
 PROXY_POLICY_new                        3309    EXIST::FUNCTION:
 BN_MONT_CTX_set_locked                  3310    EXIST::FUNCTION:
-FIPS_selftest_rng                       3311    EXIST:OPENSSL_FIPS:FUNCTION:
-EVP_sha384                              3312    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-EVP_sha512                              3313    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-EVP_sha224                              3314    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-EVP_sha256                              3315    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-FIPS_selftest_hmac                      3316    EXIST:OPENSSL_FIPS:FUNCTION:
-FIPS_corrupt_rng                        3317    EXIST:OPENSSL_FIPS:FUNCTION:
+FIPS_selftest_rng                       3311    NOEXIST::FUNCTION:
+EVP_sha384                              3312    EXIST::FUNCTION:SHA,SHA512
+EVP_sha512                              3313    EXIST::FUNCTION:SHA,SHA512
+EVP_sha224                              3314    EXIST::FUNCTION:SHA,SHA256
+EVP_sha256                              3315    EXIST::FUNCTION:SHA,SHA256
+FIPS_selftest_hmac                      3316    NOEXIST::FUNCTION:
+FIPS_corrupt_rng                        3317    NOEXIST::FUNCTION:
 BN_mod_exp_mont_consttime               3318    EXIST::FUNCTION:
 RSA_X931_hash_id                        3319    EXIST::FUNCTION:RSA
 RSA_padding_check_X931                  3320    EXIST::FUNCTION:RSA
@@ -2882,26 +2882,773 @@ RSA_verify_PKCS1_PSS                    3321	EXIST::FUNCTION:RSA
 RSA_padding_add_X931                    3322    EXIST::FUNCTION:RSA
 RSA_padding_add_PKCS1_PSS               3323    EXIST::FUNCTION:RSA
 PKCS1_MGF1                              3324    EXIST::FUNCTION:RSA
-BN_X931_generate_Xpq                    3325    EXIST:OPENSSL_FIPS:FUNCTION:
-RSA_X931_generate_key                   3326    EXIST:OPENSSL_FIPS:FUNCTION:RSA
-BN_X931_derive_prime                    3327    EXIST:OPENSSL_FIPS:FUNCTION:
-BN_X931_generate_prime                  3328    EXIST:OPENSSL_FIPS:FUNCTION:
-RSA_X931_derive                         3329    EXIST:OPENSSL_FIPS:FUNCTION:RSA
-SHA512_Update                           3356    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA256_Init                             3479    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA224                                  3510    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA384_Update                           3551    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA224_Final                            3560    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA224_Update                           3562    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA512_Final                            3581    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA224_Init                             3631    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA512_Init                             3633    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA256                                  3654    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA256_Transform                        3664    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA512                                  3669    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA512_Transform                        3675    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA256_Final                            3712    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
-SHA384_Init                             3737    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA384_Final                            3740    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA384                                  3745    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA512
-SHA256_Update                           3765    EXIST:OPENSSL_FIPS:FUNCTION:SHA,SHA256
+BN_X931_generate_Xpq                    3325    NOEXIST::FUNCTION:
+RSA_X931_generate_key                   3326    NOEXIST::FUNCTION:
+BN_X931_derive_prime                    3327    NOEXIST::FUNCTION:
+BN_X931_generate_prime                  3328    NOEXIST::FUNCTION:
+RSA_X931_derive                         3329    NOEXIST::FUNCTION:
+BIO_new_dgram                           3330    EXIST::FUNCTION:
+BN_get0_nist_prime_384                  3331    EXIST::FUNCTION:
+ERR_set_mark                            3332    EXIST::FUNCTION:
+X509_STORE_CTX_set0_crls                3333    EXIST::FUNCTION:
+ENGINE_set_STORE                        3334    EXIST::FUNCTION:ENGINE
+ENGINE_register_ECDSA                   3335    EXIST::FUNCTION:ENGINE
+STORE_method_set_list_start_function    3336    EXIST:!VMS:FUNCTION:
+STORE_meth_set_list_start_fn            3336    EXIST:VMS:FUNCTION:
+BN_BLINDING_invert_ex                   3337    EXIST::FUNCTION:
+NAME_CONSTRAINTS_free                   3338    EXIST::FUNCTION:
+STORE_ATTR_INFO_set_number              3339    EXIST::FUNCTION:
+BN_BLINDING_get_thread_id               3340    EXIST::FUNCTION:
+X509_STORE_CTX_set0_param               3341    EXIST::FUNCTION:
+POLICY_MAPPING_it                       3342    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
+POLICY_MAPPING_it                       3342    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
+STORE_parse_attrs_start                 3343    EXIST::FUNCTION:
+POLICY_CONSTRAINTS_free                 3344    EXIST::FUNCTION:
+EVP_PKEY_add1_attr_by_NID               3345    EXIST::FUNCTION:
+BN_nist_mod_192                         3346    EXIST::FUNCTION:
+EC_GROUP_get_trinomial_basis            3347    EXIST::FUNCTION:EC
+STORE_set_method                        3348    EXIST::FUNCTION:
+GENERAL_SUBTREE_free                    3349    EXIST::FUNCTION:
+NAME_CONSTRAINTS_it                     3350    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
+NAME_CONSTRAINTS_it                     3350    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
+ECDH_get_default_method                 3351    EXIST::FUNCTION:ECDH
+PKCS12_add_safe                         3352    EXIST::FUNCTION:
+EC_KEY_new_by_curve_name                3353    EXIST::FUNCTION:EC
+STORE_method_get_update_store_function  3354    EXIST:!VMS:FUNCTION:
+STORE_meth_get_update_store_fn          3354    EXIST:VMS:FUNCTION:
+ENGINE_register_ECDH                    3355    EXIST::FUNCTION:ENGINE
+SHA512_Update                           3356    EXIST::FUNCTION:SHA,SHA512
+i2d_ECPrivateKey                        3357    EXIST::FUNCTION:EC
+BN_get0_nist_prime_192                  3358    EXIST::FUNCTION:
+STORE_modify_certificate                3359    EXIST::FUNCTION:
+EC_POINT_set_affine_coordinates_GF2m    3360    EXIST:!VMS:FUNCTION:EC
+EC_POINT_set_affine_coords_GF2m         3360    EXIST:VMS:FUNCTION:EC
+BN_GF2m_mod_exp_arr                     3361    EXIST::FUNCTION:
+STORE_ATTR_INFO_modify_number           3362    EXIST::FUNCTION:
+X509_keyid_get0                         3363    EXIST::FUNCTION:
+ENGINE_load_gmp                         3364    EXIST::FUNCTION:ENGINE,GMP,STATIC_ENGINE
+pitem_new                               3365    EXIST::FUNCTION:
+BN_GF2m_mod_mul_arr                     3366    EXIST::FUNCTION:
+STORE_list_public_key_endp              3367    EXIST::FUNCTION:
+o2i_ECPublicKey                         3368    EXIST::FUNCTION:EC
+EC_KEY_copy                             3369    EXIST::FUNCTION:EC
+BIO_dump_fp                             3370    EXIST::FUNCTION:FP_API
+X509_policy_node_get0_parent            3371    EXIST::FUNCTION:
+EC_GROUP_check_discriminant             3372    EXIST::FUNCTION:EC
+i2o_ECPublicKey                         3373    EXIST::FUNCTION:EC
+EC_KEY_precompute_mult                  3374    EXIST::FUNCTION:EC
+a2i_IPADDRESS                           3375    EXIST::FUNCTION:
+STORE_method_set_initialise_function    3376    EXIST:!VMS:FUNCTION:
+STORE_meth_set_initialise_fn            3376    EXIST:VMS:FUNCTION:
+X509_STORE_CTX_set_depth                3377    EXIST::FUNCTION:
+X509_VERIFY_PARAM_inherit               3378    EXIST::FUNCTION:
+EC_POINT_point2bn                       3379    EXIST::FUNCTION:EC
+STORE_ATTR_INFO_set_dn                  3380    EXIST::FUNCTION:
+X509_policy_tree_get0_policies          3381    EXIST::FUNCTION:
+EC_GROUP_new_curve_GF2m                 3382    EXIST::FUNCTION:EC
+STORE_destroy_method                    3383    EXIST::FUNCTION:
+ENGINE_unregister_STORE                 3384    EXIST::FUNCTION:ENGINE
+EVP_PKEY_get1_EC_KEY                    3385    EXIST::FUNCTION:EC
+STORE_ATTR_INFO_get0_number             3386    EXIST::FUNCTION:
+ENGINE_get_default_ECDH                 3387    EXIST::FUNCTION:ENGINE
+EC_KEY_get_conv_form                    3388    EXIST::FUNCTION:EC
+ASN1_OCTET_STRING_NDEF_it               3389    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
+ASN1_OCTET_STRING_NDEF_it               3389    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
+STORE_delete_public_key                 3390    EXIST::FUNCTION:
+STORE_get_public_key                    3391    EXIST::FUNCTION:
+STORE_modify_arbitrary                  3392    EXIST::FUNCTION:
+ENGINE_get_static_state                 3393    EXIST::FUNCTION:ENGINE
+pqueue_iterator                         3394    EXIST::FUNCTION:
+ECDSA_SIG_new                           3395    EXIST::FUNCTION:ECDSA
+OPENSSL_DIR_end                         3396    EXIST::FUNCTION:
+BN_GF2m_mod_sqr                         3397    EXIST::FUNCTION:
+EC_POINT_bn2point                       3398    EXIST::FUNCTION:EC
+X509_VERIFY_PARAM_set_depth             3399    EXIST::FUNCTION:
+EC_KEY_set_asn1_flag                    3400    EXIST::FUNCTION:EC
+STORE_get_method                        3401    EXIST::FUNCTION:
+EC_KEY_get_key_method_data              3402    EXIST::FUNCTION:EC
+ECDSA_sign_ex                           3403    EXIST::FUNCTION:ECDSA
+STORE_parse_attrs_end                   3404    EXIST::FUNCTION:
+EC_GROUP_get_point_conversion_form      3405    EXIST:!VMS:FUNCTION:EC
+EC_GROUP_get_point_conv_form            3405    EXIST:VMS:FUNCTION:EC
+STORE_method_set_store_function         3406    EXIST::FUNCTION:
+STORE_ATTR_INFO_in                      3407    EXIST::FUNCTION:
+PEM_read_bio_ECPKParameters             3408    EXIST::FUNCTION:EC
+EC_GROUP_get_pentanomial_basis          3409    EXIST::FUNCTION:EC
+EVP_PKEY_add1_attr_by_txt               3410    EXIST::FUNCTION:
+BN_BLINDING_set_flags                   3411    EXIST::FUNCTION:
+X509_VERIFY_PARAM_set1_policies         3412    EXIST::FUNCTION:
+X509_VERIFY_PARAM_set1_name             3413    EXIST::FUNCTION:
+X509_VERIFY_PARAM_set_purpose           3414    EXIST::FUNCTION:
+STORE_get_number                        3415    EXIST::FUNCTION:
+ECDSA_sign_setup                        3416    EXIST::FUNCTION:ECDSA
+BN_GF2m_mod_solve_quad_arr              3417    EXIST::FUNCTION:
+EC_KEY_up_ref                           3418    EXIST::FUNCTION:EC
+POLICY_MAPPING_free                     3419    EXIST::FUNCTION:
+BN_GF2m_mod_div                         3420    EXIST::FUNCTION:
+X509_VERIFY_PARAM_set_flags             3421    EXIST::FUNCTION:
+EC_KEY_free                             3422    EXIST::FUNCTION:EC
+STORE_method_set_list_next_function     3423    EXIST:!VMS:FUNCTION:
+STORE_meth_set_list_next_fn             3423    EXIST:VMS:FUNCTION:
+PEM_write_bio_ECPrivateKey              3424    EXIST::FUNCTION:EC
+d2i_EC_PUBKEY                           3425    EXIST::FUNCTION:EC
+STORE_method_get_generate_function      3426    EXIST:!VMS:FUNCTION:
+STORE_meth_get_generate_fn              3426    EXIST:VMS:FUNCTION:
+STORE_method_set_list_end_function      3427    EXIST:!VMS:FUNCTION:
+STORE_meth_set_list_end_fn              3427    EXIST:VMS:FUNCTION:
+pqueue_print                            3428    EXIST::FUNCTION:
+EC_GROUP_have_precompute_mult           3429    EXIST::FUNCTION:EC
+EC_KEY_print_fp                         3430    EXIST::FUNCTION:EC,FP_API
+BN_GF2m_mod_arr                         3431    EXIST::FUNCTION:
+PEM_write_bio_X509_CERT_PAIR            3432    EXIST::FUNCTION:
+EVP_PKEY_cmp                            3433    EXIST::FUNCTION:
+X509_policy_level_node_count            3434    EXIST::FUNCTION:
+STORE_new_engine                        3435    EXIST::FUNCTION:
+STORE_list_public_key_start             3436    EXIST::FUNCTION:
+X509_VERIFY_PARAM_new                   3437    EXIST::FUNCTION:
+ECDH_get_ex_data                        3438    EXIST::FUNCTION:ECDH
+EVP_PKEY_get_attr                       3439    EXIST::FUNCTION:
+ECDSA_do_sign                           3440    EXIST::FUNCTION:ECDSA
+ENGINE_unregister_ECDH                  3441    EXIST::FUNCTION:ENGINE
+ECDH_OpenSSL                            3442    EXIST::FUNCTION:ECDH
+EC_KEY_set_conv_form                    3443    EXIST::FUNCTION:EC
+EC_POINT_dup                            3444    EXIST::FUNCTION:EC
+GENERAL_SUBTREE_new                     3445    EXIST::FUNCTION:
+STORE_list_crl_endp                     3446    EXIST::FUNCTION:
+EC_get_builtin_curves                   3447    EXIST::FUNCTION:EC
+X509_policy_node_get0_qualifiers        3448    EXIST:!VMS:FUNCTION:
+X509_pcy_node_get0_qualifiers           3448    EXIST:VMS:FUNCTION:
+STORE_list_crl_end                      3449    EXIST::FUNCTION:
+EVP_PKEY_set1_EC_KEY                    3450    EXIST::FUNCTION:EC
+BN_GF2m_mod_sqrt_arr                    3451    EXIST::FUNCTION:
+i2d_ECPrivateKey_bio                    3452    EXIST::FUNCTION:BIO,EC
+ECPKParameters_print_fp                 3453    EXIST::FUNCTION:EC,FP_API
+pqueue_find                             3454    EXIST::FUNCTION:
+ECDSA_SIG_free                          3455    EXIST::FUNCTION:ECDSA
+PEM_write_bio_ECPKParameters            3456    EXIST::FUNCTION:EC
+STORE_method_set_ctrl_function          3457    EXIST::FUNCTION:
+STORE_list_public_key_end               3458    EXIST::FUNCTION:
+EC_KEY_set_private_key                  3459    EXIST::FUNCTION:EC
+pqueue_peek                             3460    EXIST::FUNCTION:
+STORE_get_arbitrary                     3461    EXIST::FUNCTION:
+STORE_store_crl                         3462    EXIST::FUNCTION:
+X509_policy_node_get0_policy            3463    EXIST::FUNCTION:
+PKCS12_add_safes                        3464    EXIST::FUNCTION:
+BN_BLINDING_convert_ex                  3465    EXIST::FUNCTION:
+X509_policy_tree_free                   3466    EXIST::FUNCTION:
+OPENSSL_ia32cap_loc                     3467    EXIST::FUNCTION:
+BN_GF2m_poly2arr                        3468    EXIST::FUNCTION:
+STORE_ctrl                              3469    EXIST::FUNCTION:
+STORE_ATTR_INFO_compare                 3470    EXIST::FUNCTION:
+BN_get0_nist_prime_224                  3471    EXIST::FUNCTION:
+i2d_ECParameters                        3472    EXIST::FUNCTION:EC
+i2d_ECPKParameters                      3473    EXIST::FUNCTION:EC
+BN_GENCB_call                           3474    EXIST::FUNCTION:
+d2i_ECPKParameters                      3475    EXIST::FUNCTION:EC
+STORE_method_set_generate_function      3476    EXIST:!VMS:FUNCTION:
+STORE_meth_set_generate_fn              3476    EXIST:VMS:FUNCTION:
+ENGINE_set_ECDH                         3477    EXIST::FUNCTION:ENGINE
+NAME_CONSTRAINTS_new                    3478    EXIST::FUNCTION:
+SHA256_Init                             3479    EXIST::FUNCTION:SHA,SHA256
+EC_KEY_get0_public_key                  3480    EXIST::FUNCTION:EC
+PEM_write_bio_EC_PUBKEY                 3481    EXIST::FUNCTION:EC
+STORE_ATTR_INFO_set_cstr                3482    EXIST::FUNCTION:
+STORE_list_crl_next                     3483    EXIST::FUNCTION:
+STORE_ATTR_INFO_in_range                3484    EXIST::FUNCTION:
+ECParameters_print                      3485    EXIST::FUNCTION:BIO,EC
+STORE_method_set_delete_function        3486    EXIST:!VMS:FUNCTION:
+STORE_meth_set_delete_fn                3486    EXIST:VMS:FUNCTION:
+STORE_list_certificate_next             3487    EXIST::FUNCTION:
+ASN1_generate_nconf                     3488    EXIST::FUNCTION:
+BUF_memdup                              3489    EXIST::FUNCTION:
+BN_GF2m_mod_mul                         3490    EXIST::FUNCTION:
+STORE_method_get_list_next_function     3491    EXIST:!VMS:FUNCTION:
+STORE_meth_get_list_next_fn             3491    EXIST:VMS:FUNCTION:
+STORE_ATTR_INFO_get0_dn                 3492    EXIST::FUNCTION:
+STORE_list_private_key_next             3493    EXIST::FUNCTION:
+EC_GROUP_set_seed                       3494    EXIST::FUNCTION:EC
+X509_VERIFY_PARAM_set_trust             3495    EXIST::FUNCTION:
+STORE_ATTR_INFO_free                    3496    EXIST::FUNCTION:
+STORE_get_private_key                   3497    EXIST::FUNCTION:
+EVP_PKEY_get_attr_count                 3498    EXIST::FUNCTION:
+STORE_ATTR_INFO_new                     3499    EXIST::FUNCTION:
+EC_GROUP_get_curve_GF2m                 3500    EXIST::FUNCTION:EC
+STORE_method_set_revoke_function        3501    EXIST:!VMS:FUNCTION:
+STORE_meth_set_revoke_fn                3501    EXIST:VMS:FUNCTION:
+STORE_store_number                      3502    EXIST::FUNCTION:
+BN_is_prime_ex                          3503    EXIST::FUNCTION:
+STORE_revoke_public_key                 3504    EXIST::FUNCTION:
+X509_STORE_CTX_get0_param               3505    EXIST::FUNCTION:
+STORE_delete_arbitrary                  3506    EXIST::FUNCTION:
+PEM_read_X509_CERT_PAIR                 3507    EXIST:!WIN16:FUNCTION:
+X509_STORE_set_depth                    3508    EXIST::FUNCTION:
+ECDSA_get_ex_data                       3509    EXIST::FUNCTION:ECDSA
+SHA224                                  3510    EXIST::FUNCTION:SHA,SHA256
+BIO_dump_indent_fp                      3511    EXIST::FUNCTION:FP_API
+EC_KEY_set_group                        3512    EXIST::FUNCTION:EC
+BUF_strndup                             3513    EXIST::FUNCTION:
+STORE_list_certificate_start            3514    EXIST::FUNCTION:
+BN_GF2m_mod                             3515    EXIST::FUNCTION:
+X509_REQ_check_private_key              3516    EXIST::FUNCTION:
+EC_GROUP_get_seed_len                   3517    EXIST::FUNCTION:EC
+ERR_load_STORE_strings                  3518    EXIST::FUNCTION:
+PEM_read_bio_EC_PUBKEY                  3519    EXIST::FUNCTION:EC
+STORE_list_private_key_end              3520    EXIST::FUNCTION:
+i2d_EC_PUBKEY                           3521    EXIST::FUNCTION:EC
+ECDSA_get_default_method                3522    EXIST::FUNCTION:ECDSA
+ASN1_put_eoc                            3523    EXIST::FUNCTION:
+X509_STORE_CTX_get_explicit_policy      3524    EXIST:!VMS:FUNCTION:
+X509_STORE_CTX_get_expl_policy          3524    EXIST:VMS:FUNCTION:
+X509_VERIFY_PARAM_table_cleanup         3525    EXIST::FUNCTION:
+STORE_modify_private_key                3526    EXIST::FUNCTION:
+X509_VERIFY_PARAM_free                  3527    EXIST::FUNCTION:
+EC_METHOD_get_field_type                3528    EXIST::FUNCTION:EC
+EC_GFp_nist_method                      3529    EXIST::FUNCTION:EC
+STORE_method_set_modify_function        3530    EXIST:!VMS:FUNCTION:
+STORE_meth_set_modify_fn                3530    EXIST:VMS:FUNCTION:
+STORE_parse_attrs_next                  3531    EXIST::FUNCTION:
+ENGINE_load_padlock                     3532    EXIST::FUNCTION:ENGINE
+EC_GROUP_set_curve_name                 3533    EXIST::FUNCTION:EC
+X509_CERT_PAIR_it                       3534    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
+X509_CERT_PAIR_it                       3534    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
+STORE_method_get_revoke_function        3535    EXIST:!VMS:FUNCTION:
+STORE_meth_get_revoke_fn                3535    EXIST:VMS:FUNCTION:
+STORE_method_set_get_function           3536    EXIST::FUNCTION:
+STORE_modify_number                     3537    EXIST::FUNCTION:
+STORE_method_get_store_function         3538    EXIST::FUNCTION:
+STORE_store_private_key                 3539    EXIST::FUNCTION:
+BN_GF2m_mod_sqr_arr                     3540    EXIST::FUNCTION:
+RSA_setup_blinding                      3541    EXIST::FUNCTION:RSA
+BIO_s_datagram                          3542    EXIST::FUNCTION:DGRAM
+STORE_Memory                            3543    EXIST::FUNCTION:
+sk_find_ex                              3544    EXIST::FUNCTION:
+EC_GROUP_set_curve_GF2m                 3545    EXIST::FUNCTION:EC
+ENGINE_set_default_ECDSA                3546    EXIST::FUNCTION:ENGINE
+POLICY_CONSTRAINTS_new                  3547    EXIST::FUNCTION:
+BN_GF2m_mod_sqrt                        3548    EXIST::FUNCTION:
+ECDH_set_default_method                 3549    EXIST::FUNCTION:ECDH
+EC_KEY_generate_key                     3550    EXIST::FUNCTION:EC
+SHA384_Update                           3551    EXIST::FUNCTION:SHA,SHA512
+BN_GF2m_arr2poly                        3552    EXIST::FUNCTION:
+STORE_method_get_get_function           3553    EXIST::FUNCTION:
+STORE_method_set_cleanup_function       3554    EXIST:!VMS:FUNCTION:
+STORE_meth_set_cleanup_fn               3554    EXIST:VMS:FUNCTION:
+EC_GROUP_check                          3555    EXIST::FUNCTION:EC
+d2i_ECPrivateKey_bio                    3556    EXIST::FUNCTION:BIO,EC
+EC_KEY_insert_key_method_data           3557    EXIST::FUNCTION:EC
+STORE_method_get_lock_store_function    3558    EXIST:!VMS:FUNCTION:
+STORE_meth_get_lock_store_fn            3558    EXIST:VMS:FUNCTION:
+X509_VERIFY_PARAM_get_depth             3559    EXIST::FUNCTION:
+SHA224_Final                            3560    EXIST::FUNCTION:SHA,SHA256
+STORE_method_set_update_store_function  3561    EXIST:!VMS:FUNCTION:
+STORE_meth_set_update_store_fn          3561    EXIST:VMS:FUNCTION:
+SHA224_Update                           3562    EXIST::FUNCTION:SHA,SHA256
+d2i_ECPrivateKey                        3563    EXIST::FUNCTION:EC
+ASN1_item_ndef_i2d                      3564    EXIST::FUNCTION:
+STORE_delete_private_key                3565    EXIST::FUNCTION:
+ERR_pop_to_mark                         3566    EXIST::FUNCTION:
+ENGINE_register_all_STORE               3567    EXIST::FUNCTION:ENGINE
+X509_policy_level_get0_node             3568    EXIST::FUNCTION:
+i2d_PKCS7_NDEF                          3569    EXIST::FUNCTION:
+EC_GROUP_get_degree                     3570    EXIST::FUNCTION:EC
+ASN1_generate_v3                        3571    EXIST::FUNCTION:
+STORE_ATTR_INFO_modify_cstr             3572    EXIST::FUNCTION:
+X509_policy_tree_level_count            3573    EXIST::FUNCTION:
+BN_GF2m_add                             3574    EXIST::FUNCTION:
+EC_KEY_get0_group                       3575    EXIST::FUNCTION:EC
+STORE_generate_crl                      3576    EXIST::FUNCTION:
+STORE_store_public_key                  3577    EXIST::FUNCTION:
+X509_CERT_PAIR_free                     3578    EXIST::FUNCTION:
+STORE_revoke_private_key                3579    EXIST::FUNCTION:
+BN_nist_mod_224                         3580    EXIST::FUNCTION:
+SHA512_Final                            3581    EXIST::FUNCTION:SHA,SHA512
+STORE_ATTR_INFO_modify_dn               3582    EXIST::FUNCTION:
+STORE_method_get_initialise_function    3583    EXIST:!VMS:FUNCTION:
+STORE_meth_get_initialise_fn            3583    EXIST:VMS:FUNCTION:
+STORE_delete_number                     3584    EXIST::FUNCTION:
+i2d_EC_PUBKEY_bio                       3585    EXIST::FUNCTION:BIO,EC
+BIO_dgram_non_fatal_error               3586    EXIST::FUNCTION:
+EC_GROUP_get_asn1_flag                  3587    EXIST::FUNCTION:EC
+STORE_ATTR_INFO_in_ex                   3588    EXIST::FUNCTION:
+STORE_list_crl_start                    3589    EXIST::FUNCTION:
+ECDH_get_ex_new_index                   3590    EXIST::FUNCTION:ECDH
+STORE_method_get_modify_function        3591    EXIST:!VMS:FUNCTION:
+STORE_meth_get_modify_fn                3591    EXIST:VMS:FUNCTION:
+v2i_ASN1_BIT_STRING                     3592    EXIST::FUNCTION:
+STORE_store_certificate                 3593    EXIST::FUNCTION:
+OBJ_bsearch_ex                          3594    EXIST::FUNCTION:
+X509_STORE_CTX_set_default              3595    EXIST::FUNCTION:
+STORE_ATTR_INFO_set_sha1str             3596    EXIST::FUNCTION:
+BN_GF2m_mod_inv                         3597    EXIST::FUNCTION:
+BN_GF2m_mod_exp                         3598    EXIST::FUNCTION:
+STORE_modify_public_key                 3599    EXIST::FUNCTION:
+STORE_method_get_list_start_function    3600    EXIST:!VMS:FUNCTION:
+STORE_meth_get_list_start_fn            3600    EXIST:VMS:FUNCTION:
+EC_GROUP_get0_seed                      3601    EXIST::FUNCTION:EC
+STORE_store_arbitrary                   3602    EXIST::FUNCTION:
+STORE_method_set_unlock_store_function  3603    EXIST:!VMS:FUNCTION:
+STORE_meth_set_unlock_store_fn          3603    EXIST:VMS:FUNCTION:
+BN_GF2m_mod_div_arr                     3604    EXIST::FUNCTION:
+ENGINE_set_ECDSA                        3605    EXIST::FUNCTION:ENGINE
+STORE_create_method                     3606    EXIST::FUNCTION:
+ECPKParameters_print                    3607    EXIST::FUNCTION:BIO,EC
+EC_KEY_get0_private_key                 3608    EXIST::FUNCTION:EC
+PEM_write_EC_PUBKEY                     3609    EXIST:!WIN16:FUNCTION:EC
+X509_VERIFY_PARAM_set1                  3610    EXIST::FUNCTION:
+ECDH_set_method                         3611    EXIST::FUNCTION:ECDH
+v2i_GENERAL_NAME_ex                     3612    EXIST::FUNCTION:
+ECDH_set_ex_data                        3613    EXIST::FUNCTION:ECDH
+STORE_generate_key                      3614    EXIST::FUNCTION:
+BN_nist_mod_521                         3615    EXIST::FUNCTION:
+X509_policy_tree_get0_level             3616    EXIST::FUNCTION:
+EC_GROUP_set_point_conversion_form      3617    EXIST:!VMS:FUNCTION:EC
+EC_GROUP_set_point_conv_form            3617    EXIST:VMS:FUNCTION:EC
+PEM_read_EC_PUBKEY                      3618    EXIST:!WIN16:FUNCTION:EC
+i2d_ECDSA_SIG                           3619    EXIST::FUNCTION:ECDSA
+ECDSA_OpenSSL                           3620    EXIST::FUNCTION:ECDSA
+STORE_delete_crl                        3621    EXIST::FUNCTION:
+EC_KEY_get_enc_flags                    3622    EXIST::FUNCTION:EC
+ASN1_const_check_infinite_end           3623    EXIST::FUNCTION:
+EVP_PKEY_delete_attr                    3624    EXIST::FUNCTION:
+ECDSA_set_default_method                3625    EXIST::FUNCTION:ECDSA
+EC_POINT_set_compressed_coordinates_GF2m 3626   EXIST:!VMS:FUNCTION:EC
+EC_POINT_set_compr_coords_GF2m          3626    EXIST:VMS:FUNCTION:EC
+EC_GROUP_cmp                            3627    EXIST::FUNCTION:EC
+STORE_revoke_certificate                3628    EXIST::FUNCTION:
+BN_get0_nist_prime_256                  3629    EXIST::FUNCTION:
+STORE_method_get_delete_function        3630    EXIST:!VMS:FUNCTION:
+STORE_meth_get_delete_fn                3630    EXIST:VMS:FUNCTION:
+SHA224_Init                             3631    EXIST::FUNCTION:SHA,SHA256
+PEM_read_ECPrivateKey                   3632    EXIST:!WIN16:FUNCTION:EC
+SHA512_Init                             3633    EXIST::FUNCTION:SHA,SHA512
+STORE_parse_attrs_endp                  3634    EXIST::FUNCTION:
+BN_set_negative                         3635    EXIST::FUNCTION:
+ERR_load_ECDSA_strings                  3636    EXIST::FUNCTION:ECDSA
+EC_GROUP_get_basis_type                 3637    EXIST::FUNCTION:EC
+STORE_list_public_key_next              3638    EXIST::FUNCTION:
+i2v_ASN1_BIT_STRING                     3639    EXIST::FUNCTION:
+STORE_OBJECT_free                       3640    EXIST::FUNCTION:
+BN_nist_mod_384                         3641    EXIST::FUNCTION:
+i2d_X509_CERT_PAIR                      3642    EXIST::FUNCTION:
+PEM_write_ECPKParameters                3643    EXIST:!WIN16:FUNCTION:EC
+ECDH_compute_key                        3644    EXIST::FUNCTION:ECDH
+STORE_ATTR_INFO_get0_sha1str            3645    EXIST::FUNCTION:
+ENGINE_register_all_ECDH                3646    EXIST::FUNCTION:ENGINE
+pqueue_pop                              3647    EXIST::FUNCTION:
+STORE_ATTR_INFO_get0_cstr               3648    EXIST::FUNCTION:
+POLICY_CONSTRAINTS_it                   3649    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
+POLICY_CONSTRAINTS_it                   3649    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
+STORE_get_ex_new_index                  3650    EXIST::FUNCTION:
+EVP_PKEY_get_attr_by_OBJ                3651    EXIST::FUNCTION:
+X509_VERIFY_PARAM_add0_policy           3652    EXIST::FUNCTION:
+BN_GF2m_mod_solve_quad                  3653    EXIST::FUNCTION:
+SHA256                                  3654    EXIST::FUNCTION:SHA,SHA256
+i2d_ECPrivateKey_fp                     3655    EXIST::FUNCTION:EC,FP_API
+X509_policy_tree_get0_user_policies     3656    EXIST:!VMS:FUNCTION:
+X509_pcy_tree_get0_usr_policies         3656    EXIST:VMS:FUNCTION:
+OPENSSL_DIR_read                        3657    EXIST::FUNCTION:
+ENGINE_register_all_ECDSA               3658    EXIST::FUNCTION:ENGINE
+X509_VERIFY_PARAM_lookup                3659    EXIST::FUNCTION:
+EC_POINT_get_affine_coordinates_GF2m    3660    EXIST:!VMS:FUNCTION:EC
+EC_POINT_get_affine_coords_GF2m         3660    EXIST:VMS:FUNCTION:EC
+EC_GROUP_dup                            3661    EXIST::FUNCTION:EC
+ENGINE_get_default_ECDSA                3662    EXIST::FUNCTION:ENGINE
+EC_KEY_new                              3663    EXIST::FUNCTION:EC
+SHA256_Transform                        3664    EXIST::FUNCTION:SHA,SHA256
+EC_KEY_set_enc_flags                    3665    EXIST::FUNCTION:EC
+ECDSA_verify                            3666    EXIST::FUNCTION:ECDSA
+EC_POINT_point2hex                      3667    EXIST::FUNCTION:EC
+ENGINE_get_STORE                        3668    EXIST::FUNCTION:ENGINE
+SHA512                                  3669    EXIST::FUNCTION:SHA,SHA512
+STORE_get_certificate                   3670    EXIST::FUNCTION:
+ECDSA_do_sign_ex                        3671    EXIST::FUNCTION:ECDSA
+ECDSA_do_verify                         3672    EXIST::FUNCTION:ECDSA
+d2i_ECPrivateKey_fp                     3673    EXIST::FUNCTION:EC,FP_API
+STORE_delete_certificate                3674    EXIST::FUNCTION:
+SHA512_Transform                        3675    EXIST::FUNCTION:SHA,SHA512
+X509_STORE_set1_param                   3676    EXIST::FUNCTION:
+STORE_method_get_ctrl_function          3677    EXIST::FUNCTION:
+STORE_free                              3678    EXIST::FUNCTION:
+PEM_write_ECPrivateKey                  3679    EXIST:!WIN16:FUNCTION:EC
+STORE_method_get_unlock_store_function  3680    EXIST:!VMS:FUNCTION:
+STORE_meth_get_unlock_store_fn          3680    EXIST:VMS:FUNCTION:
+STORE_get_ex_data                       3681    EXIST::FUNCTION:
+EC_KEY_set_public_key                   3682    EXIST::FUNCTION:EC
+PEM_read_ECPKParameters                 3683    EXIST:!WIN16:FUNCTION:EC
+X509_CERT_PAIR_new                      3684    EXIST::FUNCTION:
+ENGINE_register_STORE                   3685    EXIST::FUNCTION:ENGINE
+RSA_generate_key_ex                     3686    EXIST::FUNCTION:RSA
+DSA_generate_parameters_ex              3687    EXIST::FUNCTION:DSA
+ECParameters_print_fp                   3688    EXIST::FUNCTION:EC,FP_API
+X509V3_NAME_from_section                3689    EXIST::FUNCTION:
+EVP_PKEY_add1_attr                      3690    EXIST::FUNCTION:
+STORE_modify_crl                        3691    EXIST::FUNCTION:
+STORE_list_private_key_start            3692    EXIST::FUNCTION:
+POLICY_MAPPINGS_it                      3693    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
+POLICY_MAPPINGS_it                      3693    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
+GENERAL_SUBTREE_it                      3694    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
+GENERAL_SUBTREE_it                      3694    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
+EC_GROUP_get_curve_name                 3695    EXIST::FUNCTION:EC
+PEM_write_X509_CERT_PAIR                3696    EXIST:!WIN16:FUNCTION:
+BIO_dump_indent_cb                      3697    EXIST::FUNCTION:
+d2i_X509_CERT_PAIR                      3698    EXIST::FUNCTION:
+STORE_list_private_key_endp             3699    EXIST::FUNCTION:
+asn1_const_Finish                       3700    EXIST::FUNCTION:
+i2d_EC_PUBKEY_fp                        3701    EXIST::FUNCTION:EC,FP_API
+BN_nist_mod_256                         3702    EXIST::FUNCTION:
+X509_VERIFY_PARAM_add0_table            3703    EXIST::FUNCTION:
+pqueue_free                             3704    EXIST::FUNCTION:
+BN_BLINDING_create_param                3705    EXIST::FUNCTION:
+ECDSA_size                              3706    EXIST::FUNCTION:ECDSA
+d2i_EC_PUBKEY_bio                       3707    EXIST::FUNCTION:BIO,EC
+BN_get0_nist_prime_521                  3708    EXIST::FUNCTION:
+STORE_ATTR_INFO_modify_sha1str          3709    EXIST::FUNCTION:
+BN_generate_prime_ex                    3710    EXIST::FUNCTION:
+EC_GROUP_new_by_curve_name              3711    EXIST::FUNCTION:EC
+SHA256_Final                            3712    EXIST::FUNCTION:SHA,SHA256
+DH_generate_parameters_ex               3713    EXIST::FUNCTION:DH
+PEM_read_bio_ECPrivateKey               3714    EXIST::FUNCTION:EC
+STORE_method_get_cleanup_function       3715    EXIST:!VMS:FUNCTION:
+STORE_meth_get_cleanup_fn               3715    EXIST:VMS:FUNCTION:
+ENGINE_get_ECDH                         3716    EXIST::FUNCTION:ENGINE
+d2i_ECDSA_SIG                           3717    EXIST::FUNCTION:ECDSA
+BN_is_prime_fasttest_ex                 3718    EXIST::FUNCTION:
+ECDSA_sign                              3719    EXIST::FUNCTION:ECDSA
+X509_policy_check                       3720    EXIST::FUNCTION:
+EVP_PKEY_get_attr_by_NID                3721    EXIST::FUNCTION:
+STORE_set_ex_data                       3722    EXIST::FUNCTION:
+ENGINE_get_ECDSA                        3723    EXIST::FUNCTION:ENGINE
+EVP_ecdsa                               3724    EXIST::FUNCTION:SHA
+BN_BLINDING_get_flags                   3725    EXIST::FUNCTION:
+PKCS12_add_cert                         3726    EXIST::FUNCTION:
+STORE_OBJECT_new                        3727    EXIST::FUNCTION:
+ERR_load_ECDH_strings                   3728    EXIST::FUNCTION:ECDH
+EC_KEY_dup                              3729    EXIST::FUNCTION:EC
+EVP_CIPHER_CTX_rand_key                 3730    EXIST::FUNCTION:
+ECDSA_set_method                        3731    EXIST::FUNCTION:ECDSA
+a2i_IPADDRESS_NC                        3732    EXIST::FUNCTION:
+d2i_ECParameters                        3733    EXIST::FUNCTION:EC
+STORE_list_certificate_end              3734    EXIST::FUNCTION:
+STORE_get_crl                           3735    EXIST::FUNCTION:
+X509_POLICY_NODE_print                  3736    EXIST::FUNCTION:
+SHA384_Init                             3737    EXIST::FUNCTION:SHA,SHA512
+EC_GF2m_simple_method                   3738    EXIST::FUNCTION:EC
+ECDSA_set_ex_data                       3739    EXIST::FUNCTION:ECDSA
+SHA384_Final                            3740    EXIST::FUNCTION:SHA,SHA512
+PKCS7_set_digest                        3741    EXIST::FUNCTION:
+EC_KEY_print                            3742    EXIST::FUNCTION:BIO,EC
+STORE_method_set_lock_store_function    3743    EXIST:!VMS:FUNCTION:
+STORE_meth_set_lock_store_fn            3743    EXIST:VMS:FUNCTION:
+ECDSA_get_ex_new_index                  3744    EXIST::FUNCTION:ECDSA
+SHA384                                  3745    EXIST::FUNCTION:SHA,SHA512
+POLICY_MAPPING_new                      3746    EXIST::FUNCTION:
+STORE_list_certificate_endp             3747    EXIST::FUNCTION:
+X509_STORE_CTX_get0_policy_tree         3748    EXIST::FUNCTION:
+EC_GROUP_set_asn1_flag                  3749    EXIST::FUNCTION:EC
+EC_KEY_check_key                        3750    EXIST::FUNCTION:EC
+d2i_EC_PUBKEY_fp                        3751    EXIST::FUNCTION:EC,FP_API
+PKCS7_set0_type_other                   3752    EXIST::FUNCTION:
+PEM_read_bio_X509_CERT_PAIR             3753    EXIST::FUNCTION:
+pqueue_next                             3754    EXIST::FUNCTION:
+STORE_method_get_list_end_function      3755    EXIST:!VMS:FUNCTION:
+STORE_meth_get_list_end_fn              3755    EXIST:VMS:FUNCTION:
+EVP_PKEY_add1_attr_by_OBJ               3756    EXIST::FUNCTION:
+X509_VERIFY_PARAM_set_time              3757    EXIST::FUNCTION:
+pqueue_new                              3758    EXIST::FUNCTION:
+ENGINE_set_default_ECDH                 3759    EXIST::FUNCTION:ENGINE
+STORE_new_method                        3760    EXIST::FUNCTION:
+PKCS12_add_key                          3761    EXIST::FUNCTION:
+DSO_merge                               3762    EXIST::FUNCTION:
+EC_POINT_hex2point                      3763    EXIST::FUNCTION:EC
+BIO_dump_cb                             3764    EXIST::FUNCTION:
+SHA256_Update                           3765    EXIST::FUNCTION:SHA,SHA256
+pqueue_insert                           3766    EXIST::FUNCTION:
+pitem_free                              3767    EXIST::FUNCTION:
+BN_GF2m_mod_inv_arr                     3768    EXIST::FUNCTION:
+ENGINE_unregister_ECDSA                 3769    EXIST::FUNCTION:ENGINE
+BN_BLINDING_set_thread_id               3770    EXIST::FUNCTION:
+get_rfc3526_prime_8192                  3771    EXIST::FUNCTION:
+X509_VERIFY_PARAM_clear_flags           3772    EXIST::FUNCTION:
+get_rfc2409_prime_1024                  3773    EXIST::FUNCTION:
+DH_check_pub_key                        3774    EXIST::FUNCTION:DH
+get_rfc3526_prime_2048                  3775    EXIST::FUNCTION:
+get_rfc3526_prime_6144                  3776    EXIST::FUNCTION:
+get_rfc3526_prime_1536                  3777    EXIST::FUNCTION:
+get_rfc3526_prime_3072                  3778    EXIST::FUNCTION:
+get_rfc3526_prime_4096                  3779    EXIST::FUNCTION:
+get_rfc2409_prime_768                   3780    EXIST::FUNCTION:
+X509_VERIFY_PARAM_get_flags             3781    EXIST::FUNCTION:
+EVP_CIPHER_CTX_new                      3782    EXIST::FUNCTION:
+EVP_CIPHER_CTX_free                     3783    EXIST::FUNCTION:
+Camellia_cbc_encrypt                    3784    EXIST::FUNCTION:CAMELLIA
+Camellia_cfb128_encrypt                 3785    EXIST::FUNCTION:CAMELLIA
+Camellia_cfb1_encrypt                   3786    EXIST::FUNCTION:CAMELLIA
+Camellia_cfb8_encrypt                   3787    EXIST::FUNCTION:CAMELLIA
+Camellia_ctr128_encrypt                 3788    EXIST::FUNCTION:CAMELLIA
+Camellia_cfbr_encrypt_block             3789    EXIST::FUNCTION:CAMELLIA
+Camellia_decrypt                        3790    EXIST::FUNCTION:CAMELLIA
+Camellia_ecb_encrypt                    3791    EXIST::FUNCTION:CAMELLIA
+Camellia_encrypt                        3792    EXIST::FUNCTION:CAMELLIA
+Camellia_ofb128_encrypt                 3793    EXIST::FUNCTION:CAMELLIA
+Camellia_set_key                        3794    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_128_cbc                    3795    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_128_cfb128                 3796    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_128_cfb1                   3797    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_128_cfb8                   3798    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_128_ecb                    3799    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_128_ofb                    3800    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_192_cbc                    3801    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_192_cfb128                 3802    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_192_cfb1                   3803    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_192_cfb8                   3804    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_192_ecb                    3805    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_192_ofb                    3806    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_256_cbc                    3807    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_256_cfb128                 3808    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_256_cfb1                   3809    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_256_cfb8                   3810    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_256_ecb                    3811    EXIST::FUNCTION:CAMELLIA
+EVP_camellia_256_ofb                    3812    EXIST::FUNCTION:CAMELLIA
+a2i_ipadd                               3813    EXIST::FUNCTION:
+ASIdentifiers_free                      3814    EXIST::FUNCTION:RFC3779
+i2d_ASIdOrRange                         3815    EXIST::FUNCTION:RFC3779
+EVP_CIPHER_block_size                   3816    EXIST::FUNCTION:
+v3_asid_is_canonical                    3817    EXIST::FUNCTION:RFC3779
+IPAddressChoice_free                    3818    EXIST::FUNCTION:RFC3779
+EVP_CIPHER_CTX_set_app_data             3819    EXIST::FUNCTION:
+BIO_set_callback_arg                    3820    EXIST::FUNCTION:
+v3_addr_add_prefix                      3821    EXIST::FUNCTION:RFC3779
+IPAddressOrRange_it                     3822    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:RFC3779
+IPAddressOrRange_it                     3822    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:RFC3779
+BIO_set_flags                           3823    EXIST::FUNCTION:
+ASIdentifiers_it                        3824    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:RFC3779
+ASIdentifiers_it                        3824    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:RFC3779
+v3_addr_get_range                       3825    EXIST::FUNCTION:RFC3779
+BIO_method_type                         3826    EXIST::FUNCTION:
+v3_addr_inherits                        3827    EXIST::FUNCTION:RFC3779
+IPAddressChoice_it                      3828    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:RFC3779
+IPAddressChoice_it                      3828    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:RFC3779
+AES_ige_encrypt                         3829    EXIST::FUNCTION:AES
+v3_addr_add_range                       3830    EXIST::FUNCTION:RFC3779
+EVP_CIPHER_CTX_nid                      3831    EXIST::FUNCTION:
+d2i_ASRange                             3832    EXIST::FUNCTION:RFC3779
+v3_addr_add_inherit                     3833    EXIST::FUNCTION:RFC3779
+v3_asid_add_id_or_range                 3834    EXIST::FUNCTION:RFC3779
+v3_addr_validate_resource_set           3835    EXIST::FUNCTION:RFC3779
+EVP_CIPHER_iv_length                    3836    EXIST::FUNCTION:
+EVP_MD_type                             3837    EXIST::FUNCTION:
+v3_asid_canonize                        3838    EXIST::FUNCTION:RFC3779
+IPAddressRange_free                     3839    EXIST::FUNCTION:RFC3779
+v3_asid_add_inherit                     3840    EXIST::FUNCTION:RFC3779
+EVP_CIPHER_CTX_key_length               3841    EXIST::FUNCTION:
+IPAddressRange_new                      3842    EXIST::FUNCTION:RFC3779
+ASIdOrRange_new                         3843    EXIST::FUNCTION:RFC3779
+EVP_MD_size                             3844    EXIST::FUNCTION:
+EVP_MD_CTX_test_flags                   3845    EXIST::FUNCTION:
+BIO_clear_flags                         3846    EXIST::FUNCTION:
+i2d_ASRange                             3847    EXIST::FUNCTION:RFC3779
+IPAddressRange_it                       3848    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:RFC3779
+IPAddressRange_it                       3848    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:RFC3779
+IPAddressChoice_new                     3849    EXIST::FUNCTION:RFC3779
+ASIdentifierChoice_new                  3850    EXIST::FUNCTION:RFC3779
+ASRange_free                            3851    EXIST::FUNCTION:RFC3779
+EVP_MD_pkey_type                        3852    EXIST::FUNCTION:
+EVP_MD_CTX_clear_flags                  3853    EXIST::FUNCTION:
+IPAddressFamily_free                    3854    EXIST::FUNCTION:RFC3779
+i2d_IPAddressFamily                     3855    EXIST::FUNCTION:RFC3779
+IPAddressOrRange_new                    3856    EXIST::FUNCTION:RFC3779
+EVP_CIPHER_flags                        3857    EXIST::FUNCTION:
+v3_asid_validate_resource_set           3858    EXIST::FUNCTION:RFC3779
+d2i_IPAddressRange                      3859    EXIST::FUNCTION:RFC3779
+AES_bi_ige_encrypt                      3860    EXIST::FUNCTION:AES
+BIO_get_callback                        3861    EXIST::FUNCTION:
+IPAddressOrRange_free                   3862    EXIST::FUNCTION:RFC3779
+v3_addr_subset                          3863    EXIST::FUNCTION:RFC3779
+d2i_IPAddressFamily                     3864    EXIST::FUNCTION:RFC3779
+v3_asid_subset                          3865    EXIST::FUNCTION:RFC3779
+BIO_test_flags                          3866    EXIST::FUNCTION:
+i2d_ASIdentifierChoice                  3867    EXIST::FUNCTION:RFC3779
+ASRange_it                              3868    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:RFC3779
+ASRange_it                              3868    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:RFC3779
+d2i_ASIdentifiers                       3869    EXIST::FUNCTION:RFC3779
+ASRange_new                             3870    EXIST::FUNCTION:RFC3779
+d2i_IPAddressChoice                     3871    EXIST::FUNCTION:RFC3779
+v3_addr_get_afi                         3872    EXIST::FUNCTION:RFC3779
+EVP_CIPHER_key_length                   3873    EXIST::FUNCTION:
+EVP_Cipher                              3874    EXIST::FUNCTION:
+i2d_IPAddressOrRange                    3875    EXIST::FUNCTION:RFC3779
+ASIdOrRange_it                          3876    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:RFC3779
+ASIdOrRange_it                          3876    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:RFC3779
+EVP_CIPHER_nid                          3877    EXIST::FUNCTION:
+i2d_IPAddressChoice                     3878    EXIST::FUNCTION:RFC3779
+EVP_CIPHER_CTX_block_size               3879    EXIST::FUNCTION:
+ASIdentifiers_new                       3880    EXIST::FUNCTION:RFC3779
+v3_addr_validate_path                   3881    EXIST::FUNCTION:RFC3779
+IPAddressFamily_new                     3882    EXIST::FUNCTION:RFC3779
+EVP_MD_CTX_set_flags                    3883    EXIST::FUNCTION:
+v3_addr_is_canonical                    3884    EXIST::FUNCTION:RFC3779
+i2d_IPAddressRange                      3885    EXIST::FUNCTION:RFC3779
+IPAddressFamily_it                      3886    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:RFC3779
+IPAddressFamily_it                      3886    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:RFC3779
+v3_asid_inherits                        3887    EXIST::FUNCTION:RFC3779
+EVP_CIPHER_CTX_cipher                   3888    EXIST::FUNCTION:
+EVP_CIPHER_CTX_get_app_data             3889    EXIST::FUNCTION:
+EVP_MD_block_size                       3890    EXIST::FUNCTION:
+EVP_CIPHER_CTX_flags                    3891    EXIST::FUNCTION:
+v3_asid_validate_path                   3892    EXIST::FUNCTION:RFC3779
+d2i_IPAddressOrRange                    3893    EXIST::FUNCTION:RFC3779
+v3_addr_canonize                        3894    EXIST::FUNCTION:RFC3779
+ASIdentifierChoice_it                   3895    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:RFC3779
+ASIdentifierChoice_it                   3895    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:RFC3779
+EVP_MD_CTX_md                           3896    EXIST::FUNCTION:
+d2i_ASIdentifierChoice                  3897    EXIST::FUNCTION:RFC3779
+BIO_method_name                         3898    EXIST::FUNCTION:
+EVP_CIPHER_CTX_iv_length                3899    EXIST::FUNCTION:
+ASIdOrRange_free                        3900    EXIST::FUNCTION:RFC3779
+ASIdentifierChoice_free                 3901    EXIST::FUNCTION:RFC3779
+BIO_get_callback_arg                    3902    EXIST::FUNCTION:
+BIO_set_callback                        3903    EXIST::FUNCTION:
+d2i_ASIdOrRange                         3904    EXIST::FUNCTION:RFC3779
+i2d_ASIdentifiers                       3905    EXIST::FUNCTION:RFC3779
+SEED_decrypt                            3908    EXIST::FUNCTION:SEED
+SEED_encrypt                            3909    EXIST::FUNCTION:SEED
+SEED_cbc_encrypt                        3910    EXIST::FUNCTION:SEED
+EVP_seed_ofb                            3911    EXIST::FUNCTION:SEED
+SEED_cfb128_encrypt                     3912    EXIST::FUNCTION:SEED
+SEED_ofb128_encrypt                     3913    EXIST::FUNCTION:SEED
+EVP_seed_cbc                            3914    EXIST::FUNCTION:SEED
+SEED_ecb_encrypt                        3915    EXIST::FUNCTION:SEED
+EVP_seed_ecb                            3916    EXIST::FUNCTION:SEED
+SEED_set_key                            3917    EXIST::FUNCTION:SEED
+EVP_seed_cfb128                         3918    EXIST::FUNCTION:SEED
+X509_EXTENSIONS_it                      3919    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
+X509_EXTENSIONS_it                      3919    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
+X509_get1_ocsp                          3920    EXIST::FUNCTION:
+OCSP_REQ_CTX_free                       3921    EXIST::FUNCTION:
+i2d_X509_EXTENSIONS                     3922    EXIST::FUNCTION:
+OCSP_sendreq_nbio                       3923    EXIST::FUNCTION:
+OCSP_sendreq_new                        3924    EXIST::FUNCTION:
+d2i_X509_EXTENSIONS                     3925    EXIST::FUNCTION:
+X509_ALGORS_it                          3926    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:
+X509_ALGORS_it                          3926    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
+X509_ALGOR_get0                         3927    EXIST::FUNCTION:
+X509_ALGOR_set0                         3928    EXIST::FUNCTION:
+AES_unwrap_key                          3929    EXIST::FUNCTION:AES
+AES_wrap_key                            3930    EXIST::FUNCTION:AES
+X509at_get0_data_by_OBJ                 3931    EXIST::FUNCTION:
+ASN1_TYPE_set1                          3932    EXIST::FUNCTION:
+ASN1_STRING_set0                        3933    EXIST::FUNCTION:
+i2d_X509_ALGORS                         3934    EXIST::FUNCTION:
+BIO_f_zlib                              3935    EXIST:ZLIB:FUNCTION:
+COMP_zlib_cleanup                       3936    EXIST::FUNCTION:
+d2i_X509_ALGORS                         3937    EXIST::FUNCTION:
+CMS_ReceiptRequest_free                 3938    EXIST::FUNCTION:CMS
+PEM_write_CMS                           3939    EXIST:!WIN16:FUNCTION:CMS
+CMS_add0_CertificateChoices             3940    EXIST::FUNCTION:CMS
+CMS_unsigned_add1_attr_by_OBJ           3941    EXIST::FUNCTION:CMS
+ERR_load_CMS_strings                    3942    EXIST::FUNCTION:CMS
+CMS_sign_receipt                        3943    EXIST::FUNCTION:CMS
+i2d_CMS_ContentInfo                     3944    EXIST::FUNCTION:CMS
+CMS_signed_delete_attr                  3945    EXIST::FUNCTION:CMS
+d2i_CMS_bio                             3946    EXIST::FUNCTION:CMS
+CMS_unsigned_get_attr_by_NID            3947    EXIST::FUNCTION:CMS
+CMS_verify                              3948    EXIST::FUNCTION:CMS
+SMIME_read_CMS                          3949    EXIST::FUNCTION:CMS
+CMS_decrypt_set1_key                    3950    EXIST::FUNCTION:CMS
+CMS_SignerInfo_get0_algs                3951    EXIST::FUNCTION:CMS
+CMS_add1_cert                           3952    EXIST::FUNCTION:CMS
+CMS_set_detached                        3953    EXIST::FUNCTION:CMS
+CMS_encrypt                             3954    EXIST::FUNCTION:CMS
+CMS_EnvelopedData_create                3955    EXIST::FUNCTION:CMS
+CMS_uncompress                          3956    EXIST::FUNCTION:CMS
+CMS_add0_crl                            3957    EXIST::FUNCTION:CMS
+CMS_SignerInfo_verify_content           3958    EXIST::FUNCTION:CMS
+CMS_unsigned_get0_data_by_OBJ           3959    EXIST::FUNCTION:CMS
+PEM_write_bio_CMS                       3960    EXIST::FUNCTION:CMS
+CMS_unsigned_get_attr                   3961    EXIST::FUNCTION:CMS
+CMS_RecipientInfo_ktri_cert_cmp         3962    EXIST::FUNCTION:CMS
+CMS_RecipientInfo_ktri_get0_algs        3963    EXIST:!VMS:FUNCTION:CMS
+CMS_RecipInfo_ktri_get0_algs            3963    EXIST:VMS:FUNCTION:CMS
+CMS_ContentInfo_free                    3964    EXIST::FUNCTION:CMS
+CMS_final                               3965    EXIST::FUNCTION:CMS
+CMS_add_simple_smimecap                 3966    EXIST::FUNCTION:CMS
+CMS_SignerInfo_verify                   3967    EXIST::FUNCTION:CMS
+CMS_data                                3968    EXIST::FUNCTION:CMS
+CMS_ContentInfo_it                      3969    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:CMS
+CMS_ContentInfo_it                      3969    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:CMS
+d2i_CMS_ReceiptRequest                  3970    EXIST::FUNCTION:CMS
+CMS_compress                            3971    EXIST::FUNCTION:CMS
+CMS_digest_create                       3972    EXIST::FUNCTION:CMS
+CMS_SignerInfo_cert_cmp                 3973    EXIST::FUNCTION:CMS
+CMS_SignerInfo_sign                     3974    EXIST::FUNCTION:CMS
+CMS_data_create                         3975    EXIST::FUNCTION:CMS
+i2d_CMS_bio                             3976    EXIST::FUNCTION:CMS
+CMS_EncryptedData_set1_key              3977    EXIST::FUNCTION:CMS
+CMS_decrypt                             3978    EXIST::FUNCTION:CMS
+int_smime_write_ASN1                    3979    EXIST::FUNCTION:
+CMS_unsigned_delete_attr                3980    EXIST::FUNCTION:CMS
+CMS_unsigned_get_attr_count             3981    EXIST::FUNCTION:CMS
+CMS_add_smimecap                        3982    EXIST::FUNCTION:CMS
+PEM_read_CMS                            3983    EXIST:!WIN16:FUNCTION:CMS
+CMS_signed_get_attr_by_OBJ              3984    EXIST::FUNCTION:CMS
+d2i_CMS_ContentInfo                     3985    EXIST::FUNCTION:CMS
+CMS_add_standard_smimecap               3986    EXIST::FUNCTION:CMS
+CMS_ContentInfo_new                     3987    EXIST::FUNCTION:CMS
+CMS_RecipientInfo_type                  3988    EXIST::FUNCTION:CMS
+CMS_get0_type                           3989    EXIST::FUNCTION:CMS
+CMS_is_detached                         3990    EXIST::FUNCTION:CMS
+CMS_sign                                3991    EXIST::FUNCTION:CMS
+CMS_signed_add1_attr                    3992    EXIST::FUNCTION:CMS
+CMS_unsigned_get_attr_by_OBJ            3993    EXIST::FUNCTION:CMS
+SMIME_write_CMS                         3994    EXIST::FUNCTION:CMS
+CMS_EncryptedData_decrypt               3995    EXIST::FUNCTION:CMS
+CMS_get0_RecipientInfos                 3996    EXIST::FUNCTION:CMS
+CMS_add0_RevocationInfoChoice           3997    EXIST::FUNCTION:CMS
+CMS_decrypt_set1_pkey                   3998    EXIST::FUNCTION:CMS
+CMS_SignerInfo_set1_signer_cert         3999    EXIST::FUNCTION:CMS
+CMS_get0_signers                        4000    EXIST::FUNCTION:CMS
+CMS_ReceiptRequest_get0_values          4001    EXIST::FUNCTION:CMS
+CMS_signed_get0_data_by_OBJ             4002    EXIST::FUNCTION:CMS
+CMS_get0_SignerInfos                    4003    EXIST::FUNCTION:CMS
+CMS_add0_cert                           4004    EXIST::FUNCTION:CMS
+CMS_EncryptedData_encrypt               4005    EXIST::FUNCTION:CMS
+CMS_digest_verify                       4006    EXIST::FUNCTION:CMS
+CMS_set1_signers_certs                  4007    EXIST::FUNCTION:CMS
+CMS_signed_get_attr                     4008    EXIST::FUNCTION:CMS
+CMS_RecipientInfo_set0_key              4009    EXIST::FUNCTION:CMS
+CMS_SignedData_init                     4010    EXIST::FUNCTION:CMS
+CMS_RecipientInfo_kekri_get0_id         4011    EXIST::FUNCTION:CMS
+CMS_verify_receipt                      4012    EXIST::FUNCTION:CMS
+CMS_ReceiptRequest_it                   4013    EXIST:!EXPORT_VAR_AS_FUNCTION:VARIABLE:CMS
+CMS_ReceiptRequest_it                   4013    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:CMS
+PEM_read_bio_CMS                        4014    EXIST::FUNCTION:CMS
+CMS_get1_crls                           4015    EXIST::FUNCTION:CMS
+CMS_add0_recipient_key                  4016    EXIST::FUNCTION:CMS
+SMIME_read_ASN1                         4017    EXIST::FUNCTION:
+CMS_ReceiptRequest_new                  4018    EXIST::FUNCTION:CMS
+CMS_get0_content                        4019    EXIST::FUNCTION:CMS
+CMS_get1_ReceiptRequest                 4020    EXIST::FUNCTION:CMS
+CMS_signed_add1_attr_by_OBJ             4021    EXIST::FUNCTION:CMS
+CMS_RecipientInfo_kekri_id_cmp          4022    EXIST::FUNCTION:CMS
+CMS_add1_ReceiptRequest                 4023    EXIST::FUNCTION:CMS
+CMS_SignerInfo_get0_signer_id           4024    EXIST::FUNCTION:CMS
+CMS_unsigned_add1_attr_by_NID           4025    EXIST::FUNCTION:CMS
+CMS_unsigned_add1_attr                  4026    EXIST::FUNCTION:CMS
+CMS_signed_get_attr_by_NID              4027    EXIST::FUNCTION:CMS
+CMS_get1_certs                          4028    EXIST::FUNCTION:CMS
+CMS_signed_add1_attr_by_NID             4029    EXIST::FUNCTION:CMS
+CMS_unsigned_add1_attr_by_txt           4030    EXIST::FUNCTION:CMS
+CMS_dataFinal                           4031    EXIST::FUNCTION:CMS
+CMS_RecipientInfo_ktri_get0_signer_id   4032    EXIST:!VMS:FUNCTION:CMS
+CMS_RecipInfo_ktri_get0_sigr_id         4032    EXIST:VMS:FUNCTION:CMS
+i2d_CMS_ReceiptRequest                  4033    EXIST::FUNCTION:CMS
+CMS_add1_recipient_cert                 4034    EXIST::FUNCTION:CMS
+CMS_dataInit                            4035    EXIST::FUNCTION:CMS
+CMS_signed_add1_attr_by_txt             4036    EXIST::FUNCTION:CMS
+CMS_RecipientInfo_decrypt               4037    EXIST::FUNCTION:CMS
+CMS_signed_get_attr_count               4038    EXIST::FUNCTION:CMS
+CMS_get0_eContentType                   4039    EXIST::FUNCTION:CMS
+CMS_set1_eContentType                   4040    EXIST::FUNCTION:CMS
+CMS_ReceiptRequest_create0              4041    EXIST::FUNCTION:CMS
+CMS_add1_signer                         4042    EXIST::FUNCTION:CMS
+CMS_RecipientInfo_set0_pkey             4043    EXIST::FUNCTION:CMS
diff --git a/src/lib/libssl/src/util/mk1mf.pl b/src/lib/libssl/src/util/mk1mf.pl
index 05a6086164..1ac5fd3a50 100644
--- a/src/lib/libssl/src/util/mk1mf.pl
+++ b/src/lib/libssl/src/util/mk1mf.pl
@@ -10,19 +10,11 @@ $OPTIONS="";
 $ssl_version="";
 $banner="\t\@echo Building OpenSSL";
 
+my $no_static_engine = 0;
+my $engines = "";
 local $zlib_opt = 0;    # 0 = no zlib, 1 = static, 2 = dynamic
 local $zlib_lib = "";
 
-my $fips_canister_path = "";
-my $fips_premain_dso_exe_path = "";
-my $fips_premain_c_path = "";
-my $fips_sha1_exe_path = "";
-
-my $fipslibdir = "";
-my $baseaddr = "";
-
-my $ex_l_libs = "";
-
 
 open(IN,"<Makefile") || die "unable to open Makefile!\n";
 while(<IN>) {
@@ -38,22 +30,21 @@ $infile="MINFO";
 
 %ops=(
         "VC-WIN32",   "Microsoft Visual C++ [4-6] - Windows NT or 9X",
-        "VC-WIN32-GMAKE", "Microsoft Visual C++ [4-6] - Windows NT or 9X, GNU make",
+        "VC-WIN64I",  "Microsoft C/C++ - Win64/IA-64",
+        "VC-WIN64A",  "Microsoft C/C++ - Win64/x64",
         "VC-CE",   "Microsoft eMbedded Visual C++ 3.0 - Windows CE ONLY",
         "VC-NT",   "Microsoft Visual C++ [4-6] - Windows NT ONLY",
-        "VC-W31-16",  "Microsoft Visual C++ 1.52 - Windows 3.1 - 286",
-        "VC-WIN16",   "Alias for VC-W31-32",
-        "VC-W31-32",  "Microsoft Visual C++ 1.52 - Windows 3.1 - 386+",
-        "VC-MSDOS","Microsoft Visual C++ 1.52 - MSDOS",
         "Mingw32", "GNU C++ - Windows NT or 9x",
         "Mingw32-files", "Create files with DOS copy ...",
         "BC-NT",   "Borland C++ 4.5 - Windows NT",
-        "BC-W31",  "Borland C++ 4.5 - Windows 3.1 - PROBABLY NOT WORKING",
-        "BC-MSDOS","Borland C++ 4.5 - MSDOS",
         "linux-elf","Linux elf",
         "ultrix-mips","DEC mips ultrix",
         "FreeBSD","FreeBSD distribution",
         "OS2-EMX", "EMX GCC OS/2",
+        "netware-clib", "CodeWarrior for NetWare - CLib - with WinSock Sockets",
+        "netware-clib-bsdsock", "CodeWarrior for NetWare - CLib - with BSD Sockets",
+        "netware-libc", "CodeWarrior for NetWare - LibC - with WinSock Sockets",
+        "netware-libc-bsdsock", "CodeWarrior for NetWare - LibC - with BSD Sockets",
         "default","cc under unix",
         );
 
@@ -73,16 +64,20 @@ and [options] can be one of
         no-md2 no-md4 no-md5 no-sha no-mdc2     - Skip this digest
         no-ripemd
         no-rc2 no-rc4 no-rc5 no-idea no-des     - Skip this symetric cipher
-        no-bf no-cast no-aes
+        no-bf no-cast no-aes no-camellia no-seed
         no-rsa no-dsa no-dh                     - Skip this public key cipher
         no-ssl2 no-ssl3                         - Skip this version of SSL
         just-ssl                                - remove all non-ssl keys/digest
         no-asm                                  - No x86 asm
         no-krb5                                 - No KRB5
         no-ec                                   - No EC
+        no-ecdsa                                - No ECDSA
+        no-ecdh                                 - No ECDH
         no-engine                               - No engine
         no-hw                                   - No hw
         nasm                                    - Use NASM for x86 asm
+        nw-nasm                                 - Use NASM x86 asm for NetWare
+        nw-mwasm                                - Use Metrowerks x86 asm for NetWare
         gaswin                                  - Use GNU as with Mingw32
         no-socks                                - No socket code
         no-err                                  - No error strings
@@ -107,6 +102,8 @@ foreach (grep(!/^$/, split(/ /, $OPTIONS)))
         print STDERR "unknown option - $_\n" if !&read_options;
         }
 
+$no_static_engine = 0 if (!$shlib);
+
 $no_mdc2=1 if ($no_des);
 
 $no_ssl3=1 if ($no_md5 || $no_sha);
@@ -119,13 +116,10 @@ $out_def="out";
 $inc_def="outinc";
 $tmp_def="tmp";
 
-$mkdir="-mkdir";
-$mkcanister="ld -r -o";
-
-$ex_build_targets = "";
+$perl="perl" unless defined $perl;
+$mkdir="-mkdir" unless defined $mkdir;
 
 ($ssl,$crypto)=("ssl","crypto");
-$cryptocompat = "";
 $ranlib="echo ranlib";
 
 $cc=(defined($VARS{'CC'}))?$VARS{'CC'}:'cc';
@@ -134,40 +128,16 @@ $bin_dir=(defined($VARS{'BIN'}))?$VARS{'BIN'}:'';
 
 # $bin_dir.=$o causes a core dump on my sparc :-(
 
+
 $NT=0;
 
 push(@INC,"util/pl","pl");
-if ($platform eq "VC-MSDOS")
-        {
-        $asmbits=16;
-        $msdos=1;
-        require 'VC-16.pl';
-        }
-elsif ($platform eq "VC-W31-16")
+if (($platform =~ /VC-(.+)/))
         {
-        $asmbits=16;
-        $msdos=1; $win16=1;
-        require 'VC-16.pl';
-        }
-elsif (($platform eq "VC-W31-32") || ($platform eq "VC-WIN16"))
-        {
-        $asmbits=32;
-        $msdos=1; $win16=1;
-        require 'VC-16.pl';
-        }
-elsif (($platform eq "VC-WIN32") || ($platform eq "VC-NT"))
-        {
-        $NT = 1 if $platform eq "VC-NT";
+        $FLAVOR=$1;
+        $NT = 1 if $1 eq "NT";
         require 'VC-32.pl';
         }
-elsif ($platform eq "VC-WIN32-GMAKE")
-        {
-        require 'VC-32-GMAKE.pl';
-        }
-elsif ($platform eq "VC-CE")
-        {
-        require 'VC-CE.pl';
-        }
 elsif ($platform eq "Mingw32")
         {
         require 'Mingw32.pl';
@@ -181,23 +151,6 @@ elsif ($platform eq "BC-NT")
         $bc=1;
         require 'BC-32.pl';
         }
-elsif ($platform eq "BC-W31")
-        {
-        $bc=1;
-        $msdos=1; $w16=1;
-        require 'BC-16.pl';
-        }
-elsif ($platform eq "BC-Q16")
-        {
-        $msdos=1; $w16=1; $shlib=0; $qw=1;
-        require 'BC-16.pl';
-        }
-elsif ($platform eq "BC-MSDOS")
-        {
-        $asmbits=16;
-        $msdos=1;
-        require 'BC-16.pl';
-        }
 elsif ($platform eq "FreeBSD")
         {
         require 'unix.pl';
@@ -220,6 +173,13 @@ elsif ($platform eq "OS2-EMX")
         $wc=1;
         require 'OS2-EMX.pl';
         }
+elsif (($platform eq "netware-clib") || ($platform eq "netware-libc") ||
+       ($platform eq "netware-clib-bsdsock") || ($platform eq "netware-libc-bsdsock"))
+        {
+        $LIBC=1 if $platform eq "netware-libc" || $platform eq "netware-libc-bsdsock";
+        $BSDSOCK=1 if ($platform eq "netware-libc-bsdsock") || ($platform eq "netware-clib-bsdsock");
+        require 'netware.pl';
+        }
 else
         {
         require "unix.pl";
@@ -238,6 +198,8 @@ $cflags= "$xcflags$cflags" if $xcflags ne "";
 
 $cflags.=" -DOPENSSL_NO_IDEA" if $no_idea;
 $cflags.=" -DOPENSSL_NO_AES"  if $no_aes;
+$cflags.=" -DOPENSSL_NO_CAMELLIA"  if $no_camellia;
+$cflags.=" -DOPENSSL_NO_SEED" if $no_seed;
 $cflags.=" -DOPENSSL_NO_RC2"  if $no_rc2;
 $cflags.=" -DOPENSSL_NO_RC4"  if $no_rc4;
 $cflags.=" -DOPENSSL_NO_RC5"  if $no_rc5;
@@ -248,7 +210,7 @@ $cflags.=" -DOPENSSL_NO_SHA"  if $no_sha;
 $cflags.=" -DOPENSSL_NO_SHA1" if $no_sha1;
 $cflags.=" -DOPENSSL_NO_RIPEMD" if $no_ripemd;
 $cflags.=" -DOPENSSL_NO_MDC2" if $no_mdc2;
-$cflags.=" -DOPENSSL_NO_BF"   if $no_bf;
+$cflags.=" -DOPENSSL_NO_BF"  if $no_bf;
 $cflags.=" -DOPENSSL_NO_CAST" if $no_cast;
 $cflags.=" -DOPENSSL_NO_DES"  if $no_des;
 $cflags.=" -DOPENSSL_NO_RSA"  if $no_rsa;
@@ -257,17 +219,30 @@ $cflags.=" -DOPENSSL_NO_DH"   if $no_dh;
 $cflags.=" -DOPENSSL_NO_SOCK" if $no_sock;
 $cflags.=" -DOPENSSL_NO_SSL2" if $no_ssl2;
 $cflags.=" -DOPENSSL_NO_SSL3" if $no_ssl3;
+$cflags.=" -DOPENSSL_NO_TLSEXT" if $no_tlsext;
+$cflags.=" -DOPENSSL_NO_CMS" if $no_cms;
 $cflags.=" -DOPENSSL_NO_ERR"  if $no_err;
 $cflags.=" -DOPENSSL_NO_KRB5" if $no_krb5;
 $cflags.=" -DOPENSSL_NO_EC"   if $no_ec;
+$cflags.=" -DOPENSSL_NO_ECDSA" if $no_ecdsa;
+$cflags.=" -DOPENSSL_NO_ECDH" if $no_ecdh;
 $cflags.=" -DOPENSSL_NO_ENGINE"   if $no_engine;
 $cflags.=" -DOPENSSL_NO_HW"   if $no_hw;
-$cflags.=" -DOPENSSL_FIPS"    if $fips;
-#$cflags.=" -DRSAref"  if $rsaref ne "";
 
 $cflags.= " -DZLIB" if $zlib_opt;
 $cflags.= " -DZLIB_SHARED" if $zlib_opt == 2;
 
+if ($no_static_engine)
+        {
+        $cflags .= " -DOPENSSL_NO_STATIC_ENGINE";
+        }
+else
+        {
+        $cflags .= " -DOPENSSL_NO_DYNAMIC_ENGINE";
+        }
+
+#$cflags.=" -DRSAref"  if $rsaref ne "";
+
 ## if ($unix)
 ##      { $cflags="$c_flags" if ($c_flags ne ""); }
 ##else
@@ -305,21 +280,11 @@ for (;;)
                 {
                 if ($lib ne "")
                         {
-                        if ($fips && $dir =~ /^fips/)
-                                {
-                                $uc = "FIPS";
-                                }
-                        else
-                                {
-                                $uc=$lib;
-                                $uc =~ s/^lib(.*)\.a/$1/;
-                                $uc =~ tr/a-z/A-Z/;
-                                }
-                        if (($uc ne "FIPS") || $fips_canister_build)
-                                {
-                                $lib_nam{$uc}=$uc;
-                                $lib_obj{$uc}.=$libobj." ";
-                                }
+                        $uc=$lib;
+                        $uc =~ s/^lib(.*)\.a/$1/;
+                        $uc =~ tr/a-z/A-Z/;
+                        $lib_nam{$uc}=$uc;
+                        $lib_obj{$uc}.=$libobj." ";
                         }
                 last if ($val eq "FINISHED");
                 $lib="";
@@ -340,10 +305,10 @@ for (;;)
                 { $ex_libs .= " $val" if $val ne "";}
 
         if ($key eq "TEST")
-                { $test.=&var_add($dir,$val); }
+                { $test.=&var_add($dir,$val, 0); }
 
         if (($key eq "PROGS") || ($key eq "E_OBJ"))
-                { $e_exe.=&var_add($dir,$val); }
+                { $e_exe.=&var_add($dir,$val, 0); }
 
         if ($key eq "LIB")
                 {
@@ -352,74 +317,45 @@ for (;;)
                 }
 
         if ($key eq "EXHEADER")
-                { $exheader.=&var_add($dir,$val); }
+                { $exheader.=&var_add($dir,$val, 1); }
 
         if ($key eq "HEADER")
-                { $header.=&var_add($dir,$val); }
-
-        if ($key eq "LIBOBJ")
-                { $libobj=&var_add($dir,$val); }
+                { $header.=&var_add($dir,$val, 1); }
 
-        if ($key eq "FIPSLIBDIR")
-                { $fipslibdir=$val;}
-
-        if ($key eq "BASEADDR")
-                { $baseaddr=$val;}
+        if ($key eq "LIBOBJ" && ($dir ne "engines" || !$no_static_engine))
+                { $libobj=&var_add($dir,$val, 0); }
+        if ($key eq "LIBNAMES" && $dir eq "engines" && $no_static_engine)
+                { $engines.=$val }
 
         if (!($_=<IN>))
                 { $_="RELATIVE_DIRECTORY=FINISHED\n"; }
         }
 close(IN);
 
-if ($fips_canister_path eq "")
-        {
-        $fips_canister_path = "\$(FIPSLIB_D)${o}fipscanister.o";
-        }
-
-if ($fips_premain_c_path eq "")
+if ($shlib)
         {
-        $fips_premain_c_path = "\$(FIPSLIB_D)${o}fips_premain.c";
-        }
-
-if ($fips)
-        {
-        if ($fips_sha1_exe_path eq "")
+        $extra_install= <<"EOF";
+        \$(CP) \"\$(O_SSL)\" \"\$(INSTALLTOP)${o}bin\"
+        \$(CP) \"\$(O_CRYPTO)\" \"\$(INSTALLTOP)${o}bin\"
+        \$(CP) \"\$(L_SSL)\" \"\$(INSTALLTOP)${o}lib\"
+        \$(CP) \"\$(L_CRYPTO)\" \"\$(INSTALLTOP)${o}lib\"
+EOF
+        if ($no_static_engine)
                 {
-                $fips_sha1_exe_path =
-                        "\$(BIN_D)${o}fips_standalone_sha1$exep";
+                $extra_install .= <<"EOF"
+        \$(MKDIR) \"\$(INSTALLTOP)${o}lib${o}engines\"
+        \$(CP) \"\$(E_SHLIB)\" \"\$(INSTALLTOP)${o}lib${o}engines\"
+EOF
                 }
         }
-        else
-        {
-        $fips_sha1_exe_path = "";
-        }
-
-if ($fips_premain_dso_exe_path eq "")
-        {
-        $fips_premain_dso_exe_path = "\$(BIN_D)${o}fips_premain_dso$exep";
-        }
-
-#       $ex_build_targets .= "\$(BIN_D)${o}\$(E_PREMAIN_DSO)$exep" if ($fips);
-
-if ($fips)
+else
         {
-        if (!$shlib)
-                {
-                $ex_build_targets .= " \$(LIB_D)$o$crypto_compat \$(PREMAIN_DSO_EXE)";
-                $ex_l_libs .= " \$(O_FIPSCANISTER)";
-                }
-        if ($fipslibdir eq "")
-                {
-                open (IN, "util/fipslib_path.txt") || fipslib_error();
-                $fipslibdir = <IN>;
-                chomp $fipslibdir;
-                close IN;
-                }
-        fips_check_files($fipslibdir,
-                        "fipscanister.o", "fipscanister.o.sha1",
-                        "fips_premain.c", "fips_premain.c.sha1");
+        $extra_install= <<"EOF";
+        \$(CP) \"\$(O_SSL)\" \"\$(INSTALLTOP)${o}lib\"
+        \$(CP) \"\$(O_CRYPTO)\" \"\$(INSTALLTOP)${o}lib\"
+EOF
+        $ex_libs .= " $zlib_lib" if $zlib_opt == 1;
         }
-        
 
 $defs= <<"EOF";
 # This makefile has been automatically generated from the OpenSSL distribution.
@@ -439,15 +375,6 @@ EOF
 
 $defs .= $preamble if defined $preamble;
 
-if ($platform eq "VC-CE")
-        {
-        $defs.= <<"EOF";
-!INCLUDE <\$(WCECOMPAT)/wcedefs.mak>
-
-EOF
-        $ex_libs .= " $zlib_lib" if $zlib_opt == 1;
-        }
-
 $defs.= <<"EOF";
 INSTALLTOP=$INSTALLTOP
 
@@ -468,10 +395,11 @@ EX_LIBS=$ex_libs
 SRC_D=$src_dir
 
 LINK=$link
-PERL=perl
-FIPSLINK=\$(PERL) util${o}fipslink.pl
 LFLAGS=$lflags
+RSC=$rsc
 
+AES_ASM_OBJ=$aes_asm_obj
+AES_ASM_SRC=$aes_asm_src
 BN_ASM_OBJ=$bn_asm_obj
 BN_ASM_SRC=$bn_asm_src
 BNCO_ASM_OBJ=$bnco_asm_obj
@@ -492,6 +420,8 @@ SHA1_ASM_OBJ=$sha1_asm_obj
 SHA1_ASM_SRC=$sha1_asm_src
 RMD160_ASM_OBJ=$rmd160_asm_obj
 RMD160_ASM_SRC=$rmd160_asm_src
+CPUID_ASM_OBJ=$cpuid_asm_obj
+CPUID_ASM_SRC=$cpuid_asm_src
 
 # The output directory for everything intersting
 OUT_D=$out_dir
@@ -501,9 +431,7 @@ TMP_D=$tmp_dir
 INC_D=$inc_dir
 INCO_D=$inc_dir${o}openssl
 
-# Directory containing FIPS module
-
-
+PERL=$perl
 CP=$cp
 RM=$rm
 RANLIB=$ranlib
@@ -511,18 +439,6 @@ MKDIR=$mkdir
 MKLIB=$bin_dir$mklib
 MLFLAGS=$mlflags
 ASM=$bin_dir$asm
-MKCANISTER=$mkcanister
-
-# FIPS validated module and support file locations
-
-E_PREMAIN_DSO=fips_premain_dso
-
-FIPSLIB_D=$fipslibdir
-BASEADDR=$baseaddr
-FIPS_PREMAIN_SRC=$fips_premain_c_path
-O_FIPSCANISTER=$fips_canister_path
-FIPS_SHA1_EXE=$fips_sha1_exe_path
-PREMAIN_DSO_EXE=$fips_premain_dso_exe_path
 
 ######################################################
 # You should not need to touch anything below this point
@@ -535,12 +451,14 @@ CRYPTO=$crypto
 # BIN_D  - Binary output directory
 # TEST_D - Binary test file output directory
 # LIB_D  - library output directory
+# ENG_D  - dynamic engine output directory
 # Note: if you change these point to different directories then uncomment out
 # the lines around the 'NB' comment below.
 # 
 BIN_D=\$(OUT_D)
 TEST_D=\$(OUT_D)
 LIB_D=\$(OUT_D)
+ENG_D=\$(OUT_D)
 
 # INCL_D - local library directory
 # OBJ_D  - temp object file directory
@@ -554,7 +472,7 @@ SO_CRYPTO= $plib\$(CRYPTO)$so_shlibp
 L_SSL=     \$(LIB_D)$o$plib\$(SSL)$libp
 L_CRYPTO=  \$(LIB_D)$o$plib\$(CRYPTO)$libp
 
-L_LIBS= \$(L_SSL) \$(L_CRYPTO) $ex_l_libs
+L_LIBS= \$(L_SSL) \$(L_CRYPTO)
 
 ######################################################
 # Don't touch anything below this point
@@ -564,19 +482,19 @@ INC=-I\$(INC_D) -I\$(INCL_D)
 APP_CFLAGS=\$(INC) \$(CFLAG) \$(APP_CFLAG)
 LIB_CFLAGS=\$(INC) \$(CFLAG) \$(LIB_CFLAG)
 SHLIB_CFLAGS=\$(INC) \$(CFLAG) \$(LIB_CFLAG) \$(SHLIB_CFLAG)
-LIBS_DEP=\$(O_CRYPTO) \$(O_SSL) $ex_libs_dep
+LIBS_DEP=\$(O_CRYPTO) \$(O_SSL)
 
 #############################################
 EOF
 
 $rules=<<"EOF";
-all: banner \$(TMP_D) \$(BIN_D) \$(TEST_D) \$(LIB_D) \$(INCO_D) headers \$(FIPS_SHA1_EXE) lib exe $ex_build_targets
+all: banner \$(TMP_D) \$(BIN_D) \$(TEST_D) \$(LIB_D) \$(INCO_D) headers lib exe
 
 banner:
 $banner
 
 \$(TMP_D):
-        \$(MKDIR) \$(TMP_D)
+        \$(MKDIR) \"\$(TMP_D)\"
 # NB: uncomment out these lines if BIN_D, TEST_D and LIB_D are different
 #\$(BIN_D):
 #       \$(MKDIR) \$(BIN_D)
@@ -585,31 +503,36 @@ $banner
 #       \$(MKDIR) \$(TEST_D)
 
 \$(LIB_D):
-        \$(MKDIR) \$(LIB_D)
+        \$(MKDIR) \"\$(LIB_D)\"
 
 \$(INCO_D): \$(INC_D)
-        \$(MKDIR) \$(INCO_D)
+        \$(MKDIR) \"\$(INCO_D)\"
 
 \$(INC_D):
-        \$(MKDIR) \$(INC_D)
+        \$(MKDIR) \"\$(INC_D)\"
 
 headers: \$(HEADER) \$(EXHEADER)
         @
 
-lib: \$(LIBS_DEP)
+lib: \$(LIBS_DEP) \$(E_SHLIB)
 
 exe: \$(T_EXE) \$(BIN_D)$o\$(E_EXE)$exep
 
-install:
-        \$(MKDIR) \$(INSTALLTOP)
-        \$(MKDIR) \$(INSTALLTOP)${o}bin
-        \$(MKDIR) \$(INSTALLTOP)${o}include
-        \$(MKDIR) \$(INSTALLTOP)${o}include${o}openssl
-        \$(MKDIR) \$(INSTALLTOP)${o}lib
-        \$(CP) \$(INCO_D)${o}*.\[ch\] \$(INSTALLTOP)${o}include${o}openssl
-        \$(CP) \$(BIN_D)$o\$(E_EXE)$exep \$(INSTALLTOP)${o}bin
-        \$(CP) \$(O_SSL) \$(INSTALLTOP)${o}lib
-        \$(CP) \$(O_CRYPTO) \$(INSTALLTOP)${o}lib
+install: all
+        \$(MKDIR) \"\$(INSTALLTOP)\"
+        \$(MKDIR) \"\$(INSTALLTOP)${o}bin\"
+        \$(MKDIR) \"\$(INSTALLTOP)${o}include\"
+        \$(MKDIR) \"\$(INSTALLTOP)${o}include${o}openssl\"
+        \$(MKDIR) \"\$(INSTALLTOP)${o}lib\"
+        \$(CP) \"\$(INCO_D)${o}*.\[ch\]\" \"\$(INSTALLTOP)${o}include${o}openssl\"
+        \$(CP) \"\$(BIN_D)$o\$(E_EXE)$exep\" \"\$(INSTALLTOP)${o}bin\"
+        \$(CP) \"apps${o}openssl.cnf\" \"\$(INSTALLTOP)\"
+$extra_install
+
+
+test: \$(T_EXE)
+        cd \$(BIN_D)
+        ..${o}ms${o}test
 
 clean:
         \$(RM) \$(TMP_D)$o*.*
@@ -668,11 +591,11 @@ foreach (split(/\s+/,$exheader)){ $h{$_}=1; }
 foreach (split(/\s+/,$header))  { $h.=$_." " unless $h{$_}; }
 chop($h); $header=$h;
 
-$defs.=&do_defs("HEADER",$header,"\$(INCL_D)",".h");
-$rules.=&do_copy_rule("\$(INCL_D)",$header,".h");
+$defs.=&do_defs("HEADER",$header,"\$(INCL_D)","");
+$rules.=&do_copy_rule("\$(INCL_D)",$header,"");
 
-$defs.=&do_defs("EXHEADER",$exheader,"\$(INCO_D)",".h");
-$rules.=&do_copy_rule("\$(INCO_D)",$exheader,".h");
+$defs.=&do_defs("EXHEADER",$exheader,"\$(INCO_D)","");
+$rules.=&do_copy_rule("\$(INCO_D)",$exheader,"");
 
 $defs.=&do_defs("T_OBJ",$test,"\$(OBJ_D)",$obj);
 $rules.=&do_compile_rule("\$(OBJ_D)",$test,"\$(APP_CFLAGS)");
@@ -680,29 +603,6 @@ $rules.=&do_compile_rule("\$(OBJ_D)",$test,"\$(APP_CFLAGS)");
 $defs.=&do_defs("E_OBJ",$e_exe,"\$(OBJ_D)",$obj);
 $rules.=&do_compile_rule("\$(OBJ_D)",$e_exe,'-DMONOLITH $(APP_CFLAGS)');
 
-# Special case rules for fips_start and fips_end fips_premain_dso
-
-if ($fips)
-        {
-        if ($fips_canister_build)
-                {
-                $rules.=&cc_compile_target("\$(OBJ_D)${o}fips_start$obj",
-                        "fips-1.0${o}fips_canister.c",
-                        "-DFIPS_START \$(SHLIB_CFLAGS)");
-                $rules.=&cc_compile_target("\$(OBJ_D)${o}fips_end$obj",
-                        "fips-1.0${o}fips_canister.c", "\$(SHLIB_CFLAGS)");
-                }
-        $rules.=&cc_compile_target("\$(OBJ_D)${o}fips_standalone_sha1$obj",
-                "fips-1.0${o}sha${o}fips_standalone_sha1.c",
-                "\$(SHLIB_CFLAGS)");
-        $rules.=&cc_compile_target("\$(OBJ_D)${o}fips_sha1dgst$obj",
-                "fips-1.0${o}sha${o}fips_sha1dgst.c",
-                "\$(SHLIB_CFLAGS)") unless $fips_canister_build;
-        $rules.=&cc_compile_target("\$(OBJ_D)${o}\$(E_PREMAIN_DSO)$obj",
-                "fips-1.0${o}fips_premain.c",
-                "-DFINGERPRINT_PREMAIN_DSO_LOAD \$(SHLIB_CFLAGS)");
-        }
-
 foreach (values %lib_nam)
         {
         $lib_obj=$lib_obj{$_};
@@ -713,7 +613,12 @@ foreach (values %lib_nam)
                 $rules.="\$(O_SSL):\n\n"; 
                 next;
                 }
-
+        if (($aes_asm_obj ne "") && ($_ eq "CRYPTO"))
+                {
+                $lib_obj =~ s/\s(\S*\/aes_core\S*)/ \$(AES_ASM_OBJ)/;
+                $lib_obj =~ s/\s\S*\/aes_cbc\S*//;
+                $rules.=&do_asm_rule($aes_asm_obj,$aes_asm_src);
+                }
         if (($bn_asm_obj ne "") && ($_ eq "CRYPTO"))
                 {
                 $lib_obj =~ s/\s\S*\/bn_asm\S*/ \$(BN_ASM_OBJ)/;
@@ -765,11 +670,28 @@ foreach (values %lib_nam)
                 $lib_obj =~ s/\s(\S*\/rmd_dgst\S*)/ $1 \$(RMD160_ASM_OBJ)/;
                 $rules.=&do_asm_rule($rmd160_asm_obj,$rmd160_asm_src);
                 }
+        if (($cpuid_asm_obj ne "") && ($_ eq "CRYPTO"))
+                {
+                $lib_obj =~ s/\s(\S*\/cversion\S*)/ $1 \$(CPUID_ASM_OBJ)/;
+                $rules.=&do_asm_rule($cpuid_asm_obj,$cpuid_asm_src);
+                }
         $defs.=&do_defs(${_}."OBJ",$lib_obj,"\$(OBJ_D)",$obj);
         $lib=($slib)?" \$(SHLIB_CFLAGS)".$shlib_ex_cflags{$_}:" \$(LIB_CFLAGS)";
         $rules.=&do_compile_rule("\$(OBJ_D)",$lib_obj{$_},$lib);
         }
 
+# hack to add version info on MSVC
+if (($platform eq "VC-WIN32") || ($platform eq "VC-NT")) {
+    $rules.= <<"EOF";
+\$(OBJ_D)\\\$(CRYPTO).res: ms\\version32.rc
+        \$(RSC) /fo"\$(OBJ_D)\\\$(CRYPTO).res" /d CRYPTO ms\\version32.rc
+
+\$(OBJ_D)\\\$(SSL).res: ms\\version32.rc
+        \$(RSC) /fo"\$(OBJ_D)\\\$(SSL).res" /d SSL ms\\version32.rc
+
+EOF
+}
+
 $defs.=&do_defs("T_EXE",$test,"\$(TEST_D)",$exep);
 foreach (split(/\s+/,$test))
         {
@@ -778,42 +700,20 @@ foreach (split(/\s+/,$test))
         $rules.=&do_link_rule("\$(TEST_D)$o$t$exep",$tt,"\$(LIBS_DEP)","\$(L_LIBS) \$(EX_LIBS)");
         }
 
-$rules.= &do_lib_rule("\$(SSLOBJ)","\$(O_SSL)",$ssl,$shlib,"\$(SO_SSL)");
-
+$defs.=&do_defs("E_SHLIB",$engines,"\$(ENG_D)",$shlibp);
 
-if ($fips)
-        {
-        if ($shlib)
-                {
-                $rules.= &do_lib_rule("\$(CRYPTOOBJ) \$(O_FIPSCANISTER)",
-                        "\$(O_CRYPTO)",
-                        "$crypto",
-                        $shlib, "\$(SO_CRYPTO)", "\$(BASEADDR)");
-                }
-        else
-                {
-                $rules.= &do_lib_rule("\$(CRYPTOOBJ)",
-                        "\$(O_CRYPTO)",$crypto,$shlib,"\$(SO_CRYPTO)", "");
-                $rules.= &do_lib_rule("\$(CRYPTOOBJ) \$(O_FIPSCANISTER)",
-                        "\$(LIB_D)$o$crypto_compat",$crypto,$shlib,"\$(SO_CRYPTO)", "");
-                }
-        }
-        else
+foreach (split(/\s+/,$engines))
         {
-        $rules.= &do_lib_rule("\$(CRYPTOOBJ)","\$(O_CRYPTO)",$crypto,$shlib,
-                                                        "\$(SO_CRYPTO)");
+        $rules.=&do_compile_rule("\$(OBJ_D)","engines${o}e_$_",$lib);
+        $rules.= &do_lib_rule("\$(OBJ_D)${o}e_${_}.obj","\$(ENG_D)$o$_$shlibp","",$shlib,"");
         }
 
 
-if ($fips)
-        {
-        $rules.= &do_rlink_rule("\$(O_FIPSCANISTER)", "\$(OBJ_D)${o}fips_start$obj \$(FIPSOBJ) \$(OBJ_D)${o}fips_end$obj", "\$(FIPSLIB_D)${o}fips_standalone_sha1$exep", "") if $fips_canister_build;
-        $rules.=&do_link_rule("\$(PREMAIN_DSO_EXE)","\$(OBJ_D)${o}\$(E_PREMAIN_DSO)$obj \$(CRYPTOOBJ) \$(O_FIPSCANISTER)","","\$(EX_LIBS)", 1);
-        
-        $rules.=&do_link_rule("\$(FIPS_SHA1_EXE)","\$(OBJ_D)${o}fips_standalone_sha1$obj \$(OBJ_D)${o}fips_sha1dgst$obj","","", 1);
-        }
 
-        $rules.=&do_link_rule("\$(BIN_D)$o\$(E_EXE)$exep","\$(E_OBJ)","\$(LIBS_DEP)","\$(L_LIBS) \$(EX_LIBS)",0);
+$rules.= &do_lib_rule("\$(SSLOBJ)","\$(O_SSL)",$ssl,$shlib,"\$(SO_SSL)");
+$rules.= &do_lib_rule("\$(CRYPTOOBJ)","\$(O_CRYPTO)",$crypto,$shlib,"\$(SO_CRYPTO)");
+
+$rules.=&do_link_rule("\$(BIN_D)$o\$(E_EXE)$exep","\$(E_OBJ)","\$(LIBS_DEP)","\$(L_LIBS) \$(EX_LIBS)");
 
 print $defs;
 
@@ -833,13 +733,15 @@ print $rules;
 # directories
 sub var_add
         {
-        local($dir,$val)=@_;
+        local($dir,$val,$keepext)=@_;
         local(@a,$_,$ret);
 
         return("") if $no_engine && $dir =~ /\/engine/;
         return("") if $no_hw   && $dir =~ /\/hw/;
         return("") if $no_idea && $dir =~ /\/idea/;
         return("") if $no_aes  && $dir =~ /\/aes/;
+        return("") if $no_camellia  && $dir =~ /\/camellia/;
+        return("") if $no_seed && $dir =~ /\/seed/;
         return("") if $no_rc2  && $dir =~ /\/rc2/;
         return("") if $no_rc4  && $dir =~ /\/rc4/;
         return("") if $no_rc5  && $dir =~ /\/rc5/;
@@ -848,6 +750,7 @@ sub var_add
         return("") if $no_dsa  && $dir =~ /\/dsa/;
         return("") if $no_dh   && $dir =~ /\/dh/;
         return("") if $no_ec   && $dir =~ /\/ec/;
+        return("") if $no_cms  && $dir =~ /\/cms/;
         if ($no_des && $dir =~ /\/des/)
                 {
                 if ($val =~ /read_pwd/)
@@ -862,7 +765,7 @@ sub var_add
 
         $val =~ s/^\s*(.*)\s*$/$1/;
         @a=split(/\s+/,$val);
-        grep(s/\.[och]$//,@a);
+        grep(s/\.[och]$//,@a) unless $keepext;
 
         @a=grep(!/^e_.*_3d$/,@a) if $no_des;
         @a=grep(!/^e_.*_d$/,@a) if $no_des;
@@ -873,6 +776,8 @@ sub var_add
         @a=grep(!/^e_.*_bf$/,@a) if $no_bf;
         @a=grep(!/^e_.*_c$/,@a) if $no_cast;
         @a=grep(!/^e_rc4$/,@a) if $no_rc4;
+        @a=grep(!/^e_camellia$/,@a) if $no_camellia;
+        @a=grep(!/^e_seed$/,@a) if $no_seed;
 
         @a=grep(!/(^s2_)|(^s23_)/,@a) if $no_ssl2;
         @a=grep(!/(^s3_)|(^s23_)/,@a) if $no_ssl3;
@@ -956,13 +861,23 @@ sub do_defs
                 elsif ($_ =~ /RC5_ENC/) { $t="$_ "; }
                 elsif ($_ =~ /MD5_ASM/) { $t="$_ "; }
                 elsif ($_ =~ /SHA1_ASM/){ $t="$_ "; }
+                elsif ($_ =~ /AES_ASM/){ $t="$_ "; }
                 elsif ($_ =~ /RMD160_ASM/){ $t="$_ "; }
+                elsif ($_ =~ /CPUID_ASM/){ $t="$_ "; }
                 else    { $t="$location${o}$_$pf "; }
 
                 $Vars{$var}.="$t ";
                 $ret.=$t;
                 }
-        chop($ret);
+        # hack to add version info on MSVC
+        if ($shlib && (($platform eq "VC-WIN32") || ($platform eq "VC-NT")))
+                {
+                if ($var eq "CRYPTOOBJ")
+                        { $ret.="\$(OBJ_D)\\\$(CRYPTO).res "; }
+                elsif ($var eq "SSLOBJ")
+                        { $ret.="\$(OBJ_D)\\\$(SSL).res "; }
+                }
+        chomp($ret);
         $ret.="\n\n";
         return($ret);
         }
@@ -1057,61 +972,118 @@ sub do_copy_rule
                 if ($n =~ /bss_file/)
                         { $pp=".c"; }
                 else    { $pp=$p; }
-                $ret.="$to${o}$n$pp: \$(SRC_D)$o$_$pp\n\t\$(CP) \$(SRC_D)$o$_$pp $to${o}$n$pp\n\n";
+                $ret.="$to${o}$n$pp: \$(SRC_D)$o$_$pp\n\t\$(CP) \"\$(SRC_D)$o$_$pp\" \"$to${o}$n$pp\"\n\n";
                 }
         return($ret);
         }
 
 sub read_options
         {
-        if    (/^no-rc2$/)      { $no_rc2=1; }
-        elsif (/^no-rc4$/)      { $no_rc4=1; }
-        elsif (/^no-rc5$/)      { $no_rc5=1; }
-        elsif (/^no-idea$/)     { $no_idea=1; }
-        elsif (/^no-aes$/)      { $no_aes=1; }
-        elsif (/^no-des$/)      { $no_des=1; }
-        elsif (/^no-bf$/)       { $no_bf=1; }
-        elsif (/^no-cast$/)     { $no_cast=1; }
-        elsif (/^no-md2$/)      { $no_md2=1; }
-        elsif (/^no-md4$/)      { $no_md4=1; }
-        elsif (/^no-md5$/)      { $no_md5=1; }
-        elsif (/^no-sha$/)      { $no_sha=1; }
-        elsif (/^no-sha1$/)     { $no_sha1=1; }
-        elsif (/^no-ripemd$/)   { $no_ripemd=1; }
-        elsif (/^no-mdc2$/)     { $no_mdc2=1; }
-        elsif (/^no-patents$/)  { $no_rc2=$no_rc4=$no_rc5=$no_idea=$no_rsa=1; }
-        elsif (/^no-rsa$/)      { $no_rsa=1; }
-        elsif (/^no-dsa$/)      { $no_dsa=1; }
-        elsif (/^no-dh$/)       { $no_dh=1; }
-        elsif (/^no-hmac$/)     { $no_hmac=1; }
-        elsif (/^no-aes$/)      { $no_aes=1; }
-        elsif (/^no-asm$/)      { $no_asm=1; }
-        elsif (/^nasm$/)        { $nasm=1; }
-        elsif (/^gaswin$/)      { $gaswin=1; }
-        elsif (/^no-ssl2$/)     { $no_ssl2=1; }
-        elsif (/^no-ssl3$/)     { $no_ssl3=1; }
-        elsif (/^no-err$/)      { $no_err=1; }
-        elsif (/^no-sock$/)     { $no_sock=1; }
-        elsif (/^no-krb5$/)     { $no_krb5=1; }
-        elsif (/^no-ec$/)       { $no_ec=1; }
-        elsif (/^no-engine$/)   { $no_engine=1; }
-        elsif (/^no-hw$/)       { $no_hw=1; }
-
-        elsif (/^just-ssl$/)    { $no_rc2=$no_idea=$no_des=$no_bf=$no_cast=1;
-                                  $no_md2=$no_sha=$no_mdc2=$no_dsa=$no_dh=1;
-                                  $no_ssl2=$no_err=$no_ripemd=$no_rc5=1;
-                                  $no_aes=1; }
-
-        elsif (/^rsaref$/)      { }
-        elsif (/^fips$/)        { $fips=1; }
-        elsif (/^gcc$/)         { $gcc=1; }
-        elsif (/^debug$/)       { $debug=1; }
-        elsif (/^profile$/)     { $profile=1; }
-        elsif (/^shlib$/)       { $shlib=1; }
-        elsif (/^dll$/)         { $shlib=1; }
-        elsif (/^shared$/)      { } # We just need to ignore it for now...
-        elsif (/^zlib$/) { $zlib_opt = 1 if $zlib_opt == 0 }
-        elsif (/^zlib-dynamic$/){ $zlib_opt = 2; }
+        # Many options are handled in a similar way. In particular
+        # no-xxx sets zero or more scalars to 1.
+        # Process these using a hash containing the option name and
+        # reference to the scalars to set.
+
+        my %valid_options = (
+                "no-rc2" => \$no_rc2,
+                "no-rc4" => \$no_rc4,
+                "no-rc5" => \$no_rc5,
+                "no-idea" => \$no_idea,
+                "no-aes" => \$no_aes,
+                "no-camellia" => \$no_camellia,
+                "no-seed" => \$no_seed,
+                "no-des" => \$no_des,
+                "no-bf" => \$no_bf,
+                "no-cast" => \$no_cast,
+                "no-md2" => \$no_md2,
+                "no-md4" => \$no_md4,
+                "no-md5" => \$no_md5,
+                "no-sha" => \$no_sha,
+                "no-sha1" => \$no_sha1,
+                "no-ripemd" => \$no_ripemd,
+                "no-mdc2" => \$no_mdc2,
+                "no-patents" => 
+                        [\$no_rc2, \$no_rc4, \$no_rc5, \$no_idea, \$no_rsa],
+                "no-rsa" => \$no_rsa,
+                "no-dsa" => \$no_dsa,
+                "no-dh" => \$no_dh,
+                "no-hmac" => \$no_hmac,
+                "no-asm" => \$no_asm,
+                "nasm" => \$nasm,
+                "nw-nasm" => \$nw_nasm,
+                "nw-mwasm" => \$nw_mwasm,
+                "gaswin" => \$gaswin,
+                "no-ssl2" => \$no_ssl2,
+                "no-ssl3" => \$no_ssl3,
+                "no-tlsext" => \$no_tlsext,
+                "no-cms" => \$no_cms,
+                "no-err" => \$no_err,
+                "no-sock" => \$no_sock,
+                "no-krb5" => \$no_krb5,
+                "no-ec" => \$no_ec,
+                "no-ecdsa" => \$no_ecdsa,
+                "no-ecdh" => \$no_ecdh,
+                "no-engine" => \$no_engine,
+                "no-hw" => \$no_hw,
+                "just-ssl" =>
+                        [\$no_rc2, \$no_idea, \$no_des, \$no_bf, \$no_cast,
+                          \$no_md2, \$no_sha, \$no_mdc2, \$no_dsa, \$no_dh,
+                          \$no_ssl2, \$no_err, \$no_ripemd, \$no_rc5,
+                          \$no_aes, \$no_camellia, \$no_seed],
+                "rsaref" => 0,
+                "gcc" => \$gcc,
+                "debug" => \$debug,
+                "profile" => \$profile,
+                "shlib" => \$shlib,
+                "dll" => \$shlib,
+                "shared" => 0,
+                "no-gmp" => 0,
+                "no-rfc3779" => 0,
+                "no-montasm" => 0,
+                "no-shared" => 0,
+                "no-zlib" => 0,
+                "no-zlib-dynamic" => 0,
+                );
+
+        if (exists $valid_options{$_})
+                {
+                my $r = $valid_options{$_};
+                if ( ref $r eq "SCALAR")
+                        { $$r = 1;}
+                elsif ( ref $r eq "ARRAY")
+                        {
+                        my $r2;
+                        foreach $r2 (@$r)
+                                {
+                                $$r2 = 1;
+                                }
+                        }
+                }
+        elsif (/^no-comp$/) { $xcflags = "-DOPENSSL_NO_COMP $xcflags"; }
+        elsif (/^enable-zlib$/) { $zlib_opt = 1 if $zlib_opt == 0 }
+        elsif (/^enable-zlib-dynamic$/)
+                {
+                $zlib_opt = 2;
+                }
+        elsif (/^no-static-engine/)
+                {
+                $no_static_engine = 1;
+                }
+        elsif (/^enable-static-engine/)
+                {
+                $no_static_engine = 0;
+                }
+        # There are also enable-xxx options which correspond to
+        # the no-xxx. Since the scalars are enabled by default
+        # these can be ignored.
+        elsif (/^enable-/)
+                {
+                my $t = $_;
+                $t =~ s/^enable/no/;
+                if (exists $valid_options{$t})
+                        {return 1;}
+                return 0;
+                }
         elsif (/^--with-krb5-flavor=(.*)$/)
                 {
                 my $krb5_flavor = $1;
@@ -1135,31 +1107,3 @@ sub read_options
         else { return(0); }
         return(1);
         }
-
-sub fipslib_error
-        {
-        print STDERR "***FIPS module directory sanity check failed***\n";
-        print STDERR "FIPS module build failed, or was deleted\n";
-        print STDERR "Please rebuild FIPS module.\n"; 
-        exit 1;
-        }
-
-sub fips_check_files
-        {
-        my $dir = shift @_;
-        my $ret = 1;
-        if (!-d $dir)
-                {
-                print STDERR "FIPS module directory $dir does not exist\n";
-                fipslib_error();
-                }
-        foreach (@_)
-                {
-                if (!-f "$dir${o}$_")
-                        {
-                        print STDERR "FIPS module file $_ does not exist!\n";
-                        $ret = 0;
-                        }
-                }
-        fipslib_error() if ($ret == 0);
-        }
diff --git a/src/lib/libssl/src/util/mkdef.pl b/src/lib/libssl/src/util/mkdef.pl
index 6c1e53bb14..ef1cc6e513 100644
--- a/src/lib/libssl/src/util/mkdef.pl
+++ b/src/lib/libssl/src/util/mkdef.pl
@@ -79,19 +79,29 @@ my $OS2=0;
 my $safe_stack_def = 0;
 
 my @known_platforms = ( "__FreeBSD__", "PERL5", "NeXT",
-                        "EXPORT_VAR_AS_FUNCTION", "OPENSSL_FIPS" );
+                        "EXPORT_VAR_AS_FUNCTION", "ZLIB" );
 my @known_ossl_platforms = ( "VMS", "WIN16", "WIN32", "WINNT", "OS2" );
 my @known_algorithms = ( "RC2", "RC4", "RC5", "IDEA", "DES", "BF",
                          "CAST", "MD2", "MD4", "MD5", "SHA", "SHA0", "SHA1",
                          "SHA256", "SHA512", "RIPEMD",
-                         "MDC2", "RSA", "DSA", "DH", "EC", "HMAC", "AES",
+                         "MDC2", "RSA", "DSA", "DH", "EC", "ECDH", "ECDSA", "HMAC", "AES", "CAMELLIA", "SEED",
                          # Envelope "algorithms"
                          "EVP", "X509", "ASN1_TYPEDEFS",
                          # Helper "algorithms"
                          "BIO", "COMP", "BUFFER", "LHASH", "STACK", "ERR",
                          "LOCKING",
                          # External "algorithms"
-                         "FP_API", "STDIO", "SOCK", "KRB5", "ENGINE", "HW" );
+                         "FP_API", "STDIO", "SOCK", "KRB5", "DGRAM",
+                         # Engines
+                         "STATIC_ENGINE", "ENGINE", "HW", "GMP",
+                         # RFC3779 support 
+                         "RFC3779",
+                         # TLS extension support
+                         "TLSEXT",
+                         # CMS
+                         "CMS",
+                         # Deprecated functions
+                         "DEPRECATED" );
 
 my $options="";
 open(IN,"<Makefile") || die "unable to open Makefile!\n";
@@ -107,9 +117,11 @@ my $no_rc2; my $no_rc4; my $no_rc5; my $no_idea; my $no_des; my $no_bf;
 my $no_cast;
 my $no_md2; my $no_md4; my $no_md5; my $no_sha; my $no_ripemd; my $no_mdc2;
 my $no_rsa; my $no_dsa; my $no_dh; my $no_hmac=0; my $no_aes; my $no_krb5;
-my $no_ec; my $no_engine; my $no_hw;
-my $no_fp_api;
-my $fips;
+my $no_ec; my $no_ecdsa; my $no_ecdh; my $no_engine; my $no_hw; my $no_camellia;
+my $no_seed;
+my $no_fp_api; my $no_static_engine; my $no_gmp; my $no_deprecated;
+my $no_rfc3779; my $no_tlsext; my $no_cms;
+
 
 foreach (@ARGV, split(/ /, $options))
         {
@@ -130,7 +142,11 @@ foreach (@ARGV, split(/ /, $options))
         }
         $VMS=1 if $_ eq "VMS";
         $OS2=1 if $_ eq "OS2";
-        $fips=1 if $_ eq "fips";
+        if ($_ eq "zlib" || $_ eq "zlib-dynamic"
+                         || $_ eq "enable-zlib-dynamic") {
+                $zlib = 1;
+        }
+
 
         $do_ssl=1 if $_ eq "ssleay";
         if ($_ eq "ssl") {
@@ -142,6 +158,8 @@ foreach (@ARGV, split(/ /, $options))
                 $do_crypto=1;
                 $libname=$_;
         }
+        $no_static_engine=1 if $_ eq "no-static-engine";
+        $no_static_engine=0 if $_ eq "enable-static-engine";
         $do_update=1 if $_ eq "update";
         $do_rewrite=1 if $_ eq "rewrite";
         $do_ctest=1 if $_ eq "ctest";
@@ -166,8 +184,12 @@ foreach (@ARGV, split(/ /, $options))
         elsif (/^no-dsa$/)      { $no_dsa=1; }
         elsif (/^no-dh$/)       { $no_dh=1; }
         elsif (/^no-ec$/)       { $no_ec=1; }
+        elsif (/^no-ecdsa$/)    { $no_ecdsa=1; }
+        elsif (/^no-ecdh$/)     { $no_ecdh=1; }
         elsif (/^no-hmac$/)     { $no_hmac=1; }
         elsif (/^no-aes$/)      { $no_aes=1; }
+        elsif (/^no-camellia$/) { $no_camellia=1; }
+        elsif (/^no-seed$/)     { $no_seed=1; }
         elsif (/^no-evp$/)      { $no_evp=1; }
         elsif (/^no-lhash$/)    { $no_lhash=1; }
         elsif (/^no-stack$/)    { $no_stack=1; }
@@ -180,6 +202,10 @@ foreach (@ARGV, split(/ /, $options))
         elsif (/^no-krb5$/)     { $no_krb5=1; }
         elsif (/^no-engine$/)   { $no_engine=1; }
         elsif (/^no-hw$/)       { $no_hw=1; }
+        elsif (/^no-gmp$/)      { $no_gmp=1; }
+        elsif (/^no-rfc3779$/)  { $no_rfc3779=1; }
+        elsif (/^no-tlsext$/)   { $no_tlsext=1; }
+        elsif (/^no-cms$/)      { $no_cms=1; }
         }
 
 
@@ -215,8 +241,10 @@ $max_crypto = $max_num;
 
 my $ssl="ssl/ssl.h";
 $ssl.=" ssl/kssl.h";
+$ssl.=" ssl/tls1.h";
 
 my $crypto ="crypto/crypto.h";
+$crypto.=" crypto/o_dir.h";
 $crypto.=" crypto/des/des.h crypto/des/des_old.h" ; # unless $no_des;
 $crypto.=" crypto/idea/idea.h" ; # unless $no_idea;
 $crypto.=" crypto/rc4/rc4.h" ; # unless $no_rc4;
@@ -231,12 +259,16 @@ $crypto.=" crypto/mdc2/mdc2.h" ; # unless $no_mdc2;
 $crypto.=" crypto/sha/sha.h" ; # unless $no_sha;
 $crypto.=" crypto/ripemd/ripemd.h" ; # unless $no_ripemd;
 $crypto.=" crypto/aes/aes.h" ; # unless $no_aes;
+$crypto.=" crypto/camellia/camellia.h" ; # unless $no_camellia;
+$crypto.=" crypto/seed/seed.h"; # unless $no_seed;
 
 $crypto.=" crypto/bn/bn.h";
 $crypto.=" crypto/rsa/rsa.h" ; # unless $no_rsa;
 $crypto.=" crypto/dsa/dsa.h" ; # unless $no_dsa;
 $crypto.=" crypto/dh/dh.h" ; # unless $no_dh;
 $crypto.=" crypto/ec/ec.h" ; # unless $no_ec;
+$crypto.=" crypto/ecdsa/ecdsa.h" ; # unless $no_ecdsa;
+$crypto.=" crypto/ecdh/ecdh.h" ; # unless $no_ecdh;
 $crypto.=" crypto/hmac/hmac.h" ; # unless $no_hmac;
 
 $crypto.=" crypto/engine/engine.h"; # unless $no_engine;
@@ -267,7 +299,9 @@ $crypto.=" crypto/ocsp/ocsp.h";
 $crypto.=" crypto/ui/ui.h crypto/ui/ui_compat.h";
 $crypto.=" crypto/krb5/krb5_asn.h";
 $crypto.=" crypto/tmdiff.h";
-$crypto.=" fips-1.0/fips.h fips-1.0/rand/fips_rand.h fips-1.0/sha/fips_sha.h";
+$crypto.=" crypto/store/store.h";
+$crypto.=" crypto/pqueue/pqueue.h";
+$crypto.=" crypto/cms/cms.h";
 
 my $symhacks="crypto/symhacks.h";
 
@@ -423,7 +457,11 @@ sub do_defs
 
                 print STDERR "DEBUG: parsing ----------\n" if $debug;
                 while(<IN>) {
-                        last if (/\/\* Error codes for the \w+ functions\. \*\//);
+                        if (/\/\* Error codes for the \w+ functions\. \*\//)
+                                {
+                                undef @tag;
+                                last;
+                                }
                         if ($line ne '') {
                                 $_ = $line . $_;
                                 $line = '';
@@ -436,17 +474,22 @@ sub do_defs
                                 next;
                         }
 
-                        $cpp = 1 if /^\#.*ifdef.*cplusplus/;
+                        if(/\/\*/) {
+                                if (not /\*\//) {       # multiline comment...
+                                        $line = $_;     # ... just accumulate
+                                        next;
+                                } else {
+                                        s/\/\*.*?\*\///gs;# wipe it
+                                }
+                        }
+
                         if ($cpp) {
-                                $cpp = 0 if /^\#.*endif/;
+                                $cpp++ if /^#\s*if/;
+                                $cpp-- if /^#\s*endif/;
                                 next;
                         }
+                        $cpp = 1 if /^#.*ifdef.*cplusplus/;
 
-                        s/\/\*.*?\*\///gs;                   # ignore comments
-                        if (/\/\*/) {                        # if we have part
-                                $line = $_;                  # of a comment,
-                                next;                        # continue reading
-                        }
                         s/{[^{}]*}//gs;                      # ignore {} blocks
                         print STDERR "DEBUG: \$def=\"$def\"\n" if $debug && $def ne "";
                         print STDERR "DEBUG: \$_=\"$_\"\n" if $debug;
@@ -505,7 +548,7 @@ sub do_defs
                                 }
                         } elsif (/^\#\s*endif/) {
                                 my $tag_i = $#tag;
-                                while($tag[$tag_i] ne "-") {
+                                while($tag_i > 0 && $tag[$tag_i] ne "-") {
                                         my $t=$tag[$tag_i];
                                         print STDERR "DEBUG: \$t=\"$t\"\n" if $debug;
                                         if ($tag{$t}==2) {
@@ -672,6 +715,10 @@ sub do_defs
                                                       "EXPORT_VAR_AS_FUNCTION",
                                                       "FUNCTION");
                                         next;
+                                } elsif (/^\s*DECLARE_ASN1_ALLOC_FUNCTIONS\s*\(\s*(\w*)\s*\)/) {
+                                        $def .= "int $1_free(void);";
+                                        $def .= "int $1_new(void);";
+                                        next;
                                 } elsif (/^\s*DECLARE_ASN1_FUNCTIONS_name\s*\(\s*(\w*)\s*,\s*(\w*)\s*\)/) {
                                         $def .= "int d2i_$2(void);";
                                         $def .= "int i2d_$2(void);";
@@ -716,12 +763,21 @@ sub do_defs
                                                       "EXPORT_VAR_AS_FUNCTION",
                                                       "FUNCTION");
                                         next;
+                                } elsif (/^\s*DECLARE_ASN1_NDEF_FUNCTION\s*\(\s*(\w*)\s*\)/) {
+                                        $def .= "int i2d_$1_NDEF(void);";
                                 } elsif (/^\s*DECLARE_ASN1_SET_OF\s*\(\s*(\w*)\s*\)/) {
                                         next;
+                                } elsif (/^\s*DECLARE_ASN1_PRINT_FUNCTION\s*\(\s*(\w*)\s*\)/) {
+                                        $def .= "int $1_print_ctx(void);";
+                                        next;
+                                } elsif (/^\s*DECLARE_ASN1_PRINT_FUNCTION_name\s*\(\s*(\w*)\s*,\s*(\w*)\s*\)/) {
+                                        $def .= "int $2_print_ctx(void);";
+                                        next;
                                 } elsif (/^\s*DECLARE_PKCS12_STACK_OF\s*\(\s*(\w*)\s*\)/) {
                                         next;
                                 } elsif (/^DECLARE_PEM_rw\s*\(\s*(\w*)\s*,/ ||
-                                         /^DECLARE_PEM_rw_cb\s*\(\s*(\w*)\s*,/ ) {
+                                         /^DECLARE_PEM_rw_cb\s*\(\s*(\w*)\s*,/ ||
+                                         /^DECLARE_PEM_rw_const\s*\(\s*(\w*)\s*,/ ) {
                                         # Things not in Win16
                                         $def .=
                                             "#INFO:"
@@ -797,7 +853,7 @@ sub do_defs
                 }
                 close(IN);
 
-                my $algs = '';
+                my $algs;
                 my $plays;
 
                 print STDERR "DEBUG: postprocessing ----------\n" if $debug;
@@ -809,6 +865,17 @@ sub do_defs
                         next if(/typedef\W/);
                         next if(/\#define/);
 
+                        # Reduce argument lists to empty ()
+                        # fold round brackets recursively: (t(*v)(t),t) -> (t{}{},t) -> {}
+                        while(/\(.*\)/s) {
+                                s/\([^\(\)]+\)/\{\}/gs;
+                                s/\(\s*\*\s*(\w+)\s*\{\}\s*\)/$1/gs;    #(*f{}) -> f
+                        }
+                        # pretend as we didn't use curly braces: {} -> ()
+                        s/\{\}/\(\)/gs;
+
+                        s/STACK_OF\(\)/void/gs;
+
                         print STDERR "DEBUG: \$_ = \"$_\"\n" if $debug;
                         if (/^\#INFO:([^:]*):(.*)$/) {
                                 $plats = $1;
@@ -819,21 +886,10 @@ sub do_defs
                                 $s = $1;
                                 $k = "VARIABLE";
                                 print STDERR "DEBUG: found external variable $s\n" if $debug;
-                        } elsif (/\(\*(\w*(\{[0-9]+\})?)\([^\)]+/) {
-                                $s = $1;
-                                print STDERR "DEBUG: found ANSI C function $s\n" if $debug;
-                        } elsif (/\w+\W+(\w+)\W*\(\s*\)(\s*__attribute__\(.*\)\s*)?$/s) {
-                                # K&R C
-                                print STDERR "DEBUG: found K&R C function $s\n" if $debug;
+                        } elsif (/TYPEDEF_\w+_OF/s) {
                                 next;
-                        } elsif (/\w+\W+\w+(\{[0-9]+\})?\W*\(.*\)(\s*__attribute__\(.*\)\s*)?$/s) {
-                                while (not /\(\)(\s*__attribute__\(.*\)\s*)?$/s) {
-                                        s/[^\(\)]*\)(\s*__attribute__\(.*\)\s*)?$/\)/s;
-                                        s/\([^\(\)]*\)\)(\s*__attribute__\(.*\)\s*)?$/\)/s;
-                                }
-                                s/\(void\)//;
-                                /(\w+(\{[0-9]+\})?)\W*\(\)/s;
-                                $s = $1;
+                        } elsif (/(\w+)\s*\(\).*/s) {   # first token prior [first] () is
+                                $s = $1;                # a function name!
                                 print STDERR "DEBUG: found function $s\n" if $debug;
                         } elsif (/\(/ and not (/=/)) {
                                 print STDERR "File $file: cannot parse: $_;\n";
@@ -864,13 +920,9 @@ sub do_defs
                         $a .= ",RSA" if($s =~ /PEM_Seal(Final|Init|Update)/);
                         $a .= ",RSA" if($s =~ /RSAPrivateKey/);
                         $a .= ",RSA" if($s =~ /SSLv23?_((client|server)_)?method/);
-                        # SHA2 algorithms only defined in FIPS mode for
-                        # OpenSSL 0.9.7
-                        $p .= "OPENSSL_FIPS" if($s =~ /SHA[235]/);
 
                         $platform{$s} =
                             &reduce_platforms((defined($platform{$s})?$platform{$s}.',':"").$p);
-                        $algorithm{$s} = '' if !defined $algorithm{$s};
                         $algorithm{$s} .= ','.$a;
 
                         if (defined($variant{$s})) {
@@ -1035,9 +1087,7 @@ sub is_valid
                         if ($keyword eq "EXPORT_VAR_AS_FUNCTION" && ($VMSVAX || $W32 || $W16)) {
                                 return 1;
                         }
-                        if ($keyword eq "OPENSSL_FIPS" && $fips) {
-                                return 1;
-                        }
+                        if ($keyword eq "ZLIB" && $zlib) { return 1; }
                         return 0;
                 } else {
                         # algorithms
@@ -1058,8 +1108,12 @@ sub is_valid
                         if ($keyword eq "DSA" && $no_dsa) { return 0; }
                         if ($keyword eq "DH" && $no_dh) { return 0; }
                         if ($keyword eq "EC" && $no_ec) { return 0; }
+                        if ($keyword eq "ECDSA" && $no_ecdsa) { return 0; }
+                        if ($keyword eq "ECDH" && $no_ecdh) { return 0; }
                         if ($keyword eq "HMAC" && $no_hmac) { return 0; }
                         if ($keyword eq "AES" && $no_aes) { return 0; }
+                        if ($keyword eq "CAMELLIA" && $no_camellia) { return 0; }
+                        if ($keyword eq "SEED" && $no_seed) { return 0; }
                         if ($keyword eq "EVP" && $no_evp) { return 0; }
                         if ($keyword eq "LHASH" && $no_lhash) { return 0; }
                         if ($keyword eq "STACK" && $no_stack) { return 0; }
@@ -1072,6 +1126,12 @@ sub is_valid
                         if ($keyword eq "ENGINE" && $no_engine) { return 0; }
                         if ($keyword eq "HW" && $no_hw) { return 0; }
                         if ($keyword eq "FP_API" && $no_fp_api) { return 0; }
+                        if ($keyword eq "STATIC_ENGINE" && $no_static_engine) { return 0; }
+                        if ($keyword eq "GMP" && $no_gmp) { return 0; }
+                        if ($keyword eq "RFC3779" && $no_rfc3779) { return 0; }
+                        if ($keyword eq "TLSEXT" && $no_tlsext) { return 0; }
+                        if ($keyword eq "CMS" && $no_cms) { return 0; }
+                        if ($keyword eq "DEPRECATED" && $no_deprecated) { return 0; }
 
                         # Nothing recognise as true
                         return 1;
@@ -1174,8 +1234,6 @@ EOO
 
 LIBRARY         $libname        $liboptions
 
-DESCRIPTION     '$description'
-
 EOF
 
         if ($W16) {
diff --git a/src/lib/libssl/src/util/mkdir-p.pl b/src/lib/libssl/src/util/mkdir-p.pl
index 6c69c2daa4..e73d02b073 100644
--- a/src/lib/libssl/src/util/mkdir-p.pl
+++ b/src/lib/libssl/src/util/mkdir-p.pl
@@ -8,6 +8,7 @@
 my $arg;
 
 foreach $arg (@ARGV) {
+  $arg =~ tr|\\|/|;
   &do_mkdir_p($arg);
 }
 
diff --git a/src/lib/libssl/src/util/mkerr.pl b/src/lib/libssl/src/util/mkerr.pl
index 9678514604..53e14ab4df 100644
--- a/src/lib/libssl/src/util/mkerr.pl
+++ b/src/lib/libssl/src/util/mkerr.pl
@@ -44,8 +44,7 @@ while (@ARGV) {
 }
 
 if($recurse) {
-        @source = (<crypto/*.c>, <crypto/*/*.c>, <ssl/*.c>, <fips-1.0/*.c>,
-                   <fips-1.0/*/*.c>);
+        @source = (<crypto/*.c>, <crypto/*/*.c>, <ssl/*.c>);
 } else {
         @source = @ARGV;
 }
@@ -66,6 +65,8 @@ while(<IN>)
                         $csrc{$1} = $3;
                         $fmax{$1} = 99;
                         $rmax{$1} = 99;
+                        $fassigned{$1} = ":";
+                        $rassigned{$1} = ":";
                         $fnew{$1} = 0;
                         $rnew{$1} = 0;
                 }
@@ -104,15 +105,24 @@ while (($hdr, $lib) = each %libinc)
                     next;
                 }
 
-                $cpp = 1 if /^#.*ifdef.*cplusplus/;  # skip "C" declaration
+                if(/\/\*/) {
+                    if (not /\*\//) {           # multiline comment...
+                        $line = $_;             # ... just accumulate
+                        next; 
+                    } else {
+                        s/\/\*.*?\*\///gs;      # wipe it
+                    }
+                }
+
                 if ($cpp) {
-                    $cpp = 0 if /^#.*endif/;
+                    $cpp++ if /^#\s*if/;
+                    $cpp-- if /^#\s*endif/;
                     next;
                 }
+                $cpp = 1 if /^#.*ifdef.*cplusplus/;  # skip "C" declaration
 
                 next if (/^\#/);                      # skip preprocessor directives
 
-                s/\/\*.*?\*\///gs;                   # ignore comments
                 s/{[^{}]*}//gs;                      # ignore {} blocks
 
                 if (/\{|\/\*/) { # Add a } so editor works...
@@ -125,31 +135,37 @@ while (($hdr, $lib) = each %libinc)
 
         print STDERR "                                  \r" if $debug;
         $defnr = 0;
+        # Delete any DECLARE_ macros
+        $def =~ s/DECLARE_\w+\([\w,\s]+\)//gs;
         foreach (split /;/, $def) {
             $defnr++;
             print STDERR "def: $defnr\r" if $debug;
 
+            # The goal is to collect function names from function declarations.
+
             s/^[\n\s]*//g;
             s/[\n\s]*$//g;
-            next if(/typedef\W/);
-            if (/\(\*(\w*)\([^\)]+/) {
-                my $name = $1;
-                $name =~ tr/[a-z]/[A-Z]/;
-                $ftrans{$name} = $1;
-            } elsif (/\w+\W+(\w+)\W*\(\s*\)(\s*__attribute__\(.*\)\s*)?$/s){
-                # K&R C
-                next ;
-            } elsif (/\w+\W+\w+\W*\(.*\)(\s*__attribute__\(.*\)\s*)?$/s) {
-                while (not /\(\)(\s*__attribute__\(.*\)\s*)?$/s) {
-                    s/[^\(\)]*\)(\s*__attribute__\(.*\)\s*)?$/\)/s;
-                    s/\([^\(\)]*\)\)(\s*__attribute__\(.*\)\s*)?$/\)/s;
-                }
-                s/\(void\)//;
-                /(\w+(\{[0-9]+\})?)\W*\(\)/s;
-                my $name = $1;
+
+            # Skip over recognized non-function declarations
+            next if(/typedef\W/ or /DECLARE_STACK_OF/ or /TYPEDEF_.*_OF/);
+
+            # Remove STACK_OF(foo)
+            s/STACK_OF\(\w+\)/void/;
+
+            # Reduce argument lists to empty ()
+            # fold round brackets recursively: (t(*v)(t),t) -> (t{}{},t) -> {}
+            while(/\(.*\)/s) {
+                s/\([^\(\)]+\)/\{\}/gs;
+                s/\(\s*\*\s*(\w+)\s*\{\}\s*\)/$1/gs;    #(*f{}) -> f
+            }
+            # pretend as we didn't use curly braces: {} -> ()
+            s/\{\}/\(\)/gs;
+
+            if (/(\w+)\s*\(\).*/s) {    # first token prior [first] () is
+                my $name = $1;          # a function name!
                 $name =~ tr/[a-z]/[A-Z]/;
                 $ftrans{$name} = $1;
-            } elsif (/\(/ and not (/=/ or /DECLARE_STACK/)) {
+            } elsif (/[\(\)]/ and not (/=/)) {
                 print STDERR "Header $hdr: cannot parse: $_;\n";
             }
         }
@@ -162,7 +178,7 @@ while (($hdr, $lib) = each %libinc)
         # maximum code used.
 
         if ($gotfile) {
-            while(<IN>) {
+          while(<IN>) {
                 if(/^\#define\s+(\S+)\s+(\S+)/) {
                         $name = $1;
                         $code = $2;
@@ -173,18 +189,49 @@ while (($hdr, $lib) = each %libinc)
                         }
                         if($1 eq "R") {
                                 $rcodes{$name} = $code;
+                                if ($rassigned{$lib} =~ /:$code:/) {
+                                        print STDERR "!! ERROR: $lib reason code $code assigned twice\n";
+                                }
+                                $rassigned{$lib} .= "$code:";
                                 if(!(exists $rextra{$name}) &&
                                          ($code > $rmax{$lib}) ) {
                                         $rmax{$lib} = $code;
                                 }
                         } else {
+                                if ($fassigned{$lib} =~ /:$code:/) {
+                                        print STDERR "!! ERROR: $lib function code $code assigned twice\n";
+                                }
+                                $fassigned{$lib} .= "$code:";
                                 if($code > $fmax{$lib}) {
                                         $fmax{$lib} = $code;
                                 }
                                 $fcodes{$name} = $code;
                         }
                 }
-            }
+          }
+        }
+
+        if ($debug) {
+                if (defined($fmax{$lib})) {
+                        print STDERR "Max function code fmax" . "{" . "$lib" . "} = $fmax{$lib}\n";
+                        $fassigned{$lib} =~ m/^:(.*):$/;
+                        @fassigned = sort {$a <=> $b} split(":", $1);
+                        print STDERR "  @fassigned\n";
+                }
+                if (defined($rmax{$lib})) {
+                        print STDERR "Max reason code rmax" . "{" . "$lib" . "} = $rmax{$lib}\n";
+                        $rassigned{$lib} =~ m/^:(.*):$/;
+                        @rassigned = sort {$a <=> $b} split(":", $1);
+                        print STDERR "  @rassigned\n";
+                }
+        }
+
+        if ($lib eq "SSL") {
+                if ($rmax{$lib} >= 1000) {
+                        print STDERR "!! ERROR: SSL error codes 1000+ are reserved for alerts.\n";
+                        print STDERR "!!        Any new alerts must be added to $config.\n";
+                        print STDERR "\n";
+                }
         }
         close IN;
 }
@@ -201,11 +248,10 @@ while (($hdr, $lib) = each %libinc)
 # so all those unreferenced can be printed out.
 
 
-print STDERR "Files loaded: " if $debug;
 foreach $file (@source) {
         # Don't parse the error source file.
         next if exists $cskip{$file};
-        print STDERR $file if $debug;
+        print STDERR "File loaded: ".$file."\r" if $debug;
         open(IN, "<$file") || die "Can't open source file $file\n";
         while(<IN>) {
                 if(/(([A-Z0-9]+)_F_([A-Z0-9_]+))/) {
@@ -229,7 +275,7 @@ foreach $file (@source) {
         }
         close IN;
 }
-print STDERR "\n" if $debug;
+print STDERR "                                  \n" if $debug;
 
 # Now process each library in turn.
 
@@ -266,7 +312,7 @@ foreach $lib (keys %csrc)
         } else {
             push @out,
 "/* ====================================================================\n",
-" * Copyright (c) 2001-2005 The OpenSSL Project.  All rights reserved.\n",
+" * Copyright (c) 2001-2008 The OpenSSL Project.  All rights reserved.\n",
 " *\n",
 " * Redistribution and use in source and binary forms, with or without\n",
 " * modification, are permitted provided that the following conditions\n",
@@ -356,7 +402,16 @@ EOF
         foreach $i (@function) {
                 $z=6-int(length($i)/8);
                 if($fcodes{$i} eq "X") {
-                        $fcodes{$i} = ++$fmax{$lib};
+                        $fassigned{$lib} =~ m/^:([^:]*):/;
+                        $findcode = $1;
+                        if (!defined($findcode)) {
+                                $findcode = $fmax{$lib};
+                        }
+                        while ($fassigned{$lib} =~ m/:$findcode:/) {
+                                $findcode++;
+                        }
+                        $fcodes{$i} = $findcode;
+                        $fassigned{$lib} .= "$findcode:";
                         print STDERR "New Function code $i\n" if $debug;
                 }
                 printf OUT "#define $i%s $fcodes{$i}\n","\t" x $z;
@@ -367,7 +422,16 @@ EOF
         foreach $i (@reasons) {
                 $z=6-int(length($i)/8);
                 if($rcodes{$i} eq "X") {
-                        $rcodes{$i} = ++$rmax{$lib};
+                        $rassigned{$lib} =~ m/^:([^:]*):/;
+                        $findcode = $1;
+                        if (!defined($findcode)) {
+                                $findcode = $rmax{$lib};
+                        }
+                        while ($rassigned{$lib} =~ m/:$findcode:/) {
+                                $findcode++;
+                        }
+                        $rcodes{$i} = $findcode;
+                        $rassigned{$lib} .= "$findcode:";
                         print STDERR "New Reason code   $i\n" if $debug;
                 }
                 printf OUT "#define $i%s $rcodes{$i}\n","\t" x $z;
@@ -422,7 +486,7 @@ EOF
         print OUT <<"EOF";
 /* $cfile */
 /* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2008 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -536,17 +600,14 @@ if($static) {
 
 ${staticloader}void ERR_load_${lib}_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(${lib}_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings($load_errcode,${lib}_str_functs);
                 ERR_load_strings($load_errcode,${lib}_str_reasons);
-#endif
-
                 }
+#endif
         }
 EOF
 } else {
diff --git a/src/lib/libssl/src/util/mkfiles.pl b/src/lib/libssl/src/util/mkfiles.pl
index bc78510f56..1282392fea 100644
--- a/src/lib/libssl/src/util/mkfiles.pl
+++ b/src/lib/libssl/src/util/mkfiles.pl
@@ -24,12 +24,16 @@ my @dirs = (
 "crypto/bf",
 "crypto/cast",
 "crypto/aes",
+"crypto/camellia",
+"crypto/seed",
 "crypto/bn",
 "crypto/rsa",
 "crypto/dsa",
 "crypto/dso",
 "crypto/dh",
 "crypto/ec",
+"crypto/ecdh",
+"crypto/ecdsa",
 "crypto/buffer",
 "crypto/bio",
 "crypto/stack",
@@ -51,17 +55,12 @@ my @dirs = (
 "crypto/ocsp",
 "crypto/ui",
 "crypto/krb5",
-"fips-1.0",
-"fips-1.0/aes",
-"fips-1.0/des",
-"fips-1.0/dsa",
-"fips-1.0/dh",
-"fips-1.0/hmac",
-"fips-1.0/rand",
-"fips-1.0/rsa",
-"fips-1.0/sha",
+"crypto/store",
+"crypto/pqueue",
+"crypto/cms",
 "ssl",
 "apps",
+"engines",
 "test",
 "tools"
 );
diff --git a/src/lib/libssl/src/util/mklink.pl b/src/lib/libssl/src/util/mklink.pl
index 182732d959..d9bc98aab8 100644
--- a/src/lib/libssl/src/util/mklink.pl
+++ b/src/lib/libssl/src/util/mklink.pl
@@ -14,7 +14,6 @@
 # not contain symbolic links and that the parent of / is never referenced.
 # Apart from this, this script should be able to handle even the most
 # pathological cases.
-#
 
 use Cwd;
 
diff --git a/src/lib/libssl/src/util/mkstack.pl b/src/lib/libssl/src/util/mkstack.pl
index 0ca9eb6a76..2a968f395f 100644
--- a/src/lib/libssl/src/util/mkstack.pl
+++ b/src/lib/libssl/src/util/mkstack.pl
@@ -75,6 +75,7 @@ while(<IN>) {
 #define sk_${type_thing}_push(st, val) SKM_sk_push($type_thing, (st), (val))
 #define sk_${type_thing}_unshift(st, val) SKM_sk_unshift($type_thing, (st), (val))
 #define sk_${type_thing}_find(st, val) SKM_sk_find($type_thing, (st), (val))
+#define sk_${type_thing}_find_ex(st, val) SKM_sk_find_ex($type_thing, (st), (val))
 #define sk_${type_thing}_delete(st, i) SKM_sk_delete($type_thing, (st), (i))
 #define sk_${type_thing}_delete_ptr(st, ptr) SKM_sk_delete_ptr($type_thing, (st), (ptr))
 #define sk_${type_thing}_insert(st, val, i) SKM_sk_insert($type_thing, (st), (val), (i))
diff --git a/src/lib/libssl/src/util/pl/BC-32.pl b/src/lib/libssl/src/util/pl/BC-32.pl
index 28869c868d..99b8c058d2 100644
--- a/src/lib/libssl/src/util/pl/BC-32.pl
+++ b/src/lib/libssl/src/util/pl/BC-32.pl
@@ -62,7 +62,7 @@ $des_enc_src='';
 $bf_enc_obj='';
 $bf_enc_src='';
 
-if (!$no_asm && !$fips)
+if (!$no_asm)
         {
         $bn_mulw_obj='crypto\bn\asm\bn_win32.obj';
         $bn_mulw_src='crypto\bn\asm\bn_win32.asm';
@@ -126,18 +126,13 @@ ___
 
 sub do_link_rule
         {
-        local($target,$files,$dep_libs,$libs,$sha1file,$openssl)=@_;
+        local($target,$files,$dep_libs,$libs)=@_;
         local($ret,$_);
-
+        
         $file =~ s/\//$o/g if $o ne '/';
         $n=&bname($targer);
         $ret.="$target: $files $dep_libs\n";
-        $ret.="\t\$(LINK) \$(LFLAGS) $files \$(APP_EX_OBJ), $target,, $libs\n";
-        if (defined $sha1file)
-                {
-                $ret.="\t$openssl sha1 -hmac etaonrishdlcupfm -binary $target > $sha1file";
-                }
-        $ret.="\n";
+        $ret.="\t\$(LINK) \$(LFLAGS) $files \$(APP_EX_OBJ), $target,, $libs\n\n";
         return($ret);
         }
 
diff --git a/src/lib/libssl/src/util/pl/Mingw32.pl b/src/lib/libssl/src/util/pl/Mingw32.pl
index b9bb24d21d..8f0483fb93 100644
--- a/src/lib/libssl/src/util/pl/Mingw32.pl
+++ b/src/lib/libssl/src/util/pl/Mingw32.pl
@@ -19,9 +19,9 @@ $cc='gcc';
 if ($debug)
         { $cflags="-DL_ENDIAN -DDSO_WIN32 -g2 -ggdb"; }
 else
-        { $cflags="-DL_ENDIAN -DDSO_WIN32 -fomit-frame-pointer -O3 -mcpu=i486 -Wall"; }
+        { $cflags="-DL_ENDIAN -DDSO_WIN32 -fomit-frame-pointer -O3 -march=i486 -Wall"; }
 
-if ($gaswin and !$no_asm and !$fips)
+if ($gaswin and !$no_asm)
         {
         $bn_asm_obj='$(OBJ_D)\bn-win32.o';
         $bn_asm_src='crypto/bn/asm/bn-win32.s';
@@ -43,7 +43,9 @@ if ($gaswin and !$no_asm and !$fips)
         $rmd160_asm_src='crypto/ripemd/asm/rm-win32.s';
         $sha1_asm_obj='$(OBJ_D)\s1-win32.o';
         $sha1_asm_src='crypto/sha/asm/s1-win32.s';
-        $cflags.=" -DBN_ASM -DMD5_ASM -DSHA1_ASM";
+        $cpuid_asm_obj='$(OBJ_D)\cpu-win32.o';
+        $cpuid_asm_src='crypto/cpu-win32.s';
+        $cflags.=" -DBN_ASM -DMD5_ASM -DSHA1_ASM -DOPENSSL_BN_ASM_PART_WORDS";
         }
 
 
@@ -92,18 +94,13 @@ sub do_lib_rule
 
 sub do_link_rule
         {
-        local($target,$files,$dep_libs,$libs,$sha1file,$openssl)=@_;
+        local($target,$files,$dep_libs,$libs)=@_;
         local($ret,$_);
         
         $file =~ s/\//$o/g if $o ne '/';
         $n=&bname($target);
         $ret.="$target: $files $dep_libs\n";
-        $ret.="\t\$(LINK) ${efile}$target \$(LFLAGS) $files $libs\n";
-        if (defined $sha1file)
-                {
-                $ret.="\t$openssl sha1 -hmac etaonrishdlcupfm -binary $target > $sha1file";
-                }
-        $ret.="\n";
+        $ret.="\t\$(LINK) ${efile}$target \$(LFLAGS) $files $libs\n\n";
         return($ret);
         }
 1;
diff --git a/src/lib/libssl/src/util/pl/OS2-EMX.pl b/src/lib/libssl/src/util/pl/OS2-EMX.pl
index 8dbeaa7a08..28cd116907 100644
--- a/src/lib/libssl/src/util/pl/OS2-EMX.pl
+++ b/src/lib/libssl/src/util/pl/OS2-EMX.pl
@@ -48,7 +48,7 @@ $des_enc_src="";
 $bf_enc_obj="";
 $bf_enc_src="";
 
-if (!$no_asm && !$fips)
+if (!$no_asm)
         {
         $bn_asm_obj="crypto/bn/asm/bn-os2$obj crypto/bn/asm/co-os2$obj";
         $bn_asm_src="crypto/bn/asm/bn-os2.asm crypto/bn/asm/co-os2.asm";
@@ -107,18 +107,13 @@ sub do_lib_rule
 
 sub do_link_rule
         {
-        local($target,$files,$dep_libs,$libs,$sha1file,$openssl)=@_;
+        local($target,$files,$dep_libs,$libs)=@_;
         local($ret,$_);
         
         $file =~ s/\//$o/g if $o ne '/';
         $n=&bname($target);
         $ret.="$target: $files $dep_libs\n";
-        $ret.="\t\$(LINK) ${efile}$target \$(CFLAG) \$(LFLAGS) $files $libs\n";
-        if (defined $sha1file)
-                {
-                $ret.="\t$openssl sha1 -hmac etaonrishdlcupfm -binary $target > $sha1file";
-                }
-        $ret.="\n";
+        $ret.="\t\$(LINK) ${efile}$target \$(CFLAG) \$(LFLAGS) $files $libs\n\n";
         return($ret);
         }
 
diff --git a/src/lib/libssl/src/util/pl/VC-32.pl b/src/lib/libssl/src/util/pl/VC-32.pl
index 4e97dfa9af..9cb2ab7e99 100644
--- a/src/lib/libssl/src/util/pl/VC-32.pl
+++ b/src/lib/libssl/src/util/pl/VC-32.pl
@@ -1,56 +1,154 @@
 #!/usr/local/bin/perl
-# VCw32lib.pl - the file for Visual C++ 4.[01] for windows NT, static libraries
+# VC-32.pl - unified script for Microsoft Visual C++, covering Win32,
+# Win64 and WinCE [follow $FLAVOR variable to trace the differences].
 #
 
 $ssl=   "ssleay32";
-
-if ($fips && !$shlib)
-        {
-        $crypto="libeayfips32";
-        $crypto_compat = "libeaycompat32.lib";
-        }
-else
-        {
-        $crypto="libeay32";
-        }
+$crypto="libeay32";
 
 $o='\\';
-$cp='copy nul+';        # Timestamps get stuffed otherwise
+$cp='$(PERL) util/copy.pl';
+$mkdir='$(PERL) util/mkdir-p.pl';
 $rm='del';
 
 $zlib_lib="zlib1.lib";
 
 # C compiler stuff
 $cc='cl';
-$cflags=' /MD /W3 /WX /Ox /O2 /Ob2 /Gs0 /GF /Gy /nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DDSO_WIN32';
-$cflags.=' -D_CRT_SECURE_NO_DEPRECATE';         # shut up VC8
-$cflags.=' -D_CRT_NONSTDC_NO_DEPRECATE';        # shut up VC8
-$lflags="/nologo /subsystem:console /machine:I386 /opt:ref";
+if ($FLAVOR =~ /WIN64/)
+    {
+    # Note that we currently don't have /WX on Win64! There is a lot of
+    # warnings, but only of two types:
+    #
+    # C4344: conversion from '__int64' to 'int/long', possible loss of data
+    # C4267: conversion from 'size_t' to 'int/long', possible loss of data
+    #
+    # Amount of latter type is minimized by aliasing strlen to function of
+    # own desing and limiting its return value to 2GB-1 (see e_os.h). As
+    # per 0.9.8 release remaining warnings were explicitly examined and
+    # considered safe to ignore.
+    # 
+    $base_cflags=' /W3 /Gs0 /GF /Gy /nologo -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -DOPENSSL_SYSNAME_WIN32 -DOPENSSL_SYSNAME_WINNT -DUNICODE -D_UNICODE';
+    $base_cflags.=' -D_CRT_SECURE_NO_DEPRECATE';        # shut up VC8
+    $base_cflags.=' -D_CRT_NONSTDC_NO_DEPRECATE';       # shut up VC8
+    my $f = $shlib?' /MD':' /MT';
+    $lib_cflag='/Zl' if (!$shlib);      # remove /DEFAULTLIBs from static lib
+    $opt_cflags=$f.' /Ox';
+    $dbg_cflags=$f.'d /Od -DDEBUG -D_DEBUG';
+    $lflags="/nologo /subsystem:console /opt:ref";
+    }
+elsif ($FLAVOR =~ /CE/)
+    {
+    # sanity check
+    die '%OSVERSION% is not defined'    if (!defined($ENV{'OSVERSION'}));
+    die '%PLATFORM% is not defined'     if (!defined($ENV{'PLATFORM'}));
+    die '%TARGETCPU% is not defined'    if (!defined($ENV{'TARGETCPU'}));
+
+    #
+    # Idea behind this is to mimic flags set by eVC++ IDE...
+    #
+    $wcevers = $ENV{'OSVERSION'};                       # WCENNN
+    die '%OSVERSION% value is insane'   if ($wcevers !~ /^WCE([1-9])([0-9]{2})$/);
+    $wcecdefs = "-D_WIN32_WCE=$1$2 -DUNDER_CE=$1$2";    # -D_WIN32_WCE=NNN
+    $wcelflag = "/subsystem:windowsce,$1.$2";           # ...,N.NN
+
+    $wceplatf =  $ENV{'PLATFORM'};
+    $wceplatf =~ tr/a-z0-9 /A-Z0-9_/d;
+    $wcecdefs .= " -DWCE_PLATFORM_$wceplatf";
+
+    $wcetgt = $ENV{'TARGETCPU'};        # just shorter name...
+    SWITCH: for($wcetgt) {
+        /^X86/          && do { $wcecdefs.=" -Dx86 -D_X86_ -D_i386_ -Di_386_";
+                                $wcelflag.=" /machine:IX86";    last; };
+        /^ARMV4[IT]/    && do { $wcecdefs.=" -DARM -D_ARM_ -D$wcetgt";
+                                $wcecdefs.=" -DTHUMB -D_THUMB_" if($wcetgt=~/T$/);
+                                $wcecdefs.=" -QRarch4T -QRinterwork-return";
+                                $wcelflag.=" /machine:THUMB";   last; };
+        /^ARM/          && do { $wcecdefs.=" -DARM -D_ARM_ -D$wcetgt";
+                                $wcelflag.=" /machine:ARM";     last; };
+        /^MIPSIV/       && do { $wcecdefs.=" -DMIPS -D_MIPS_ -DR4000 -D$wcetgt";
+                                $wcecdefs.=" -D_MIPS64 -QMmips4 -QMn32";
+                                $wcelflag.=" /machine:MIPSFPU"; last; };
+        /^MIPS16/       && do { $wcecdefs.=" -DMIPS -D_MIPS_ -DR4000 -D$wcetgt";
+                                $wcecdefs.=" -DMIPSII -QMmips16";
+                                $wcelflag.=" /machine:MIPS16";  last; };
+        /^MIPSII/       && do { $wcecdefs.=" -DMIPS -D_MIPS_ -DR4000 -D$wcetgt";
+                                $wcecdefs.=" -QMmips2";
+                                $wcelflag.=" /machine:MIPS";    last; };
+        /^R4[0-9]{3}/   && do { $wcecdefs.=" -DMIPS -D_MIPS_ -DR4000";
+                                $wcelflag.=" /machine:MIPS";    last; };
+        /^SH[0-9]/      && do { $wcecdefs.=" -D$wcetgt -D_$wcetgt_ -DSHx";
+                                $wcecdefs.=" -Qsh4" if ($wcetgt =~ /^SH4/);
+                                $wcelflag.=" /machine:$wcetgt"; last; };
+        { $wcecdefs.=" -D$wcetgt -D_$wcetgt_";
+          $wcelflag.=" /machine:$wcetgt";                       last; };
+    }
+
+    $cc='$(CC)';
+    $base_cflags=' /W3 /WX /GF /Gy /nologo -DUNICODE -D_UNICODE -DOPENSSL_SYSNAME_WINCE -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -DNO_CHMOD -I$(WCECOMPAT)/include -DOPENSSL_SMALL_FOOTPRINT';
+    $base_cflags.=" $wcecdefs";
+    $opt_cflags=' /MC /O1i';    # optimize for space, but with intrinsics...
+    $dbg_clfags=' /MC /Od -DDEBUG -D_DEBUG';
+    $lflags="/nologo /opt:ref $wcelflag";
+    }
+else    # Win32
+    {
+    $base_cflags=' /W3 /WX /Gs0 /GF /Gy /nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DDSO_WIN32';
+    $base_cflags.=' -D_CRT_SECURE_NO_DEPRECATE';        # shut up VC8
+    $base_cflags.=' -D_CRT_NONSTDC_NO_DEPRECATE';       # shut up VC8
+    my $f = $shlib?' /MD':' /MT';
+    $lib_cflag='/Zl' if (!$shlib);      # remove /DEFAULTLIBs from static lib
+    $opt_cflags=$f.' /Ox /O2 /Ob2';
+    $dbg_cflags=$f.'d /Od -DDEBUG -D_DEBUG';
+    $lflags="/nologo /subsystem:console /opt:ref";
+    }
 $mlflags='';
 
-$out_def="out32";
-$tmp_def="tmp32";
+$out_def="out32"; $out_def.='_$(TARGETCPU)' if ($FLAVOR =~ /CE/);
+$tmp_def="tmp32"; $tmp_def.='_$(TARGETCPU)' if ($FLAVOR =~ /CE/);
 $inc_def="inc32";
 
 if ($debug)
         {
-        $cflags=" /MDd /W3 /WX /Zi /Yd /Od /nologo -DOPENSSL_SYSNAME_WIN32 -D_DEBUG -DL_ENDIAN -DWIN32_LEAN_AND_MEAN -DDEBUG -DDSO_WIN32";
+        $cflags=$dbg_cflags.$base_cflags;
         $lflags.=" /debug";
         $mlflags.=' /debug';
         }
-$cflags .= " -DOPENSSL_SYSNAME_WINNT" if $NT == 1;
+else
+        {
+        $cflags=$opt_cflags.$base_cflags;
+        }
 
 $obj='.obj';
 $ofile="/Fo";
 
 # EXE linking stuff
 $link="link";
+$rsc="rc";
 $efile="/out:";
 $exep='.exe';
-if ($no_sock)
-        { $ex_libs=""; }
-else    { $ex_libs="wsock32.lib user32.lib gdi32.lib"; }
+if ($no_sock)           { $ex_libs=''; }
+elsif ($FLAVOR =~ /CE/) { $ex_libs='winsock.lib'; }
+else                    { $ex_libs='wsock32.lib'; }
 
+if ($FLAVOR =~ /CE/)
+        {
+        $ex_libs.=' $(WCECOMPAT)/lib/wcecompatex.lib';
+        $ex_libs.=' /nodefaultlib:oldnames.lib coredll.lib corelibc.lib' if ($ENV{'TARGETCPU'} eq "X86");
+        }
+else
+        {
+        $ex_libs.=' gdi32.lib advapi32.lib user32.lib';
+        $ex_libs.=' bufferoverflowu.lib' if ($FLAVOR =~ /WIN64/);
+        }
+
+# As native NT API is pure UNICODE, our WIN-NT build defaults to UNICODE,
+# but gets linked with unicows.lib to ensure backward compatibility.
+if ($FLAVOR =~ /NT/)
+        {
+        $cflags.=" -DOPENSSL_SYSNAME_WINNT -DUNICODE -D_UNICODE";
+        $ex_libs="unicows.lib $ex_libs";
+        }
 # static library stuff
 $mklib='lib';
 $ranlib='';
@@ -60,9 +158,12 @@ $shlibp=($shlib)?".dll":".lib";
 $lfile='/out:';
 
 $shlib_ex_obj="";
-$app_ex_obj="setargv.obj";
+$app_ex_obj="setargv.obj" if ($FLAVOR !~ /CE/);
 if ($nasm) {
-        $asm='nasmw -f win32';
+        my $ver=`nasm -v 2>NUL`;
+        my $vew=`nasmw -v 2>NUL`;
+        # pick newest version
+        $asm=($ver gt $vew?"nasm":"nasmw")." -f win32";
         $afile='-o ';
 } else {
         $asm='ml /Cp /coff /c /Cx';
@@ -77,10 +178,14 @@ $des_enc_src='';
 $bf_enc_obj='';
 $bf_enc_src='';
 
-if (!$no_asm && !$fips)
+if (!$no_asm)
         {
+        $aes_asm_obj='crypto\aes\asm\a_win32.obj';
+        $aes_asm_src='crypto\aes\asm\a_win32.asm';
         $bn_asm_obj='crypto\bn\asm\bn_win32.obj';
         $bn_asm_src='crypto\bn\asm\bn_win32.asm';
+        $bnco_asm_obj='crypto\bn\asm\co_win32.obj';
+        $bnco_asm_src='crypto\bn\asm\co_win32.asm';
         $des_enc_obj='crypto\des\asm\d_win32.obj crypto\des\asm\y_win32.obj';
         $des_enc_src='crypto\des\asm\d_win32.asm crypto\des\asm\y_win32.asm';
         $bf_enc_obj='crypto\bf\asm\b_win32.obj';
@@ -93,76 +198,96 @@ if (!$no_asm && !$fips)
         $rc5_enc_src='crypto\rc5\asm\r5_win32.asm';
         $md5_asm_obj='crypto\md5\asm\m5_win32.obj';
         $md5_asm_src='crypto\md5\asm\m5_win32.asm';
-        $sha1_asm_obj='crypto\sha\asm\s1_win32.obj';
-        $sha1_asm_src='crypto\sha\asm\s1_win32.asm';
+        $sha1_asm_obj='crypto\sha\asm\s1_win32.obj crypto\sha\asm\sha512-sse2.obj';
+        $sha1_asm_src='crypto\sha\asm\s1_win32.asm crypto\sha\asm\sha512-sse2.asm';
         $rmd160_asm_obj='crypto\ripemd\asm\rm_win32.obj';
         $rmd160_asm_src='crypto\ripemd\asm\rm_win32.asm';
-        $cflags.=" -DBN_ASM -DMD5_ASM -DSHA1_ASM -DRMD160_ASM";
+        $cpuid_asm_obj='crypto\cpu_win32.obj';
+        $cpuid_asm_src='crypto\cpu_win32.asm';
+        $cflags.=" -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DAES_ASM -DBN_ASM -DOPENSSL_BN_ASM_PART_WORDS -DMD5_ASM -DSHA1_ASM -DRMD160_ASM";
         }
 
-if ($shlib)
+if ($shlib && $FLAVOR !~ /CE/)
         {
         $mlflags.=" $lflags /dll";
-#       $cflags =~ s| /MD| /MT|;
         $lib_cflag=" -D_WINDLL";
         $out_def="out32dll";
         $tmp_def="tmp32dll";
+        #
+        # Engage Applink...
+        #
+        $app_ex_obj.=" \$(OBJ_D)\\applink.obj /implib:\$(TMP_D)\\junk.lib";
+        $cflags.=" -DOPENSSL_USE_APPLINK -I.";
+        # I'm open for better suggestions than overriding $banner...
+        $banner=<<'___';
+        @echo Building OpenSSL
+
+$(OBJ_D)\applink.obj:   ms\applink.c
+        $(CC) /Fo$(OBJ_D)\applink.obj $(APP_CFLAGS) -c ms\applink.c
+$(OBJ_D)\uplink.obj:    ms\uplink.c ms\applink.c
+        $(CC) /Fo$(OBJ_D)\uplink.obj $(SHLIB_CFLAGS) -c ms\uplink.c
+$(INCO_D)\applink.c:    ms\applink.c
+        $(CP) ms\applink.c $(INCO_D)\applink.c
+
+EXHEADER= $(EXHEADER) $(INCO_D)\applink.c
+
+LIBS_DEP=$(LIBS_DEP) $(OBJ_D)\applink.obj
+CRYPTOOBJ=$(OBJ_D)\uplink.obj $(CRYPTOOBJ)
+___
+        $banner.=<<'___' if ($FLAVOR =~ /WIN64/);
+CRYPTOOBJ=ms\uptable.obj $(CRYPTOOBJ)
+___
+        }
+elsif ($shlib && $FLAVOR =~ /CE/)
+        {
+        $mlflags.=" $lflags /dll";
+        $lib_cflag=" -D_WINDLL -D_DLL";
+        $out_def='out32dll_$(TARGETCPU)';
+        $tmp_def='tmp32dll_$(TARGETCPU)';
         }
 
 $cflags.=" /Fd$out_def";
 
 sub do_lib_rule
         {
-        local($objs,$target,$name,$shlib,$ign,$base_addr) = @_;
-        local($ret,$Name);
+        local($objs,$target,$name,$shlib)=@_;
+        local($ret);
 
         $taget =~ s/\//$o/g if $o ne '/';
-        ($Name=$name) =~ tr/a-z/A-Z/;
-        my $base_arg;
-        if ($base_addr ne "")
-                {
-                $base_arg= " /base:$base_addr";
-                }
-        else
+        if ($name ne "")
                 {
-                $base_arg = "";
+                $name =~ tr/a-z/A-Z/;
+                $name = "/def:ms/${name}.def";
                 }
 
-
 #       $target="\$(LIB_D)$o$target";
+        $ret.="$target: $objs\n";
         if (!$shlib)
                 {
 #               $ret.="\t\$(RM) \$(O_$Name)\n";
-                $ret.="$target: $objs\n";
-                $ex =' advapi32.lib';
-                $ex.=" \$(FIPSLIB_D)${o}_chkstk.o" if $fips && $target =~ /O_CRYPTO/;
+                $ex =' ';
                 $ret.="\t\$(MKLIB) $lfile$target @<<\n  $objs $ex\n<<\n";
                 }
         else
                 {
-                local($ex)=($target =~ /O_SSL/)?' $(L_CRYPTO)':'';
-                $ex.=' wsock32.lib gdi32.lib advapi32.lib user32.lib';
-                $ex.=" $zlib_lib" if $zlib_opt == 1 && $target =~ /O_CRYPTO/;
-                if ($fips && $target =~ /O_CRYPTO/)
+                local($ex)=($target =~ /O_CRYPTO/)?'':' $(L_CRYPTO)';
+                if ($name eq "")
+                        {
+                        $ex.=' bufferoverflowu.lib' if ($FLAVOR =~ /WIN64/);
+                        }
+                elsif ($FLAVOR =~ /CE/)
                         {
-                        $ex.=" \$(FIPSLIB_D)${o}_chkstk.o";
-                        $ret.="$target: $objs \$(PREMAIN_DSO_EXE)\n";
-                        $ret.="\tSET FIPS_LINK=\$(LINK)\n";
-                        $ret.="\tSET FIPS_CC=\$(CC)\n";
-                        $ret.="\tSET FIPS_CC_ARGS=/Fo\$(OBJ_D)${o}fips_premain.obj \$(SHLIB_CFLAGS) -c\n";
-                        $ret.="\tSET PREMAIN_DSO_EXE=\$(PREMAIN_DSO_EXE)\n";
-                        $ret.="\tSET FIPS_SHA1_EXE=\$(FIPS_SHA1_EXE)\n";
-                        $ret.="\tSET FIPS_TARGET=$target\n";
-                        $ret.="\tSET FIPSLIB_D=\$(FIPSLIB_D)\n";
-                        $ret.="\t\$(FIPSLINK) \$(MLFLAGS) $base_arg $efile$target ";
-                        $ret.="/def:ms/${Name}.def @<<\n  \$(SHLIB_EX_OBJ) $objs ";
-                        $ret.="\$(OBJ_D)${o}fips_premain.obj $ex\n<<\n";
+                        $ex.=' winsock.lib $(WCECOMPAT)/lib/wcecompatex.lib';
                         }
                 else
                         {
-                        $ret.="$target: $objs\n";
-                        $ret.="\t\$(LINK) \$(MLFLAGS) $base_arg $efile$target /def:ms/${Name}.def @<<\n  \$(SHLIB_EX_OBJ) $objs $ex\n<<\n";
+                        $ex.=' unicows.lib' if ($FLAVOR =~ /NT/);
+                        $ex.=' wsock32.lib gdi32.lib advapi32.lib user32.lib';
+                        $ex.=' bufferoverflowu.lib' if ($FLAVOR =~ /WIN64/);
                         }
+                $ex.=" $zlib_lib" if $zlib_opt == 1 && $target =~ /O_CRYPTO/;
+                $ret.="\t\$(LINK) \$(MLFLAGS) $efile$target $name @<<\n  \$(SHLIB_EX_OBJ) $objs $ex\n<<\n";
+        $ret.="\tIF EXIST \$@.manifest mt -nologo -manifest \$@.manifest -outputresource:\$@;2\n\n";
                 }
         $ret.="\n";
         return($ret);
@@ -170,51 +295,16 @@ sub do_lib_rule
 
 sub do_link_rule
         {
-        local($target,$files,$dep_libs,$libs,$standalone)=@_;
-        local($ret,$_);
-        $file =~ s/\//$o/g if $o ne '/';
-        $n=&bname($targer);
-        $ret.="$target: $files $dep_libs\n";
-        if ($standalone)
-                {
-                $ret.="  \$(LINK) \$(LFLAGS) $efile$target @<<\n\t";
-                $ret.="\$(FIPSLIB_D)${o}_chkstk.o " if ($files =~ /O_FIPSCANISTER/);
-                $ret.="$files $libs\n<<\n";
-                }
-        elsif ($fips && !$shlib)
-                {
-                $ret.="\tSET FIPS_LINK=\$(LINK)\n";
-                $ret.="\tSET FIPS_CC=\$(CC)\n";
-                $ret.="\tSET FIPS_CC_ARGS=/Fo\$(OBJ_D)${o}fips_premain.obj \$(SHLIB_CFLAGS) -c\n";
-                $ret.="\tSET PREMAIN_DSO_EXE=\n";
-                $ret.="\tSET FIPS_TARGET=$target\n";
-                $ret.="\tSET FIPS_SHA1_EXE=\$(FIPS_SHA1_EXE)\n";
-                $ret.="\tSET FIPSLIB_D=\$(FIPSLIB_D)\n";
-                $ret.="  \$(FIPSLINK) \$(LFLAGS) $efile$target @<<\n";
-                $ret.="  \$(APP_EX_OBJ) $files \$(OBJ_D)${o}fips_premain.obj $libs\n<<\n";
-                }
-        else
-                {
-                $ret.="  \$(LINK) \$(LFLAGS) $efile$target @<<\n";
-                $ret.="  \$(APP_EX_OBJ) $files $libs\n<<\n";
-                }
-        $ret.="\n";
-        return($ret);
-        }
-
-sub do_rlink_rule
-        {
         local($target,$files,$dep_libs,$libs)=@_;
         local($ret,$_);
-
+        
         $file =~ s/\//$o/g if $o ne '/';
         $n=&bname($targer);
         $ret.="$target: $files $dep_libs\n";
-        $ret.="  \$(MKCANISTER) $target <<\n";
-        $ret.="INPUT($files)\n<<\n";
-        $ret.="\n";
+        $ret.="\t\$(LINK) \$(LFLAGS) $efile$target @<<\n";
+        $ret.="  \$(APP_EX_OBJ) $files $libs\n<<\n";
+    $ret.="\tIF EXIST \$@.manifest mt -nologo -manifest \$@.manifest -outputresource:\$@;1\n\n";
         return($ret);
         }
 
-
 1;
diff --git a/src/lib/libssl/src/util/pl/linux.pl b/src/lib/libssl/src/util/pl/linux.pl
index df05c40526..d24f7b7291 100644
--- a/src/lib/libssl/src/util/pl/linux.pl
+++ b/src/lib/libssl/src/util/pl/linux.pl
@@ -39,7 +39,7 @@ if (!$no_asm)
         $rmd160_asm_src='crypto/ripemd/asm/rm86unix.cpp';
         $sha1_asm_obj='$(OBJ_D)/sx86-elf.o';
         $sha1_asm_src='crypto/sha/asm/sx86unix.cpp';
-        $cflags.=" -DBN_ASM -DMD5_ASM -DSHA1_ASM";
+        $cflags.=" -DBN_ASM -DMD5_ASM -DSHA1_ASM -DOPENSSL_BN_ASM_PART_WORDS";
         }
 
 $cflags.=" -DTERMIO -DL_ENDIAN -m486 -Wall";
@@ -72,18 +72,13 @@ sub do_shlib_rule
 
 sub do_link_rule
         {
-        local($target,$files,$dep_libs,$libs,$sha1file,$openssl)=@_;
+        local($target,$files,$dep_libs,$libs)=@_;
         local($ret,$_);
         
         $file =~ s/\//$o/g if $o ne '/';
         $n=&bname($target);
         $ret.="$target: $files $dep_libs\n";
-        $ret.="\t\$(LINK) ${efile}$target \$(LFLAGS) $files $libs\n";
-        if (defined $sha1file)
-                {
-                $ret.="\t$openssl sha1 -hmac etaonrishdlcupfm -binary $target > $sha1file";
-                }
-        $ret.="\n";
+        $ret.="\t\$(LINK) ${efile}$target \$(LFLAGS) $files $libs\n\n";
         return($ret);
         }
 
diff --git a/src/lib/libssl/src/util/pl/ultrix.pl b/src/lib/libssl/src/util/pl/ultrix.pl
index 447b854708..ea370c71f9 100644
--- a/src/lib/libssl/src/util/pl/ultrix.pl
+++ b/src/lib/libssl/src/util/pl/ultrix.pl
@@ -17,7 +17,7 @@ else
 
 $cflags.=" -std1 -DL_ENDIAN";
 
-if (!$no_asm && !$fips)
+if (!$no_asm)
         {
         $bn_asm_obj='$(OBJ_D)/mips1.o';
         $bn_asm_src='crypto/bn/asm/mips1.s';
@@ -25,18 +25,13 @@ if (!$no_asm && !$fips)
 
 sub do_link_rule
         {
-        local($target,$files,$dep_libs,$libs,$sha1file,$openssl)=@_;
+        local($target,$files,$dep_libs,$libs)=@_;
         local($ret,$_);
         
         $file =~ s/\//$o/g if $o ne '/';
         $n=&bname($target);
         $ret.="$target: $files $dep_libs\n";
-        $ret.="\t\$(LINK) ${efile}$target \$(LFLAGS) $files $libs\n";
-        if (defined $sha1file)
-                {
-                $ret.="\t$openssl sha1 -hmac etaonrishdlcupfm -binary $target > $sha1file";
-                }
-        $ret.="\n";
+        $ret.="\t\$(LINK) ${efile}$target \$(LFLAGS) $files $libs\n\n";
         return($ret);
         }
 
diff --git a/src/lib/libssl/src/util/pl/unix.pl b/src/lib/libssl/src/util/pl/unix.pl
index bbd1798a2e..146611ad99 100644
--- a/src/lib/libssl/src/util/pl/unix.pl
+++ b/src/lib/libssl/src/util/pl/unix.pl
@@ -70,18 +70,13 @@ sub do_lib_rule
 
 sub do_link_rule
         {
-        local($target,$files,$dep_libs,$libs,$sha1file,$openssl)=@_;
+        local($target,$files,$dep_libs,$libs)=@_;
         local($ret,$_);
         
         $file =~ s/\//$o/g if $o ne '/';
         $n=&bname($target);
         $ret.="$target: $files $dep_libs\n";
-        $ret.="\t\$(LINK) ${efile}$target \$(LFLAGS) $files $libs\n";
-        if (defined $sha1file)
-                {
-                $ret.="\t$openssl sha1 -hmac etaonrishdlcupfm -binary $target > $sha1file";
-                }
-        $ret.="\n";
+        $ret.="\t\$(LINK) ${efile}$target \$(LFLAGS) $files $libs\n\n";
         return($ret);
         }
 
diff --git a/src/lib/libssl/src/util/ssleay.num b/src/lib/libssl/src/util/ssleay.num
index 46e38a131f..b3ac136a56 100644
--- a/src/lib/libssl/src/util/ssleay.num
+++ b/src/lib/libssl/src/util/ssleay.num
@@ -170,7 +170,7 @@ SSL_add_file_cert_subjs_to_stk          185	EXIST:VMS:FUNCTION:STDIO
 SSL_set_tmp_rsa_callback                186     EXIST::FUNCTION:RSA
 SSL_set_tmp_dh_callback                 187     EXIST::FUNCTION:DH
 SSL_add_dir_cert_subjects_to_stack      188     EXIST:!VMS:FUNCTION:STDIO
-SSL_add_dir_cert_subjs_to_stk           188     NOEXIST::FUNCTION:
+SSL_add_dir_cert_subjs_to_stk           188     EXIST:VMS:FUNCTION:STDIO
 SSL_set_session_id_context              189     EXIST::FUNCTION:
 SSL_CTX_use_certificate_chain_file      222     EXIST:!VMS:FUNCTION:STDIO
 SSL_CTX_use_cert_chain_file             222     EXIST:VMS:FUNCTION:STDIO
@@ -215,3 +215,29 @@ SSL_CTX_set_generate_session_id         264	EXIST::FUNCTION:
 SSL_renegotiate_pending                 265     EXIST::FUNCTION:
 SSL_CTX_set_msg_callback                266     EXIST::FUNCTION:
 SSL_set_msg_callback                    267     EXIST::FUNCTION:
+DTLSv1_client_method                    268     EXIST::FUNCTION:
+SSL_CTX_set_tmp_ecdh_callback           269     EXIST::FUNCTION:ECDH
+SSL_set_tmp_ecdh_callback               270     EXIST::FUNCTION:ECDH
+SSL_COMP_get_name                       271     EXIST::FUNCTION:COMP
+SSL_get_current_compression             272     EXIST::FUNCTION:COMP
+DTLSv1_method                           273     EXIST::FUNCTION:
+SSL_get_current_expansion               274     EXIST::FUNCTION:COMP
+DTLSv1_server_method                    275     EXIST::FUNCTION:
+SSL_COMP_get_compression_methods        276     EXIST:!VMS:FUNCTION:COMP
+SSL_COMP_get_compress_methods           276     EXIST:VMS:FUNCTION:COMP
+SSL_SESSION_get_id                      277     EXIST::FUNCTION:
+SSL_CTX_sess_set_new_cb                 278     EXIST::FUNCTION:
+SSL_CTX_sess_get_get_cb                 279     EXIST::FUNCTION:
+SSL_CTX_sess_set_get_cb                 280     EXIST::FUNCTION:
+SSL_CTX_set_cookie_verify_cb            281     EXIST::FUNCTION:
+SSL_CTX_get_info_callback               282     EXIST::FUNCTION:
+SSL_CTX_set_cookie_generate_cb          283     EXIST::FUNCTION:
+SSL_CTX_set_client_cert_cb              284     EXIST::FUNCTION:
+SSL_CTX_sess_set_remove_cb              285     EXIST::FUNCTION:
+SSL_CTX_set_info_callback               286     EXIST::FUNCTION:
+SSL_CTX_sess_get_new_cb                 287     EXIST::FUNCTION:
+SSL_CTX_get_client_cert_cb              288     EXIST::FUNCTION:
+SSL_CTX_sess_get_remove_cb              289     EXIST::FUNCTION:
+SSL_set_SSL_CTX                         290     EXIST::FUNCTION:
+SSL_get_servername                      291     EXIST::FUNCTION:TLSEXT
+SSL_get_servername_type                 292     EXIST::FUNCTION:TLSEXT
diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
index 99e188086b..6df921f3c1 100644
--- a/src/lib/libssl/ssl.h
+++ b/src/lib/libssl/ssl.h
@@ -109,7 +109,7 @@
  *
  */
 /* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -161,6 +161,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #ifndef HEADER_SSL_H 
 #define HEADER_SSL_H 
@@ -173,9 +178,17 @@
 #ifndef OPENSSL_NO_BIO
 #include <openssl/bio.h>
 #endif
+#ifndef OPENSSL_NO_DEPRECATED
 #ifndef OPENSSL_NO_X509
 #include <openssl/x509.h>
 #endif
+#include <openssl/crypto.h>
+#include <openssl/lhash.h>
+#include <openssl/buffer.h>
+#endif
+#include <openssl/pem.h>
+#include <openssl/hmac.h>
+
 #include <openssl/kssl.h>
 #include <openssl/safestack.h>
 #include <openssl/symhacks.h>
@@ -239,7 +252,6 @@ extern "C" {
 #define SSL_TXT_LOW             "LOW"
 #define SSL_TXT_MEDIUM          "MEDIUM"
 #define SSL_TXT_HIGH            "HIGH"
-#define SSL_TXT_FIPS            "FIPS"
 #define SSL_TXT_kFZA            "kFZA"
 #define SSL_TXT_aFZA            "aFZA"
 #define SSL_TXT_eFZA            "eFZA"
@@ -270,7 +282,9 @@ extern "C" {
 #define SSL_TXT_RC4             "RC4"
 #define SSL_TXT_RC2             "RC2"
 #define SSL_TXT_IDEA            "IDEA"
+#define SSL_TXT_SEED            "SEED"
 #define SSL_TXT_AES             "AES"
+#define SSL_TXT_CAMELLIA        "CAMELLIA"
 #define SSL_TXT_MD5             "MD5"
 #define SSL_TXT_SHA1            "SHA1"
 #define SSL_TXT_SHA             "SHA"
@@ -282,6 +296,7 @@ extern "C" {
 #define SSL_TXT_SSLV3           "SSLv3"
 #define SSL_TXT_TLSV1           "TLSv1"
 #define SSL_TXT_ALL             "ALL"
+#define SSL_TXT_ECC             "ECCdraft" /* ECC ciphersuites are not yet official */
 
 /*
  * COMPLEMENTOF* definitions. These identifiers are used to (de-select)
@@ -303,7 +318,7 @@ extern "C" {
 /* The following cipher list is used by default.
  * It also is substituted when an application-defined cipher list string
  * starts with 'DEFAULT'. */
-#define SSL_DEFAULT_CIPHER_LIST "ALL:!ADH:+RC4:@STRENGTH" /* low priority for RC4 */
+#define SSL_DEFAULT_CIPHER_LIST "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH" /* low priority for RC4 */
 
 /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */
 #define SSL_SENT_SHUTDOWN       1
@@ -313,11 +328,6 @@ extern "C" {
 }
 #endif
 
-#include <openssl/crypto.h>
-#include <openssl/lhash.h>
-#include <openssl/buffer.h>
-#include <openssl/pem.h>
-
 #ifdef  __cplusplus
 extern "C" {
 #endif
@@ -369,6 +379,12 @@ typedef struct ssl_method_st
         int (*ssl_shutdown)(SSL *s);
         int (*ssl_renegotiate)(SSL *s);
         int (*ssl_renegotiate_check)(SSL *s);
+        long (*ssl_get_message)(SSL *s, int st1, int stn, int mt, long
+                max, int *ok);
+        int (*ssl_read_bytes)(SSL *s, int type, unsigned char *buf, int len, 
+                int peek);
+        int (*ssl_write_bytes)(SSL *s, int type, const void *buf_, int len);
+        int (*ssl_dispatch_alert)(SSL *s);
         long (*ssl_ctrl)(SSL *s,int cmd,long larg,void *parg);
         long (*ssl_ctx_ctrl)(SSL_CTX *ctx,int cmd,long larg,void *parg);
         SSL_CIPHER *(*get_cipher_by_char)(const unsigned char *ptr);
@@ -379,9 +395,9 @@ typedef struct ssl_method_st
         struct ssl_method_st *(*get_ssl_method)(int version);
         long (*get_timeout)(void);
         struct ssl3_enc_method *ssl3_enc; /* Extra SSLv3/TLS stuff */
-        int (*ssl_version)();
-        long (*ssl_callback_ctrl)(SSL *s, int cb_id, void (*fp)());
-        long (*ssl_ctx_callback_ctrl)(SSL_CTX *s, int cb_id, void (*fp)());
+        int (*ssl_version)(void);
+        long (*ssl_callback_ctrl)(SSL *s, int cb_id, void (*fp)(void));
+        long (*ssl_ctx_callback_ctrl)(SSL_CTX *s, int cb_id, void (*fp)(void));
         } SSL_METHOD;
 
 /* Lets make this into an ASN.1 type structure as follows
@@ -459,6 +475,13 @@ typedef struct ssl_session_st
         /* These are used to make removal of session-ids more
          * efficient and to implement a maximum cache size. */
         struct ssl_session_st *prev,*next;
+#ifndef OPENSSL_NO_TLSEXT
+        char *tlsext_hostname;
+        /* RFC4507 info */
+        unsigned char *tlsext_tick;     /* Session ticket */
+        size_t  tlsext_ticklen;         /* Session ticket length */     
+        long tlsext_tick_lifetime_hint; /* Session lifetime hint in seconds */
+#endif
         } SSL_SESSION;
 
 
@@ -483,8 +506,17 @@ typedef struct ssl_session_st
  *             This used to be 0x000FFFFFL before 0.9.7. */
 #define SSL_OP_ALL                                      0x00000FFFL
 
+/* DTLS options */
+#define SSL_OP_NO_QUERY_MTU                 0x00001000L
+/* Turn on Cookie Exchange (on relevant for servers) */
+#define SSL_OP_COOKIE_EXCHANGE              0x00002000L
+/* Don't use RFC4507 ticket extension */
+#define SSL_OP_NO_TICKET                    0x00004000L
+
 /* As server, disallow session resumption on renegotiation */
 #define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION   0x00010000L
+/* If set, always create a new key when using tmp_ecdh parameters */
+#define SSL_OP_SINGLE_ECDH_USE                          0x00080000L
 /* If set, always create a new key when using tmp_dh parameters */
 #define SSL_OP_SINGLE_DH_USE                            0x00100000L
 /* Set to always use the tmp_rsa key when doing RSA operations,
@@ -546,6 +578,8 @@ typedef struct ssl_session_st
         SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL)
 #define SSL_get_mode(ssl) \
         SSL_ctrl((ssl),SSL_CTRL_MODE,0,NULL)
+#define SSL_set_mtu(ssl, mtu) \
+        SSL_ctrl((ssl),SSL_CTRL_SET_MTU,(mtu),NULL)
 
 
 void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg));
@@ -582,7 +616,7 @@ typedef int (*GEN_SESSION_CB)(const SSL *ssl, unsigned char *id,
 typedef struct ssl_comp_st
         {
         int id;
-        char *name;
+        const char *name;
 #ifndef OPENSSL_NO_COMP
         COMP_METHOD *method;
 #else
@@ -670,6 +704,14 @@ struct ssl_ctx_st
         /* get client cert callback */
         int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
 
+    /* cookie generate callback */
+    int (*app_gen_cookie_cb)(SSL *ssl, unsigned char *cookie, 
+        unsigned int *cookie_len);
+
+    /* verify cookie callback */
+    int (*app_verify_cookie_cb)(SSL *ssl, unsigned char *cookie, 
+        unsigned int cookie_len);
+
         CRYPTO_EX_DATA ex_data;
 
         const EVP_MD *rsa_md5;/* For SSLv2 - name is 'ssl2-md5' */
@@ -702,7 +744,6 @@ struct ssl_ctx_st
         void *msg_callback_arg;
 
         int verify_mode;
-        int verify_depth;
         unsigned int sid_ctx_length;
         unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
         int (*default_verify_callback)(int ok,X509_STORE_CTX *ctx); /* called 'verify_callback' in the SSL */
@@ -710,10 +751,35 @@ struct ssl_ctx_st
         /* Default generate session ID callback. */
         GEN_SESSION_CB generate_session_id;
 
+        X509_VERIFY_PARAM *param;
+
+#if 0
         int purpose;            /* Purpose setting */
         int trust;              /* Trust setting */
+#endif
 
         int quiet_shutdown;
+
+#ifndef OPENSSL_NO_TLSEXT
+        /* TLS extensions servername callback */
+        int (*tlsext_servername_callback)(SSL*, int *, void *);
+        void *tlsext_servername_arg;
+        /* RFC 4507 session ticket keys */
+        unsigned char tlsext_tick_key_name[16];
+        unsigned char tlsext_tick_hmac_key[16];
+        unsigned char tlsext_tick_aes_key[16];
+        /* Callback to support customisation of ticket key setting */
+        int (*tlsext_ticket_key_cb)(SSL *ssl,
+                                        unsigned char *name, unsigned char *iv,
+                                        EVP_CIPHER_CTX *ectx,
+                                        HMAC_CTX *hctx, int enc);
+
+        /* certificate status request info */
+        /* Callback for status request */
+        int (*tlsext_status_cb)(SSL *ssl, void *arg);
+        void *tlsext_status_arg;
+#endif
+
         };
 
 #define SSL_SESS_CACHE_OFF                      0x0000
@@ -753,16 +819,18 @@ struct ssl_ctx_st
 #define SSL_CTX_sess_cache_full(ctx) \
         SSL_CTX_ctrl(ctx,SSL_CTRL_SESS_CACHE_FULL,0,NULL)
 
-#define SSL_CTX_sess_set_new_cb(ctx,cb) ((ctx)->new_session_cb=(cb))
-#define SSL_CTX_sess_get_new_cb(ctx)    ((ctx)->new_session_cb)
-#define SSL_CTX_sess_set_remove_cb(ctx,cb)      ((ctx)->remove_session_cb=(cb))
-#define SSL_CTX_sess_get_remove_cb(ctx) ((ctx)->remove_session_cb)
-#define SSL_CTX_sess_set_get_cb(ctx,cb) ((ctx)->get_session_cb=(cb))
-#define SSL_CTX_sess_get_get_cb(ctx)    ((ctx)->get_session_cb)
-#define SSL_CTX_set_info_callback(ctx,cb)       ((ctx)->info_callback=(cb))
-#define SSL_CTX_get_info_callback(ctx)          ((ctx)->info_callback)
-#define SSL_CTX_set_client_cert_cb(ctx,cb)      ((ctx)->client_cert_cb=(cb))
-#define SSL_CTX_get_client_cert_cb(ctx)         ((ctx)->client_cert_cb)
+void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx, int (*new_session_cb)(struct ssl_st *ssl,SSL_SESSION *sess));
+int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(struct ssl_st *ssl, SSL_SESSION *sess);
+void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx, void (*remove_session_cb)(struct ssl_ctx_st *ctx,SSL_SESSION *sess));
+void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(struct ssl_ctx_st *ctx, SSL_SESSION *sess);
+void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx, SSL_SESSION *(*get_session_cb)(struct ssl_st *ssl, unsigned char *data,int len,int *copy));
+SSL_SESSION *(*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(struct ssl_st *ssl, unsigned char *Data, int len, int *copy);
+void SSL_CTX_set_info_callback(SSL_CTX *ctx, void (*cb)(const SSL *ssl,int type,int val));
+void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl,int type,int val);
+void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx, int (*client_cert_cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey));
+int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
+void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, int (*app_gen_cookie_cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len));
+void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, int (*app_verify_cookie_cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len));
 
 #define SSL_NOTHING     1
 #define SSL_WRITING     2
@@ -778,7 +846,7 @@ struct ssl_ctx_st
 struct ssl_st
         {
         /* protocol version
-         * (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION)
+         * (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION, DTLS1_VERSION)
          */
         int version;
         int type; /* SSL_ST_CONNECT or SSL_ST_ACCEPT */
@@ -807,7 +875,7 @@ struct ssl_st
 
         /* true when we are actually in SSL_accept() or SSL_connect() */
         int in_handshake;
-        int (*handshake_func)();
+        int (*handshake_func)(SSL *);
 
         /* Imagine that here's a boolean member "init" that is
          * switched as soon as SSL_set_{accept/connect}_state
@@ -842,6 +910,7 @@ struct ssl_st
 
         struct ssl2_state_st *s2; /* SSLv2 variables */
         struct ssl3_state_st *s3; /* SSLv3 variables */
+        struct dtls1_state_st *d1; /* DTLSv1 variables */
 
         int read_ahead;         /* Read as many input bytes as possible
                                  * (for non-blocking reads) */
@@ -852,8 +921,12 @@ struct ssl_st
 
         int hit;                /* reusing a previous session */
 
+        X509_VERIFY_PARAM *param;
+
+#if 0
         int purpose;            /* Purpose setting */
         int trust;              /* Trust setting */
+#endif
 
         /* crypto */
         STACK_OF(SSL_CIPHER) *cipher_list;
@@ -898,7 +971,6 @@ struct ssl_st
         /* Used in SSL2 and SSL3 */
         int verify_mode;        /* 0 don't care about verify failure.
                                  * 1 fail if verify fails */
-        int verify_depth;
         int (*verify_callback)(int ok,X509_STORE_CTX *ctx); /* fail if callback returns 0 */
 
         void (*info_callback)(const SSL *ssl,int type,int val); /* optional informational callback */
@@ -929,6 +1001,37 @@ struct ssl_st
         int first_packet;
         int client_version;     /* what was passed, used for
                                  * SSLv3/TLS rollback check */
+#ifndef OPENSSL_NO_TLSEXT
+        /* TLS extension debug callback */
+        void (*tlsext_debug_cb)(SSL *s, int client_server, int type,
+                                        unsigned char *data, int len,
+                                        void *arg);
+        void *tlsext_debug_arg;
+        char *tlsext_hostname;
+        int servername_done;   /* no further mod of servername 
+                                  0 : call the servername extension callback.
+                                  1 : prepare 2, allow last ack just after in server callback.
+                                  2 : don't call servername callback, no ack in server hello
+                               */
+        /* certificate status request info */
+        /* Status type or -1 if no status type */
+        int tlsext_status_type;
+        /* Expect OCSP CertificateStatus message */
+        int tlsext_status_expected;
+        /* OCSP status request only */
+        STACK_OF(OCSP_RESPID) *tlsext_ocsp_ids;
+        X509_EXTENSIONS *tlsext_ocsp_exts;
+        /* OCSP response received or to be sent */
+        unsigned char *tlsext_ocsp_resp;
+        int tlsext_ocsp_resplen;
+
+        /* RFC4507 session ticket expected to be received or sent */
+        int tlsext_ticket_expected;
+        SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */
+#define session_ctx initial_ctx
+#else
+#define session_ctx ctx
+#endif
         };
 
 #ifdef __cplusplus
@@ -938,6 +1041,7 @@ struct ssl_st
 #include <openssl/ssl2.h>
 #include <openssl/ssl3.h>
 #include <openssl/tls1.h> /* This is mostly sslv3 with a few tweaks */
+#include <openssl/dtls1.h> /* Datagram TLS */
 #include <openssl/ssl23.h>
 
 #ifdef  __cplusplus
@@ -1035,21 +1139,16 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
 #define SSL_set_timeout(a,b)    SSL_SESSION_set_timeout((a),(b))
 
 #if 1 /*SSLEAY_MACROS*/
-#define d2i_SSL_SESSION_bio(bp,s_id) (SSL_SESSION *)ASN1_d2i_bio( \
-        (char *(*)())SSL_SESSION_new,(char *(*)())d2i_SSL_SESSION, \
-        (bp),(unsigned char **)(s_id))
-#define i2d_SSL_SESSION_bio(bp,s_id) ASN1_i2d_bio(i2d_SSL_SESSION, \
-        bp,(unsigned char *)s_id)
+#define d2i_SSL_SESSION_bio(bp,s_id) ASN1_d2i_bio_of(SSL_SESSION,SSL_SESSION_new,d2i_SSL_SESSION,bp,s_id)
+#define i2d_SSL_SESSION_bio(bp,s_id) ASN1_i2d_bio_of(SSL_SESSION,i2d_SSL_SESSION,bp,s_id)
 #define PEM_read_SSL_SESSION(fp,x,cb,u) (SSL_SESSION *)PEM_ASN1_read( \
         (char *(*)())d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,fp,(char **)x,cb,u)
-#define PEM_read_bio_SSL_SESSION(bp,x,cb,u) (SSL_SESSION *)PEM_ASN1_read_bio( \
-        (char *(*)())d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,bp,(char **)x,cb,u)
+#define PEM_read_bio_SSL_SESSION(bp,x,cb,u) PEM_ASN1_read_bio_of(SSL_SESSION,d2i_SSL_SESSION,PEM_STRING_SSL_SESSION,bp,x,cb,u)
 #define PEM_write_SSL_SESSION(fp,x) \
         PEM_ASN1_write((int (*)())i2d_SSL_SESSION, \
                 PEM_STRING_SSL_SESSION,fp, (char *)x, NULL,NULL,0,NULL,NULL)
 #define PEM_write_bio_SSL_SESSION(bp,x) \
-        PEM_ASN1_write_bio((int (*)())i2d_SSL_SESSION, \
-                PEM_STRING_SSL_SESSION,bp, (char *)x, NULL,NULL,0,NULL,NULL)
+        PEM_ASN1_write_bio_of(SSL_SESSION,i2d_SSL_SESSION,PEM_STRING_SSL_SESSION,bp,x,NULL,NULL,0,NULL,NULL)
 #endif
 
 #define SSL_AD_REASON_OFFSET            1000
@@ -1078,6 +1177,10 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
 #define SSL_AD_INTERNAL_ERROR           TLS1_AD_INTERNAL_ERROR  /* fatal */
 #define SSL_AD_USER_CANCELLED           TLS1_AD_USER_CANCELLED
 #define SSL_AD_NO_RENEGOTIATION         TLS1_AD_NO_RENEGOTIATION
+#define SSL_AD_UNSUPPORTED_EXTENSION    TLS1_AD_UNSUPPORTED_EXTENSION
+#define SSL_AD_CERTIFICATE_UNOBTAINABLE TLS1_AD_CERTIFICATE_UNOBTAINABLE
+#define SSL_AD_UNRECOGNIZED_NAME        TLS1_AD_UNRECOGNIZED_NAME
+#define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE
 
 #define SSL_ERROR_NONE                  0
 #define SSL_ERROR_SSL                   1
@@ -1092,20 +1195,24 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
 #define SSL_CTRL_NEED_TMP_RSA                   1
 #define SSL_CTRL_SET_TMP_RSA                    2
 #define SSL_CTRL_SET_TMP_DH                     3
-#define SSL_CTRL_SET_TMP_RSA_CB                 4
-#define SSL_CTRL_SET_TMP_DH_CB                  5
-
-#define SSL_CTRL_GET_SESSION_REUSED             6
-#define SSL_CTRL_GET_CLIENT_CERT_REQUEST        7
-#define SSL_CTRL_GET_NUM_RENEGOTIATIONS         8
-#define SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS       9
-#define SSL_CTRL_GET_TOTAL_RENEGOTIATIONS       10
-#define SSL_CTRL_GET_FLAGS                      11
-#define SSL_CTRL_EXTRA_CHAIN_CERT               12
-
-#define SSL_CTRL_SET_MSG_CALLBACK               13
-#define SSL_CTRL_SET_MSG_CALLBACK_ARG           14
-
+#define SSL_CTRL_SET_TMP_ECDH                   4
+#define SSL_CTRL_SET_TMP_RSA_CB                 5
+#define SSL_CTRL_SET_TMP_DH_CB                  6
+#define SSL_CTRL_SET_TMP_ECDH_CB                7
+
+#define SSL_CTRL_GET_SESSION_REUSED             8
+#define SSL_CTRL_GET_CLIENT_CERT_REQUEST        9
+#define SSL_CTRL_GET_NUM_RENEGOTIATIONS         10
+#define SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS       11
+#define SSL_CTRL_GET_TOTAL_RENEGOTIATIONS       12
+#define SSL_CTRL_GET_FLAGS                      13
+#define SSL_CTRL_EXTRA_CHAIN_CERT               14
+
+#define SSL_CTRL_SET_MSG_CALLBACK               15
+#define SSL_CTRL_SET_MSG_CALLBACK_ARG           16
+
+/* only applies to datagram connections */
+#define SSL_CTRL_SET_MTU                17
 /* Stats */
 #define SSL_CTRL_SESS_NUMBER                    20
 #define SSL_CTRL_SESS_CONNECT                   21
@@ -1132,6 +1239,29 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
 #define SSL_CTRL_GET_MAX_CERT_LIST              50
 #define SSL_CTRL_SET_MAX_CERT_LIST              51
 
+/* see tls1.h for macros based on these */
+#ifndef OPENSSL_NO_TLSEXT
+#define SSL_CTRL_SET_TLSEXT_SERVERNAME_CB       53
+#define SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG      54
+#define SSL_CTRL_SET_TLSEXT_HOSTNAME            55
+#define SSL_CTRL_SET_TLSEXT_DEBUG_CB            56
+#define SSL_CTRL_SET_TLSEXT_DEBUG_ARG           57
+#define SSL_CTRL_GET_TLSEXT_TICKET_KEYS         58
+#define SSL_CTRL_SET_TLSEXT_TICKET_KEYS         59
+
+#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB       63
+#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG   64
+#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE     65
+#define SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS     66
+#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS     67
+#define SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS      68
+#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS      69
+#define SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP        70
+#define SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP        71
+
+#define SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB       72
+#endif
+
 #define SSL_session_reused(ssl) \
         SSL_ctrl((ssl),SSL_CTRL_GET_SESSION_REUSED,0,NULL)
 #define SSL_num_renegotiations(ssl) \
@@ -1147,6 +1277,8 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_RSA,0,(char *)rsa)
 #define SSL_CTX_set_tmp_dh(ctx,dh) \
         SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH,0,(char *)dh)
+#define SSL_CTX_set_tmp_ecdh(ctx,ecdh) \
+        SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH,0,(char *)ecdh)
 
 #define SSL_need_tmp_RSA(ssl) \
         SSL_ctrl(ssl,SSL_CTRL_NEED_TMP_RSA,0,NULL)
@@ -1154,6 +1286,8 @@ size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count);
         SSL_ctrl(ssl,SSL_CTRL_SET_TMP_RSA,0,(char *)rsa)
 #define SSL_set_tmp_dh(ssl,dh) \
         SSL_ctrl(ssl,SSL_CTRL_SET_TMP_DH,0,(char *)dh)
+#define SSL_set_tmp_ecdh(ssl,ecdh) \
+        SSL_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH,0,(char *)ecdh)
 
 #define SSL_CTX_add_extra_chain_cert(ctx,x509) \
         SSL_CTX_ctrl(ctx,SSL_CTRL_EXTRA_CHAIN_CERT,0,(char *)x509)
@@ -1215,9 +1349,9 @@ int	SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa);
 #endif
 int     SSL_use_RSAPrivateKey_ASN1(SSL *ssl, unsigned char *d, long len);
 int     SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey);
-int     SSL_use_PrivateKey_ASN1(int pk,SSL *ssl, unsigned char *d, long len);
+int     SSL_use_PrivateKey_ASN1(int pk,SSL *ssl, const unsigned char *d, long len);
 int     SSL_use_certificate(SSL *ssl, X509 *x);
-int     SSL_use_certificate_ASN1(SSL *ssl, unsigned char *d, int len);
+int     SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len);
 
 #ifndef OPENSSL_NO_STDIO
 int     SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type);
@@ -1253,6 +1387,7 @@ void	SSL_copy_session_id(SSL *to,const SSL *from);
 SSL_SESSION *SSL_SESSION_new(void);
 unsigned long SSL_SESSION_hash(const SSL_SESSION *a);
 int     SSL_SESSION_cmp(const SSL_SESSION *a,const SSL_SESSION *b);
+const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s, unsigned int *len);
 #ifndef OPENSSL_NO_FP_API
 int     SSL_SESSION_print_fp(FILE *fp,const SSL_SESSION *ses);
 #endif
@@ -1268,7 +1403,7 @@ int	SSL_CTX_set_generate_session_id(SSL_CTX *, GEN_SESSION_CB);
 int     SSL_set_generate_session_id(SSL *, GEN_SESSION_CB);
 int     SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
                                         unsigned int id_len);
-SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a,const unsigned char * const *pp,
+SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a,const unsigned char **pp,
                              long length);
 
 #ifdef HEADER_X509_H
@@ -1287,12 +1422,12 @@ void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, int (*cb)(X509_STORE_CTX *,v
 #ifndef OPENSSL_NO_RSA
 int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa);
 #endif
-int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, unsigned char *d, long len);
+int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len);
 int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey);
 int SSL_CTX_use_PrivateKey_ASN1(int pk,SSL_CTX *ctx,
-        unsigned char *d, long len);
+        const unsigned char *d, long len);
 int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x);
-int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, unsigned char *d);
+int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d);
 
 void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb);
 void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u);
@@ -1319,9 +1454,9 @@ int 	SSL_read(SSL *ssl,void *buf,int num);
 int     SSL_peek(SSL *ssl,void *buf,int num);
 int     SSL_write(SSL *ssl,const void *buf,int num);
 long    SSL_ctrl(SSL *ssl,int cmd, long larg, void *parg);
-long    SSL_callback_ctrl(SSL *, int, void (*)());
+long    SSL_callback_ctrl(SSL *, int, void (*)(void));
 long    SSL_CTX_ctrl(SSL_CTX *ctx,int cmd, long larg, void *parg);
-long    SSL_CTX_callback_ctrl(SSL_CTX *, int, void (*)());
+long    SSL_CTX_callback_ctrl(SSL_CTX *, int, void (*)(void));
 
 int     SSL_get_error(const SSL *s,int ret_code);
 const char *SSL_get_version(const SSL *s);
@@ -1345,6 +1480,10 @@ SSL_METHOD *TLSv1_method(void);		/* TLSv1.0 */
 SSL_METHOD *TLSv1_server_method(void);  /* TLSv1.0 */
 SSL_METHOD *TLSv1_client_method(void);  /* TLSv1.0 */
 
+SSL_METHOD *DTLSv1_method(void);                /* DTLSv1.0 */
+SSL_METHOD *DTLSv1_server_method(void); /* DTLSv1.0 */
+SSL_METHOD *DTLSv1_client_method(void); /* DTLSv1.0 */
+
 STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s);
 
 int SSL_do_handshake(SSL *s);
@@ -1395,6 +1534,7 @@ int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
 SSL_SESSION *SSL_get_session(const SSL *ssl);
 SSL_SESSION *SSL_get1_session(SSL *ssl); /* obtain a reference count */
 SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl);
+SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx);
 void SSL_set_info_callback(SSL *ssl,
                            void (*cb)(const SSL *ssl,int type,int val));
 void (*SSL_get_info_callback(const SSL *ssl))(const SSL *ssl,int type,int val);
@@ -1462,11 +1602,27 @@ void SSL_set_tmp_dh_callback(SSL *ssl,
                                  DH *(*dh)(SSL *ssl,int is_export,
                                            int keylength));
 #endif
+#ifndef OPENSSL_NO_ECDH
+void SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx,
+                                 EC_KEY *(*ecdh)(SSL *ssl,int is_export,
+                                           int keylength));
+void SSL_set_tmp_ecdh_callback(SSL *ssl,
+                                 EC_KEY *(*ecdh)(SSL *ssl,int is_export,
+                                           int keylength));
+#endif
 
 #ifndef OPENSSL_NO_COMP
+const COMP_METHOD *SSL_get_current_compression(SSL *s);
+const COMP_METHOD *SSL_get_current_expansion(SSL *s);
+const char *SSL_COMP_get_name(const COMP_METHOD *comp);
+STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void);
 int SSL_COMP_add_compression_method(int id,COMP_METHOD *cm);
 #else
-int SSL_COMP_add_compression_method(int id,char *cm);
+const void *SSL_get_current_compression(SSL *s);
+const void *SSL_get_current_expansion(SSL *s);
+const char *SSL_COMP_get_name(const void *comp);
+void *SSL_COMP_get_compression_methods(void);
+int SSL_COMP_add_compression_method(int id,void *cm);
 #endif
 
 /* BEGIN ERROR CODES */
@@ -1479,11 +1635,36 @@ void ERR_load_SSL_strings(void);
 
 /* Function codes. */
 #define SSL_F_CLIENT_CERTIFICATE                         100
-#define SSL_F_CLIENT_FINISHED                            238
+#define SSL_F_CLIENT_FINISHED                            167
 #define SSL_F_CLIENT_HELLO                               101
 #define SSL_F_CLIENT_MASTER_KEY                          102
 #define SSL_F_D2I_SSL_SESSION                            103
+#define SSL_F_DO_DTLS1_WRITE                             245
 #define SSL_F_DO_SSL3_WRITE                              104
+#define SSL_F_DTLS1_ACCEPT                               246
+#define SSL_F_DTLS1_BUFFER_RECORD                        247
+#define SSL_F_DTLS1_CLIENT_HELLO                         248
+#define SSL_F_DTLS1_CONNECT                              249
+#define SSL_F_DTLS1_ENC                                  250
+#define SSL_F_DTLS1_GET_HELLO_VERIFY                     251
+#define SSL_F_DTLS1_GET_MESSAGE                          252
+#define SSL_F_DTLS1_GET_MESSAGE_FRAGMENT                 253
+#define SSL_F_DTLS1_GET_RECORD                           254
+#define SSL_F_DTLS1_OUTPUT_CERT_CHAIN                    255
+#define SSL_F_DTLS1_PREPROCESS_FRAGMENT                  277
+#define SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE           256
+#define SSL_F_DTLS1_PROCESS_RECORD                       257
+#define SSL_F_DTLS1_READ_BYTES                           258
+#define SSL_F_DTLS1_READ_FAILED                          259
+#define SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST             260
+#define SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE              261
+#define SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE             262
+#define SSL_F_DTLS1_SEND_CLIENT_VERIFY                   263
+#define SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST            264
+#define SSL_F_DTLS1_SEND_SERVER_CERTIFICATE              265
+#define SSL_F_DTLS1_SEND_SERVER_HELLO                    266
+#define SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE             267
+#define SSL_F_DTLS1_WRITE_APP_DATA_BYTES                 268
 #define SSL_F_GET_CLIENT_FINISHED                        105
 #define SSL_F_GET_CLIENT_HELLO                           106
 #define SSL_F_GET_CLIENT_MASTER_KEY                      107
@@ -1524,6 +1705,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL3_ENC                                   134
 #define SSL_F_SSL3_GENERATE_KEY_BLOCK                    238
 #define SSL_F_SSL3_GET_CERTIFICATE_REQUEST               135
+#define SSL_F_SSL3_GET_CERT_STATUS                       288
 #define SSL_F_SSL3_GET_CERT_VERIFY                       136
 #define SSL_F_SSL3_GET_CLIENT_CERTIFICATE                137
 #define SSL_F_SSL3_GET_CLIENT_HELLO                      138
@@ -1531,10 +1713,12 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL3_GET_FINISHED                          140
 #define SSL_F_SSL3_GET_KEY_EXCHANGE                      141
 #define SSL_F_SSL3_GET_MESSAGE                           142
+#define SSL_F_SSL3_GET_NEW_SESSION_TICKET                283
 #define SSL_F_SSL3_GET_RECORD                            143
 #define SSL_F_SSL3_GET_SERVER_CERTIFICATE                144
 #define SSL_F_SSL3_GET_SERVER_DONE                       145
 #define SSL_F_SSL3_GET_SERVER_HELLO                      146
+#define SSL_F_SSL3_NEW_SESSION_TICKET                    284
 #define SSL_F_SSL3_OUTPUT_CERT_CHAIN                     147
 #define SSL_F_SSL3_PEEK                                  235
 #define SSL_F_SSL3_READ_BYTES                            148
@@ -1550,8 +1734,10 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL3_SETUP_KEY_BLOCK                       157
 #define SSL_F_SSL3_WRITE_BYTES                           158
 #define SSL_F_SSL3_WRITE_PENDING                         159
+#define SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT                 272
 #define SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK         215
 #define SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK        216
+#define SSL_F_SSL_ADD_SERVERHELLO_TLSEXT                 273
 #define SSL_F_SSL_BAD_METHOD                             160
 #define SSL_F_SSL_BYTES_TO_CIPHER_LIST                   161
 #define SSL_F_SSL_CERT_DUP                               221
@@ -1559,6 +1745,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL_CERT_INSTANTIATE                       214
 #define SSL_F_SSL_CERT_NEW                               162
 #define SSL_F_SSL_CHECK_PRIVATE_KEY                      163
+#define SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT               274
 #define SSL_F_SSL_CIPHER_PROCESS_RULESTR                 230
 #define SSL_F_SSL_CIPHER_STRENGTH_SORT                   231
 #define SSL_F_SSL_CLEAR                                  164
@@ -1590,6 +1777,9 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL_INIT_WBIO_BUFFER                       184
 #define SSL_F_SSL_LOAD_CLIENT_CA_FILE                    185
 #define SSL_F_SSL_NEW                                    186
+#define SSL_F_SSL_PEEK                                   270
+#define SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT             275
+#define SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT             276
 #define SSL_F_SSL_READ                                   223
 #define SSL_F_SSL_RSA_PRIVATE_DECRYPT                    187
 #define SSL_F_SSL_RSA_PUBLIC_ENCRYPT                     188
@@ -1609,6 +1799,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL_SHUTDOWN                               224
 #define SSL_F_SSL_UNDEFINED_CONST_FUNCTION               243
 #define SSL_F_SSL_UNDEFINED_FUNCTION                     197
+#define SSL_F_SSL_UNDEFINED_VOID_FUNCTION                244
 #define SSL_F_SSL_USE_CERTIFICATE                        198
 #define SSL_F_SSL_USE_CERTIFICATE_ASN1                   199
 #define SSL_F_SSL_USE_CERTIFICATE_FILE                   200
@@ -1639,6 +1830,9 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_BAD_DH_P_LENGTH                            110
 #define SSL_R_BAD_DIGEST_LENGTH                          111
 #define SSL_R_BAD_DSA_SIGNATURE                          112
+#define SSL_R_BAD_ECC_CERT                               304
+#define SSL_R_BAD_ECDSA_SIGNATURE                        305
+#define SSL_R_BAD_ECPOINT                                306
 #define SSL_R_BAD_HELLO_REQUEST                          105
 #define SSL_R_BAD_LENGTH                                 271
 #define SSL_R_BAD_MAC_DECODE                             113
@@ -1668,17 +1862,22 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_CIPHER_CODE_WRONG_LENGTH                   137
 #define SSL_R_CIPHER_OR_HASH_UNAVAILABLE                 138
 #define SSL_R_CIPHER_TABLE_SRC_ERROR                     139
+#define SSL_R_CLIENTHELLO_TLSEXT                         157
 #define SSL_R_COMPRESSED_LENGTH_TOO_LONG                 140
 #define SSL_R_COMPRESSION_FAILURE                        141
+#define SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE    307
 #define SSL_R_COMPRESSION_LIBRARY_ERROR                  142
 #define SSL_R_CONNECTION_ID_IS_DIFFERENT                 143
 #define SSL_R_CONNECTION_TYPE_NOT_SET                    144
+#define SSL_R_COOKIE_MISMATCH                            308
 #define SSL_R_DATA_BETWEEN_CCS_AND_FINISHED              145
 #define SSL_R_DATA_LENGTH_TOO_LONG                       146
 #define SSL_R_DECRYPTION_FAILED                          147
 #define SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC        281
 #define SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG            148
 #define SSL_R_DIGEST_CHECK_FAILED                        149
+#define SSL_R_DUPLICATE_COMPRESSION_ID                   309
+#define SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER               310
 #define SSL_R_ENCRYPTED_LENGTH_TOO_LONG                  150
 #define SSL_R_ERROR_GENERATING_TMP_RSA_KEY               282
 #define SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST              151
@@ -1691,6 +1890,8 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_INVALID_CHALLENGE_LENGTH                   158
 #define SSL_R_INVALID_COMMAND                            280
 #define SSL_R_INVALID_PURPOSE                            278
+#define SSL_R_INVALID_STATUS_RESPONSE                    316
+#define SSL_R_INVALID_TICKET_KEYS_LENGTH                 275
 #define SSL_R_INVALID_TRUST                              279
 #define SSL_R_KEY_ARG_TOO_LONG                           284
 #define SSL_R_KRB5                                       285
@@ -1719,6 +1920,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_MISSING_RSA_ENCRYPTING_CERT                169
 #define SSL_R_MISSING_RSA_SIGNING_CERT                   170
 #define SSL_R_MISSING_TMP_DH_KEY                         171
+#define SSL_R_MISSING_TMP_ECDH_KEY                       311
 #define SSL_R_MISSING_TMP_RSA_KEY                        172
 #define SSL_R_MISSING_TMP_RSA_PKEY                       173
 #define SSL_R_MISSING_VERIFY_MESSAGE                     174
@@ -1747,6 +1949,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED            197
 #define SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE              297
 #define SSL_R_PACKET_LENGTH_TOO_LONG                     198
+#define SSL_R_PARSE_TLSEXT                               223
 #define SSL_R_PATH_TOO_LONG                              270
 #define SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE          199
 #define SSL_R_PEER_ERROR                                 200
@@ -1761,6 +1964,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_PUBLIC_KEY_IS_NOT_RSA                      209
 #define SSL_R_PUBLIC_KEY_NOT_RSA                         210
 #define SSL_R_READ_BIO_NOT_SET                           211
+#define SSL_R_READ_TIMEOUT_EXPIRED                       312
 #define SSL_R_READ_WRONG_PACKET_TYPE                     212
 #define SSL_R_RECORD_LENGTH_MISMATCH                     213
 #define SSL_R_RECORD_TOO_LARGE                           214
@@ -1769,11 +1973,14 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_REUSE_CERT_LENGTH_NOT_ZERO                 216
 #define SSL_R_REUSE_CERT_TYPE_NOT_ZERO                   217
 #define SSL_R_REUSE_CIPHER_LIST_NOT_ZERO                 218
+#define SSL_R_SERVERHELLO_TLSEXT                         224
 #define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED           277
 #define SSL_R_SHORT_READ                                 219
 #define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE      220
 #define SSL_R_SSL23_DOING_SESSION_ID_REUSE               221
 #define SSL_R_SSL2_CONNECTION_ID_TOO_LONG                299
+#define SSL_R_SSL3_EXT_INVALID_SERVERNAME                225
+#define SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE           226
 #define SSL_R_SSL3_SESSION_ID_TOO_LONG                   300
 #define SSL_R_SSL3_SESSION_ID_TOO_SHORT                  222
 #define SSL_R_SSLV3_ALERT_BAD_CERTIFICATE                1042
@@ -1808,12 +2015,15 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_TLSV1_ALERT_UNKNOWN_CA                     1048
 #define SSL_R_TLSV1_ALERT_USER_CANCELLED                 1090
 #define SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER       232
+#define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST             227
 #define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233
 #define SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG    234
 #define SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER            235
 #define SSL_R_UNABLE_TO_DECODE_DH_CERTS                  236
+#define SSL_R_UNABLE_TO_DECODE_ECDH_CERTS                313
 #define SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY               237
 #define SSL_R_UNABLE_TO_FIND_DH_PARAMETERS               238
+#define SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS             314
 #define SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS       239
 #define SSL_R_UNABLE_TO_FIND_SSL_METHOD                  240
 #define SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES           241
@@ -1834,8 +2044,10 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_UNKNOWN_STATE                              255
 #define SSL_R_UNSUPPORTED_CIPHER                         256
 #define SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM          257
+#define SSL_R_UNSUPPORTED_ELLIPTIC_CURVE                 315
 #define SSL_R_UNSUPPORTED_PROTOCOL                       258
 #define SSL_R_UNSUPPORTED_SSL_VERSION                    259
+#define SSL_R_UNSUPPORTED_STATUS_TYPE                    329
 #define SSL_R_WRITE_BIO_NOT_SET                          260
 #define SSL_R_WRONG_CIPHER_RETURNED                      261
 #define SSL_R_WRONG_MESSAGE_TYPE                         262
diff --git a/src/lib/libssl/ssl3.h b/src/lib/libssl/ssl3.h
index 1153aeda74..4b1e2e9834 100644
--- a/src/lib/libssl/ssl3.h
+++ b/src/lib/libssl/ssl3.h
@@ -108,6 +108,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #ifndef HEADER_SSL3_H 
 #define HEADER_SSL3_H 
@@ -118,6 +123,7 @@
 #include <openssl/buffer.h>
 #include <openssl/evp.h>
 #include <openssl/ssl.h>
+#include <openssl/pq_compat.h>
 
 #ifdef  __cplusplus
 extern "C" {
@@ -248,7 +254,11 @@ extern "C" {
 #endif
 
 #define SSL3_RT_MAX_PLAIN_LENGTH                16384
+#ifdef OPENSSL_NO_COMP
+#define SSL3_RT_MAX_COMPRESSED_LENGTH   SSL3_RT_MAX_PLAIN_LENGTH
+#else
 #define SSL3_RT_MAX_COMPRESSED_LENGTH   (1024+SSL3_RT_MAX_PLAIN_LENGTH)
+#endif
 #define SSL3_RT_MAX_ENCRYPTED_LENGTH    (1024+SSL3_RT_MAX_COMPRESSED_LENGTH)
 #define SSL3_RT_MAX_PACKET_SIZE         (SSL3_RT_MAX_ENCRYPTED_LENGTH+SSL3_RT_HEADER_LENGTH)
 #define SSL3_RT_MAX_DATA_SIZE                   (1024*1024)
@@ -289,6 +299,8 @@ typedef struct ssl3_record_st
 /*rw*/  unsigned char *data;    /* pointer to the record data */
 /*rw*/  unsigned char *input;   /* where the decode bytes are */
 /*r */  unsigned char *comp;    /* only used with decompression - malloc()ed */
+/*r */  unsigned long epoch;    /* epoch number, needed by DTLS1 */
+/*r */  PQ_64BIT seq_num;       /* sequence number, needed by DTLS1 */
         } SSL3_RECORD;
 
 typedef struct ssl3_buffer_st
@@ -307,7 +319,12 @@ typedef struct ssl3_buffer_st
 #define SSL3_CT_RSA_EPHEMERAL_DH                5
 #define SSL3_CT_DSS_EPHEMERAL_DH                6
 #define SSL3_CT_FORTEZZA_DMS                    20
-#define SSL3_CT_NUMBER                          7
+/* SSL3_CT_NUMBER is used to size arrays and it must be large
+ * enough to contain all of the cert types defined either for
+ * SSLv3 and TLSv1.
+ */
+#define SSL3_CT_NUMBER                  7
+
 
 #define SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS       0x0001
 #define SSL3_FLAGS_DELAY_CLIENT_FINISHED        0x0002
@@ -392,6 +409,11 @@ typedef struct ssl3_state_st
 #ifndef OPENSSL_NO_DH
                 DH *dh;
 #endif
+
+#ifndef OPENSSL_NO_ECDH
+                EC_KEY *ecdh; /* holds short lived ECDH key */
+#endif
+
                 /* used when SSL_ST_FLUSH_DATA is entered */
                 int next_state;                 
 
@@ -420,6 +442,7 @@ typedef struct ssl3_state_st
 
         } SSL3_STATE;
 
+
 /* SSLv3 */
 /*client */
 /* extra state */
@@ -430,6 +453,8 @@ typedef struct ssl3_state_st
 /* read from server */
 #define SSL3_ST_CR_SRVR_HELLO_A         (0x120|SSL_ST_CONNECT)
 #define SSL3_ST_CR_SRVR_HELLO_B         (0x121|SSL_ST_CONNECT)
+#define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A (0x126|SSL_ST_CONNECT)
+#define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B (0x127|SSL_ST_CONNECT)
 #define SSL3_ST_CR_CERT_A               (0x130|SSL_ST_CONNECT)
 #define SSL3_ST_CR_CERT_B               (0x131|SSL_ST_CONNECT)
 #define SSL3_ST_CR_KEY_EXCH_A           (0x140|SSL_ST_CONNECT)
@@ -456,6 +481,10 @@ typedef struct ssl3_state_st
 #define SSL3_ST_CR_CHANGE_B             (0x1C1|SSL_ST_CONNECT)
 #define SSL3_ST_CR_FINISHED_A           (0x1D0|SSL_ST_CONNECT)
 #define SSL3_ST_CR_FINISHED_B           (0x1D1|SSL_ST_CONNECT)
+#define SSL3_ST_CR_SESSION_TICKET_A     (0x1E0|SSL_ST_CONNECT)
+#define SSL3_ST_CR_SESSION_TICKET_B     (0x1E1|SSL_ST_CONNECT)
+#define SSL3_ST_CR_CERT_STATUS_A        (0x1F0|SSL_ST_CONNECT)
+#define SSL3_ST_CR_CERT_STATUS_B        (0x1F1|SSL_ST_CONNECT)
 
 /* server */
 /* extra state */
@@ -466,6 +495,8 @@ typedef struct ssl3_state_st
 #define SSL3_ST_SR_CLNT_HELLO_B         (0x111|SSL_ST_ACCEPT)
 #define SSL3_ST_SR_CLNT_HELLO_C         (0x112|SSL_ST_ACCEPT)
 /* write to client */
+#define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A (0x113|SSL_ST_ACCEPT)
+#define DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B (0x114|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_HELLO_REQ_A          (0x120|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_HELLO_REQ_B          (0x121|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_HELLO_REQ_C          (0x122|SSL_ST_ACCEPT)
@@ -495,10 +526,15 @@ typedef struct ssl3_state_st
 #define SSL3_ST_SW_CHANGE_B             (0x1D1|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_FINISHED_A           (0x1E0|SSL_ST_ACCEPT)
 #define SSL3_ST_SW_FINISHED_B           (0x1E1|SSL_ST_ACCEPT)
+#define SSL3_ST_SW_SESSION_TICKET_A     (0x1F0|SSL_ST_ACCEPT)
+#define SSL3_ST_SW_SESSION_TICKET_B     (0x1F1|SSL_ST_ACCEPT)
+#define SSL3_ST_SW_CERT_STATUS_A        (0x200|SSL_ST_ACCEPT)
+#define SSL3_ST_SW_CERT_STATUS_B        (0x201|SSL_ST_ACCEPT)
 
 #define SSL3_MT_HELLO_REQUEST                   0
 #define SSL3_MT_CLIENT_HELLO                    1
 #define SSL3_MT_SERVER_HELLO                    2
+#define SSL3_MT_NEWSESSION_TICKET               4
 #define SSL3_MT_CERTIFICATE                     11
 #define SSL3_MT_SERVER_KEY_EXCHANGE             12
 #define SSL3_MT_CERTIFICATE_REQUEST             13
@@ -506,6 +542,9 @@ typedef struct ssl3_state_st
 #define SSL3_MT_CERTIFICATE_VERIFY              15
 #define SSL3_MT_CLIENT_KEY_EXCHANGE             16
 #define SSL3_MT_FINISHED                        20
+#define SSL3_MT_CERTIFICATE_STATUS              22
+#define DTLS1_MT_HELLO_VERIFY_REQUEST    3
+
 
 #define SSL3_MT_CCS                             1
 
diff --git a/src/lib/libssl/ssl_algs.c b/src/lib/libssl/ssl_algs.c
index 3d1299ee7b..4717c0e6e1 100644
--- a/src/lib/libssl/ssl_algs.c
+++ b/src/lib/libssl/ssl_algs.c
@@ -82,6 +82,16 @@ int SSL_library_init(void)
         EVP_add_cipher(EVP_aes_192_cbc());
         EVP_add_cipher(EVP_aes_256_cbc());
 #endif
+
+#ifndef OPENSSL_NO_CAMELLIA
+        EVP_add_cipher(EVP_camellia_128_cbc());
+        EVP_add_cipher(EVP_camellia_256_cbc());
+#endif
+
+#ifndef OPENSSL_NO_SEED
+        EVP_add_cipher(EVP_seed_cbc());
+#endif
+
 #ifndef OPENSSL_NO_MD2
         EVP_add_digest(EVP_md2());
 #endif
@@ -101,11 +111,22 @@ int SSL_library_init(void)
         EVP_add_digest_alias(SN_dsaWithSHA1,"DSS1");
         EVP_add_digest_alias(SN_dsaWithSHA1,"dss1");
 #endif
+#ifndef OPENSSL_NO_ECDSA
+        EVP_add_digest(EVP_ecdsa());
+#endif
         /* If you want support for phased out ciphers, add the following */
 #if 0
         EVP_add_digest(EVP_sha());
         EVP_add_digest(EVP_dss());
 #endif
+#ifndef OPENSSL_NO_COMP
+        /* This will initialise the built-in compression algorithms.
+           The value returned is a STACK_OF(SSL_COMP), but that can
+           be discarded safely */
+        (void)SSL_COMP_get_compression_methods();
+#endif
+        /* initialize cipher/digest methods table */
+        ssl_load_ciphers();
         return(1);
         }
 
diff --git a/src/lib/libssl/ssl_asn1.c b/src/lib/libssl/ssl_asn1.c
index fc5fcce108..6e14f4d834 100644
--- a/src/lib/libssl/ssl_asn1.c
+++ b/src/lib/libssl/ssl_asn1.c
@@ -78,6 +78,11 @@ typedef struct ssl_session_asn1_st
         ASN1_INTEGER time;
         ASN1_INTEGER timeout;
         ASN1_INTEGER verify_result;
+#ifndef OPENSSL_NO_TLSEXT
+        ASN1_OCTET_STRING tlsext_hostname;
+        ASN1_INTEGER tlsext_tick_lifetime;
+        ASN1_OCTET_STRING tlsext_tick;
+#endif /* OPENSSL_NO_TLSEXT */
         } SSL_SESSION_ASN1;
 
 int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
@@ -86,6 +91,10 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
         int v1=0,v2=0,v3=0,v4=0,v5=0;
         unsigned char buf[4],ibuf1[LSIZE2],ibuf2[LSIZE2];
         unsigned char ibuf3[LSIZE2],ibuf4[LSIZE2],ibuf5[LSIZE2];
+#ifndef OPENSSL_NO_TLSEXT
+        int v6=0,v9=0,v10=0;
+        unsigned char ibuf6[LSIZE2];
+#endif
         long l;
         SSL_SESSION_ASN1 a;
         M_ASN1_I2D_vars(in);
@@ -178,7 +187,33 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
                 ASN1_INTEGER_set(&a.verify_result,in->verify_result);
                 }
 
-
+#ifndef OPENSSL_NO_TLSEXT
+        if (in->tlsext_hostname)
+                {
+                a.tlsext_hostname.length=strlen(in->tlsext_hostname);
+                a.tlsext_hostname.type=V_ASN1_OCTET_STRING;
+                a.tlsext_hostname.data=(unsigned char *)in->tlsext_hostname;
+                }
+        if (in->tlsext_tick)
+                {
+                a.tlsext_tick.length= in->tlsext_ticklen;
+                a.tlsext_tick.type=V_ASN1_OCTET_STRING;
+                a.tlsext_tick.data=(unsigned char *)in->tlsext_tick;
+                /* If we have a ticket set session ID to empty because
+                 * it will be bogus. If liftime hint is -1 treat as a special
+                 * case because the session is being used as a container
+                 */
+                if (in->tlsext_ticklen && (in->tlsext_tick_lifetime_hint != -1))
+                        a.session_id.length=0;
+                }
+        if (in->tlsext_tick_lifetime_hint > 0)
+                {
+                a.tlsext_tick_lifetime.length=LSIZE2;
+                a.tlsext_tick_lifetime.type=V_ASN1_INTEGER;
+                a.tlsext_tick_lifetime.data=ibuf6;
+                ASN1_INTEGER_set(&a.tlsext_tick_lifetime,in->tlsext_tick_lifetime_hint);
+                }
+#endif /* OPENSSL_NO_TLSEXT */
         M_ASN1_I2D_len(&(a.version),            i2d_ASN1_INTEGER);
         M_ASN1_I2D_len(&(a.ssl_version),        i2d_ASN1_INTEGER);
         M_ASN1_I2D_len(&(a.cipher),             i2d_ASN1_OCTET_STRING);
@@ -200,6 +235,14 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
         if (in->verify_result != X509_V_OK)
                 M_ASN1_I2D_len_EXP_opt(&(a.verify_result),i2d_ASN1_INTEGER,5,v5);
 
+#ifndef OPENSSL_NO_TLSEXT
+        if (in->tlsext_tick_lifetime_hint > 0)
+                M_ASN1_I2D_len_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER,9,v9);
+        if (in->tlsext_tick)
+                M_ASN1_I2D_len_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING,10,v10);
+        if (in->tlsext_hostname)
+                M_ASN1_I2D_len_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING,6,v6);
+#endif /* OPENSSL_NO_TLSEXT */
         M_ASN1_I2D_seq_total();
 
         M_ASN1_I2D_put(&(a.version),            i2d_ASN1_INTEGER);
@@ -223,10 +266,18 @@ int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
                                v4);
         if (in->verify_result != X509_V_OK)
                 M_ASN1_I2D_put_EXP_opt(&a.verify_result,i2d_ASN1_INTEGER,5,v5);
+#ifndef OPENSSL_NO_TLSEXT
+        if (in->tlsext_hostname)
+                M_ASN1_I2D_put_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING,6,v6);
+        if (in->tlsext_tick_lifetime_hint > 0)
+                M_ASN1_I2D_put_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER,9,v9);
+        if (in->tlsext_tick)
+                M_ASN1_I2D_put_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING,10,v10);
+#endif /* OPENSSL_NO_TLSEXT */
         M_ASN1_I2D_finish();
         }
 
-SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char * const *pp,
+SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
              long length)
         {
         int version,ssl_version=0,i;
@@ -242,18 +293,18 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char * const *pp,
         M_ASN1_D2I_start_sequence();
 
         ai.data=NULL; ai.length=0;
-        M_ASN1_D2I_get(aip,d2i_ASN1_INTEGER);
+        M_ASN1_D2I_get_x(ASN1_INTEGER,aip,d2i_ASN1_INTEGER);
         version=(int)ASN1_INTEGER_get(aip);
         if (ai.data != NULL) { OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; }
 
         /* we don't care about the version right now :-) */
-        M_ASN1_D2I_get(aip,d2i_ASN1_INTEGER);
+        M_ASN1_D2I_get_x(ASN1_INTEGER,aip,d2i_ASN1_INTEGER);
         ssl_version=(int)ASN1_INTEGER_get(aip);
         ret->ssl_version=ssl_version;
         if (ai.data != NULL) { OPENSSL_free(ai.data); ai.data=NULL; ai.length=0; }
 
         os.data=NULL; os.length=0;
-        M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_x(ASN1_OCTET_STRING,osp,d2i_ASN1_OCTET_STRING);
         if (ssl_version == SSL2_VERSION)
                 {
                 if (os.length != 3)
@@ -286,22 +337,22 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char * const *pp,
         ret->cipher=NULL;
         ret->cipher_id=id;
 
-        M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_x(ASN1_OCTET_STRING,osp,d2i_ASN1_OCTET_STRING);
         if ((ssl_version>>8) == SSL3_VERSION_MAJOR)
                 i=SSL3_MAX_SSL_SESSION_ID_LENGTH;
-        else /* if (ssl_version == SSL2_VERSION_MAJOR) */
+        else /* if (ssl_version>>8 == SSL2_VERSION_MAJOR) */
                 i=SSL2_MAX_SSL_SESSION_ID_LENGTH;
 
         if (os.length > i)
                 os.length = i;
-        if (os.length > sizeof ret->session_id) /* can't happen */
-                os.length = sizeof ret->session_id;
+        if (os.length > (int)sizeof(ret->session_id)) /* can't happen */
+                os.length = sizeof(ret->session_id);
 
         ret->session_id_length=os.length;
-        OPENSSL_assert(os.length <= sizeof ret->session_id);
+        OPENSSL_assert(os.length <= (int)sizeof(ret->session_id));
         memcpy(ret->session_id,os.data,os.length);
 
-        M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_x(ASN1_OCTET_STRING,osp,d2i_ASN1_OCTET_STRING);
         if (ret->master_key_length > SSL_MAX_MASTER_KEY_LENGTH)
                 ret->master_key_length=SSL_MAX_MASTER_KEY_LENGTH;
         else
@@ -394,5 +445,56 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char * const *pp,
         else
                 ret->verify_result=X509_V_OK;
 
+#ifndef OPENSSL_NO_TLSEXT
+        os.length=0;
+        os.data=NULL;
+        M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,6);
+        if (os.data)
+                {
+                ret->tlsext_hostname = BUF_strndup((char *)os.data, os.length);
+                OPENSSL_free(os.data);
+                os.data = NULL;
+                os.length = 0;
+                }
+        else
+                ret->tlsext_hostname=NULL;
+        ai.length=0;
+        M_ASN1_D2I_get_EXP_opt(aip,d2i_ASN1_INTEGER,9);
+        if (ai.data != NULL)
+                {
+                ret->tlsext_tick_lifetime_hint=ASN1_INTEGER_get(aip);
+                OPENSSL_free(ai.data); ai.data=NULL; ai.length=0;
+                }
+        else if (ret->tlsext_ticklen && ret->session_id_length)
+                ret->tlsext_tick_lifetime_hint = -1;
+        else
+                ret->tlsext_tick_lifetime_hint = 0;
+        os.length=0;
+        os.data=NULL;
+        M_ASN1_D2I_get_EXP_opt(osp,d2i_ASN1_OCTET_STRING,10);
+        if (os.data)
+                {
+                ret->tlsext_tick = os.data;
+                ret->tlsext_ticklen = os.length;
+                os.data = NULL;
+                os.length = 0;
+#if 0
+                /* There are two ways to detect a resumed ticket sesion.
+                 * One is to set a random session ID and then the server
+                 * must return a match in ServerHello. This allows the normal
+                 * client session ID matching to work.
+                 */ 
+                if (ret->session_id_length == 0)
+                        {
+                        ret->session_id_length=SSL3_MAX_SSL_SESSION_ID_LENGTH;
+                        RAND_pseudo_bytes(ret->session_id,
+                                                ret->session_id_length);
+                        }
+#endif
+                }
+        else
+                ret->tlsext_tick=NULL;
+#endif /* OPENSSL_NO_TLSEXT */
+
         M_ASN1_D2I_Finish(a,SSL_SESSION_free,SSL_F_D2I_SSL_SESSION);
         }
diff --git a/src/lib/libssl/ssl_cert.c b/src/lib/libssl/ssl_cert.c
index b779e6bb4d..a32b2d4446 100644
--- a/src/lib/libssl/ssl_cert.c
+++ b/src/lib/libssl/ssl_cert.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -73,12 +73,12 @@
  * 3. All advertising materials mentioning features or use of this
  *    software must display the following acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  *
  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  *    endorse or promote products derived from this software without
  *    prior written permission. For written permission, please contact
- *    openssl-core@OpenSSL.org.
+ *    openssl-core@openssl.org.
  *
  * 5. Products derived from this software may not be called "OpenSSL"
  *    nor may "OpenSSL" appear in their names without prior written
@@ -87,7 +87,7 @@
  * 6. Redistributions of any form whatsoever must retain the following
  *    acknowledgment:
  *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  *
  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
@@ -102,6 +102,16 @@
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  * OF THE POSSIBILITY OF SUCH DAMAGE.
  * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
  */
 
 #include <stdio.h>
@@ -111,45 +121,42 @@
 # include <sys/types.h>
 #endif
 
-#if !defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_SYS_VMS) && !defined(NeXT) && !defined(MAC_OS_pre_X)
-#include <dirent.h>
-#endif
-
-#if defined(WIN32)
-#include <windows.h>
-#include <tchar.h>
-#endif
-
-#ifdef NeXT
-#include <sys/dir.h>
-#define dirent direct
-#endif
-
+#include "o_dir.h"
 #include <openssl/objects.h>
 #include <openssl/bio.h>
 #include <openssl/pem.h>
 #include <openssl/x509v3.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
 #include "ssl_locl.h"
-#include <openssl/fips.h>
 
 int SSL_get_ex_data_X509_STORE_CTX_idx(void)
         {
         static volatile int ssl_x509_store_ctx_idx= -1;
+        int got_write_lock = 0;
+
+        CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
 
         if (ssl_x509_store_ctx_idx < 0)
                 {
-                /* any write lock will do; usually this branch
-                 * will only be taken once anyway */
+                CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
                 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
+                got_write_lock = 1;
                 
                 if (ssl_x509_store_ctx_idx < 0)
                         {
                         ssl_x509_store_ctx_idx=X509_STORE_CTX_get_ex_new_index(
                                 0,"SSL for verify callback",NULL,NULL,NULL);
                         }
-                
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
                 }
+
+        if (got_write_lock)
+                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
+        else
+                CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
+        
         return ssl_x509_store_ctx_idx;
         }
 
@@ -205,7 +212,6 @@ CERT *ssl_cert_dup(CERT *cert)
 #ifndef OPENSSL_NO_DH
         if (cert->dh_tmp != NULL)
                 {
-                /* DH parameters don't have a reference count */
                 ret->dh_tmp = DHparams_dup(cert->dh_tmp);
                 if (ret->dh_tmp == NULL)
                         {
@@ -236,6 +242,19 @@ CERT *ssl_cert_dup(CERT *cert)
         ret->dh_tmp_cb = cert->dh_tmp_cb;
 #endif
 
+#ifndef OPENSSL_NO_ECDH
+        if (cert->ecdh_tmp)
+                {
+                ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp);
+                if (ret->ecdh_tmp == NULL)
+                        {
+                        SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_EC_LIB);
+                        goto err;
+                        }
+                }
+        ret->ecdh_tmp_cb = cert->ecdh_tmp_cb;
+#endif
+
         for (i = 0; i < SSL_PKEY_NUM; i++)
                 {
                 if (cert->pkeys[i].x509 != NULL)
@@ -270,7 +289,11 @@ CERT *ssl_cert_dup(CERT *cert)
                         case SSL_PKEY_DH_DSA:
                                 /* We have a DH key. */
                                 break;
-                                
+
+                        case SSL_PKEY_ECC:
+                                /* We have an ECC key */
+                                break;
+
                         default:
                                 /* Can't happen. */
                                 SSLerr(SSL_F_SSL_CERT_DUP, SSL_R_LIBRARY_BUG);
@@ -285,7 +308,7 @@ CERT *ssl_cert_dup(CERT *cert)
 
         return(ret);
         
-#ifndef OPENSSL_NO_DH /* avoid 'unreferenced label' warning if OPENSSL_NO_DH is defined */
+#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ECDH)
 err:
 #endif
 #ifndef OPENSSL_NO_RSA
@@ -296,6 +319,10 @@ err:
         if (ret->dh_tmp != NULL)
                 DH_free(ret->dh_tmp);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        if (ret->ecdh_tmp != NULL)
+                EC_KEY_free(ret->ecdh_tmp);
+#endif
 
         for (i = 0; i < SSL_PKEY_NUM; i++)
                 {
@@ -335,6 +362,9 @@ void ssl_cert_free(CERT *c)
 #ifndef OPENSSL_NO_DH
         if (c->dh_tmp) DH_free(c->dh_tmp);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        if (c->ecdh_tmp) EC_KEY_free(c->ecdh_tmp);
+#endif
 
         for (i=0; i<SSL_PKEY_NUM; i++)
                 {
@@ -441,6 +471,10 @@ void ssl_sess_cert_free(SESS_CERT *sc)
         if (sc->peer_dh_tmp != NULL)
                 DH_free(sc->peer_dh_tmp);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        if (sc->peer_ecdh_tmp != NULL)
+                EC_KEY_free(sc->peer_ecdh_tmp);
+#endif
 
         OPENSSL_free(sc);
         }
@@ -466,20 +500,22 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
                 SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,ERR_R_X509_LIB);
                 return(0);
                 }
+        if (s->param)
+                X509_VERIFY_PARAM_inherit(X509_STORE_CTX_get0_param(&ctx),
+                                                s->param);
+#if 0
         if (SSL_get_verify_depth(s) >= 0)
                 X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s));
+#endif
         X509_STORE_CTX_set_ex_data(&ctx,SSL_get_ex_data_X509_STORE_CTX_idx(),s);
 
-        /* We need to set the verify purpose. The purpose can be determined by
+        /* We need to inherit the verify parameters. These can be determined by
          * the context: if its a server it will verify SSL client certificates
          * or vice versa.
          */
-        if (s->server)
-                i = X509_PURPOSE_SSL_CLIENT;
-        else
-                i = X509_PURPOSE_SSL_SERVER;
 
-        X509_STORE_CTX_purpose_inherit(&ctx, i, s->purpose, s->trust);
+        X509_STORE_CTX_set_default(&ctx,
+                                s->server ? "ssl_client" : "ssl_server");
 
         if (s->verify_callback)
                 X509_STORE_CTX_set_verify_cb(&ctx, s->verify_callback);
@@ -726,7 +762,7 @@ err:
         if(x != NULL)
                 X509_free(x);
         
-        sk_X509_NAME_set_cmp_func(stack,oldcmp);
+        (void)sk_X509_NAME_set_cmp_func(stack,oldcmp);
 
         return ret;
         }
@@ -742,157 +778,52 @@ err:
  * certs may have been added to \c stack.
  */
 
-#ifndef OPENSSL_SYS_WIN32
-#ifndef OPENSSL_SYS_VMS         /* XXXX This may be fixed in the future */
-#ifndef OPENSSL_SYS_MACINTOSH_CLASSIC /* XXXXX: Better scheme needed! */
-
 int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
                                        const char *dir)
         {
-        DIR *d;
-        struct dirent *dstruct;
+        OPENSSL_DIR_CTX *d = NULL;
+        const char *filename;
         int ret = 0;
 
         CRYPTO_w_lock(CRYPTO_LOCK_READDIR);
-        d = opendir(dir);
 
         /* Note that a side effect is that the CAs will be sorted by name */
-        if(!d)
-                {
-                SYSerr(SYS_F_OPENDIR, get_last_sys_error());
-                ERR_add_error_data(3, "opendir('", dir, "')");
-                SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB);
-                goto err;
-                }
-        
-        while((dstruct=readdir(d)))
+
+        while((filename = OPENSSL_DIR_read(&d, dir)))
                 {
                 char buf[1024];
                 int r;
-                
-                if(strlen(dir)+strlen(dstruct->d_name)+2 > sizeof buf)
+
+                if(strlen(dir)+strlen(filename)+2 > sizeof buf)
                         {
                         SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG);
                         goto err;
                         }
-                
-                r = BIO_snprintf(buf,sizeof buf,"%s/%s",dir,dstruct->d_name);
-                if (r <= 0 || r >= sizeof buf)
+
+#ifdef OPENSSL_SYS_VMS
+                r = BIO_snprintf(buf,sizeof buf,"%s%s",dir,filename);
+#else
+                r = BIO_snprintf(buf,sizeof buf,"%s/%s",dir,filename);
+#endif
+                if (r <= 0 || r >= (int)sizeof(buf))
                         goto err;
                 if(!SSL_add_file_cert_subjects_to_stack(stack,buf))
                         goto err;
                 }
-        ret = 1;
-
-err:    
-        if (d) closedir(d);
-        CRYPTO_w_unlock(CRYPTO_LOCK_READDIR);
-        return ret;
-        }
-
-#endif
-#endif
-
-#else /* OPENSSL_SYS_WIN32 */
-
-#if defined(_WIN32_WCE)
-# ifndef UNICODE
-#  error "WinCE comes in UNICODE flavor only..."
-# endif
-# if _WIN32_WCE<101 && !defined(OPENSSL_NO_MULTIBYTE)
-#  define OPENSSL_NO_MULTIBYTE
-# endif
-# ifndef  FindFirstFile
-#  define FindFirstFile FindFirstFileW
-# endif
-# ifndef  FindNextFile
-#  define FindNextFile FindNextFileW
-# endif
-#endif
-
-int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
-                                       const char *dir)
-        {
-        WIN32_FIND_DATA FindFileData;
-        HANDLE hFind;
-        int    ret = 0;
-        TCHAR *wdir = NULL;
-        size_t i,len_0 = strlen(dir)+1; /* len_0 accounts for trailing 0 */
-        char   buf[1024],*slash;
-
-        if (len_0 > (sizeof(buf)-14))   /* 14 is just some value... */
-                {
-                SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG);
-                return ret;
-                }
-
-        CRYPTO_w_lock(CRYPTO_LOCK_READDIR);
-
-        if (sizeof(TCHAR) != sizeof(char))
-                {
-                wdir = (TCHAR *)malloc(len_0*sizeof(TCHAR));
-                if (wdir == NULL)
-                        goto err_noclose;
-#ifndef OPENSSL_NO_MULTIBYTE
-                if (!MultiByteToWideChar(CP_ACP,0,dir,len_0,
-                                        (WCHAR *)wdir,len_0))
-#endif
-                        for (i=0;i<len_0;i++) wdir[i]=(TCHAR)dir[i];
-
-                hFind = FindFirstFile(wdir, &FindFileData);
-                }
-        else    hFind = FindFirstFile((const TCHAR *)dir, &FindFileData);
 
-        /* Note that a side effect is that the CAs will be sorted by name */
-        if(hFind == INVALID_HANDLE_VALUE)
+        if (errno)
                 {
                 SYSerr(SYS_F_OPENDIR, get_last_sys_error());
-                ERR_add_error_data(3, "opendir('", dir, "')");
+                ERR_add_error_data(3, "OPENSSL_DIR_read(&ctx, '", dir, "')");
                 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB);
-                goto err_noclose;
+                goto err;
                 }
 
-        strncpy(buf,dir,sizeof(buf));   /* strcpy is safe too... */
-        buf[len_0-1]='/';               /* no trailing zero!     */
-        slash=buf+len_0;
-
-        do      {
-                const TCHAR *fnam=FindFileData.cFileName;
-                size_t flen_0=_tcslen(fnam)+1;
-
-                if (flen_0 > (sizeof(buf)-len_0))
-                        {
-                        SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG);
-                        goto err;
-                        }
-                /* else strcpy would be safe too... */
-
-                if (sizeof(TCHAR) != sizeof(char))
-                        {
-#ifndef OPENSSL_NO_MULTIBYTE
-                        if (!WideCharToMultiByte(CP_ACP,0,
-                                                (WCHAR *)fnam,flen_0,
-                                                slash,sizeof(buf)-len_0,
-                                                NULL,0))
-#endif
-                                for (i=0;i<flen_0;i++) slash[i]=(char)fnam[i];
-                        }
-                else    strncpy(slash,(const char *)fnam,sizeof(buf)-len_0);
-
-                if(!SSL_add_file_cert_subjects_to_stack(stack,buf))
-                        goto err;
-                }
-        while (FindNextFile(hFind, &FindFileData) != FALSE);
         ret = 1;
 
-err:    
-        FindClose(hFind);
-err_noclose:
-        if (wdir != NULL)
-                free(wdir);
-
+err:
+        if (d) OPENSSL_DIR_end(&d);
         CRYPTO_w_unlock(CRYPTO_LOCK_READDIR);
         return ret;
         }
 
-#endif
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c
index f622180c69..71b645da14 100644
--- a/src/lib/libssl/ssl_ciph.c
+++ b/src/lib/libssl/ssl_ciph.c
@@ -55,11 +55,67 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
-
+/* ====================================================================
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 #include <stdio.h>
 #include <openssl/objects.h>
 #include <openssl/comp.h>
-#include <openssl/fips.h>
 #include "ssl_locl.h"
 
 #define SSL_ENC_DES_IDX         0
@@ -71,12 +127,20 @@
 #define SSL_ENC_NULL_IDX        6
 #define SSL_ENC_AES128_IDX      7
 #define SSL_ENC_AES256_IDX      8
-#define SSL_ENC_NUM_IDX         9
+#define SSL_ENC_CAMELLIA128_IDX 9
+#define SSL_ENC_CAMELLIA256_IDX 10
+#define SSL_ENC_SEED_IDX        11
+#define SSL_ENC_NUM_IDX         12
+
 
 static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX]={
         NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL
         };
 
+#define SSL_COMP_NULL_IDX       0
+#define SSL_COMP_ZLIB_IDX       1
+#define SSL_COMP_NUM_IDX        2
+
 static STACK_OF(SSL_COMP) *ssl_comp_methods=NULL;
 
 #define SSL_MD_MD5_IDX  0
@@ -102,18 +166,20 @@ typedef struct cipher_order_st
 
 static const SSL_CIPHER cipher_aliases[]={
         /* Don't include eNULL unless specifically enabled. */
-        {0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL}, /* must be first */
-        {0,SSL_TXT_CMPALL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0},  /* COMPLEMENT OF ALL */
+        /* Don't include ECC in ALL because these ciphers are not yet official. */
+        {0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL & ~SSL_kECDH & ~SSL_kECDHE, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL}, /* must be first */
+        /* TODO: COMPLEMENT OF ALL and COMPLEMENT OF DEFAULT do not have ECC cipher suites handled properly. */
+        {0,SSL_TXT_CMPALL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0},  /* COMPLEMENT OF ALL */
         {0,SSL_TXT_CMPDEF,0,SSL_ADH, 0,0,0,0,SSL_AUTH_MASK,0},
-        {0,SSL_TXT_kKRB5,0,SSL_kKRB5,0,0,0,0,SSL_MKEY_MASK,0},  /* VRS Kerberos5 */
+        {0,SSL_TXT_kKRB5,0,SSL_kKRB5,0,0,0,0,SSL_MKEY_MASK,0},  /* VRS Kerberos5 */
         {0,SSL_TXT_kRSA,0,SSL_kRSA,  0,0,0,0,SSL_MKEY_MASK,0},
         {0,SSL_TXT_kDHr,0,SSL_kDHr,  0,0,0,0,SSL_MKEY_MASK,0},
         {0,SSL_TXT_kDHd,0,SSL_kDHd,  0,0,0,0,SSL_MKEY_MASK,0},
         {0,SSL_TXT_kEDH,0,SSL_kEDH,  0,0,0,0,SSL_MKEY_MASK,0},
         {0,SSL_TXT_kFZA,0,SSL_kFZA,  0,0,0,0,SSL_MKEY_MASK,0},
         {0,SSL_TXT_DH,  0,SSL_DH,    0,0,0,0,SSL_MKEY_MASK,0},
+        {0,SSL_TXT_ECC, 0,(SSL_kECDH|SSL_kECDHE), 0,0,0,0,SSL_MKEY_MASK,0},
         {0,SSL_TXT_EDH, 0,SSL_EDH,   0,0,0,0,SSL_MKEY_MASK|SSL_AUTH_MASK,0},
-
         {0,SSL_TXT_aKRB5,0,SSL_aKRB5,0,0,0,0,SSL_AUTH_MASK,0},  /* VRS Kerberos5 */
         {0,SSL_TXT_aRSA,0,SSL_aRSA,  0,0,0,0,SSL_AUTH_MASK,0},
         {0,SSL_TXT_aDSS,0,SSL_aDSS,  0,0,0,0,SSL_AUTH_MASK,0},
@@ -129,9 +195,11 @@ static const SSL_CIPHER cipher_aliases[]={
 #ifndef OPENSSL_NO_IDEA
         {0,SSL_TXT_IDEA,0,SSL_IDEA,  0,0,0,0,SSL_ENC_MASK,0},
 #endif
+        {0,SSL_TXT_SEED,0,SSL_SEED,  0,0,0,0,SSL_ENC_MASK,0},
         {0,SSL_TXT_eNULL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0},
         {0,SSL_TXT_eFZA,0,SSL_eFZA,  0,0,0,0,SSL_ENC_MASK,0},
         {0,SSL_TXT_AES, 0,SSL_AES,   0,0,0,0,SSL_ENC_MASK,0},
+        {0,SSL_TXT_CAMELLIA,0,SSL_CAMELLIA, 0,0,0,0,SSL_ENC_MASK,0},
 
         {0,SSL_TXT_MD5, 0,SSL_MD5,   0,0,0,0,SSL_MAC_MASK,0},
         {0,SSL_TXT_SHA1,0,SSL_SHA1,  0,0,0,0,SSL_MAC_MASK,0},
@@ -154,12 +222,9 @@ static const SSL_CIPHER cipher_aliases[]={
         {0,SSL_TXT_LOW,   0, 0,   SSL_LOW, 0,0,0,0,SSL_STRONG_MASK},
         {0,SSL_TXT_MEDIUM,0, 0,SSL_MEDIUM, 0,0,0,0,SSL_STRONG_MASK},
         {0,SSL_TXT_HIGH,  0, 0,  SSL_HIGH, 0,0,0,0,SSL_STRONG_MASK},
-        {0,SSL_TXT_FIPS,  0, 0,  SSL_FIPS, 0,0,0,0,SSL_FIPS|SSL_STRONG_NONE},
         };
 
-static int init_ciphers=1;
-
-static void load_ciphers(void)
+void ssl_load_ciphers(void)
         {
         ssl_cipher_methods[SSL_ENC_DES_IDX]= 
                 EVP_get_cipherbyname(SN_des_cbc);
@@ -179,14 +244,73 @@ static void load_ciphers(void)
           EVP_get_cipherbyname(SN_aes_128_cbc);
         ssl_cipher_methods[SSL_ENC_AES256_IDX]=
           EVP_get_cipherbyname(SN_aes_256_cbc);
+        ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX]=
+          EVP_get_cipherbyname(SN_camellia_128_cbc);
+        ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX]=
+          EVP_get_cipherbyname(SN_camellia_256_cbc);
+        ssl_cipher_methods[SSL_ENC_SEED_IDX]=
+          EVP_get_cipherbyname(SN_seed_cbc);
 
         ssl_digest_methods[SSL_MD_MD5_IDX]=
                 EVP_get_digestbyname(SN_md5);
         ssl_digest_methods[SSL_MD_SHA1_IDX]=
                 EVP_get_digestbyname(SN_sha1);
-        init_ciphers=0;
         }
 
+
+#ifndef OPENSSL_NO_COMP
+
+static int sk_comp_cmp(const SSL_COMP * const *a,
+                        const SSL_COMP * const *b)
+        {
+        return((*a)->id-(*b)->id);
+        }
+
+static void load_builtin_compressions(void)
+        {
+        int got_write_lock = 0;
+
+        CRYPTO_r_lock(CRYPTO_LOCK_SSL);
+        if (ssl_comp_methods == NULL)
+                {
+                CRYPTO_r_unlock(CRYPTO_LOCK_SSL);
+                CRYPTO_w_lock(CRYPTO_LOCK_SSL);
+                got_write_lock = 1;
+                
+                if (ssl_comp_methods == NULL)
+                        {
+                        SSL_COMP *comp = NULL;
+
+                        MemCheck_off();
+                        ssl_comp_methods=sk_SSL_COMP_new(sk_comp_cmp);
+                        if (ssl_comp_methods != NULL)
+                                {
+                                comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
+                                if (comp != NULL)
+                                        {
+                                        comp->method=COMP_zlib();
+                                        if (comp->method
+                                                && comp->method->type == NID_undef)
+                                                OPENSSL_free(comp);
+                                        else
+                                                {
+                                                comp->id=SSL_COMP_ZLIB_IDX;
+                                                comp->name=comp->method->name;
+                                                sk_SSL_COMP_push(ssl_comp_methods,comp);
+                                                }
+                                        }
+                                }
+                        MemCheck_on();
+                        }
+                }
+        
+        if (got_write_lock)
+                CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
+        else
+                CRYPTO_r_unlock(CRYPTO_LOCK_SSL);
+        }
+#endif
+
 int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
              const EVP_MD **md, SSL_COMP **comp)
         {
@@ -198,18 +322,14 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
         if (comp != NULL)
                 {
                 SSL_COMP ctmp;
+#ifndef OPENSSL_NO_COMP
+                load_builtin_compressions();
+#endif
 
-                if (s->compress_meth == 0)
-                        *comp=NULL;
-                else if (ssl_comp_methods == NULL)
+                *comp=NULL;
+                ctmp.id=s->compress_meth;
+                if (ssl_comp_methods != NULL)
                         {
-                        /* bad */
-                        *comp=NULL;
-                        }
-                else
-                        {
-
-                        ctmp.id=s->compress_meth;
                         i=sk_SSL_COMP_find(ssl_comp_methods,&ctmp);
                         if (i >= 0)
                                 *comp=sk_SSL_COMP_value(ssl_comp_methods,i);
@@ -248,6 +368,18 @@ int ssl_cipher_get_evp(const SSL_SESSION *s, const EVP_CIPHER **enc,
                 default: i=-1; break;
                         }
                 break;
+        case SSL_CAMELLIA:
+                switch(c->alg_bits)
+                        {
+                case 128: i=SSL_ENC_CAMELLIA128_IDX; break;
+                case 256: i=SSL_ENC_CAMELLIA256_IDX; break;
+                default: i=-1; break;
+                        }
+                break;
+        case SSL_SEED:
+                i=SSL_ENC_SEED_IDX;
+                break;
+
         default:
                 i= -1;
                 break;
@@ -305,9 +437,18 @@ static void ll_append_tail(CIPHER_ORDER **head, CIPHER_ORDER *curr,
         *tail=curr;
         }
 
-static unsigned long ssl_cipher_get_disabled(void)
+struct disabled_masks { /* This is a kludge no longer needed with OpenSSL 0.9.9,
+                         * where 128-bit and 256-bit algorithms simply will get
+                         * separate bits. */
+  unsigned long mask; /* everything except m256 */
+  unsigned long m256; /* applies to 256-bit algorithms only */
+};
+
+static struct disabled_masks ssl_cipher_get_disabled(void)
         {
         unsigned long mask;
+        unsigned long m256;
+        struct disabled_masks ret;
 
         mask = SSL_kFZA;
 #ifdef OPENSSL_NO_RSA
@@ -322,7 +463,9 @@ static unsigned long ssl_cipher_get_disabled(void)
 #ifdef OPENSSL_NO_KRB5
         mask |= SSL_kKRB5|SSL_aKRB5;
 #endif
-
+#ifdef OPENSSL_NO_ECDH
+        mask |= SSL_kECDH|SSL_kECDHE;
+#endif
 #ifdef SSL_FORBID_ENULL
         mask |= SSL_eNULL;
 #endif
@@ -333,17 +476,27 @@ static unsigned long ssl_cipher_get_disabled(void)
         mask |= (ssl_cipher_methods[SSL_ENC_RC2_IDX ] == NULL) ? SSL_RC2 :0;
         mask |= (ssl_cipher_methods[SSL_ENC_IDEA_IDX] == NULL) ? SSL_IDEA:0;
         mask |= (ssl_cipher_methods[SSL_ENC_eFZA_IDX] == NULL) ? SSL_eFZA:0;
-        mask |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES:0;
+        mask |= (ssl_cipher_methods[SSL_ENC_SEED_IDX] == NULL) ? SSL_SEED:0;
 
         mask |= (ssl_digest_methods[SSL_MD_MD5_IDX ] == NULL) ? SSL_MD5 :0;
         mask |= (ssl_digest_methods[SSL_MD_SHA1_IDX] == NULL) ? SSL_SHA1:0;
 
-        return(mask);
+        /* finally consider algorithms where mask and m256 differ */
+        m256 = mask;
+        mask |= (ssl_cipher_methods[SSL_ENC_AES128_IDX] == NULL) ? SSL_AES:0;
+        mask |= (ssl_cipher_methods[SSL_ENC_CAMELLIA128_IDX] == NULL) ? SSL_CAMELLIA:0;
+        m256 |= (ssl_cipher_methods[SSL_ENC_AES256_IDX] == NULL) ? SSL_AES:0;
+        m256 |= (ssl_cipher_methods[SSL_ENC_CAMELLIA256_IDX] == NULL) ? SSL_CAMELLIA:0;
+
+        ret.mask = mask;
+        ret.m256 = m256;
+        return ret;
         }
 
 static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
-                int num_of_ciphers, unsigned long mask, CIPHER_ORDER *co_list,
-                CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
+                int num_of_ciphers, unsigned long mask, unsigned long m256,
+                CIPHER_ORDER *co_list, CIPHER_ORDER **head_p,
+                CIPHER_ORDER **tail_p)
         {
         int i, co_list_num;
         SSL_CIPHER *c;
@@ -360,13 +513,9 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
         for (i = 0; i < num_of_ciphers; i++)
                 {
                 c = ssl_method->get_cipher(i);
+#define IS_MASKED(c) ((c)->algorithms & (((c)->alg_bits == 256) ? m256 : mask))
                 /* drop those that use any of that is not available */
-#ifdef OPENSSL_FIPS
-                if ((c != NULL) && c->valid && !(c->algorithms & mask)
-                        && (!FIPS_mode() || (c->algo_strength & SSL_FIPS)))
-#else
-                if ((c != NULL) && c->valid && !(c->algorithms & mask))
-#endif
+                if ((c != NULL) && c->valid && !IS_MASKED(c))
                         {
                         co_list[co_list_num].cipher = c;
                         co_list[co_list_num].next = NULL;
@@ -440,7 +589,8 @@ static void ssl_cipher_collect_aliases(SSL_CIPHER **ca_list,
         *ca_curr = NULL;        /* end of list */
         }
 
-static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
+static void ssl_cipher_apply_rule(unsigned long cipher_id, unsigned long ssl_version,
+                unsigned long algorithms, unsigned long mask,
                 unsigned long algo_strength, unsigned long mask_strength,
                 int rule, int strength_bits, CIPHER_ORDER *co_list,
                 CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
@@ -466,11 +616,20 @@ static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
 
                 cp = curr->cipher;
 
+                /* If explicit cipher suite, match only that one for its own protocol version.
+                 * Usual selection criteria will be used for similar ciphersuites from other version! */
+
+                if (cipher_id && (cp->algorithms & SSL_SSL_MASK) == ssl_version)
+                        {
+                        if (cp->id != cipher_id)
+                                continue;
+                        }
+
                 /*
                  * Selection criteria is either the number of strength_bits
                  * or the algorithm used.
                  */
-                if (strength_bits == -1)
+                else if (strength_bits == -1)
                         {
                         ma = mask & cp->algorithms;
                         ma_s = mask_strength & cp->algo_strength;
@@ -501,8 +660,22 @@ static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
                         {
                         if (!curr->active)
                                 {
-                                ll_append_tail(&head, curr, &tail);
-                                curr->active = 1;
+                                int add_this_cipher = 1;
+
+                                if (((cp->algorithms & (SSL_kECDHE|SSL_kECDH|SSL_aECDSA)) != 0))
+                                        {
+                                        /* Make sure "ECCdraft" ciphersuites are activated only if
+                                         * *explicitly* requested, but not implicitly (such as
+                                         * as part of the "AES" alias). */
+
+                                        add_this_cipher = (mask & (SSL_kECDHE|SSL_kECDH|SSL_aECDSA)) != 0 || cipher_id != 0;
+                                        }
+                                
+                                if (add_this_cipher)
+                                        {
+                                        ll_append_tail(&head, curr, &tail);
+                                        curr->active = 1;
+                                        }
                                 }
                         }
                 /* Move the added cipher to this location */
@@ -583,7 +756,7 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER *co_list,
          */
         for (i = max_strength_bits; i >= 0; i--)
                 if (number_uses[i] > 0)
-                        ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i,
+                        ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, CIPHER_ORD, i,
                                         co_list, head_p, tail_p);
 
         OPENSSL_free(number_uses);
@@ -597,6 +770,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
         unsigned long algorithms, mask, algo_strength, mask_strength;
         const char *l, *start, *buf;
         int j, multi, found, rule, retval, ok, buflen;
+        unsigned long cipher_id = 0, ssl_version = 0;
         char ch;
 
         retval = 1;
@@ -686,6 +860,8 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                          * use strcmp(), because buf is not '\0' terminated.)
                          */
                          j = found = 0;
+                         cipher_id = 0;
+                         ssl_version = 0;
                          while (ca_list[j])
                                 {
                                 if (!strncmp(buf, ca_list[j]->name, buflen) &&
@@ -714,6 +890,14 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                                         (algo_strength & ca_list[j]->algo_strength);
                         mask_strength |= ca_list[j]->mask_strength;
 
+                        /* explicit ciphersuite found */
+                        if (ca_list[j]->valid)
+                                {
+                                cipher_id = ca_list[j]->id;
+                                ssl_version = ca_list[j]->algorithms & SSL_SSL_MASK;
+                                break;
+                                }
+
                         if (!multi) break;
                         }
 
@@ -738,18 +922,18 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                          * rest of the command, if any left, until
                          * end or ':' is found.
                          */
-                        while ((*l != '\0') && ITEM_SEP(*l))
+                        while ((*l != '\0') && !ITEM_SEP(*l))
                                 l++;
                         }
                 else if (found)
                         {
-                        ssl_cipher_apply_rule(algorithms, mask,
+                        ssl_cipher_apply_rule(cipher_id, ssl_version, algorithms, mask,
                                 algo_strength, mask_strength, rule, -1,
                                 co_list, head_p, tail_p);
                         }
                 else
                         {
-                        while ((*l != '\0') && ITEM_SEP(*l))
+                        while ((*l != '\0') && !ITEM_SEP(*l))
                                 l++;
                         }
                 if (*l == '\0') break; /* done */
@@ -765,6 +949,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         {
         int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
         unsigned long disabled_mask;
+        unsigned long disabled_m256;
         STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;
         const char *rule_p;
         CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
@@ -776,18 +961,16 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         if (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)
                 return NULL;
 
-        if (init_ciphers)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL);
-                if (init_ciphers) load_ciphers();
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
-                }
-
         /*
          * To reduce the work to do we only want to process the compiled
          * in algorithms, so we first get the mask of disabled ciphers.
          */
-        disabled_mask = ssl_cipher_get_disabled();
+        {
+                struct disabled_masks d;
+                d = ssl_cipher_get_disabled();
+                disabled_mask = d.mask;
+                disabled_m256 = d.m256;
+        }
 
         /*
          * Now we have to collect the available ciphers from the compiled
@@ -806,7 +989,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
                 }
 
         ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, disabled_mask,
-                                   co_list, &head, &tail);
+                                   disabled_m256, co_list, &head, &tail);
 
         /*
          * We also need cipher aliases for selecting based on the rule_str.
@@ -826,8 +1009,8 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
                 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
                 return(NULL);   /* Failure */
                 }
-        ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, disabled_mask,
-                                   head);
+        ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
+                                   (disabled_mask & disabled_m256), head);
 
         /*
          * If the rule_string begins with DEFAULT, apply the default rule
@@ -871,11 +1054,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
          */
         for (curr = head; curr != NULL; curr = curr->next)
                 {
-#ifdef OPENSSL_FIPS
-                if (curr->active && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS))
-#else
                 if (curr->active)
-#endif
                         {
                         sk_SSL_CIPHER_push(cipherstack, curr->cipher);
 #ifdef CIPHER_DEBUG
@@ -897,7 +1076,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         if (*cipher_list_by_id != NULL)
                 sk_SSL_CIPHER_free(*cipher_list_by_id);
         *cipher_list_by_id = tmp_cipher_list;
-        sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);
+        (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);
 
         return(cipherstack);
         }
@@ -905,13 +1084,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
 char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
         {
         int is_export,pkl,kl;
-        char *ver,*exp_str;
-        char *kx,*au,*enc,*mac;
+        const char *ver,*exp_str;
+        const char *kx,*au,*enc,*mac;
         unsigned long alg,alg2,alg_s;
 #ifdef KSSL_DEBUG
-        static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx\n";
+        static const char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s AL=%lx\n";
 #else
-        static char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
+        static const char *format="%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s\n";
 #endif /* KSSL_DEBUG */
 
         alg=cipher->algorithms;
@@ -922,7 +1101,7 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
         pkl=SSL_C_EXPORT_PKEYLENGTH(cipher);
         kl=SSL_C_EXPORT_KEYLENGTH(cipher);
         exp_str=is_export?" export":"";
-
+        
         if (alg & SSL_SSLV2)
                 ver="SSLv2";
         else if (alg & SSL_SSLV3)
@@ -951,6 +1130,10 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
         case SSL_kEDH:
                 kx=is_export?(pkl == 512 ? "DH(512)" : "DH(1024)"):"DH";
                 break;
+        case SSL_kECDH:
+        case SSL_kECDHE:
+                kx=is_export?"ECDH(<=163)":"ECDH";
+                break;
         default:
                 kx="unknown";
                 }
@@ -974,6 +1157,9 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
         case SSL_aNULL:
                 au="None";
                 break;
+        case SSL_aECDSA:
+                au="ECDSA";
+                break;
         default:
                 au="unknown";
                 break;
@@ -1012,6 +1198,18 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
                 default: enc="AES(?""?""?)"; break;
                         }
                 break;
+        case SSL_CAMELLIA:
+                switch(cipher->strength_bits)
+                        {
+                case 128: enc="Camellia(128)"; break;
+                case 256: enc="Camellia(256)"; break;
+                default: enc="Camellia(?""?""?)"; break;
+                        }
+                break;
+        case SSL_SEED:
+                enc="SEED(128)";
+                break;
+
         default:
                 enc="unknown";
                 break;
@@ -1098,35 +1296,63 @@ SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n)
         return(NULL);
         }
 
-static int sk_comp_cmp(const SSL_COMP * const *a,
-                        const SSL_COMP * const *b)
+#ifdef OPENSSL_NO_COMP
+void *SSL_COMP_get_compression_methods(void)
         {
-        return((*a)->id-(*b)->id);
+        return NULL;
+        }
+int SSL_COMP_add_compression_method(int id, void *cm)
+        {
+        return 1;
         }
 
+const char *SSL_COMP_get_name(const void *comp)
+        {
+        return NULL;
+        }
+#else
 STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void)
         {
+        load_builtin_compressions();
         return(ssl_comp_methods);
         }
 
 int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
         {
         SSL_COMP *comp;
-        STACK_OF(SSL_COMP) *sk;
 
         if (cm == NULL || cm->type == NID_undef)
                 return 1;
 
+        /* According to draft-ietf-tls-compression-04.txt, the
+           compression number ranges should be the following:
+
+           0 to 63:    methods defined by the IETF
+           64 to 192:  external party methods assigned by IANA
+           193 to 255: reserved for private use */
+        if (id < 193 || id > 255)
+                {
+                SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE);
+                return 0;
+                }
+
         MemCheck_off();
         comp=(SSL_COMP *)OPENSSL_malloc(sizeof(SSL_COMP));
         comp->id=id;
         comp->method=cm;
-        if (ssl_comp_methods == NULL)
-                sk=ssl_comp_methods=sk_SSL_COMP_new(sk_comp_cmp);
-        else
-                sk=ssl_comp_methods;
-        if ((sk == NULL) || !sk_SSL_COMP_push(sk,comp))
+        load_builtin_compressions();
+        if (ssl_comp_methods
+                && !sk_SSL_COMP_find(ssl_comp_methods,comp))
                 {
+                OPENSSL_free(comp);
+                MemCheck_on();
+                SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,SSL_R_DUPLICATE_COMPRESSION_ID);
+                return(1);
+                }
+        else if ((ssl_comp_methods == NULL)
+                || !sk_SSL_COMP_push(ssl_comp_methods,comp))
+                {
+                OPENSSL_free(comp);
                 MemCheck_on();
                 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE);
                 return(1);
@@ -1137,3 +1363,12 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
                 return(0);
                 }
         }
+
+const char *SSL_COMP_get_name(const COMP_METHOD *comp)
+        {
+        if (comp)
+                return comp->name;
+        return NULL;
+        }
+
+#endif
diff --git a/src/lib/libssl/ssl_err.c b/src/lib/libssl/ssl_err.c
index 4bcf591298..50779c1632 100644
--- a/src/lib/libssl/ssl_err.c
+++ b/src/lib/libssl/ssl_err.c
@@ -1,6 +1,6 @@
 /* ssl/ssl_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -75,7 +75,32 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_CLIENT_HELLO),  "CLIENT_HELLO"},
 {ERR_FUNC(SSL_F_CLIENT_MASTER_KEY),     "CLIENT_MASTER_KEY"},
 {ERR_FUNC(SSL_F_D2I_SSL_SESSION),       "d2i_SSL_SESSION"},
+{ERR_FUNC(SSL_F_DO_DTLS1_WRITE),        "DO_DTLS1_WRITE"},
 {ERR_FUNC(SSL_F_DO_SSL3_WRITE), "DO_SSL3_WRITE"},
+{ERR_FUNC(SSL_F_DTLS1_ACCEPT),  "DTLS1_ACCEPT"},
+{ERR_FUNC(SSL_F_DTLS1_BUFFER_RECORD),   "DTLS1_BUFFER_RECORD"},
+{ERR_FUNC(SSL_F_DTLS1_CLIENT_HELLO),    "DTLS1_CLIENT_HELLO"},
+{ERR_FUNC(SSL_F_DTLS1_CONNECT), "DTLS1_CONNECT"},
+{ERR_FUNC(SSL_F_DTLS1_ENC),     "DTLS1_ENC"},
+{ERR_FUNC(SSL_F_DTLS1_GET_HELLO_VERIFY),        "DTLS1_GET_HELLO_VERIFY"},
+{ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE),     "DTLS1_GET_MESSAGE"},
+{ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT),    "DTLS1_GET_MESSAGE_FRAGMENT"},
+{ERR_FUNC(SSL_F_DTLS1_GET_RECORD),      "DTLS1_GET_RECORD"},
+{ERR_FUNC(SSL_F_DTLS1_OUTPUT_CERT_CHAIN),       "DTLS1_OUTPUT_CERT_CHAIN"},
+{ERR_FUNC(SSL_F_DTLS1_PREPROCESS_FRAGMENT),     "DTLS1_PREPROCESS_FRAGMENT"},
+{ERR_FUNC(SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE),      "DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE"},
+{ERR_FUNC(SSL_F_DTLS1_PROCESS_RECORD),  "DTLS1_PROCESS_RECORD"},
+{ERR_FUNC(SSL_F_DTLS1_READ_BYTES),      "DTLS1_READ_BYTES"},
+{ERR_FUNC(SSL_F_DTLS1_READ_FAILED),     "DTLS1_READ_FAILED"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_CERTIFICATE_REQUEST),        "DTLS1_SEND_CERTIFICATE_REQUEST"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE), "DTLS1_SEND_CLIENT_CERTIFICATE"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE),        "DTLS1_SEND_CLIENT_KEY_EXCHANGE"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_CLIENT_VERIFY),      "DTLS1_SEND_CLIENT_VERIFY"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST),       "DTLS1_SEND_HELLO_VERIFY_REQUEST"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_CERTIFICATE), "DTLS1_SEND_SERVER_CERTIFICATE"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_HELLO),       "DTLS1_SEND_SERVER_HELLO"},
+{ERR_FUNC(SSL_F_DTLS1_SEND_SERVER_KEY_EXCHANGE),        "DTLS1_SEND_SERVER_KEY_EXCHANGE"},
+{ERR_FUNC(SSL_F_DTLS1_WRITE_APP_DATA_BYTES),    "DTLS1_WRITE_APP_DATA_BYTES"},
 {ERR_FUNC(SSL_F_GET_CLIENT_FINISHED),   "GET_CLIENT_FINISHED"},
 {ERR_FUNC(SSL_F_GET_CLIENT_HELLO),      "GET_CLIENT_HELLO"},
 {ERR_FUNC(SSL_F_GET_CLIENT_MASTER_KEY), "GET_CLIENT_MASTER_KEY"},
@@ -116,6 +141,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL3_ENC),      "SSL3_ENC"},
 {ERR_FUNC(SSL_F_SSL3_GENERATE_KEY_BLOCK),       "SSL3_GENERATE_KEY_BLOCK"},
 {ERR_FUNC(SSL_F_SSL3_GET_CERTIFICATE_REQUEST),  "SSL3_GET_CERTIFICATE_REQUEST"},
+{ERR_FUNC(SSL_F_SSL3_GET_CERT_STATUS),  "SSL3_GET_CERT_STATUS"},
 {ERR_FUNC(SSL_F_SSL3_GET_CERT_VERIFY),  "SSL3_GET_CERT_VERIFY"},
 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_CERTIFICATE),   "SSL3_GET_CLIENT_CERTIFICATE"},
 {ERR_FUNC(SSL_F_SSL3_GET_CLIENT_HELLO), "SSL3_GET_CLIENT_HELLO"},
@@ -123,10 +149,12 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL3_GET_FINISHED),     "SSL3_GET_FINISHED"},
 {ERR_FUNC(SSL_F_SSL3_GET_KEY_EXCHANGE), "SSL3_GET_KEY_EXCHANGE"},
 {ERR_FUNC(SSL_F_SSL3_GET_MESSAGE),      "SSL3_GET_MESSAGE"},
+{ERR_FUNC(SSL_F_SSL3_GET_NEW_SESSION_TICKET),   "SSL3_GET_NEW_SESSION_TICKET"},
 {ERR_FUNC(SSL_F_SSL3_GET_RECORD),       "SSL3_GET_RECORD"},
 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_CERTIFICATE),   "SSL3_GET_SERVER_CERTIFICATE"},
 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_DONE),  "SSL3_GET_SERVER_DONE"},
 {ERR_FUNC(SSL_F_SSL3_GET_SERVER_HELLO), "SSL3_GET_SERVER_HELLO"},
+{ERR_FUNC(SSL_F_SSL3_NEW_SESSION_TICKET),       "SSL3_NEW_SESSION_TICKET"},
 {ERR_FUNC(SSL_F_SSL3_OUTPUT_CERT_CHAIN),        "SSL3_OUTPUT_CERT_CHAIN"},
 {ERR_FUNC(SSL_F_SSL3_PEEK),     "SSL3_PEEK"},
 {ERR_FUNC(SSL_F_SSL3_READ_BYTES),       "SSL3_READ_BYTES"},
@@ -142,8 +170,10 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL3_SETUP_KEY_BLOCK),  "SSL3_SETUP_KEY_BLOCK"},
 {ERR_FUNC(SSL_F_SSL3_WRITE_BYTES),      "SSL3_WRITE_BYTES"},
 {ERR_FUNC(SSL_F_SSL3_WRITE_PENDING),    "SSL3_WRITE_PENDING"},
+{ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT),    "SSL_ADD_CLIENTHELLO_TLSEXT"},
 {ERR_FUNC(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK),    "SSL_add_dir_cert_subjects_to_stack"},
 {ERR_FUNC(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK),   "SSL_add_file_cert_subjects_to_stack"},
+{ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT),    "SSL_ADD_SERVERHELLO_TLSEXT"},
 {ERR_FUNC(SSL_F_SSL_BAD_METHOD),        "SSL_BAD_METHOD"},
 {ERR_FUNC(SSL_F_SSL_BYTES_TO_CIPHER_LIST),      "SSL_BYTES_TO_CIPHER_LIST"},
 {ERR_FUNC(SSL_F_SSL_CERT_DUP),  "SSL_CERT_DUP"},
@@ -151,6 +181,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL_CERT_INSTANTIATE),  "SSL_CERT_INSTANTIATE"},
 {ERR_FUNC(SSL_F_SSL_CERT_NEW),  "SSL_CERT_NEW"},
 {ERR_FUNC(SSL_F_SSL_CHECK_PRIVATE_KEY), "SSL_check_private_key"},
+{ERR_FUNC(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT),  "SSL_CHECK_SERVERHELLO_TLSEXT"},
 {ERR_FUNC(SSL_F_SSL_CIPHER_PROCESS_RULESTR),    "SSL_CIPHER_PROCESS_RULESTR"},
 {ERR_FUNC(SSL_F_SSL_CIPHER_STRENGTH_SORT),      "SSL_CIPHER_STRENGTH_SORT"},
 {ERR_FUNC(SSL_F_SSL_CLEAR),     "SSL_clear"},
@@ -182,6 +213,9 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL_INIT_WBIO_BUFFER),  "SSL_INIT_WBIO_BUFFER"},
 {ERR_FUNC(SSL_F_SSL_LOAD_CLIENT_CA_FILE),       "SSL_load_client_CA_file"},
 {ERR_FUNC(SSL_F_SSL_NEW),       "SSL_new"},
+{ERR_FUNC(SSL_F_SSL_PEEK),      "SSL_peek"},
+{ERR_FUNC(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT),        "SSL_PREPARE_CLIENTHELLO_TLSEXT"},
+{ERR_FUNC(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT),        "SSL_PREPARE_SERVERHELLO_TLSEXT"},
 {ERR_FUNC(SSL_F_SSL_READ),      "SSL_read"},
 {ERR_FUNC(SSL_F_SSL_RSA_PRIVATE_DECRYPT),       "SSL_RSA_PRIVATE_DECRYPT"},
 {ERR_FUNC(SSL_F_SSL_RSA_PUBLIC_ENCRYPT),        "SSL_RSA_PUBLIC_ENCRYPT"},
@@ -201,6 +235,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL_SHUTDOWN),  "SSL_shutdown"},
 {ERR_FUNC(SSL_F_SSL_UNDEFINED_CONST_FUNCTION),  "SSL_UNDEFINED_CONST_FUNCTION"},
 {ERR_FUNC(SSL_F_SSL_UNDEFINED_FUNCTION),        "SSL_UNDEFINED_FUNCTION"},
+{ERR_FUNC(SSL_F_SSL_UNDEFINED_VOID_FUNCTION),   "SSL_UNDEFINED_VOID_FUNCTION"},
 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE),   "SSL_use_certificate"},
 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_ASN1),      "SSL_use_certificate_ASN1"},
 {ERR_FUNC(SSL_F_SSL_USE_CERTIFICATE_FILE),      "SSL_use_certificate_file"},
@@ -234,6 +269,9 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_BAD_DH_P_LENGTH)       ,"bad dh p length"},
 {ERR_REASON(SSL_R_BAD_DIGEST_LENGTH)     ,"bad digest length"},
 {ERR_REASON(SSL_R_BAD_DSA_SIGNATURE)     ,"bad dsa signature"},
+{ERR_REASON(SSL_R_BAD_ECC_CERT)          ,"bad ecc cert"},
+{ERR_REASON(SSL_R_BAD_ECDSA_SIGNATURE)   ,"bad ecdsa signature"},
+{ERR_REASON(SSL_R_BAD_ECPOINT)           ,"bad ecpoint"},
 {ERR_REASON(SSL_R_BAD_HELLO_REQUEST)     ,"bad hello request"},
 {ERR_REASON(SSL_R_BAD_LENGTH)            ,"bad length"},
 {ERR_REASON(SSL_R_BAD_MAC_DECODE)        ,"bad mac decode"},
@@ -263,17 +301,22 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_CIPHER_CODE_WRONG_LENGTH),"cipher code wrong length"},
 {ERR_REASON(SSL_R_CIPHER_OR_HASH_UNAVAILABLE),"cipher or hash unavailable"},
 {ERR_REASON(SSL_R_CIPHER_TABLE_SRC_ERROR),"cipher table src error"},
+{ERR_REASON(SSL_R_CLIENTHELLO_TLSEXT)    ,"clienthello tlsext"},
 {ERR_REASON(SSL_R_COMPRESSED_LENGTH_TOO_LONG),"compressed length too long"},
 {ERR_REASON(SSL_R_COMPRESSION_FAILURE)   ,"compression failure"},
+{ERR_REASON(SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE),"compression id not within private range"},
 {ERR_REASON(SSL_R_COMPRESSION_LIBRARY_ERROR),"compression library error"},
 {ERR_REASON(SSL_R_CONNECTION_ID_IS_DIFFERENT),"connection id is different"},
 {ERR_REASON(SSL_R_CONNECTION_TYPE_NOT_SET),"connection type not set"},
+{ERR_REASON(SSL_R_COOKIE_MISMATCH)       ,"cookie mismatch"},
 {ERR_REASON(SSL_R_DATA_BETWEEN_CCS_AND_FINISHED),"data between ccs and finished"},
 {ERR_REASON(SSL_R_DATA_LENGTH_TOO_LONG)  ,"data length too long"},
 {ERR_REASON(SSL_R_DECRYPTION_FAILED)     ,"decryption failed"},
 {ERR_REASON(SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC),"decryption failed or bad record mac"},
 {ERR_REASON(SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG),"dh public value length is wrong"},
 {ERR_REASON(SSL_R_DIGEST_CHECK_FAILED)   ,"digest check failed"},
+{ERR_REASON(SSL_R_DUPLICATE_COMPRESSION_ID),"duplicate compression id"},
+{ERR_REASON(SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER),"ecgroup too large for cipher"},
 {ERR_REASON(SSL_R_ENCRYPTED_LENGTH_TOO_LONG),"encrypted length too long"},
 {ERR_REASON(SSL_R_ERROR_GENERATING_TMP_RSA_KEY),"error generating tmp rsa key"},
 {ERR_REASON(SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST),"error in received cipher list"},
@@ -286,6 +329,8 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH),"invalid challenge length"},
 {ERR_REASON(SSL_R_INVALID_COMMAND)       ,"invalid command"},
 {ERR_REASON(SSL_R_INVALID_PURPOSE)       ,"invalid purpose"},
+{ERR_REASON(SSL_R_INVALID_STATUS_RESPONSE),"invalid status response"},
+{ERR_REASON(SSL_R_INVALID_TICKET_KEYS_LENGTH),"invalid ticket keys length"},
 {ERR_REASON(SSL_R_INVALID_TRUST)         ,"invalid trust"},
 {ERR_REASON(SSL_R_KEY_ARG_TOO_LONG)      ,"key arg too long"},
 {ERR_REASON(SSL_R_KRB5)                  ,"krb5"},
@@ -314,6 +359,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_MISSING_RSA_ENCRYPTING_CERT),"missing rsa encrypting cert"},
 {ERR_REASON(SSL_R_MISSING_RSA_SIGNING_CERT),"missing rsa signing cert"},
 {ERR_REASON(SSL_R_MISSING_TMP_DH_KEY)    ,"missing tmp dh key"},
+{ERR_REASON(SSL_R_MISSING_TMP_ECDH_KEY)  ,"missing tmp ecdh key"},
 {ERR_REASON(SSL_R_MISSING_TMP_RSA_KEY)   ,"missing tmp rsa key"},
 {ERR_REASON(SSL_R_MISSING_TMP_RSA_PKEY)  ,"missing tmp rsa pkey"},
 {ERR_REASON(SSL_R_MISSING_VERIFY_MESSAGE),"missing verify message"},
@@ -342,6 +388,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED),"old session cipher not returned"},
 {ERR_REASON(SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE),"only tls allowed in fips mode"},
 {ERR_REASON(SSL_R_PACKET_LENGTH_TOO_LONG),"packet length too long"},
+{ERR_REASON(SSL_R_PARSE_TLSEXT)          ,"parse tlsext"},
 {ERR_REASON(SSL_R_PATH_TOO_LONG)         ,"path too long"},
 {ERR_REASON(SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE),"peer did not return a certificate"},
 {ERR_REASON(SSL_R_PEER_ERROR)            ,"peer error"},
@@ -356,6 +403,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_PUBLIC_KEY_IS_NOT_RSA) ,"public key is not rsa"},
 {ERR_REASON(SSL_R_PUBLIC_KEY_NOT_RSA)    ,"public key not rsa"},
 {ERR_REASON(SSL_R_READ_BIO_NOT_SET)      ,"read bio not set"},
+{ERR_REASON(SSL_R_READ_TIMEOUT_EXPIRED)  ,"read timeout expired"},
 {ERR_REASON(SSL_R_READ_WRONG_PACKET_TYPE),"read wrong packet type"},
 {ERR_REASON(SSL_R_RECORD_LENGTH_MISMATCH),"record length mismatch"},
 {ERR_REASON(SSL_R_RECORD_TOO_LARGE)      ,"record too large"},
@@ -364,11 +412,14 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_REUSE_CERT_LENGTH_NOT_ZERO),"reuse cert length not zero"},
 {ERR_REASON(SSL_R_REUSE_CERT_TYPE_NOT_ZERO),"reuse cert type not zero"},
 {ERR_REASON(SSL_R_REUSE_CIPHER_LIST_NOT_ZERO),"reuse cipher list not zero"},
+{ERR_REASON(SSL_R_SERVERHELLO_TLSEXT)    ,"serverhello tlsext"},
 {ERR_REASON(SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED),"session id context uninitialized"},
 {ERR_REASON(SSL_R_SHORT_READ)            ,"short read"},
 {ERR_REASON(SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE),"signature for non signing certificate"},
 {ERR_REASON(SSL_R_SSL23_DOING_SESSION_ID_REUSE),"ssl23 doing session id reuse"},
 {ERR_REASON(SSL_R_SSL2_CONNECTION_ID_TOO_LONG),"ssl2 connection id too long"},
+{ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME),"ssl3 ext invalid servername"},
+{ERR_REASON(SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE),"ssl3 ext invalid servername type"},
 {ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_LONG),"ssl3 session id too long"},
 {ERR_REASON(SSL_R_SSL3_SESSION_ID_TOO_SHORT),"ssl3 session id too short"},
 {ERR_REASON(SSL_R_SSLV3_ALERT_BAD_CERTIFICATE),"sslv3 alert bad certificate"},
@@ -403,12 +454,15 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_TLSV1_ALERT_UNKNOWN_CA),"tlsv1 alert unknown ca"},
 {ERR_REASON(SSL_R_TLSV1_ALERT_USER_CANCELLED),"tlsv1 alert user cancelled"},
 {ERR_REASON(SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER),"tls client cert req with anon cipher"},
+{ERR_REASON(SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST),"tls invalid ecpointformat list"},
 {ERR_REASON(SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST),"tls peer did not respond with certificate list"},
 {ERR_REASON(SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG),"tls rsa encrypted value length is wrong"},
 {ERR_REASON(SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER),"tried to use unsupported cipher"},
 {ERR_REASON(SSL_R_UNABLE_TO_DECODE_DH_CERTS),"unable to decode dh certs"},
+{ERR_REASON(SSL_R_UNABLE_TO_DECODE_ECDH_CERTS),"unable to decode ecdh certs"},
 {ERR_REASON(SSL_R_UNABLE_TO_EXTRACT_PUBLIC_KEY),"unable to extract public key"},
 {ERR_REASON(SSL_R_UNABLE_TO_FIND_DH_PARAMETERS),"unable to find dh parameters"},
+{ERR_REASON(SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS),"unable to find ecdh parameters"},
 {ERR_REASON(SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS),"unable to find public key parameters"},
 {ERR_REASON(SSL_R_UNABLE_TO_FIND_SSL_METHOD),"unable to find ssl method"},
 {ERR_REASON(SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES),"unable to load ssl2 md5 routines"},
@@ -429,8 +483,10 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_UNKNOWN_STATE)         ,"unknown state"},
 {ERR_REASON(SSL_R_UNSUPPORTED_CIPHER)    ,"unsupported cipher"},
 {ERR_REASON(SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM),"unsupported compression algorithm"},
+{ERR_REASON(SSL_R_UNSUPPORTED_ELLIPTIC_CURVE),"unsupported elliptic curve"},
 {ERR_REASON(SSL_R_UNSUPPORTED_PROTOCOL)  ,"unsupported protocol"},
 {ERR_REASON(SSL_R_UNSUPPORTED_SSL_VERSION),"unsupported ssl version"},
+{ERR_REASON(SSL_R_UNSUPPORTED_STATUS_TYPE),"unsupported status type"},
 {ERR_REASON(SSL_R_WRITE_BIO_NOT_SET)     ,"write bio not set"},
 {ERR_REASON(SSL_R_WRONG_CIPHER_RETURNED) ,"wrong cipher returned"},
 {ERR_REASON(SSL_R_WRONG_MESSAGE_TYPE)    ,"wrong message type"},
@@ -448,15 +504,12 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 
 void ERR_load_SSL_strings(void)
         {
-        static int init=1;
+#ifndef OPENSSL_NO_ERR
 
-        if (init)
+        if (ERR_func_error_string(SSL_str_functs[0].error) == NULL)
                 {
-                init=0;
-#ifndef OPENSSL_NO_ERR
                 ERR_load_strings(0,SSL_str_functs);
                 ERR_load_strings(0,SSL_str_reasons);
-#endif
-
                 }
+#endif
         }
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 0f4b7a475b..31f6318357 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -110,7 +110,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
-
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #ifdef REF_CHECK
 #  include <assert.h>
@@ -121,7 +125,11 @@
 #include <openssl/objects.h>
 #include <openssl/lhash.h>
 #include <openssl/x509v3.h>
-#include <openssl/fips.h>
+#include <openssl/rand.h>
+#include <openssl/ocsp.h>
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
 
 const char *SSL_version_str=OPENSSL_VERSION_TEXT;
 
@@ -132,7 +140,14 @@ SSL3_ENC_METHOD ssl3_undef_enc_method={
         ssl_undefined_function,
         (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function,
         (int (*)(SSL*, int))ssl_undefined_function,
-        (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function
+        (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function,
+        0,      /* finish_mac_length */
+        (int (*)(SSL *, EVP_MD_CTX *, unsigned char *))ssl_undefined_function,
+        NULL,   /* client_finished_label */
+        0,      /* client_finished_label_len */
+        NULL,   /* server_finished_label */
+        0,      /* server_finished_label_len */
+        (int (*)(int))ssl_undefined_function
         };
 
 int SSL_clear(SSL *s)
@@ -272,19 +287,40 @@ SSL *SSL_new(SSL_CTX *ctx)
         s->msg_callback=ctx->msg_callback;
         s->msg_callback_arg=ctx->msg_callback_arg;
         s->verify_mode=ctx->verify_mode;
+#if 0
         s->verify_depth=ctx->verify_depth;
+#endif
         s->sid_ctx_length=ctx->sid_ctx_length;
         OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);
         memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx));
         s->verify_callback=ctx->default_verify_callback;
         s->generate_session_id=ctx->generate_session_id;
+
+        s->param = X509_VERIFY_PARAM_new();
+        if (!s->param)
+                goto err;
+        X509_VERIFY_PARAM_inherit(s->param, ctx->param);
+#if 0
         s->purpose = ctx->purpose;
         s->trust = ctx->trust;
+#endif
         s->quiet_shutdown=ctx->quiet_shutdown;
 
         CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
         s->ctx=ctx;
-
+#ifndef OPENSSL_NO_TLSEXT
+        s->tlsext_debug_cb = 0;
+        s->tlsext_debug_arg = NULL;
+        s->tlsext_ticket_expected = 0;
+        s->tlsext_status_type = -1;
+        s->tlsext_status_expected = 0;
+        s->tlsext_ocsp_ids = NULL;
+        s->tlsext_ocsp_exts = NULL;
+        s->tlsext_ocsp_resp = NULL;
+        s->tlsext_ocsp_resplen = -1;
+        CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
+        s->initial_ctx=ctx;
+#endif
         s->verify_result=X509_V_OK;
 
         s->method=ctx->method;
@@ -393,22 +429,22 @@ int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
 
 int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
         {
-        return X509_PURPOSE_set(&s->purpose, purpose);
+        return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
         }
 
 int SSL_set_purpose(SSL *s, int purpose)
         {
-        return X509_PURPOSE_set(&s->purpose, purpose);
+        return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
         }
 
 int SSL_CTX_set_trust(SSL_CTX *s, int trust)
         {
-        return X509_TRUST_set(&s->trust, trust);
+        return X509_VERIFY_PARAM_set_trust(s->param, trust);
         }
 
 int SSL_set_trust(SSL *s, int trust)
         {
-        return X509_TRUST_set(&s->trust, trust);
+        return X509_VERIFY_PARAM_set_trust(s->param, trust);
         }
 
 void SSL_free(SSL *s)
@@ -431,6 +467,9 @@ void SSL_free(SSL *s)
                 }
 #endif
 
+        if (s->param)
+                X509_VERIFY_PARAM_free(s->param);
+
         CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
 
         if (s->bbio != NULL)
@@ -467,7 +506,16 @@ void SSL_free(SSL *s)
         /* Free up if allocated */
 
         if (s->ctx) SSL_CTX_free(s->ctx);
-
+#ifndef OPENSSL_NO_TLSEXT
+        if (s->initial_ctx) SSL_CTX_free(s->initial_ctx);
+        if (s->tlsext_ocsp_exts)
+                sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
+                                                X509_EXTENSION_free);
+        if (s->tlsext_ocsp_ids)
+                sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free);
+        if (s->tlsext_ocsp_resp)
+                OPENSSL_free(s->tlsext_ocsp_resp);
+#endif
         if (s->client_CA != NULL)
                 sk_X509_NAME_pop_free(s->client_CA,X509_NAME_free);
 
@@ -643,7 +691,7 @@ int SSL_get_verify_mode(const SSL *s)
 
 int SSL_get_verify_depth(const SSL *s)
         {
-        return(s->verify_depth);
+        return X509_VERIFY_PARAM_get_depth(s->param);
         }
 
 int (*SSL_get_verify_callback(const SSL *s))(int,X509_STORE_CTX *)
@@ -658,7 +706,7 @@ int SSL_CTX_get_verify_mode(const SSL_CTX *ctx)
 
 int SSL_CTX_get_verify_depth(const SSL_CTX *ctx)
         {
-        return(ctx->verify_depth);
+        return X509_VERIFY_PARAM_get_depth(ctx->param);
         }
 
 int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx))(int,X509_STORE_CTX *)
@@ -676,7 +724,7 @@ void SSL_set_verify(SSL *s,int mode,
 
 void SSL_set_verify_depth(SSL *s,int depth)
         {
-        s->verify_depth=depth;
+        X509_VERIFY_PARAM_set_depth(s->param, depth);
         }
 
 void SSL_set_read_ahead(SSL *s,int yes)
@@ -850,7 +898,7 @@ int SSL_peek(SSL *s,void *buf,int num)
         {
         if (s->handshake_func == 0)
                 {
-                SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED);
+                SSLerr(SSL_F_SSL_PEEK, SSL_R_UNINITIALIZED);
                 return -1;
                 }
 
@@ -941,12 +989,19 @@ long SSL_ctrl(SSL *s,int cmd,long larg,void *parg)
                 l=s->max_cert_list;
                 s->max_cert_list=larg;
                 return(l);
+        case SSL_CTRL_SET_MTU:
+                if (SSL_version(s) == DTLS1_VERSION)
+                        {
+                        s->d1->mtu = larg;
+                        return larg;
+                        }
+                return 0;
         default:
                 return(s->method->ssl_ctrl(s,cmd,larg,parg));
                 }
         }
 
-long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)())
+long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
         {
         switch(cmd)
                 {
@@ -1034,7 +1089,7 @@ long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,void *parg)
                 }
         }
 
-long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
+long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
         {
         switch(cmd)
                 {
@@ -1269,6 +1324,29 @@ err:
         return(NULL);
         }
 
+#ifndef OPENSSL_NO_TLSEXT
+/** return a servername extension value if provided in Client Hello, or NULL.
+ * So far, only host_name types are defined (RFC 3546).
+ */
+
+const char *SSL_get_servername(const SSL *s, const int type)
+        {
+        if (type != TLSEXT_NAMETYPE_host_name)
+                return NULL;
+
+        return s->session && !s->tlsext_hostname ?
+                s->session->tlsext_hostname :
+                s->tlsext_hostname;
+        }
+
+int SSL_get_servername_type(const SSL *s)
+        {
+        if (s->session && (!s->tlsext_hostname ? s->session->tlsext_hostname : s->tlsext_hostname))
+                return TLSEXT_NAMETYPE_host_name;
+        return -1;
+        }
+#endif
+
 unsigned long SSL_SESSION_hash(const SSL_SESSION *a)
         {
         unsigned long l;
@@ -1312,14 +1390,6 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
                 return(NULL);
                 }
 
-#ifdef OPENSSL_FIPS
-        if (FIPS_mode() && (meth->version < TLS1_VERSION))      
-                {
-                SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
-                return NULL;
-                }
-#endif
-
         if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0)
                 {
                 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
@@ -1368,7 +1438,9 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
         ret->msg_callback=0;
         ret->msg_callback_arg=NULL;
         ret->verify_mode=SSL_VERIFY_NONE;
+#if 0
         ret->verify_depth=-1; /* Don't impose a limit (but x509_lu.c does) */
+#endif
         ret->sid_ctx_length=0;
         ret->default_verify_callback=NULL;
         if ((ret->cert=ssl_cert_new()) == NULL)
@@ -1377,6 +1449,8 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
         ret->default_passwd_callback=0;
         ret->default_passwd_callback_userdata=NULL;
         ret->client_cert_cb=0;
+        ret->app_gen_cookie_cb=0;
+        ret->app_verify_cookie_cb=0;
 
         ret->sessions=lh_new(LHASH_HASH_FN(SSL_SESSION_hash),
                         LHASH_COMP_FN(SSL_SESSION_cmp));
@@ -1394,6 +1468,10 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
                 goto err2;
                 }
 
+        ret->param = X509_VERIFY_PARAM_new();
+        if (!ret->param)
+                goto err;
+
         if ((ret->rsa_md5=EVP_get_digestbyname("ssl2-md5")) == NULL)
                 {
                 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES);
@@ -1418,6 +1496,20 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
         ret->extra_certs=NULL;
         ret->comp_methods=SSL_COMP_get_compression_methods();
 
+#ifndef OPENSSL_NO_TLSEXT
+        ret->tlsext_servername_callback = 0;
+        ret->tlsext_servername_arg = NULL;
+        /* Setup RFC4507 ticket keys */
+        if ((RAND_pseudo_bytes(ret->tlsext_tick_key_name, 16) <= 0)
+                || (RAND_bytes(ret->tlsext_tick_hmac_key, 16) <= 0)
+                || (RAND_bytes(ret->tlsext_tick_aes_key, 16) <= 0))
+                ret->options |= SSL_OP_NO_TICKET;
+
+        ret->tlsext_status_cb = 0;
+        ret->tlsext_status_arg = NULL;
+
+#endif
+
         return(ret);
 err:
         SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);
@@ -1450,6 +1542,9 @@ void SSL_CTX_free(SSL_CTX *a)
                 }
 #endif
 
+        if (a->param)
+                X509_VERIFY_PARAM_free(a->param);
+
         /*
          * Free internal session cache. However: the remove_cb() may reference
          * the ex_data of SSL_CTX, thus the ex_data store can only be removed
@@ -1512,7 +1607,7 @@ void SSL_CTX_set_verify(SSL_CTX *ctx,int mode,int (*cb)(int, X509_STORE_CTX *))
 
 void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth)
         {
-        ctx->verify_depth=depth;
+        X509_VERIFY_PARAM_set_depth(ctx->param, depth);
         }
 
 void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
@@ -1522,6 +1617,13 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
         int rsa_enc_export,dh_rsa_export,dh_dsa_export;
         int rsa_tmp_export,dh_tmp_export,kl;
         unsigned long mask,emask;
+        int have_ecc_cert, ecdh_ok, ecdsa_ok, ecc_pkey_size;
+#ifndef OPENSSL_NO_ECDH
+        int have_ecdh_tmp;
+#endif
+        X509 *x = NULL;
+        EVP_PKEY *ecc_pkey = NULL;
+        int signature_nid = 0;
 
         if (c == NULL) return;
 
@@ -1542,6 +1644,9 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
         dh_tmp=dh_tmp_export=0;
 #endif
 
+#ifndef OPENSSL_NO_ECDH
+        have_ecdh_tmp=(c->ecdh_tmp != NULL || c->ecdh_tmp_cb != NULL);
+#endif
         cpk= &(c->pkeys[SSL_PKEY_RSA_ENC]);
         rsa_enc= (cpk->x509 != NULL && cpk->privatekey != NULL);
         rsa_enc_export=(rsa_enc && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
@@ -1556,7 +1661,8 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
 /* FIX THIS EAY EAY EAY */
         dh_dsa=  (cpk->x509 != NULL && cpk->privatekey != NULL);
         dh_dsa_export=(dh_dsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
-
+        cpk= &(c->pkeys[SSL_PKEY_ECC]);
+        have_ecc_cert= (cpk->x509 != NULL && cpk->privatekey != NULL);
         mask=0;
         emask=0;
 
@@ -1613,11 +1719,127 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
         emask|=SSL_kKRB5|SSL_aKRB5;
 #endif
 
+        /* An ECC certificate may be usable for ECDH and/or
+         * ECDSA cipher suites depending on the key usage extension.
+         */
+        if (have_ecc_cert)
+                {
+                /* This call populates extension flags (ex_flags) */
+                x = (c->pkeys[SSL_PKEY_ECC]).x509;
+                X509_check_purpose(x, -1, 0);
+                ecdh_ok = (x->ex_flags & EXFLAG_KUSAGE) ?
+                    (x->ex_kusage & X509v3_KU_KEY_AGREEMENT) : 1;
+                ecdsa_ok = (x->ex_flags & EXFLAG_KUSAGE) ?
+                    (x->ex_kusage & X509v3_KU_DIGITAL_SIGNATURE) : 1;
+                ecc_pkey = X509_get_pubkey(x);
+                ecc_pkey_size = (ecc_pkey != NULL) ? 
+                    EVP_PKEY_bits(ecc_pkey) : 0;
+                EVP_PKEY_free(ecc_pkey);
+                if ((x->sig_alg) && (x->sig_alg->algorithm))
+                        signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
+#ifndef OPENSSL_NO_ECDH
+                if (ecdh_ok)
+                        {
+                        if ((signature_nid == NID_md5WithRSAEncryption) ||
+                            (signature_nid == NID_md4WithRSAEncryption) ||
+                            (signature_nid == NID_md2WithRSAEncryption))
+                                {
+                                mask|=SSL_kECDH|SSL_aRSA;
+                                if (ecc_pkey_size <= 163)
+                                        emask|=SSL_kECDH|SSL_aRSA;
+                                }
+                        if (signature_nid == NID_ecdsa_with_SHA1)
+                                {
+                                mask|=SSL_kECDH|SSL_aECDSA;
+                                if (ecc_pkey_size <= 163)
+                                        emask|=SSL_kECDH|SSL_aECDSA;
+                                }
+                        }
+#endif
+#ifndef OPENSSL_NO_ECDSA
+                if (ecdsa_ok)
+                        {
+                        mask|=SSL_aECDSA;
+                        emask|=SSL_aECDSA;
+                        }
+#endif
+                }
+
+#ifndef OPENSSL_NO_ECDH
+        if (have_ecdh_tmp)
+                {
+                mask|=SSL_kECDHE;
+                emask|=SSL_kECDHE;
+                }
+#endif
         c->mask=mask;
         c->export_mask=emask;
         c->valid=1;
         }
 
+/* This handy macro borrowed from crypto/x509v3/v3_purp.c */
+#define ku_reject(x, usage) \
+        (((x)->ex_flags & EXFLAG_KUSAGE) && !((x)->ex_kusage & (usage)))
+
+int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs)
+        {
+        unsigned long alg = cs->algorithms;
+        EVP_PKEY *pkey = NULL;
+        int keysize = 0;
+        int signature_nid = 0;
+
+        if (SSL_C_IS_EXPORT(cs))
+                {
+                /* ECDH key length in export ciphers must be <= 163 bits */
+                pkey = X509_get_pubkey(x);
+                if (pkey == NULL) return 0;
+                keysize = EVP_PKEY_bits(pkey);
+                EVP_PKEY_free(pkey);
+                if (keysize > 163) return 0;
+                }
+
+        /* This call populates the ex_flags field correctly */
+        X509_check_purpose(x, -1, 0);
+        if ((x->sig_alg) && (x->sig_alg->algorithm))
+                signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
+        if (alg & SSL_kECDH) 
+                {
+                /* key usage, if present, must allow key agreement */
+                if (ku_reject(x, X509v3_KU_KEY_AGREEMENT))
+                        {
+                        return 0;
+                        }
+                if (alg & SSL_aECDSA) 
+                        {
+                        /* signature alg must be ECDSA */
+                        if (signature_nid != NID_ecdsa_with_SHA1)
+                                {
+                                return 0;
+                                }
+                        }
+                if (alg & SSL_aRSA)
+                        {
+                        /* signature alg must be RSA */
+                        if ((signature_nid != NID_md5WithRSAEncryption) &&
+                            (signature_nid != NID_md4WithRSAEncryption) &&
+                            (signature_nid != NID_md2WithRSAEncryption))
+                                {
+                                return 0;
+                                }
+                        }
+                } 
+        else if (alg & SSL_aECDSA)
+                {
+                /* key usage, if present, must allow signing */
+                if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE))
+                        {
+                        return 0;
+                        }
+                }
+
+        return 1;  /* all checks are ok */
+        }
+
 /* THIS NEEDS CLEANING UP */
 X509 *ssl_get_server_send_cert(SSL *s)
         {
@@ -1632,7 +1854,26 @@ X509 *ssl_get_server_send_cert(SSL *s)
         mask=is_export?c->export_mask:c->mask;
         kalg=alg&(SSL_MKEY_MASK|SSL_AUTH_MASK);
 
-        if      (kalg & SSL_kDHr)
+        if (kalg & SSL_kECDH)
+                {
+                /* we don't need to look at SSL_kECDHE 
+                 * since no certificate is needed for
+                 * anon ECDH and for authenticated
+                 * ECDHE, the check for the auth 
+                 * algorithm will set i correctly
+                 * NOTE: For ECDH-RSA, we need an ECC
+                 * not an RSA cert but for ECDHE-RSA
+                 * we need an RSA cert. Placing the
+                 * checks for SSL_kECDH before RSA
+                 * checks ensures the correct cert is chosen.
+                 */
+                i=SSL_PKEY_ECC;
+                }
+        else if (kalg & SSL_aECDSA)
+                {
+                i=SSL_PKEY_ECC;
+                }
+        else if (kalg & SSL_kDHr)
                 i=SSL_PKEY_DH_RSA;
         else if (kalg & SSL_kDHd)
                 i=SSL_PKEY_DH_DSA;
@@ -1656,6 +1897,7 @@ X509 *ssl_get_server_send_cert(SSL *s)
                 return(NULL);
                 }
         if (c->pkeys[i].x509 == NULL) return(NULL);
+
         return(c->pkeys[i].x509);
         }
 
@@ -1679,6 +1921,9 @@ EVP_PKEY *ssl_get_sign_pkey(SSL *s,SSL_CIPHER *cipher)
                 else
                         return(NULL);
                 }
+        else if ((alg & SSL_aECDSA) &&
+                 (c->pkeys[SSL_PKEY_ECC].privatekey != NULL))
+                return(c->pkeys[SSL_PKEY_ECC].privatekey);
         else /* if (alg & SSL_aNULL) */
                 {
                 SSLerr(SSL_F_SSL_GET_SIGN_PKEY,ERR_R_INTERNAL_ERROR);
@@ -1884,6 +2129,12 @@ int ssl_undefined_function(SSL *s)
         return(0);
         }
 
+int ssl_undefined_void_function(void)
+        {
+        SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+        return(0);
+        }
+
 int ssl_undefined_const_function(const SSL *s)
         {
         SSLerr(SSL_F_SSL_UNDEFINED_CONST_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
@@ -1999,8 +2250,8 @@ SSL *SSL_dup(SSL *s)
         ret->rstate=s->rstate;
         ret->init_num = 0; /* would have to copy ret->init_buf, ret->init_msg, ret->init_num, ret->init_off */
         ret->hit=s->hit;
-        ret->purpose=s->purpose;
-        ret->trust=s->trust;
+
+        X509_VERIFY_PARAM_inherit(ret->param, s->param);
 
         /* dup the cipher_list and cipher_list_by_id stacks */
         if (s->cipher_list != NULL)
@@ -2052,6 +2303,7 @@ void ssl_clear_cipher_ctx(SSL *s)
                 OPENSSL_free(s->enc_write_ctx);
                 s->enc_write_ctx=NULL;
                 }
+#ifndef OPENSSL_NO_COMP
         if (s->expand != NULL)
                 {
                 COMP_CTX_free(s->expand);
@@ -2062,6 +2314,7 @@ void ssl_clear_cipher_ctx(SSL *s)
                 COMP_CTX_free(s->compress);
                 s->compress=NULL;
                 }
+#endif
         }
 
 /* Fix this function so that it takes an optional type parameter */
@@ -2088,6 +2341,31 @@ SSL_CIPHER *SSL_get_current_cipher(const SSL *s)
                 return(s->session->cipher);
         return(NULL);
         }
+#ifdef OPENSSL_NO_COMP
+const void *SSL_get_current_compression(SSL *s)
+        {
+        return NULL;
+        }
+const void *SSL_get_current_expansion(SSL *s)
+        {
+        return NULL;
+        }
+#else
+
+const COMP_METHOD *SSL_get_current_compression(SSL *s)
+        {
+        if (s->compress != NULL)
+                return(s->compress->meth);
+        return(NULL);
+        }
+
+const COMP_METHOD *SSL_get_current_expansion(SSL *s)
+        {
+        if (s->expand != NULL)
+                return(s->expand->meth);
+        return(NULL);
+        }
+#endif
 
 int ssl_init_wbio_buffer(SSL *s,int push)
         {
@@ -2181,6 +2459,24 @@ SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl)
         return(ssl->ctx);
         }
 
+SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx)
+        {
+        if (ssl->ctx == ctx)
+                return ssl->ctx;
+#ifndef OPENSSL_NO_TLSEXT
+        if (ctx == NULL)
+                ctx = ssl->initial_ctx;
+#endif
+        if (ssl->cert != NULL)
+                ssl_cert_free(ssl->cert);
+        ssl->cert = ssl_cert_dup(ctx->cert);
+        CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
+        if (ssl->ctx != NULL)
+                SSL_CTX_free(ssl->ctx); /* decrement reference count */
+        ssl->ctx = ctx;
+        return(ssl->ctx);
+        }
+
 #ifndef OPENSSL_NO_STDIO
 int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
         {
@@ -2190,19 +2486,19 @@ int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
 int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
                 const char *CApath)
         {
-        int r;
-        r=X509_STORE_load_locations(ctx->cert_store,CAfile,CApath);
-        return r;
+        return(X509_STORE_load_locations(ctx->cert_store,CAfile,CApath));
         }
 #endif
 
 void SSL_set_info_callback(SSL *ssl,
-                           void (*cb)(const SSL *ssl,int type,int val))
+        void (*cb)(const SSL *ssl,int type,int val))
         {
         ssl->info_callback=cb;
         }
 
-void (*SSL_get_info_callback(const SSL *ssl))(const SSL *ssl,int type,int val)
+/* One compiler (Diab DCC) doesn't like argument names in returned
+   function pointer.  */
+void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /*ssl*/,int /*type*/,int /*val*/) 
         {
         return ssl->info_callback;
         }
@@ -2289,14 +2585,14 @@ void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,RSA *(*cb)(SSL *ssl,
                                                           int is_export,
                                                           int keylength))
     {
-    SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb);
+    SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,(void (*)(void))cb);
     }
 
 void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,
                                                   int is_export,
                                                   int keylength))
     {
-    SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb);
+    SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,(void (*)(void))cb);
     }
 #endif
 
@@ -2325,24 +2621,38 @@ RSA *cb(SSL *ssl,int is_export,int keylength)
 void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export,
                                                         int keylength))
         {
-        SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh);
+        SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh);
         }
 
 void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export,
                                                 int keylength))
         {
-        SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh);
+        SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)(void))dh);
+        }
+#endif
+
+#ifndef OPENSSL_NO_ECDH
+void SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx,EC_KEY *(*ecdh)(SSL *ssl,int is_export,
+                                                        int keylength))
+        {
+        SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh);
+        }
+
+void SSL_set_tmp_ecdh_callback(SSL *ssl,EC_KEY *(*ecdh)(SSL *ssl,int is_export,
+                                                int keylength))
+        {
+        SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_ECDH_CB,(void (*)(void))ecdh);
         }
 #endif
 
 
 void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))
         {
-        SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)())cb);
+        SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
         }
 void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))
         {
-        SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)())cb);
+        SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
         }
 
 
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index 6a0b7595f4..de94c0d0c7 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -108,6 +108,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #ifndef HEADER_SSL_LOCL_H
 #define HEADER_SSL_LOCL_H
@@ -121,10 +126,13 @@
 #include <openssl/buffer.h>
 #include <openssl/comp.h>
 #include <openssl/bio.h>
-#include <openssl/crypto.h>
-#include <openssl/evp.h>
 #include <openssl/stack.h>
-#include <openssl/x509.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 #include <openssl/symhacks.h>
@@ -172,6 +180,20 @@
                          *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                          *((c)++)=(unsigned char)(((l)    )&0xff))
 
+#define l2n6(l,c)       (*((c)++)=(unsigned char)(((l)>>40)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>>32)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>>24)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
+                         *((c)++)=(unsigned char)(((l)    )&0xff))
+
+#define n2l6(c,l)       (l =((BN_ULLONG)(*((c)++)))<<40, \
+                         l|=((BN_ULLONG)(*((c)++)))<<32, \
+                         l|=((BN_ULLONG)(*((c)++)))<<24, \
+                         l|=((BN_ULLONG)(*((c)++)))<<16, \
+                         l|=((BN_ULLONG)(*((c)++)))<< 8, \
+                         l|=((BN_ULLONG)(*((c)++))))
+
 /* NOTE - c is not incremented as per l2c */
 #define l2cn(l1,l2,c,n) { \
                         c+=n; \
@@ -227,52 +249,58 @@
  * that the different entities within are mutually exclusive:
  * ONLY ONE BIT PER MASK CAN BE SET AT A TIME.
  */
-#define SSL_MKEY_MASK           0x0000003FL
+#define SSL_MKEY_MASK           0x000000FFL
 #define SSL_kRSA                0x00000001L /* RSA key exchange */
 #define SSL_kDHr                0x00000002L /* DH cert RSA CA cert */
 #define SSL_kDHd                0x00000004L /* DH cert DSA CA cert */
 #define SSL_kFZA                0x00000008L
 #define SSL_kEDH                0x00000010L /* tmp DH key no DH cert */
 #define SSL_kKRB5               0x00000020L /* Kerberos5 key exchange */
+#define SSL_kECDH               0x00000040L /* ECDH w/ long-term keys */
+#define SSL_kECDHE              0x00000080L /* ephemeral ECDH */
 #define SSL_EDH                 (SSL_kEDH|(SSL_AUTH_MASK^SSL_aNULL))
 
-#define SSL_AUTH_MASK           0x00000FC0L
-#define SSL_aRSA                0x00000040L /* Authenticate with RSA */
-#define SSL_aDSS                0x00000080L /* Authenticate with DSS */
+#define SSL_AUTH_MASK           0x00007F00L
+#define SSL_aRSA                0x00000100L /* Authenticate with RSA */
+#define SSL_aDSS                0x00000200L /* Authenticate with DSS */
 #define SSL_DSS                 SSL_aDSS
-#define SSL_aFZA                0x00000100L
-#define SSL_aNULL               0x00000200L /* no Authenticate, ADH */
-#define SSL_aDH                 0x00000400L /* no Authenticate, ADH */
-#define SSL_aKRB5               0x00000800L /* Authenticate with KRB5 */
+#define SSL_aFZA                0x00000400L
+#define SSL_aNULL               0x00000800L /* no Authenticate, ADH */
+#define SSL_aDH                 0x00001000L /* no Authenticate, ADH */
+#define SSL_aKRB5               0x00002000L /* Authenticate with KRB5 */
+#define SSL_aECDSA              0x00004000L /* Authenticate with ECDSA */
 
 #define SSL_NULL                (SSL_eNULL)
 #define SSL_ADH                 (SSL_kEDH|SSL_aNULL)
 #define SSL_RSA                 (SSL_kRSA|SSL_aRSA)
 #define SSL_DH                  (SSL_kDHr|SSL_kDHd|SSL_kEDH)
+#define SSL_ECDH                (SSL_kECDH|SSL_kECDHE)
 #define SSL_FZA                 (SSL_aFZA|SSL_kFZA|SSL_eFZA)
 #define SSL_KRB5                (SSL_kKRB5|SSL_aKRB5)
 
-#define SSL_ENC_MASK            0x0087F000L
-#define SSL_DES                 0x00001000L
-#define SSL_3DES                0x00002000L
-#define SSL_RC4                 0x00004000L
-#define SSL_RC2                 0x00008000L
-#define SSL_IDEA                0x00010000L
-#define SSL_eFZA                0x00020000L
-#define SSL_eNULL               0x00040000L
-#define SSL_AES                 0x00800000L
-
-#define SSL_MAC_MASK            0x00180000L
-#define SSL_MD5                 0x00080000L
-#define SSL_SHA1                0x00100000L
+#define SSL_ENC_MASK            0x1C3F8000L
+#define SSL_DES                 0x00008000L
+#define SSL_3DES                0x00010000L
+#define SSL_RC4                 0x00020000L
+#define SSL_RC2                 0x00040000L
+#define SSL_IDEA                0x00080000L
+#define SSL_eFZA                0x00100000L
+#define SSL_eNULL               0x00200000L
+#define SSL_AES                 0x04000000L
+#define SSL_CAMELLIA            0x08000000L
+#define SSL_SEED                0x10000000L
+
+#define SSL_MAC_MASK            0x00c00000L
+#define SSL_MD5                 0x00400000L
+#define SSL_SHA1                0x00800000L
 #define SSL_SHA                 (SSL_SHA1)
 
-#define SSL_SSL_MASK            0x00600000L
-#define SSL_SSLV2               0x00200000L
-#define SSL_SSLV3               0x00400000L
+#define SSL_SSL_MASK            0x03000000L
+#define SSL_SSLV2               0x01000000L
+#define SSL_SSLV3               0x02000000L
 #define SSL_TLSV1               SSL_SSLV3       /* for now */
 
-/* we have used 007fffff - 9 bits left to go */
+/* we have used 1fffffff - 3 bits left to go. */
 
 /*
  * Export and cipher strength information. For each cipher we have to decide
@@ -302,9 +330,8 @@
 #define SSL_LOW                 0x00000020L
 #define SSL_MEDIUM              0x00000040L
 #define SSL_HIGH                0x00000080L
-#define SSL_FIPS                0x00000100L
 
-/* we have used 000001ff - 23 bits left to go */
+/* we have used 000000ff - 24 bits left to go */
 
 /*
  * Macros to check the export status and cipher strength for export ciphers.
@@ -345,7 +372,8 @@
 #define SSL_PKEY_DSA_SIGN       2
 #define SSL_PKEY_DH_RSA         3
 #define SSL_PKEY_DH_DSA         4
-#define SSL_PKEY_NUM            5
+#define SSL_PKEY_ECC            5
+#define SSL_PKEY_NUM            6
 
 /* SSL_kRSA <- RSA_ENC | (RSA_TMP & RSA_SIGN) |
  *          <- (EXPORT & (RSA_ENC | RSA_TMP) & RSA_SIGN)
@@ -361,6 +389,15 @@
 #define CERT_PRIVATE_KEY        2
 */
 
+#ifndef OPENSSL_NO_EC
+/* From ECC-TLS draft, used in encoding the curve type in 
+ * ECParameters
+ */
+#define EXPLICIT_PRIME_CURVE_TYPE  1   
+#define EXPLICIT_CHAR2_CURVE_TYPE  2
+#define NAMED_CURVE_TYPE           3
+#endif  /* OPENSSL_NO_EC */
+
 typedef struct cert_pkey_st
         {
         X509 *x509;
@@ -387,6 +424,11 @@ typedef struct cert_st
         DH *dh_tmp;
         DH *(*dh_tmp_cb)(SSL *ssl,int is_export,int keysize);
 #endif
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *ecdh_tmp;
+        /* Callback for generating ephemeral ECDH keys */
+        EC_KEY *(*ecdh_tmp_cb)(SSL *ssl,int is_export,int keysize);
+#endif
 
         CERT_PKEY pkeys[SSL_PKEY_NUM];
 
@@ -412,6 +454,9 @@ typedef struct sess_cert_st
 #ifndef OPENSSL_NO_DH
         DH *peer_dh_tmp; /* not used for SSL 2 */
 #endif
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *peer_ecdh_tmp;
+#endif
 
         int references; /* actually always 1 at the moment */
         } SESS_CERT;
@@ -466,17 +511,201 @@ extern SSL3_ENC_METHOD ssl3_undef_enc_method;
 OPENSSL_EXTERN SSL_CIPHER ssl2_ciphers[];
 OPENSSL_EXTERN SSL_CIPHER ssl3_ciphers[];
 
-#ifdef OPENSSL_SYS_VMS
-#undef SSL_COMP_get_compression_methods
-#define SSL_COMP_get_compression_methods        SSL_COMP_get_compress_methods
-#endif
-
 
 SSL_METHOD *ssl_bad_method(int ver);
 SSL_METHOD *sslv2_base_method(void);
 SSL_METHOD *sslv23_base_method(void);
 SSL_METHOD *sslv3_base_method(void);
 
+extern SSL3_ENC_METHOD TLSv1_enc_data;
+extern SSL3_ENC_METHOD SSLv3_enc_data;
+extern SSL3_ENC_METHOD DTLSv1_enc_data;
+
+#define IMPLEMENT_tls1_meth_func(func_name, s_accept, s_connect, s_get_meth) \
+SSL_METHOD *func_name(void)  \
+        { \
+        static SSL_METHOD func_name##_data= { \
+                TLS1_VERSION, \
+                tls1_new, \
+                tls1_clear, \
+                tls1_free, \
+                s_accept, \
+                s_connect, \
+                ssl3_read, \
+                ssl3_peek, \
+                ssl3_write, \
+                ssl3_shutdown, \
+                ssl3_renegotiate, \
+                ssl3_renegotiate_check, \
+                ssl3_get_message, \
+                ssl3_read_bytes, \
+                ssl3_write_bytes, \
+                ssl3_dispatch_alert, \
+                ssl3_ctrl, \
+                ssl3_ctx_ctrl, \
+                ssl3_get_cipher_by_char, \
+                ssl3_put_cipher_by_char, \
+                ssl3_pending, \
+                ssl3_num_ciphers, \
+                ssl3_get_cipher, \
+                s_get_meth, \
+                tls1_default_timeout, \
+                &TLSv1_enc_data, \
+                ssl_undefined_void_function, \
+                ssl3_callback_ctrl, \
+                ssl3_ctx_callback_ctrl, \
+        }; \
+        return &func_name##_data; \
+        }
+
+#define IMPLEMENT_ssl3_meth_func(func_name, s_accept, s_connect, s_get_meth) \
+SSL_METHOD *func_name(void)  \
+        { \
+        static SSL_METHOD func_name##_data= { \
+                SSL3_VERSION, \
+                ssl3_new, \
+                ssl3_clear, \
+                ssl3_free, \
+                s_accept, \
+                s_connect, \
+                ssl3_read, \
+                ssl3_peek, \
+                ssl3_write, \
+                ssl3_shutdown, \
+                ssl3_renegotiate, \
+                ssl3_renegotiate_check, \
+                ssl3_get_message, \
+                ssl3_read_bytes, \
+                ssl3_write_bytes, \
+                ssl3_dispatch_alert, \
+                ssl3_ctrl, \
+                ssl3_ctx_ctrl, \
+                ssl3_get_cipher_by_char, \
+                ssl3_put_cipher_by_char, \
+                ssl3_pending, \
+                ssl3_num_ciphers, \
+                ssl3_get_cipher, \
+                s_get_meth, \
+                ssl3_default_timeout, \
+                &SSLv3_enc_data, \
+                ssl_undefined_void_function, \
+                ssl3_callback_ctrl, \
+                ssl3_ctx_callback_ctrl, \
+        }; \
+        return &func_name##_data; \
+        }
+
+#define IMPLEMENT_ssl23_meth_func(func_name, s_accept, s_connect, s_get_meth) \
+SSL_METHOD *func_name(void)  \
+        { \
+        static SSL_METHOD func_name##_data= { \
+        TLS1_VERSION, \
+        tls1_new, \
+        tls1_clear, \
+        tls1_free, \
+        s_accept, \
+        s_connect, \
+        ssl23_read, \
+        ssl23_peek, \
+        ssl23_write, \
+        ssl_undefined_function, \
+        ssl_undefined_function, \
+        ssl_ok, \
+        ssl3_get_message, \
+        ssl3_read_bytes, \
+        ssl3_write_bytes, \
+        ssl3_dispatch_alert, \
+        ssl3_ctrl, \
+        ssl3_ctx_ctrl, \
+        ssl23_get_cipher_by_char, \
+        ssl23_put_cipher_by_char, \
+        ssl_undefined_const_function, \
+        ssl23_num_ciphers, \
+        ssl23_get_cipher, \
+        s_get_meth, \
+        ssl23_default_timeout, \
+        &ssl3_undef_enc_method, \
+        ssl_undefined_void_function, \
+        ssl3_callback_ctrl, \
+        ssl3_ctx_callback_ctrl, \
+        }; \
+        return &func_name##_data; \
+        }
+
+#define IMPLEMENT_ssl2_meth_func(func_name, s_accept, s_connect, s_get_meth) \
+SSL_METHOD *func_name(void)  \
+        { \
+        static SSL_METHOD func_name##_data= { \
+                SSL2_VERSION, \
+                ssl2_new,       /* local */ \
+                ssl2_clear,     /* local */ \
+                ssl2_free,      /* local */ \
+                s_accept, \
+                s_connect, \
+                ssl2_read, \
+                ssl2_peek, \
+                ssl2_write, \
+                ssl2_shutdown, \
+                ssl_ok, /* NULL - renegotiate */ \
+                ssl_ok, /* NULL - check renegotiate */ \
+                NULL, /* NULL - ssl_get_message */ \
+                NULL, /* NULL - ssl_get_record */ \
+                NULL, /* NULL - ssl_write_bytes */ \
+                NULL, /* NULL - dispatch_alert */ \
+                ssl2_ctrl,      /* local */ \
+                ssl2_ctx_ctrl,  /* local */ \
+                ssl2_get_cipher_by_char, \
+                ssl2_put_cipher_by_char, \
+                ssl2_pending, \
+                ssl2_num_ciphers, \
+                ssl2_get_cipher, \
+                s_get_meth, \
+                ssl2_default_timeout, \
+                &ssl3_undef_enc_method, \
+                ssl_undefined_void_function, \
+                ssl2_callback_ctrl,     /* local */ \
+                ssl2_ctx_callback_ctrl, /* local */ \
+        }; \
+        return &func_name##_data; \
+        }
+
+#define IMPLEMENT_dtls1_meth_func(func_name, s_accept, s_connect, s_get_meth) \
+SSL_METHOD *func_name(void)  \
+        { \
+        static SSL_METHOD func_name##_data= { \
+                DTLS1_VERSION, \
+                dtls1_new, \
+                dtls1_clear, \
+                dtls1_free, \
+                s_accept, \
+                s_connect, \
+                ssl3_read, \
+                ssl3_peek, \
+                ssl3_write, \
+                ssl3_shutdown, \
+                ssl3_renegotiate, \
+                ssl3_renegotiate_check, \
+                dtls1_get_message, \
+                dtls1_read_bytes, \
+                dtls1_write_app_data_bytes, \
+                dtls1_dispatch_alert, \
+                ssl3_ctrl, \
+                ssl3_ctx_ctrl, \
+                ssl3_get_cipher_by_char, \
+                ssl3_put_cipher_by_char, \
+                ssl3_pending, \
+                ssl3_num_ciphers, \
+                dtls1_get_cipher, \
+                s_get_meth, \
+                dtls1_default_timeout, \
+                &DTLSv1_enc_data, \
+                ssl_undefined_void_function, \
+                ssl3_callback_ctrl, \
+                ssl3_ctx_callback_ctrl, \
+        }; \
+        return &func_name##_data; \
+        }
+
 void ssl_clear_cipher_ctx(SSL *s);
 int ssl_clear_bad_session(SSL *s);
 CERT *ssl_cert_new(void);
@@ -487,7 +716,7 @@ SESS_CERT *ssl_sess_cert_new(void);
 void ssl_sess_cert_free(SESS_CERT *sc);
 int ssl_set_peer_cert_type(SESS_CERT *c, int type);
 int ssl_get_new_session(SSL *s, int session);
-int ssl_get_prev_session(SSL *s, unsigned char *session,int len);
+int ssl_get_prev_session(SSL *s, unsigned char *session,int len, const unsigned char *limit);
 int ssl_cipher_id_cmp(const SSL_CIPHER *a,const SSL_CIPHER *b);
 int ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap,
                         const SSL_CIPHER * const *bp);
@@ -504,6 +733,7 @@ int ssl_cipher_get_evp(const SSL_SESSION *s,const EVP_CIPHER **enc,
                        const EVP_MD **md,SSL_COMP **comp);
 int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk);
 int ssl_undefined_function(SSL *s);
+int ssl_undefined_void_function(void);
 int ssl_undefined_const_function(const SSL *s);
 X509 *ssl_get_server_send_cert(SSL *);
 EVP_PKEY *ssl_get_sign_pkey(SSL *,SSL_CIPHER *);
@@ -511,6 +741,7 @@ int ssl_cert_type(X509 *x,EVP_PKEY *pkey);
 void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher);
 STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
 int ssl_verify_alarm_type(long type);
+void ssl_load_ciphers(void);
 
 int ssl2_enc_init(SSL *s, int client);
 int ssl2_generate_key_material(SSL *s);
@@ -520,7 +751,7 @@ SSL_CIPHER *ssl2_get_cipher_by_char(const unsigned char *p);
 int ssl2_put_cipher_by_char(const SSL_CIPHER *c,unsigned char *p);
 int ssl2_part_read(SSL *s, unsigned long f, int i);
 int ssl2_do_write(SSL *s);
-int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data);
+int ssl2_set_certificate(SSL *s, int type, int len, const unsigned char *data);
 void ssl2_return_error(SSL *s,int reason);
 void ssl2_write_error(SSL *s);
 int ssl2_num_ciphers(void);
@@ -536,14 +767,17 @@ int	ssl2_shutdown(SSL *s);
 void    ssl2_clear(SSL *s);
 long    ssl2_ctrl(SSL *s,int cmd, long larg, void *parg);
 long    ssl2_ctx_ctrl(SSL_CTX *s,int cmd, long larg, void *parg);
-long    ssl2_callback_ctrl(SSL *s,int cmd, void (*fp)());
-long    ssl2_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)());
+long    ssl2_callback_ctrl(SSL *s,int cmd, void (*fp)(void));
+long    ssl2_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)(void));
 int     ssl2_pending(const SSL *s);
+long    ssl2_default_timeout(void );
 
 SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p);
 int ssl3_put_cipher_by_char(const SSL_CIPHER *c,unsigned char *p);
 void ssl3_init_finished_mac(SSL *s);
 int ssl3_send_server_certificate(SSL *s);
+int ssl3_send_newsession_ticket(SSL *s);
+int ssl3_send_cert_status(SSL *s);
 int ssl3_get_finished(SSL *s,int state_a,int state_b);
 int ssl3_setup_key_block(SSL *s);
 int ssl3_send_change_cipher_spec(SSL *s,int state_a,int state_b);
@@ -584,10 +818,94 @@ int	ssl3_shutdown(SSL *s);
 void    ssl3_clear(SSL *s);
 long    ssl3_ctrl(SSL *s,int cmd, long larg, void *parg);
 long    ssl3_ctx_ctrl(SSL_CTX *s,int cmd, long larg, void *parg);
-long    ssl3_callback_ctrl(SSL *s,int cmd, void (*fp)());
-long    ssl3_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)());
+long    ssl3_callback_ctrl(SSL *s,int cmd, void (*fp)(void));
+long    ssl3_ctx_callback_ctrl(SSL_CTX *s,int cmd, void (*fp)(void));
 int     ssl3_pending(const SSL *s);
 
+void ssl3_record_sequence_update(unsigned char *seq);
+int ssl3_do_change_cipher_spec(SSL *ssl);
+long ssl3_default_timeout(void );
+
+int ssl23_num_ciphers(void );
+SSL_CIPHER *ssl23_get_cipher(unsigned int u);
+int ssl23_read(SSL *s, void *buf, int len);
+int ssl23_peek(SSL *s, void *buf, int len);
+int ssl23_write(SSL *s, const void *buf, int len);
+int ssl23_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p);
+SSL_CIPHER *ssl23_get_cipher_by_char(const unsigned char *p);
+long ssl23_default_timeout(void );
+
+long tls1_default_timeout(void);
+int dtls1_do_write(SSL *s,int type);
+int ssl3_read_n(SSL *s, int n, int max, int extend);
+int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek);
+int ssl3_do_compress(SSL *ssl);
+int ssl3_do_uncompress(SSL *ssl);
+int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
+        unsigned int len);
+unsigned char *dtls1_set_message_header(SSL *s, 
+        unsigned char *p, unsigned char mt,     unsigned long len, 
+        unsigned long frag_off, unsigned long frag_len);
+
+int dtls1_write_app_data_bytes(SSL *s, int type, const void *buf, int len);
+int dtls1_write_bytes(SSL *s, int type, const void *buf, int len);
+
+int dtls1_send_change_cipher_spec(SSL *s, int a, int b);
+int dtls1_send_finished(SSL *s, int a, int b, const char *sender, int slen);
+unsigned long dtls1_output_cert_chain(SSL *s, X509 *x);
+int dtls1_read_failed(SSL *s, int code);
+int dtls1_buffer_message(SSL *s, int ccs);
+int dtls1_retransmit_message(SSL *s, unsigned short seq, 
+        unsigned long frag_off, int *found);
+void dtls1_clear_record_buffer(SSL *s);
+void dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr);
+void dtls1_get_ccs_header(unsigned char *data, struct ccs_header_st *ccs_hdr);
+void dtls1_reset_seq_numbers(SSL *s, int rw);
+long dtls1_default_timeout(void);
+SSL_CIPHER *dtls1_get_cipher(unsigned int u);
+
+
+
+/* some client-only functions */
+int ssl3_client_hello(SSL *s);
+int ssl3_get_server_hello(SSL *s);
+int ssl3_get_certificate_request(SSL *s);
+int ssl3_get_new_session_ticket(SSL *s);
+int ssl3_get_cert_status(SSL *s);
+int ssl3_get_server_done(SSL *s);
+int ssl3_send_client_verify(SSL *s);
+int ssl3_send_client_certificate(SSL *s);
+int ssl3_send_client_key_exchange(SSL *s);
+int ssl3_get_key_exchange(SSL *s);
+int ssl3_get_server_certificate(SSL *s);
+int ssl3_check_cert_and_algorithm(SSL *s);
+
+int dtls1_client_hello(SSL *s);
+int dtls1_send_client_certificate(SSL *s);
+int dtls1_send_client_key_exchange(SSL *s);
+int dtls1_send_client_verify(SSL *s);
+
+/* some server-only functions */
+int ssl3_get_client_hello(SSL *s);
+int ssl3_send_server_hello(SSL *s);
+int ssl3_send_hello_request(SSL *s);
+int ssl3_send_server_key_exchange(SSL *s);
+int ssl3_send_certificate_request(SSL *s);
+int ssl3_send_server_done(SSL *s);
+int ssl3_check_client_hello(SSL *s);
+int ssl3_get_client_certificate(SSL *s);
+int ssl3_get_client_key_exchange(SSL *s);
+int ssl3_get_cert_verify(SSL *s);
+
+int dtls1_send_hello_request(SSL *s);
+int dtls1_send_server_hello(SSL *s);
+int dtls1_send_server_certificate(SSL *s);
+int dtls1_send_server_key_exchange(SSL *s);
+int dtls1_send_certificate_request(SSL *s);
+int dtls1_send_server_done(SSL *s);
+
+
+
 int ssl23_accept(SSL *s);
 int ssl23_connect(SSL *s);
 int ssl23_read_bytes(SSL *s, int n);
@@ -597,9 +915,24 @@ int tls1_new(SSL *s);
 void tls1_free(SSL *s);
 void tls1_clear(SSL *s);
 long tls1_ctrl(SSL *s,int cmd, long larg, void *parg);
-long tls1_callback_ctrl(SSL *s,int cmd, void (*fp)());
+long tls1_callback_ctrl(SSL *s,int cmd, void (*fp)(void));
 SSL_METHOD *tlsv1_base_method(void );
 
+int dtls1_new(SSL *s);
+int     dtls1_accept(SSL *s);
+int     dtls1_connect(SSL *s);
+void dtls1_free(SSL *s);
+void dtls1_clear(SSL *s);
+long dtls1_ctrl(SSL *s,int cmd, long larg, void *parg);
+SSL_METHOD *dtlsv1_base_method(void );
+
+long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok);
+int dtls1_get_record(SSL *s);
+int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
+        unsigned int len, int create_empty_fragement);
+int dtls1_dispatch_alert(SSL *s);
+int dtls1_enc(SSL *s, int snd);
+
 int ssl_init_wbio_buffer(SSL *s, int push);
 void ssl_free_wbio_buffer(SSL *s);
 
@@ -616,8 +949,28 @@ int tls1_alert_code(int code);
 int ssl3_alert_code(int code);
 int ssl_ok(SSL *s);
 
+int check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs);
+
 SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n);
-STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void);
 
+#ifndef OPENSSL_NO_TLSEXT
+unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit); 
+unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit); 
+int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **data, unsigned char *d, int n, int *al);
+int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **data, unsigned char *d, int n, int *al);
+int ssl_prepare_clienthello_tlsext(SSL *s);
+int ssl_prepare_serverhello_tlsext(SSL *s);
+int ssl_check_clienthello_tlsext(SSL *s);
+int ssl_check_serverhello_tlsext(SSL *s);
+#ifdef OPENSSL_NO_SHA256
+#define tlsext_tick_md  EVP_sha1
+#else
+#define tlsext_tick_md  EVP_sha256
+#endif
+int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
+                                const unsigned char *limit, SSL_SESSION **ret);
+EVP_MD_CTX* ssl_replace_hash(EVP_MD_CTX **hash,const EVP_MD *md) ;
+void ssl_clear_hash_ctx(EVP_MD_CTX **hash);
+#endif
 
 #endif
diff --git a/src/lib/libssl/ssl_rsa.c b/src/lib/libssl/ssl_rsa.c
index fb0bd4d045..27113eba50 100644
--- a/src/lib/libssl/ssl_rsa.c
+++ b/src/lib/libssl/ssl_rsa.c
@@ -131,7 +131,7 @@ end:
         }
 #endif
 
-int SSL_use_certificate_ASN1(SSL *ssl, unsigned char *d, int len)
+int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len)
         {
         X509 *x;
         int ret;
@@ -181,7 +181,7 @@ int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa)
 
 static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
         {
-        int i,ok=0,bad=0;
+        int i;
 
         i=ssl_cert_type(NULL,pkey);
         if (i < 0)
@@ -202,47 +202,18 @@ static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
                 /* Don't check the public/private key, this is mostly
                  * for smart cards. */
                 if ((pkey->type == EVP_PKEY_RSA) &&
-                        (RSA_flags(pkey->pkey.rsa) &
-                         RSA_METHOD_FLAG_NO_CHECK))
-                         ok=1;
+                        (RSA_flags(pkey->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK))
+                        ;
                 else
 #endif
-                     if (!X509_check_private_key(c->pkeys[i].x509,pkey))
+                if (!X509_check_private_key(c->pkeys[i].x509,pkey))
                         {
-                        if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA))
-                                {
-                                i=(i == SSL_PKEY_DH_RSA)?
-                                        SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA;
-
-                                if (c->pkeys[i].x509 == NULL)
-                                        ok=1;
-                                else
-                                        {
-                                        if (!X509_check_private_key(
-                                                c->pkeys[i].x509,pkey))
-                                                bad=1;
-                                        else
-                                                ok=1;
-                                        }
-                                }
-                        else
-                                bad=1;
+                        X509_free(c->pkeys[i].x509);
+                        c->pkeys[i].x509 = NULL;
+                        return 0;
                         }
-                else
-                        ok=1;
-                }
-        else
-                ok=1;
-
-        if (bad)
-                {
-                X509_free(c->pkeys[i].x509);
-                c->pkeys[i].x509=NULL;
-                return(0);
                 }
 
-        ERR_clear_error(); /* make sure no error from X509_check_private_key()
-                            * is left if we have chosen to ignore it */
         if (c->pkeys[i].privatekey != NULL)
                 EVP_PKEY_free(c->pkeys[i].privatekey);
         CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
@@ -364,6 +335,11 @@ int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type)
                 pkey=PEM_read_bio_PrivateKey(in,NULL,
                         ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
                 }
+        else if (type == SSL_FILETYPE_ASN1)
+                {
+                j = ERR_R_ASN1_LIB;
+                pkey = d2i_PrivateKey_bio(in,NULL);
+                }
         else
                 {
                 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
@@ -382,10 +358,10 @@ end:
         }
 #endif
 
-int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, unsigned char *d, long len)
+int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, long len)
         {
         int ret;
-        unsigned char *p;
+        const unsigned char *p;
         EVP_PKEY *pkey;
 
         p=d;
@@ -418,7 +394,7 @@ int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x)
 static int ssl_set_cert(CERT *c, X509 *x)
         {
         EVP_PKEY *pkey;
-        int i,ok=0,bad=0;
+        int i;
 
         pkey=X509_get_pubkey(x);
         if (pkey == NULL)
@@ -446,44 +422,23 @@ static int ssl_set_cert(CERT *c, X509 *x)
                 if ((c->pkeys[i].privatekey->type == EVP_PKEY_RSA) &&
                         (RSA_flags(c->pkeys[i].privatekey->pkey.rsa) &
                          RSA_METHOD_FLAG_NO_CHECK))
-                         ok=1;
+                         ;
                 else
-#endif
-                {
+#endif /* OPENSSL_NO_RSA */
                 if (!X509_check_private_key(x,c->pkeys[i].privatekey))
                         {
-                        if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA))
-                                {
-                                i=(i == SSL_PKEY_DH_RSA)?
-                                        SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA;
-
-                                if (c->pkeys[i].privatekey == NULL)
-                                        ok=1;
-                                else
-                                        {
-                                        if (!X509_check_private_key(x,
-                                                c->pkeys[i].privatekey))
-                                                bad=1;
-                                        else
-                                                ok=1;
-                                        }
-                                }
-                        else
-                                bad=1;
+                        /* don't fail for a cert/key mismatch, just free
+                         * current private key (when switching to a different
+                         * cert & key, first this function should be used,
+                         * then ssl_set_pkey */
+                        EVP_PKEY_free(c->pkeys[i].privatekey);
+                        c->pkeys[i].privatekey=NULL;
+                        /* clear error queue */
+                        ERR_clear_error();
                         }
-                else
-                        ok=1;
-                } /* OPENSSL_NO_RSA */
                 }
-        else
-                ok=1;
 
         EVP_PKEY_free(pkey);
-        if (bad)
-                {
-                EVP_PKEY_free(c->pkeys[i].privatekey);
-                c->pkeys[i].privatekey=NULL;
-                }
 
         if (c->pkeys[i].x509 != NULL)
                 X509_free(c->pkeys[i].x509);
@@ -545,7 +500,7 @@ end:
         }
 #endif
 
-int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, unsigned char *d)
+int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d)
         {
         X509 *x;
         int ret;
@@ -640,7 +595,7 @@ end:
         }
 #endif
 
-int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, unsigned char *d, long len)
+int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len)
         {
         int ret;
         const unsigned char *p;
@@ -699,6 +654,11 @@ int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type)
                 pkey=PEM_read_bio_PrivateKey(in,NULL,
                         ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
                 }
+        else if (type == SSL_FILETYPE_ASN1)
+                {
+                j = ERR_R_ASN1_LIB;
+                pkey = d2i_PrivateKey_bio(in,NULL);
+                }
         else
                 {
                 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
@@ -717,11 +677,11 @@ end:
         }
 #endif
 
-int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, unsigned char *d,
+int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const unsigned char *d,
              long len)
         {
         int ret;
-        unsigned char *p;
+        const unsigned char *p;
         EVP_PKEY *pkey;
 
         p=d;
@@ -748,6 +708,8 @@ int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
         int ret=0;
         X509 *x=NULL;
 
+        ERR_clear_error(); /* clear error stack for SSL_CTX_use_certificate() */
+
         in=BIO_new(BIO_s_file_internal());
         if (in == NULL)
                 {
diff --git a/src/lib/libssl/ssl_sess.c b/src/lib/libssl/ssl_sess.c
index 2ba8b9612e..ee88be2b88 100644
--- a/src/lib/libssl/ssl_sess.c
+++ b/src/lib/libssl/ssl_sess.c
@@ -122,10 +122,20 @@ SSL_SESSION *SSL_SESSION_new(void)
         ss->prev=NULL;
         ss->next=NULL;
         ss->compress_meth=0;
+#ifndef OPENSSL_NO_TLSEXT
+        ss->tlsext_hostname = NULL; 
+#endif
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data);
         return(ss);
         }
 
+const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s, unsigned int *len)
+        {
+        if(len)
+                *len = s->session_id_length;
+        return s->session_id;
+        }
+
 /* Even with SSLv2, we have 16 bytes (128 bits) of session ID space. SSLv3/TLSv1
  * has 32 bytes (256 bits). As such, filling the ID with random gunk repeatedly
  * until we have no conflict is going to complete in one iteration pretty much
@@ -141,7 +151,7 @@ static int def_generate_session_id(const SSL *ssl, unsigned char *id,
 {
         unsigned int retry = 0;
         do
-                if(RAND_pseudo_bytes(id, *id_len) <= 0)
+                if (RAND_pseudo_bytes(id, *id_len) <= 0)
                         return 0;
         while(SSL_has_matching_session_id(ssl, id, *id_len) &&
                 (++retry < MAX_SESS_ID_ATTEMPTS));
@@ -198,12 +208,25 @@ int ssl_get_new_session(SSL *s, int session)
                         ss->ssl_version=TLS1_VERSION;
                         ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
                         }
+                else if (s->version == DTLS1_VERSION)
+                        {
+                        ss->ssl_version=DTLS1_VERSION;
+                        ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
+                        }
                 else
                         {
                         SSLerr(SSL_F_SSL_GET_NEW_SESSION,SSL_R_UNSUPPORTED_SSL_VERSION);
                         SSL_SESSION_free(ss);
                         return(0);
                         }
+#ifndef OPENSSL_NO_TLSEXT
+                /* If RFC4507 ticket use empty session ID */
+                if (s->tlsext_ticket_expected)
+                        {
+                        ss->session_id_length = 0;
+                        goto sess_id_done;
+                        }
+#endif
                 /* Choose which callback will set the session ID */
                 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
                 if(s->generate_session_id)
@@ -245,6 +268,17 @@ int ssl_get_new_session(SSL *s, int session)
                         SSL_SESSION_free(ss);
                         return(0);
                         }
+#ifndef OPENSSL_NO_TLSEXT
+                sess_id_done:
+                if (s->tlsext_hostname) {
+                        ss->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
+                        if (ss->tlsext_hostname == NULL) {
+                                SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR);
+                                SSL_SESSION_free(ss);
+                                return 0;
+                                }
+                        }
+#endif
                 }
         else
                 {
@@ -266,21 +300,41 @@ int ssl_get_new_session(SSL *s, int session)
         return(1);
         }
 
-int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
+int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
+                        const unsigned char *limit)
         {
         /* This is used only by servers. */
 
-        SSL_SESSION *ret=NULL,data;
+        SSL_SESSION *ret=NULL;
         int fatal = 0;
-
-        data.ssl_version=s->version;
-        data.session_id_length=len;
+#ifndef OPENSSL_NO_TLSEXT
+        int r;
+#endif
+  
         if (len > SSL_MAX_SSL_SESSION_ID_LENGTH)
                 goto err;
-        memcpy(data.session_id,session_id,len);
-
+#ifndef OPENSSL_NO_TLSEXT
+        r = tls1_process_ticket(s, session_id, len, limit, &ret);
+        if (r == -1)
+                {
+                fatal = 1;
+                goto err;
+                }
+        else if (r == 0 || (!ret && !len))
+                goto err;
+        else if (!ret && !(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
+#else
+        if (len == 0)
+                goto err;
         if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
+#endif
                 {
+                SSL_SESSION data;
+                data.ssl_version=s->version;
+                data.session_id_length=len;
+                if (len == 0)
+                        return 0;
+                memcpy(data.session_id,session_id,len);
                 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
                 ret=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,&data);
                 if (ret != NULL)
@@ -322,33 +376,35 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
 
         /* Now ret is non-NULL, and we own one of its reference counts. */
 
-        if((s->verify_mode&SSL_VERIFY_PEER)
-           && (!s->sid_ctx_length || ret->sid_ctx_length != s->sid_ctx_length
-               || memcmp(ret->sid_ctx,s->sid_ctx,ret->sid_ctx_length)))
-            {
+        if (ret->sid_ctx_length != s->sid_ctx_length
+            || memcmp(ret->sid_ctx,s->sid_ctx,ret->sid_ctx_length))
+                {
                 /* We've found the session named by the client, but we don't
                  * want to use it in this context. */
-                
-                if (s->sid_ctx_length == 0)
-                        {
-                        /* application should have used SSL[_CTX]_set_session_id_context
-                         * -- we could tolerate this and just pretend we never heard
-                         * of this session, but then applications could effectively
-                         * disable the session cache by accident without anyone noticing */
 
-                        SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED);
-                        fatal = 1;
-                        goto err;
-                        }
-                else
-                        {
 #if 0 /* The client cannot always know when a session is not appropriate,
-           * so we shouldn't generate an error message. */
+       * so we shouldn't generate an error message. */
 
-                        SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
+                SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
 #endif
-                        goto err; /* treat like cache miss */
-                        }
+                goto err; /* treat like cache miss */
+                }
+        
+        if((s->verify_mode & SSL_VERIFY_PEER) && s->sid_ctx_length == 0)
+                {
+                /* We can't be sure if this session is being used out of
+                 * context, which is especially important for SSL_VERIFY_PEER.
+                 * The application should have used SSL[_CTX]_set_session_id_context.
+                 *
+                 * For this error case, we generate an error instead of treating
+                 * the event like a cache miss (otherwise it would be easy for
+                 * applications to effectively disable the session cache by
+                 * accident without anyone noticing).
+                 */
+                
+                SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED);
+                fatal = 1;
+                goto err;
                 }
 
         if (ret->cipher == NULL)
@@ -534,6 +590,10 @@ void SSL_SESSION_free(SSL_SESSION *ss)
         if (ss->sess_cert != NULL) ssl_sess_cert_free(ss->sess_cert);
         if (ss->peer != NULL) X509_free(ss->peer);
         if (ss->ciphers != NULL) sk_SSL_CIPHER_free(ss->ciphers);
+#ifndef OPENSSL_NO_TLSEXT
+        if (ss->tlsext_hostname != NULL) OPENSSL_free(ss->tlsext_hostname);
+        if (ss->tlsext_tick != NULL) OPENSSL_free(ss->tlsext_tick);
+#endif
         OPENSSL_cleanse(ss,sizeof(*ss));
         OPENSSL_free(ss);
         }
@@ -568,7 +628,7 @@ int SSL_set_session(SSL *s, SSL_SESSION *session)
                 if (s->kssl_ctx && !s->kssl_ctx->client_princ &&
                     session->krb5_client_princ_len > 0)
                 {
-                    s->kssl_ctx->client_princ = (char *)malloc(session->krb5_client_princ_len + 1);
+                    s->kssl_ctx->client_princ = (char *)OPENSSL_malloc(session->krb5_client_princ_len + 1);
                     memcpy(s->kssl_ctx->client_princ,session->krb5_client_princ,
                             session->krb5_client_princ_len);
                     s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0';
@@ -753,3 +813,72 @@ static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s)
                 }
         }
 
+void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx,
+        int (*cb)(struct ssl_st *ssl,SSL_SESSION *sess))
+        {
+        ctx->new_session_cb=cb;
+        }
+
+int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(SSL *ssl, SSL_SESSION *sess)
+        {
+        return ctx->new_session_cb;
+        }
+
+void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx,
+        void (*cb)(SSL_CTX *ctx,SSL_SESSION *sess))
+        {
+        ctx->remove_session_cb=cb;
+        }
+
+void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(SSL_CTX * ctx,SSL_SESSION *sess)
+        {
+        return ctx->remove_session_cb;
+        }
+
+void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx,
+        SSL_SESSION *(*cb)(struct ssl_st *ssl,
+                 unsigned char *data,int len,int *copy))
+        {
+        ctx->get_session_cb=cb;
+        }
+
+SSL_SESSION * (*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(SSL *ssl,
+                 unsigned char *data,int len,int *copy)
+        {
+        return ctx->get_session_cb;
+        }
+
+void SSL_CTX_set_info_callback(SSL_CTX *ctx, 
+        void (*cb)(const SSL *ssl,int type,int val))
+        {
+        ctx->info_callback=cb;
+        }
+
+void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl,int type,int val)
+        {
+        return ctx->info_callback;
+        }
+
+void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx,
+        int (*cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey))
+        {
+        ctx->client_cert_cb=cb;
+        }
+
+int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL * ssl, X509 ** x509 , EVP_PKEY **pkey)
+        {
+        return ctx->client_cert_cb;
+        }
+
+void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx,
+        int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len))
+        {
+        ctx->app_gen_cookie_cb=cb;
+        }
+
+void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx,
+        int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len))
+        {
+        ctx->app_verify_cookie_cb=cb;
+        }
+
diff --git a/src/lib/libssl/ssl_stat.c b/src/lib/libssl/ssl_stat.c
index b16d253081..73b02509d4 100644
--- a/src/lib/libssl/ssl_stat.c
+++ b/src/lib/libssl/ssl_stat.c
@@ -127,6 +127,8 @@ case SSL3_ST_CR_KEY_EXCH_A:	str="SSLv3 read server key exchange A"; break;
 case SSL3_ST_CR_KEY_EXCH_B:     str="SSLv3 read server key exchange B"; break;
 case SSL3_ST_CR_CERT_REQ_A:     str="SSLv3 read server certificate request A"; break;
 case SSL3_ST_CR_CERT_REQ_B:     str="SSLv3 read server certificate request B"; break;
+case SSL3_ST_CR_SESSION_TICKET_A: str="SSLv3 read server session ticket A";break;
+case SSL3_ST_CR_SESSION_TICKET_B: str="SSLv3 read server session ticket B";break;
 case SSL3_ST_CR_SRVR_DONE_A:    str="SSLv3 read server done A"; break;
 case SSL3_ST_CR_SRVR_DONE_B:    str="SSLv3 read server done B"; break;
 case SSL3_ST_CW_CERT_A:         str="SSLv3 write client certificate A"; break;
@@ -172,6 +174,8 @@ case SSL3_ST_SW_KEY_EXCH_A:	str="SSLv3 write key exchange A"; break;
 case SSL3_ST_SW_KEY_EXCH_B:     str="SSLv3 write key exchange B"; break;
 case SSL3_ST_SW_CERT_REQ_A:     str="SSLv3 write certificate request A"; break;
 case SSL3_ST_SW_CERT_REQ_B:     str="SSLv3 write certificate request B"; break;
+case SSL3_ST_SW_SESSION_TICKET_A: str="SSLv3 write session ticket A"; break;
+case SSL3_ST_SW_SESSION_TICKET_B: str="SSLv3 write session ticket B"; break;
 case SSL3_ST_SW_SRVR_DONE_A:    str="SSLv3 write server done A"; break;
 case SSL3_ST_SW_SRVR_DONE_B:    str="SSLv3 write server done B"; break;
 case SSL3_ST_SR_CERT_A:         str="SSLv3 read client certificate A"; break;
diff --git a/src/lib/libssl/ssl_txt.c b/src/lib/libssl/ssl_txt.c
index 8655a31333..06b86750fd 100644
--- a/src/lib/libssl/ssl_txt.c
+++ b/src/lib/libssl/ssl_txt.c
@@ -81,7 +81,7 @@ int SSL_SESSION_print_fp(FILE *fp, const SSL_SESSION *x)
 int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
         {
         unsigned int i;
-        char *s;
+        const char *s;
 
         if (x == NULL) goto err;
         if (BIO_puts(bp,"SSL-Session:\n") <= 0) goto err;
@@ -151,9 +151,25 @@ int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
                         if (BIO_printf(bp,"%02X",x->krb5_client_princ[i]) <= 0) goto err;
                         }
 #endif /* OPENSSL_NO_KRB5 */
+#ifndef OPENSSL_NO_TLSEXT
+        if (x->tlsext_tick_lifetime_hint)
+                {
+                if (BIO_printf(bp,
+                        "\n    TLS session ticket lifetime hint: %ld (seconds)",
+                        x->tlsext_tick_lifetime_hint) <=0)
+                        goto err;
+                }
+        if (x->tlsext_tick)
+                {
+                if (BIO_puts(bp, "\n    TLS session ticket:\n") <= 0) goto err;
+                if (BIO_dump_indent(bp, (char *)x->tlsext_tick, x->tlsext_ticklen, 4) <= 0)
+                        goto err;
+                }
+#endif
+#ifndef OPENSSL_NO_COMP
         if (x->compress_meth != 0)
                 {
-                SSL_COMP *comp;
+                SSL_COMP *comp = NULL;
 
                 ssl_cipher_get_evp(x,NULL,NULL,&comp);
                 if (comp == NULL)
@@ -165,6 +181,7 @@ int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
                         if (BIO_printf(bp,"\n   Compression: %d (%s)", comp->id,comp->method->name) <= 0) goto err;
                         }
                 }       
+#endif
         if (x->time != 0L)
                 {
                 if (BIO_printf(bp, "\n    Start Time: %ld",x->time) <= 0) goto err;
diff --git a/src/lib/libssl/t1_clnt.c b/src/lib/libssl/t1_clnt.c
index 57205fb429..4d1e198cdc 100644
--- a/src/lib/libssl/t1_clnt.c
+++ b/src/lib/libssl/t1_clnt.c
@@ -72,26 +72,8 @@ static SSL_METHOD *tls1_get_client_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *TLSv1_client_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD TLSv1_client_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&TLSv1_client_data,(char *)tlsv1_base_method(),
-                                sizeof(SSL_METHOD));
-                        TLSv1_client_data.ssl_connect=ssl3_connect;
-                        TLSv1_client_data.get_ssl_method=tls1_get_client_method;
-                        init=0;
-                        }
-                
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&TLSv1_client_data);
-        }
+IMPLEMENT_tls1_meth_func(TLSv1_client_method,
+                        ssl_undefined_function,
+                        ssl3_connect,
+                        tls1_get_client_method)
 
diff --git a/src/lib/libssl/t1_enc.c b/src/lib/libssl/t1_enc.c
index 2c6246abf5..ed5a4a7255 100644
--- a/src/lib/libssl/t1_enc.c
+++ b/src/lib/libssl/t1_enc.c
@@ -115,7 +115,6 @@
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/md5.h>
-#include <openssl/fips.h>
 
 static void tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
                         int sec_len, unsigned char *seed, int seed_len,
@@ -132,8 +131,6 @@ static void tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
 
         HMAC_CTX_init(&ctx);
         HMAC_CTX_init(&ctx_tmp);
-        HMAC_CTX_set_flags(&ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-        HMAC_CTX_set_flags(&ctx_tmp, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
         HMAC_Init_ex(&ctx,sec,sec_len,md, NULL);
         HMAC_Init_ex(&ctx_tmp,sec,sec_len,md, NULL);
         HMAC_Update(&ctx,seed,seed_len);
@@ -180,6 +177,7 @@ static void tls1_PRF(const EVP_MD *md5, const EVP_MD *sha1,
         S2= &(sec[len]);
         len+=(slen&1); /* add for odd, make longer */
 
+        
         tls1_P_hash(md5 ,S1,len,label,label_len,out1,olen);
         tls1_P_hash(sha1,S2,len,label,label_len,out2,olen);
 
@@ -233,7 +231,9 @@ int tls1_change_cipher_state(SSL *s, int which)
         int client_write;
         EVP_CIPHER_CTX *dd;
         const EVP_CIPHER *c;
+#ifndef OPENSSL_NO_COMP
         const SSL_COMP *comp;
+#endif
         const EVP_MD *m;
         int is_export,n,i,j,k,exp_label_len,cl;
         int reuse_dd = 0;
@@ -241,7 +241,9 @@ int tls1_change_cipher_state(SSL *s, int which)
         is_export=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
         c=s->s3->tmp.new_sym_enc;
         m=s->s3->tmp.new_hash;
+#ifndef OPENSSL_NO_COMP
         comp=s->s3->tmp.new_compression;
+#endif
         key_block=s->s3->tmp.key_block;
 
 #ifdef KSSL_DEBUG
@@ -265,8 +267,12 @@ int tls1_change_cipher_state(SSL *s, int which)
                         reuse_dd = 1;
                 else if ((s->enc_read_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
                         goto err;
+                else
+                        /* make sure it's intialized in case we exit later with an error */
+                        EVP_CIPHER_CTX_init(s->enc_read_ctx);
                 dd= s->enc_read_ctx;
                 s->read_hash=m;
+#ifndef OPENSSL_NO_COMP
                 if (s->expand != NULL)
                         {
                         COMP_CTX_free(s->expand);
@@ -286,7 +292,10 @@ int tls1_change_cipher_state(SSL *s, int which)
                         if (s->s3->rrec.comp == NULL)
                                 goto err;
                         }
-                memset(&(s->s3->read_sequence[0]),0,8);
+#endif
+                /* this is done by dtls1_reset_seq_numbers for DTLS1_VERSION */
+                if (s->version != DTLS1_VERSION)
+                        memset(&(s->s3->read_sequence[0]),0,8);
                 mac_secret= &(s->s3->read_mac_secret[0]);
                 }
         else
@@ -295,12 +304,12 @@ int tls1_change_cipher_state(SSL *s, int which)
                         reuse_dd = 1;
                 else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
                         goto err;
-                if ((s->enc_write_ctx == NULL) &&
-                        ((s->enc_write_ctx=(EVP_CIPHER_CTX *)
-                        OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL))
-                        goto err;
+                else
+                        /* make sure it's intialized in case we exit later with an error */
+                        EVP_CIPHER_CTX_init(s->enc_write_ctx);
                 dd= s->enc_write_ctx;
                 s->write_hash=m;
+#ifndef OPENSSL_NO_COMP
                 if (s->compress != NULL)
                         {
                         COMP_CTX_free(s->compress);
@@ -315,13 +324,15 @@ int tls1_change_cipher_state(SSL *s, int which)
                                 goto err2;
                                 }
                         }
-                memset(&(s->s3->write_sequence[0]),0,8);
+#endif
+                /* this is done by dtls1_reset_seq_numbers for DTLS1_VERSION */
+                if (s->version != DTLS1_VERSION)
+                        memset(&(s->s3->write_sequence[0]),0,8);
                 mac_secret= &(s->s3->write_mac_secret[0]);
                 }
 
         if (reuse_dd)
                 EVP_CIPHER_CTX_cleanup(dd);
-        EVP_CIPHER_CTX_init(dd);
 
         p=s->s3->tmp.key_block;
         i=EVP_MD_size(m);
@@ -503,7 +514,7 @@ printf("\nkey block\n");
 #endif
                         }
                 }
-
+                
         return(1);
 err:
         SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE);
@@ -618,7 +629,15 @@ int tls1_enc(SSL *s, int send)
                         {
                         ii=i=rec->data[l-1]; /* padding_length */
                         i++;
-                        if (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
+                        /* NB: if compression is in operation the first packet
+                         * may not be of even length so the padding bug check
+                         * cannot be performed. This bug workaround has been
+                         * around since SSLeay so hopefully it is either fixed
+                         * now or no buggy implementation supports compression 
+                         * [steve]
+                         */
+                        if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
+                                && !s->expand)
                                 {
                                 /* First packet is even in size, so check */
                                 if ((memcmp(s->s3->read_sequence,
@@ -719,15 +738,35 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
         md_size=EVP_MD_size(hash);
 
         buf[0]=rec->type;
-        buf[1]=TLS1_VERSION_MAJOR;
-        buf[2]=TLS1_VERSION_MINOR;
+        if (ssl->version == DTLS1_VERSION && ssl->client_version == DTLS1_BAD_VER)
+                {
+                buf[1]=TLS1_VERSION_MAJOR;
+                buf[2]=TLS1_VERSION_MINOR;
+                }
+        else    {
+                buf[1]=(unsigned char)(ssl->version>>8);
+                buf[2]=(unsigned char)(ssl->version);
+                }
+
         buf[3]=rec->length>>8;
         buf[4]=rec->length&0xff;
 
         /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
         HMAC_CTX_init(&hmac);
         HMAC_Init_ex(&hmac,mac_sec,EVP_MD_size(hash),hash,NULL);
-        HMAC_Update(&hmac,seq,8);
+
+        if (ssl->version == DTLS1_VERSION && ssl->client_version != DTLS1_BAD_VER)
+                {
+                unsigned char dtlsseq[8],*p=dtlsseq;
+
+                s2n(send?ssl->d1->w_epoch:ssl->d1->r_epoch, p);
+                memcpy (p,&seq[2],6);
+
+                HMAC_Update(&hmac,dtlsseq,8);
+                }
+        else
+                HMAC_Update(&hmac,seq,8);
+
         HMAC_Update(&hmac,buf,5);
         HMAC_Update(&hmac,rec->input,rec->length);
         HMAC_Final(&hmac,md,&md_size);
@@ -744,10 +783,13 @@ printf("rec=");
 {unsigned int z; for (z=0; z<rec->length; z++) printf("%02X ",buf[z]); printf("\n"); }
 #endif
 
-        for (i=7; i>=0; i--)
+        if ( SSL_version(ssl) != DTLS1_VERSION)
                 {
-                ++seq[i];
-                if (seq[i] != 0) break; 
+                for (i=7; i>=0; i--)
+                        {
+                        ++seq[i];
+                        if (seq[i] != 0) break; 
+                        }
                 }
 
 #ifdef TLS_DEBUG
@@ -810,6 +852,8 @@ int tls1_alert_code(int code)
         case SSL_AD_INTERNAL_ERROR:     return(TLS1_AD_INTERNAL_ERROR);
         case SSL_AD_USER_CANCELLED:     return(TLS1_AD_USER_CANCELLED);
         case SSL_AD_NO_RENEGOTIATION:   return(TLS1_AD_NO_RENEGOTIATION);
+        case DTLS1_AD_MISSING_HANDSHAKE_MESSAGE: return 
+                                          (DTLS1_AD_MISSING_HANDSHAKE_MESSAGE);
         default:                        return(-1);
                 }
         }
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index ca6c03d5af..35f04afa4a 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -58,13 +58,20 @@
 
 #include <stdio.h>
 #include <openssl/objects.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/ocsp.h>
 #include "ssl_locl.h"
 
-const char *tls1_version_str="TLSv1" OPENSSL_VERSION_PTEXT;
+const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 
-static long tls1_default_timeout(void);
+#ifndef OPENSSL_NO_TLSEXT
+static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
+                                const unsigned char *sess_id, int sesslen,
+                                SSL_SESSION **psess);
+#endif
 
-static SSL3_ENC_METHOD TLSv1_enc_data={
+SSL3_ENC_METHOD TLSv1_enc_data={
         tls1_enc,
         tls1_mac,
         tls1_setup_key_block,
@@ -78,45 +85,17 @@ static SSL3_ENC_METHOD TLSv1_enc_data={
         tls1_alert_code,
         };
 
-static SSL_METHOD TLSv1_data= {
-        TLS1_VERSION,
-        tls1_new,
-        tls1_clear,
-        tls1_free,
-        ssl_undefined_function,
-        ssl_undefined_function,
-        ssl3_read,
-        ssl3_peek,
-        ssl3_write,
-        ssl3_shutdown,
-        ssl3_renegotiate,
-        ssl3_renegotiate_check,
-        ssl3_ctrl,
-        ssl3_ctx_ctrl,
-        ssl3_get_cipher_by_char,
-        ssl3_put_cipher_by_char,
-        ssl3_pending,
-        ssl3_num_ciphers,
-        ssl3_get_cipher,
-        ssl_bad_method,
-        tls1_default_timeout,
-        &TLSv1_enc_data,
-        ssl_undefined_function,
-        ssl3_callback_ctrl,
-        ssl3_ctx_callback_ctrl,
-        };
-
-static long tls1_default_timeout(void)
+long tls1_default_timeout(void)
         {
         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
          * is way too long for http, the cache would over fill */
         return(60*60*2);
         }
 
-SSL_METHOD *tlsv1_base_method(void)
-        {
-        return(&TLSv1_data);
-        }
+IMPLEMENT_tls1_meth_func(tlsv1_base_method,
+                        ssl_undefined_function,
+                        ssl_undefined_function,
+                        ssl_bad_method)
 
 int tls1_new(SSL *s)
         {
@@ -147,3 +126,751 @@ long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)())
         return(0);
         }
 #endif
+
+#ifndef OPENSSL_NO_TLSEXT
+unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
+        {
+        int extdatalen=0;
+        unsigned char *ret = p;
+
+        ret+=2;
+
+        if (ret>=limit) return NULL; /* this really never occurs, but ... */
+
+        if (s->tlsext_hostname != NULL)
+                { 
+                /* Add TLS extension servername to the Client Hello message */
+                unsigned long size_str;
+                long lenmax; 
+
+                /* check for enough space.
+                   4 for the servername type and entension length
+                   2 for servernamelist length
+                   1 for the hostname type
+                   2 for hostname length
+                   + hostname length 
+                */
+                   
+                if ((lenmax = limit - ret - 9) < 0 
+                || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax) 
+                        return NULL;
+                        
+                /* extension type and length */
+                s2n(TLSEXT_TYPE_server_name,ret); 
+                s2n(size_str+5,ret);
+                
+                /* length of servername list */
+                s2n(size_str+3,ret);
+        
+                /* hostname type, length and hostname */
+                *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
+                s2n(size_str,ret);
+                memcpy(ret, s->tlsext_hostname, size_str);
+                ret+=size_str;
+
+                }
+
+        if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
+                {
+                int ticklen;
+                if (s->session && s->session->tlsext_tick)
+                        ticklen = s->session->tlsext_ticklen;
+                else
+                        ticklen = 0;
+                /* Check for enough room 2 for extension type, 2 for len
+                 * rest for ticket
+                 */
+                if (limit - ret - 4 - ticklen < 0)
+                        return NULL;
+                s2n(TLSEXT_TYPE_session_ticket,ret); 
+                s2n(ticklen,ret);
+                if (ticklen)
+                        {
+                        memcpy(ret, s->session->tlsext_tick, ticklen);
+                        ret += ticklen;
+                        }
+                }
+
+        if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
+                {
+                int i;
+                long extlen, idlen, itmp;
+                OCSP_RESPID *id;
+
+                idlen = 0;
+                for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
+                        {
+                        id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
+                        itmp = i2d_OCSP_RESPID(id, NULL);
+                        if (itmp <= 0)
+                                return NULL;
+                        idlen += itmp + 2;
+                        }
+
+                if (s->tlsext_ocsp_exts)
+                        {
+                        extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
+                        if (extlen < 0)
+                                return NULL;
+                        }
+                else
+                        extlen = 0;
+                        
+                if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
+                s2n(TLSEXT_TYPE_status_request, ret);
+                if (extlen + idlen > 0xFFF0)
+                        return NULL;
+                s2n(extlen + idlen + 5, ret);
+                *(ret++) = TLSEXT_STATUSTYPE_ocsp;
+                s2n(idlen, ret);
+                for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
+                        {
+                        /* save position of id len */
+                        unsigned char *q = ret;
+                        id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
+                        /* skip over id len */
+                        ret += 2;
+                        itmp = i2d_OCSP_RESPID(id, &ret);
+                        /* write id len */
+                        s2n(itmp, q);
+                        }
+                s2n(extlen, ret);
+                if (extlen > 0)
+                        i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
+                }
+
+        if ((extdatalen = ret-p-2)== 0) 
+                return p;
+
+        s2n(extdatalen,p);
+        return ret;
+        }
+
+unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
+        {
+        int extdatalen=0;
+        unsigned char *ret = p;
+
+        ret+=2;
+        if (ret>=limit) return NULL; /* this really never occurs, but ... */
+
+        if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
+                { 
+                if (limit - ret - 4 < 0) return NULL; 
+
+                s2n(TLSEXT_TYPE_server_name,ret);
+                s2n(0,ret);
+                }
+        
+        if (s->tlsext_ticket_expected
+                && !(SSL_get_options(s) & SSL_OP_NO_TICKET)) 
+                { 
+                if (limit - ret - 4 < 0) return NULL; 
+                s2n(TLSEXT_TYPE_session_ticket,ret);
+                s2n(0,ret);
+                }
+
+        if (s->tlsext_status_expected)
+                { 
+                if ((long)(limit - ret - 4) < 0) return NULL; 
+                s2n(TLSEXT_TYPE_status_request,ret);
+                s2n(0,ret);
+                }
+
+        if ((extdatalen = ret-p-2)== 0) 
+                return p;
+
+        s2n(extdatalen,p);
+        return ret;
+        }
+
+int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
+        {
+        unsigned short type;
+        unsigned short size;
+        unsigned short len;
+        unsigned char *data = *p;
+        s->servername_done = 0;
+        s->tlsext_status_type = -1;
+
+        if (data >= (d+n-2))
+                return 1;
+        n2s(data,len);
+
+        if (data > (d+n-len)) 
+                return 1;
+
+        while (data <= (d+n-4))
+                {
+                n2s(data,type);
+                n2s(data,size);
+
+                if (data+size > (d+n))
+                        return 1;
+
+                if (s->tlsext_debug_cb)
+                        s->tlsext_debug_cb(s, 0, type, data, size,
+                                                s->tlsext_debug_arg);
+/* The servername extension is treated as follows:
+
+   - Only the hostname type is supported with a maximum length of 255.
+   - The servername is rejected if too long or if it contains zeros,
+     in which case an fatal alert is generated.
+   - The servername field is maintained together with the session cache.
+   - When a session is resumed, the servername call back invoked in order
+     to allow the application to position itself to the right context. 
+   - The servername is acknowledged if it is new for a session or when 
+     it is identical to a previously used for the same session. 
+     Applications can control the behaviour.  They can at any time
+     set a 'desirable' servername for a new SSL object. This can be the
+     case for example with HTTPS when a Host: header field is received and
+     a renegotiation is requested. In this case, a possible servername
+     presented in the new client hello is only acknowledged if it matches
+     the value of the Host: field. 
+   - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
+     if they provide for changing an explicit servername context for the session,
+     i.e. when the session has been established with a servername extension. 
+   - On session reconnect, the servername extension may be absent. 
+
+*/      
+
+                if (type == TLSEXT_TYPE_server_name)
+                        {
+                        unsigned char *sdata;
+                        int servname_type;
+                        int dsize; 
+                
+                        if (size < 2) 
+                                {
+                                *al = SSL_AD_DECODE_ERROR;
+                                return 0;
+                                }
+                        n2s(data,dsize);  
+                        size -= 2;
+                        if (dsize > size  ) 
+                                {
+                                *al = SSL_AD_DECODE_ERROR;
+                                return 0;
+                                } 
+
+                        sdata = data;
+                        while (dsize > 3) 
+                                {
+                                servname_type = *(sdata++); 
+                                n2s(sdata,len);
+                                dsize -= 3;
+
+                                if (len > dsize) 
+                                        {
+                                        *al = SSL_AD_DECODE_ERROR;
+                                        return 0;
+                                        }
+                                if (s->servername_done == 0)
+                                switch (servname_type)
+                                        {
+                                case TLSEXT_NAMETYPE_host_name:
+                                        if (s->session->tlsext_hostname == NULL)
+                                                {
+                                                if (len > TLSEXT_MAXLEN_host_name || 
+                                                        ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
+                                                        {
+                                                        *al = TLS1_AD_UNRECOGNIZED_NAME;
+                                                        return 0;
+                                                        }
+                                                memcpy(s->session->tlsext_hostname, sdata, len);
+                                                s->session->tlsext_hostname[len]='\0';
+                                                if (strlen(s->session->tlsext_hostname) != len) {
+                                                        OPENSSL_free(s->session->tlsext_hostname);
+                                                        s->session->tlsext_hostname = NULL;
+                                                        *al = TLS1_AD_UNRECOGNIZED_NAME;
+                                                        return 0;
+                                                }
+                                                s->servername_done = 1; 
+
+                                                }
+                                        else 
+                                                s->servername_done = strlen(s->session->tlsext_hostname) == len 
+                                                        && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
+                                        
+                                        break;
+
+                                default:
+                                        break;
+                                        }
+                                 
+                                dsize -= len;
+                                }
+                        if (dsize != 0) 
+                                {
+                                *al = SSL_AD_DECODE_ERROR;
+                                return 0;
+                                }
+
+                        }
+                else if (type == TLSEXT_TYPE_status_request
+                                                && s->ctx->tlsext_status_cb)
+                        {
+                
+                        if (size < 5) 
+                                {
+                                *al = SSL_AD_DECODE_ERROR;
+                                return 0;
+                                }
+
+                        s->tlsext_status_type = *data++;
+                        size--;
+                        if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
+                                {
+                                const unsigned char *sdata;
+                                int dsize;
+                                /* Read in responder_id_list */
+                                n2s(data,dsize);
+                                size -= 2;
+                                if (dsize > size  ) 
+                                        {
+                                        *al = SSL_AD_DECODE_ERROR;
+                                        return 0;
+                                        }
+                                while (dsize > 0)
+                                        {
+                                        OCSP_RESPID *id;
+                                        int idsize;
+                                        if (dsize < 4)
+                                                {
+                                                *al = SSL_AD_DECODE_ERROR;
+                                                return 0;
+                                                }
+                                        n2s(data, idsize);
+                                        dsize -= 2 + idsize;
+                                        if (dsize < 0)
+                                                {
+                                                *al = SSL_AD_DECODE_ERROR;
+                                                return 0;
+                                                }
+                                        sdata = data;
+                                        data += idsize;
+                                        id = d2i_OCSP_RESPID(NULL,
+                                                                &sdata, idsize);
+                                        if (!id)
+                                                {
+                                                *al = SSL_AD_DECODE_ERROR;
+                                                return 0;
+                                                }
+                                        if (data != sdata)
+                                                {
+                                                OCSP_RESPID_free(id);
+                                                *al = SSL_AD_DECODE_ERROR;
+                                                return 0;
+                                                }
+                                        if (!s->tlsext_ocsp_ids
+                                                && !(s->tlsext_ocsp_ids =
+                                                sk_OCSP_RESPID_new_null()))
+                                                {
+                                                OCSP_RESPID_free(id);
+                                                *al = SSL_AD_INTERNAL_ERROR;
+                                                return 0;
+                                                }
+                                        if (!sk_OCSP_RESPID_push(
+                                                        s->tlsext_ocsp_ids, id))
+                                                {
+                                                OCSP_RESPID_free(id);
+                                                *al = SSL_AD_INTERNAL_ERROR;
+                                                return 0;
+                                                }
+                                        }
+
+                                /* Read in request_extensions */
+                                n2s(data,dsize);
+                                size -= 2;
+                                if (dsize > size) 
+                                        {
+                                        *al = SSL_AD_DECODE_ERROR;
+                                        return 0;
+                                        }
+                                sdata = data;
+                                if (dsize > 0)
+                                        {
+                                        s->tlsext_ocsp_exts =
+                                                d2i_X509_EXTENSIONS(NULL,
+                                                        &sdata, dsize);
+                                        if (!s->tlsext_ocsp_exts
+                                                || (data + dsize != sdata))
+                                                {
+                                                *al = SSL_AD_DECODE_ERROR;
+                                                return 0;
+                                                }
+                                        }
+                                }
+                                /* We don't know what to do with any other type
+                                * so ignore it.
+                                */
+                                else
+                                        s->tlsext_status_type = -1;
+                        }
+                /* session ticket processed earlier */
+
+                data+=size;             
+                }
+
+        *p = data;
+        return 1;
+        }
+
+int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
+        {
+        unsigned short type;
+        unsigned short size;
+        unsigned short len;  
+        unsigned char *data = *p;
+
+        int tlsext_servername = 0;
+
+        if (data >= (d+n-2))
+                return 1;
+
+        n2s(data,len);
+
+        while(data <= (d+n-4))
+                {
+                n2s(data,type);
+                n2s(data,size);
+
+                if (data+size > (d+n))
+                        return 1;
+
+                if (s->tlsext_debug_cb)
+                        s->tlsext_debug_cb(s, 1, type, data, size,
+                                                s->tlsext_debug_arg);
+
+                if (type == TLSEXT_TYPE_server_name)
+                        {
+                        if (s->tlsext_hostname == NULL || size > 0)
+                                {
+                                *al = TLS1_AD_UNRECOGNIZED_NAME;
+                                return 0;
+                                }
+                        tlsext_servername = 1;   
+                        }
+                else if (type == TLSEXT_TYPE_session_ticket)
+                        {
+                        if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
+                                || (size > 0))
+                                {
+                                *al = TLS1_AD_UNSUPPORTED_EXTENSION;
+                                return 0;
+                                }
+                        s->tlsext_ticket_expected = 1;
+                        }
+                else if (type == TLSEXT_TYPE_status_request)
+                        {
+                        /* MUST be empty and only sent if we've requested
+                         * a status request message.
+                         */ 
+                        if ((s->tlsext_status_type == -1) || (size > 0))
+                                {
+                                *al = TLS1_AD_UNSUPPORTED_EXTENSION;
+                                return 0;
+                                }
+                        /* Set flag to expect CertificateStatus message */
+                        s->tlsext_status_expected = 1;
+                        }
+
+                data+=size;             
+                }
+
+        if (data != d+n)
+                {
+                *al = SSL_AD_DECODE_ERROR;
+                return 0;
+                }
+
+        if (!s->hit && tlsext_servername == 1)
+                {
+                if (s->tlsext_hostname)
+                        {
+                        if (s->session->tlsext_hostname == NULL)
+                                {
+                                s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);   
+                                if (!s->session->tlsext_hostname)
+                                        {
+                                        *al = SSL_AD_UNRECOGNIZED_NAME;
+                                        return 0;
+                                        }
+                                }
+                        else 
+                                {
+                                *al = SSL_AD_DECODE_ERROR;
+                                return 0;
+                                }
+                        }
+                }
+
+        *p = data;
+        return 1;
+        }
+
+int ssl_check_clienthello_tlsext(SSL *s)
+        {
+        int ret=SSL_TLSEXT_ERR_NOACK;
+        int al = SSL_AD_UNRECOGNIZED_NAME;
+
+        if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 
+                ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
+        else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)             
+                ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
+
+        /* If status request then ask callback what to do.
+         * Note: this must be called after servername callbacks in case 
+         * the certificate has changed.
+         */
+        if ((s->tlsext_status_type != -1) && s->ctx->tlsext_status_cb)
+                {
+                int r;
+                r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
+                switch (r)
+                        {
+                        /* We don't want to send a status request response */
+                        case SSL_TLSEXT_ERR_NOACK:
+                                s->tlsext_status_expected = 0;
+                                break;
+                        /* status request response should be sent */
+                        case SSL_TLSEXT_ERR_OK:
+                                if (s->tlsext_ocsp_resp)
+                                        s->tlsext_status_expected = 1;
+                                else
+                                        s->tlsext_status_expected = 0;
+                                break;
+                        /* something bad happened */
+                        case SSL_TLSEXT_ERR_ALERT_FATAL:
+                                ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+                                al = SSL_AD_INTERNAL_ERROR;
+                                goto err;
+                        }
+                }
+        else
+                s->tlsext_status_expected = 0;
+        err:
+        switch (ret)
+                {
+                case SSL_TLSEXT_ERR_ALERT_FATAL:
+                        ssl3_send_alert(s,SSL3_AL_FATAL,al); 
+                        return -1;
+
+                case SSL_TLSEXT_ERR_ALERT_WARNING:
+                        ssl3_send_alert(s,SSL3_AL_WARNING,al);
+                        return 1; 
+                                        
+                case SSL_TLSEXT_ERR_NOACK:
+                        s->servername_done=0;
+                        default:
+                return 1;
+                }
+        }
+
+int ssl_check_serverhello_tlsext(SSL *s)
+        {
+        int ret=SSL_TLSEXT_ERR_NOACK;
+        int al = SSL_AD_UNRECOGNIZED_NAME;
+
+        if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 
+                ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
+        else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)             
+                ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
+
+        /* If we've requested certificate status and we wont get one
+         * tell the callback
+         */
+        if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
+                        && s->ctx->tlsext_status_cb)
+                {
+                int r;
+                /* Set resp to NULL, resplen to -1 so callback knows
+                 * there is no response.
+                 */
+                if (s->tlsext_ocsp_resp)
+                        {
+                        OPENSSL_free(s->tlsext_ocsp_resp);
+                        s->tlsext_ocsp_resp = NULL;
+                        }
+                s->tlsext_ocsp_resplen = -1;
+                r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
+                if (r == 0)
+                        {
+                        al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
+                        ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+                        }
+                if (r < 0)
+                        {
+                        al = SSL_AD_INTERNAL_ERROR;
+                        ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+                        }
+                }
+
+        switch (ret)
+                {
+                case SSL_TLSEXT_ERR_ALERT_FATAL:
+                        ssl3_send_alert(s,SSL3_AL_FATAL,al); 
+                        return -1;
+
+                case SSL_TLSEXT_ERR_ALERT_WARNING:
+                        ssl3_send_alert(s,SSL3_AL_WARNING,al);
+                        return 1; 
+                                        
+                case SSL_TLSEXT_ERR_NOACK:
+                        s->servername_done=0;
+                        default:
+                return 1;
+                }
+        }
+
+/* Since the server cache lookup is done early on in the processing of client
+ * hello and other operations depend on the result we need to handle any TLS
+ * session ticket extension at the same time.
+ */
+
+int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
+                                const unsigned char *limit, SSL_SESSION **ret)
+        {
+        /* Point after session ID in client hello */
+        const unsigned char *p = session_id + len;
+        unsigned short i;
+        if ((s->version <= SSL3_VERSION) || !limit)
+                return 1;
+        if (p >= limit)
+                return -1;
+        /* Skip past cipher list */
+        n2s(p, i);
+        p+= i;
+        if (p >= limit)
+                return -1;
+        /* Skip past compression algorithm list */
+        i = *(p++);
+        p += i;
+        if (p > limit)
+                return -1;
+        /* Now at start of extensions */
+        if ((p + 2) >= limit)
+                return 1;
+        n2s(p, i);
+        while ((p + 4) <= limit)
+                {
+                unsigned short type, size;
+                n2s(p, type);
+                n2s(p, size);
+                if (p + size > limit)
+                        return 1;
+                if (type == TLSEXT_TYPE_session_ticket)
+                        {
+                        /* If tickets disabled indicate cache miss which will
+                         * trigger a full handshake
+                         */
+                        if (SSL_get_options(s) & SSL_OP_NO_TICKET)
+                                return 0;
+                        /* If zero length not client will accept a ticket
+                         * and indicate cache miss to trigger full handshake
+                         */
+                        if (size == 0)
+                                {
+                                s->tlsext_ticket_expected = 1;
+                                return 0;       /* Cache miss */
+                                }
+                        return tls_decrypt_ticket(s, p, size, session_id, len,
+                                                                        ret);
+                        }
+                p += size;
+                }
+        return 1;
+        }
+
+static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
+                                const unsigned char *sess_id, int sesslen,
+                                SSL_SESSION **psess)
+        {
+        SSL_SESSION *sess;
+        unsigned char *sdec;
+        const unsigned char *p;
+        int slen, mlen, renew_ticket = 0;
+        unsigned char tick_hmac[EVP_MAX_MD_SIZE];
+        HMAC_CTX hctx;
+        EVP_CIPHER_CTX ctx;
+        /* Need at least keyname + iv + some encrypted data */
+        if (eticklen < 48)
+                goto tickerr;
+        /* Initialize session ticket encryption and HMAC contexts */
+        HMAC_CTX_init(&hctx);
+        EVP_CIPHER_CTX_init(&ctx);
+        if (s->ctx->tlsext_ticket_key_cb)
+                {
+                unsigned char *nctick = (unsigned char *)etick;
+                int rv = s->ctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
+                                                        &ctx, &hctx, 0);
+                if (rv < 0)
+                        return -1;
+                if (rv == 0)
+                        goto tickerr;
+                if (rv == 2)
+                        renew_ticket = 1;
+                }
+        else
+                {
+                /* Check key name matches */
+                if (memcmp(etick, s->ctx->tlsext_tick_key_name, 16))
+                        goto tickerr;
+                HMAC_Init_ex(&hctx, s->ctx->tlsext_tick_hmac_key, 16,
+                                        tlsext_tick_md(), NULL);
+                EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
+                                s->ctx->tlsext_tick_aes_key, etick + 16);
+                }
+        /* Attempt to process session ticket, first conduct sanity and
+         * integrity checks on ticket.
+         */
+        mlen = HMAC_size(&hctx);
+        eticklen -= mlen;
+        /* Check HMAC of encrypted ticket */
+        HMAC_Update(&hctx, etick, eticklen);
+        HMAC_Final(&hctx, tick_hmac, NULL);
+        HMAC_CTX_cleanup(&hctx);
+        if (memcmp(tick_hmac, etick + eticklen, mlen))
+                goto tickerr;
+        /* Attempt to decrypt session data */
+        /* Move p after IV to start of encrypted ticket, update length */
+        p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
+        eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
+        sdec = OPENSSL_malloc(eticklen);
+        if (!sdec)
+                {
+                EVP_CIPHER_CTX_cleanup(&ctx);
+                return -1;
+                }
+        EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
+        if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
+                goto tickerr;
+        slen += mlen;
+        EVP_CIPHER_CTX_cleanup(&ctx);
+        p = sdec;
+                
+        sess = d2i_SSL_SESSION(NULL, &p, slen);
+        OPENSSL_free(sdec);
+        if (sess)
+                {
+                /* The session ID if non-empty is used by some clients to
+                 * detect that the ticket has been accepted. So we copy it to
+                 * the session structure. If it is empty set length to zero
+                 * as required by standard.
+                 */
+                if (sesslen)
+                        memcpy(sess->session_id, sess_id, sesslen);
+                sess->session_id_length = sesslen;
+                *psess = sess;
+                s->tlsext_ticket_expected = renew_ticket;
+                return 1;
+                }
+        /* If session decrypt failure indicate a cache miss and set state to
+         * send a new ticket
+         */
+        tickerr:        
+        s->tlsext_ticket_expected = 1;
+        return 0;
+        }
+
+#endif
diff --git a/src/lib/libssl/t1_meth.c b/src/lib/libssl/t1_meth.c
index fcc243f782..f5d8df634e 100644
--- a/src/lib/libssl/t1_meth.c
+++ b/src/lib/libssl/t1_meth.c
@@ -69,28 +69,8 @@ static SSL_METHOD *tls1_get_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *TLSv1_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD TLSv1_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-                
-                if (init)
-                        {
-                        memcpy((char *)&TLSv1_data,(char *)tlsv1_base_method(),
-                                sizeof(SSL_METHOD));
-                        TLSv1_data.ssl_connect=ssl3_connect;
-                        TLSv1_data.ssl_accept=ssl3_accept;
-                        TLSv1_data.get_ssl_method=tls1_get_method;
-                        init=0;
-                        }
-
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        
-        return(&TLSv1_data);
-        }
+IMPLEMENT_tls1_meth_func(TLSv1_method,
+                        ssl3_accept,
+                        ssl3_connect,
+                        tls1_get_method)
 
diff --git a/src/lib/libssl/t1_srvr.c b/src/lib/libssl/t1_srvr.c
index 1c1149e49f..b75636abba 100644
--- a/src/lib/libssl/t1_srvr.c
+++ b/src/lib/libssl/t1_srvr.c
@@ -73,26 +73,8 @@ static SSL_METHOD *tls1_get_server_method(int ver)
                 return(NULL);
         }
 
-SSL_METHOD *TLSv1_server_method(void)
-        {
-        static int init=1;
-        static SSL_METHOD TLSv1_server_data;
-
-        if (init)
-                {
-                CRYPTO_w_lock(CRYPTO_LOCK_SSL_METHOD);
-
-                if (init)
-                        {
-                        memcpy((char *)&TLSv1_server_data,(char *)tlsv1_base_method(),
-                                sizeof(SSL_METHOD));
-                        TLSv1_server_data.ssl_accept=ssl3_accept;
-                        TLSv1_server_data.get_ssl_method=tls1_get_server_method;
-                        init=0;
-                        }
-                        
-                CRYPTO_w_unlock(CRYPTO_LOCK_SSL_METHOD);
-                }
-        return(&TLSv1_server_data);
-        }
+IMPLEMENT_tls1_meth_func(TLSv1_server_method,
+                        ssl3_accept,
+                        ssl_undefined_function,
+                        tls1_get_server_method)
 
diff --git a/src/lib/libssl/test/bctest b/src/lib/libssl/test/bctest
index e81fc0733a..bdb3218f7a 100644
--- a/src/lib/libssl/test/bctest
+++ b/src/lib/libssl/test/bctest
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-# This script is used by test/Makefile to check whether a sane 'bc'
+# This script is used by test/Makefile.ssl to check whether a sane 'bc'
 # is installed.
 # ('make test_bn' should not try to run 'bc' if it does not exist or if
 # it is a broken 'bc' version that is known to cause trouble.)
diff --git a/src/lib/libssl/test/maketests.com b/src/lib/libssl/test/maketests.com
index 94621a655b..14cbf06088 100644
--- a/src/lib/libssl/test/maketests.com
+++ b/src/lib/libssl/test/maketests.com
@@ -127,9 +127,11 @@ $ GOSUB CHECK_OPT_FILE
 $!
 $! Define The TEST Files.
 $!
-$ TEST_FILES = "BNTEST,ECTEST,IDEATEST,MD2TEST,MD4TEST,MD5TEST,HMACTEST,"+ -
+$ TEST_FILES = "BNTEST,ECTEST,ECDSATEST,ECDHTEST,IDEATEST,"+ -
+               "MD2TEST,MD4TEST,MD5TEST,HMACTEST,"+ -
                "RC2TEST,RC4TEST,RC5TEST,"+ -
-               "DESTEST,SHATEST,SHA1TEST,MDC2TEST,RMDTEST,"+ -
+               "DESTEST,SHATEST,SHA1TEST,SHA256T,SHA512T,"+ -
+               "MDC2TEST,RMDTEST,"+ -
                "RANDTEST,DHTEST,ENGINETEST,"+ -
                "BFTEST,CASTTEST,SSLTEST,EXPTEST,DSATEST,RSA_TEST,"+ -
                "EVP_TEST"
diff --git a/src/lib/libssl/test/tcrl b/src/lib/libssl/test/tcrl
index 3ffed12a03..055269eab8 100644
--- a/src/lib/libssl/test/tcrl
+++ b/src/lib/libssl/test/tcrl
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 cmd='../util/shlib_wrap.sh ../apps/openssl crl'
 
 if [ "$1"x != "x" ]; then
diff --git a/src/lib/libssl/test/testca b/src/lib/libssl/test/testca
index 5b2faa78f1..b109cfe271 100644
--- a/src/lib/libssl/test/testca
+++ b/src/lib/libssl/test/testca
@@ -2,16 +2,16 @@
 
 SH="/bin/sh"
 if test "$OSTYPE" = msdosdjgpp; then
-    PATH=./apps\;../apps\;$PATH
+    PATH="../apps\;$PATH"
 else
-    PATH=../apps:$PATH
+    PATH="../apps:$PATH"
 fi
 export SH PATH
 
 SSLEAY_CONFIG="-config CAss.cnf"
 export SSLEAY_CONFIG
 
-OPENSSL="`pwd`/../util/shlib_wrap.sh openssl"
+OPENSSL="`pwd`/../util/opensslwrap.sh"
 export OPENSSL
 
 /bin/rm -fr demoCA
diff --git a/src/lib/libssl/test/testenc b/src/lib/libssl/test/testenc
index 4571ea2875..f5ce7c0c45 100644
--- a/src/lib/libssl/test/testenc
+++ b/src/lib/libssl/test/testenc
@@ -7,8 +7,8 @@ cmd="../util/shlib_wrap.sh ../apps/openssl"
 cat $testsrc >$test;
 
 echo cat
-$cmd enc -non-fips-allow < $test > $test.cipher
-$cmd enc -non-fips-allow < $test.cipher >$test.clear
+$cmd enc < $test > $test.cipher
+$cmd enc < $test.cipher >$test.clear
 cmp $test $test.clear
 if [ $? != 0 ]
 then
@@ -17,8 +17,8 @@ else
         /bin/rm $test.cipher $test.clear
 fi
 echo base64
-$cmd enc -non-fips-allow -a -e < $test > $test.cipher
-$cmd enc -non-fips-allow -a -d < $test.cipher >$test.clear
+$cmd enc -a -e < $test > $test.cipher
+$cmd enc -a -d < $test.cipher >$test.clear
 cmp $test $test.clear
 if [ $? != 0 ]
 then
@@ -30,8 +30,8 @@ fi
 for i in `$cmd list-cipher-commands`
 do
         echo $i
-        $cmd $i -non-fips-allow -bufsize 113 -e -k test < $test > $test.$i.cipher
-        $cmd $i -non-fips-allow -bufsize 157 -d -k test < $test.$i.cipher >$test.$i.clear
+        $cmd $i -bufsize 113 -e -k test < $test > $test.$i.cipher
+        $cmd $i -bufsize 157 -d -k test < $test.$i.cipher >$test.$i.clear
         cmp $test $test.$i.clear
         if [ $? != 0 ]
         then
@@ -41,8 +41,8 @@ do
         fi
 
         echo $i base64
-        $cmd $i -non-fips-allow -bufsize 113 -a -e -k test < $test > $test.$i.cipher
-        $cmd $i -non-fips-allow -bufsize 157 -a -d -k test < $test.$i.cipher >$test.$i.clear
+        $cmd $i -bufsize 113 -a -e -k test < $test > $test.$i.cipher
+        $cmd $i -bufsize 157 -a -d -k test < $test.$i.cipher >$test.$i.clear
         cmp $test $test.$i.clear
         if [ $? != 0 ]
         then
diff --git a/src/lib/libssl/test/tests.com b/src/lib/libssl/test/tests.com
index 07a3c7f16d..056082e7fe 100644
--- a/src/lib/libssl/test/tests.com
+++ b/src/lib/libssl/test/tests.com
@@ -22,14 +22,17 @@ $	    tests := -
         test_des,test_idea,test_sha,test_md4,test_md5,test_hmac,-
         test_md2,test_mdc2,-
         test_rmd,test_rc2,test_rc4,test_rc5,test_bf,test_cast,test_rd,-
-        test_rand,test_bn,test_ec,test_enc,test_x509,test_rsa,test_crl,test_sid,-
+        test_rand,test_bn,test_ec,test_ecdsa,test_ecdh,-
+        test_enc,test_x509,test_rsa,test_crl,test_sid,-
         test_gen,test_req,test_pkcs7,test_verify,test_dh,test_dsa,-
-        test_ss,test_ca,test_engine,test_ssl,test_evp
+        test_ss,test_ca,test_engine,test_evp,test_ssl
 $       endif
 $       tests = f$edit(tests,"COLLAPSE")
 $
 $       BNTEST :=       bntest
 $       ECTEST :=       ectest
+$       ECDSATEST :=    ecdsatest
+$       ECDHTEST :=     ecdhtest
 $       EXPTEST :=      exptest
 $       IDEATEST :=     ideatest
 $       SHATEST :=      shatest
@@ -182,6 +185,14 @@ $ test_ec:
 $       write sys$output "test elliptic curves"
 $       mcr 'texe_dir''ectest'
 $       return
+$ test_ecdsa:
+$       write sys$output "test ecdsa"
+$       mcr 'texe_dir''ecdsatest'
+$       return
+$ test_ecdh:
+$       write sys$output "test ecdh"
+$       mcr 'texe_dir''ecdhtest'
+$       return
 $ test_verify:
 $       write sys$output "The following command should have some OK's and some failures"
 $       write sys$output "There are definitly a few expired certificates"
diff --git a/src/lib/libssl/test/tpkcs7 b/src/lib/libssl/test/tpkcs7
index 79bb6e0edf..3e435ffbf9 100644
--- a/src/lib/libssl/test/tpkcs7
+++ b/src/lib/libssl/test/tpkcs7
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 cmd='../util/shlib_wrap.sh ../apps/openssl pkcs7'
 
 if [ "$1"x != "x" ]; then
diff --git a/src/lib/libssl/test/tpkcs7d b/src/lib/libssl/test/tpkcs7d
index 20394b34c4..64fc28e88f 100644
--- a/src/lib/libssl/test/tpkcs7d
+++ b/src/lib/libssl/test/tpkcs7d
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 cmd='../util/shlib_wrap.sh ../apps/openssl pkcs7'
 
 if [ "$1"x != "x" ]; then
diff --git a/src/lib/libssl/test/treq b/src/lib/libssl/test/treq
index 7e020210a5..77f37dcf3a 100644
--- a/src/lib/libssl/test/treq
+++ b/src/lib/libssl/test/treq
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 cmd='../util/shlib_wrap.sh ../apps/openssl req -config ../apps/openssl.cnf'
 
 if [ "$1"x != "x" ]; then
@@ -15,7 +8,7 @@ else
         t=testreq.pem
 fi
 
-if $cmd -in $t -inform p -noout -text | fgrep 'Unknown Public Key'; then
+if $cmd -in $t -inform p -noout -text 2>&1 | fgrep -i 'Unknown Public Key'; then
   echo "skipping req conversion test for $t"
   exit 0
 fi
diff --git a/src/lib/libssl/test/trsa b/src/lib/libssl/test/trsa
index 67b4a98841..249ac1ddcc 100644
--- a/src/lib/libssl/test/trsa
+++ b/src/lib/libssl/test/trsa
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 if ../util/shlib_wrap.sh ../apps/openssl no-rsa; then
   echo skipping rsa conversion test
   exit 0
diff --git a/src/lib/libssl/test/tsid b/src/lib/libssl/test/tsid
index fb4a7213b9..6adbd531ce 100644
--- a/src/lib/libssl/test/tsid
+++ b/src/lib/libssl/test/tsid
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 cmd='../util/shlib_wrap.sh ../apps/openssl sess_id'
 
 if [ "$1"x != "x" ]; then
diff --git a/src/lib/libssl/test/tx509 b/src/lib/libssl/test/tx509
index 1b9c8661f3..4a15b98d17 100644
--- a/src/lib/libssl/test/tx509
+++ b/src/lib/libssl/test/tx509
@@ -1,12 +1,5 @@
 #!/bin/sh
 
-if test "$OSTYPE" = msdosdjgpp; then
-    PATH=../apps\;$PATH
-else
-    PATH=../apps:$PATH
-fi
-export PATH
-
 cmd='../util/shlib_wrap.sh ../apps/openssl x509'
 
 if [ "$1"x != "x" ]; then
diff --git a/src/lib/libssl/tls1.h b/src/lib/libssl/tls1.h
index 38838ea9a5..2d1d293e1a 100644
--- a/src/lib/libssl/tls1.h
+++ b/src/lib/libssl/tls1.h
@@ -55,6 +55,19 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.]
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by 
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * ECC cipher suite support in OpenSSL originally written by
+ * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
+ *
+ */
 
 #ifndef HEADER_TLS1_H 
 #define HEADER_TLS1_H 
@@ -65,7 +78,7 @@
 extern "C" {
 #endif
 
-#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES    1
+#define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES    0
 
 #define TLS1_VERSION                    0x0301
 #define TLS1_VERSION_MAJOR              0x03
@@ -83,6 +96,93 @@ extern "C" {
 #define TLS1_AD_INTERNAL_ERROR          80      /* fatal */
 #define TLS1_AD_USER_CANCELLED          90
 #define TLS1_AD_NO_RENEGOTIATION        100
+/* codes 110-114 are from RFC3546 */
+#define TLS1_AD_UNSUPPORTED_EXTENSION   110
+#define TLS1_AD_CERTIFICATE_UNOBTAINABLE 111
+#define TLS1_AD_UNRECOGNIZED_NAME       112
+#define TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE 113
+#define TLS1_AD_BAD_CERTIFICATE_HASH_VALUE 114
+#define TLS1_AD_UNKNOWN_PSK_IDENTITY    115     /* fatal */
+
+/* ExtensionType values from RFC 3546 */
+#define TLSEXT_TYPE_server_name                 0
+#define TLSEXT_TYPE_max_fragment_length         1
+#define TLSEXT_TYPE_client_certificate_url      2
+#define TLSEXT_TYPE_trusted_ca_keys             3
+#define TLSEXT_TYPE_truncated_hmac              4
+#define TLSEXT_TYPE_status_request              5
+#define TLSEXT_TYPE_elliptic_curves             10
+#define TLSEXT_TYPE_ec_point_formats            11
+#define TLSEXT_TYPE_session_ticket              35
+
+/* NameType value from RFC 3546 */
+#define TLSEXT_NAMETYPE_host_name 0
+/* status request value from RFC 3546 */
+#define TLSEXT_STATUSTYPE_ocsp 1
+
+#ifndef OPENSSL_NO_TLSEXT
+
+#define TLSEXT_MAXLEN_host_name 255
+
+const char *SSL_get_servername(const SSL *s, const int type) ;
+int SSL_get_servername_type(const SSL *s) ;
+
+#define SSL_set_tlsext_host_name(s,name) \
+SSL_ctrl(s,SSL_CTRL_SET_TLSEXT_HOSTNAME,TLSEXT_NAMETYPE_host_name,(char *)name)
+
+#define SSL_set_tlsext_debug_callback(ssl, cb) \
+SSL_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_DEBUG_CB,(void (*)(void))cb)
+
+#define SSL_set_tlsext_debug_arg(ssl, arg) \
+SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_DEBUG_ARG,0, (void *)arg)
+
+#define SSL_set_tlsext_status_type(ssl, type) \
+SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE,type, NULL)
+
+#define SSL_get_tlsext_status_exts(ssl, arg) \
+SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS,0, (void *)arg)
+
+#define SSL_set_tlsext_status_exts(ssl, arg) \
+SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS,0, (void *)arg)
+
+#define SSL_get_tlsext_status_ids(ssl, arg) \
+SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS,0, (void *)arg)
+
+#define SSL_set_tlsext_status_ids(ssl, arg) \
+SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS,0, (void *)arg)
+
+#define SSL_get_tlsext_status_ocsp_resp(ssl, arg) \
+SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP,0, (void *)arg)
+
+#define SSL_set_tlsext_status_ocsp_resp(ssl, arg, arglen) \
+SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP,arglen, (void *)arg)
+
+#define SSL_CTX_set_tlsext_servername_callback(ctx, cb) \
+SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SERVERNAME_CB,(void (*)(void))cb)
+
+#define SSL_TLSEXT_ERR_OK 0
+#define SSL_TLSEXT_ERR_ALERT_WARNING 1
+#define SSL_TLSEXT_ERR_ALERT_FATAL 2
+#define SSL_TLSEXT_ERR_NOACK 3
+
+#define SSL_CTX_set_tlsext_servername_arg(ctx, arg) \
+SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG,0, (void *)arg)
+
+#define SSL_CTX_get_tlsext_ticket_keys(ctx, keys, keylen) \
+        SSL_CTX_ctrl((ctx),SSL_CTRL_GET_TLXEXT_TICKET_KEYS,(keylen),(keys))
+#define SSL_CTX_set_tlsext_ticket_keys(ctx, keys, keylen) \
+        SSL_CTX_ctrl((ctx),SSL_CTRL_SET_TLXEXT_TICKET_KEYS,(keylen),(keys))
+
+#define SSL_CTX_set_tlsext_status_cb(ssl, cb) \
+SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB,(void (*)(void))cb)
+
+#define SSL_CTX_set_tlsext_status_arg(ssl, arg) \
+SSL_CTX_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG,0, (void *)arg)
+
+#define SSL_CTX_set_tlsext_ticket_key_cb(ssl, cb) \
+SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
+
+#endif
 
 /* Additional TLS ciphersuites from draft-ietf-tls-56-bit-ciphersuites-00.txt
  * (available if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES is defined, see
@@ -112,6 +212,60 @@ extern "C" {
 #define TLS1_CK_DHE_RSA_WITH_AES_256_SHA                0x03000039
 #define TLS1_CK_ADH_WITH_AES_256_SHA                    0x0300003A
 
+/* Camellia ciphersuites from RFC4132 */
+#define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA           0x03000041
+#define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA        0x03000042
+#define TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA        0x03000043
+#define TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA       0x03000044
+#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA       0x03000045
+#define TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA           0x03000046
+
+#define TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA           0x03000084
+#define TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA        0x03000085
+#define TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA        0x03000086
+#define TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA       0x03000087
+#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA       0x03000088
+#define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA           0x03000089
+
+/* SEED ciphersuites from RFC4162 */
+#define TLS1_CK_RSA_WITH_SEED_SHA                       0x03000096
+#define TLS1_CK_DH_DSS_WITH_SEED_SHA                    0x03000097
+#define TLS1_CK_DH_RSA_WITH_SEED_SHA                    0x03000098
+#define TLS1_CK_DHE_DSS_WITH_SEED_SHA                   0x03000099
+#define TLS1_CK_DHE_RSA_WITH_SEED_SHA                   0x0300009A
+#define TLS1_CK_ADH_WITH_SEED_SHA                       0x0300009B
+
+/* ECC ciphersuites from draft-ietf-tls-ecc-12.txt with changes soon to be in draft 13 */
+#define TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA                0x0300C001
+#define TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA             0x0300C002
+#define TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA        0x0300C003
+#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA         0x0300C004
+#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA         0x0300C005
+
+#define TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA               0x0300C006
+#define TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA            0x0300C007
+#define TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA       0x0300C008
+#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA        0x0300C009
+#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA        0x0300C00A
+
+#define TLS1_CK_ECDH_RSA_WITH_NULL_SHA                  0x0300C00B
+#define TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA               0x0300C00C
+#define TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA          0x0300C00D
+#define TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA           0x0300C00E
+#define TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA           0x0300C00F
+
+#define TLS1_CK_ECDHE_RSA_WITH_NULL_SHA                 0x0300C010
+#define TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA              0x0300C011
+#define TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA         0x0300C012
+#define TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA          0x0300C013
+#define TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA          0x0300C014
+
+#define TLS1_CK_ECDH_anon_WITH_NULL_SHA                 0x0300C015
+#define TLS1_CK_ECDH_anon_WITH_RC4_128_SHA              0x0300C016
+#define TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA         0x0300C017
+#define TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA          0x0300C018
+#define TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA          0x0300C019
+
 /* XXX
  * Inconsistency alert:
  * The OpenSSL names of ciphers with ephemeral DH here include the string
@@ -142,12 +296,68 @@ extern "C" {
 #define TLS1_TXT_DHE_RSA_WITH_AES_256_SHA               "DHE-RSA-AES256-SHA"
 #define TLS1_TXT_ADH_WITH_AES_256_SHA                   "ADH-AES256-SHA"
 
+/* ECC ciphersuites from draft-ietf-tls-ecc-01.txt (Mar 15, 2001) */
+#define TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA               "ECDH-ECDSA-NULL-SHA"
+#define TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA            "ECDH-ECDSA-RC4-SHA"
+#define TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA       "ECDH-ECDSA-DES-CBC3-SHA"
+#define TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA        "ECDH-ECDSA-AES128-SHA"
+#define TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA        "ECDH-ECDSA-AES256-SHA"
+
+#define TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA              "ECDHE-ECDSA-NULL-SHA"
+#define TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA           "ECDHE-ECDSA-RC4-SHA"
+#define TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA      "ECDHE-ECDSA-DES-CBC3-SHA"
+#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA       "ECDHE-ECDSA-AES128-SHA"
+#define TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA       "ECDHE-ECDSA-AES256-SHA"
+
+#define TLS1_TXT_ECDH_RSA_WITH_NULL_SHA                 "ECDH-RSA-NULL-SHA"
+#define TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA              "ECDH-RSA-RC4-SHA"
+#define TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA         "ECDH-RSA-DES-CBC3-SHA"
+#define TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA          "ECDH-RSA-AES128-SHA"
+#define TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA          "ECDH-RSA-AES256-SHA"
+
+#define TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA                "ECDHE-RSA-NULL-SHA"
+#define TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA             "ECDHE-RSA-RC4-SHA"
+#define TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA        "ECDHE-RSA-DES-CBC3-SHA"
+#define TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA         "ECDHE-RSA-AES128-SHA"
+#define TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA         "ECDHE-RSA-AES256-SHA"
+
+#define TLS1_TXT_ECDH_anon_WITH_NULL_SHA                "AECDH-NULL-SHA"
+#define TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA             "AECDH-RC4-SHA"
+#define TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA        "AECDH-DES-CBC3-SHA"
+#define TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA         "AECDH-AES128-SHA"
+#define TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA         "AECDH-AES256-SHA"
+
+/* Camellia ciphersuites from RFC4132 */
+#define TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA          "CAMELLIA128-SHA"
+#define TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA       "DH-DSS-CAMELLIA128-SHA"
+#define TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA       "DH-RSA-CAMELLIA128-SHA"
+#define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA      "DHE-DSS-CAMELLIA128-SHA"
+#define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA      "DHE-RSA-CAMELLIA128-SHA"
+#define TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA          "ADH-CAMELLIA128-SHA"
+
+#define TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA          "CAMELLIA256-SHA"
+#define TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA       "DH-DSS-CAMELLIA256-SHA"
+#define TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA       "DH-RSA-CAMELLIA256-SHA"
+#define TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA      "DHE-DSS-CAMELLIA256-SHA"
+#define TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA      "DHE-RSA-CAMELLIA256-SHA"
+#define TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA          "ADH-CAMELLIA256-SHA"
+
+/* SEED ciphersuites from RFC4162 */
+#define TLS1_TXT_RSA_WITH_SEED_SHA                      "SEED-SHA"
+#define TLS1_TXT_DH_DSS_WITH_SEED_SHA                   "DH-DSS-SEED-SHA"
+#define TLS1_TXT_DH_RSA_WITH_SEED_SHA                   "DH-RSA-SEED-SHA"
+#define TLS1_TXT_DHE_DSS_WITH_SEED_SHA                  "DHE-DSS-SEED-SHA"
+#define TLS1_TXT_DHE_RSA_WITH_SEED_SHA                  "DHE-RSA-SEED-SHA"
+#define TLS1_TXT_ADH_WITH_SEED_SHA                      "ADH-SEED-SHA"
 
 #define TLS_CT_RSA_SIGN                 1
 #define TLS_CT_DSS_SIGN                 2
 #define TLS_CT_RSA_FIXED_DH             3
 #define TLS_CT_DSS_FIXED_DH             4
-#define TLS_CT_NUMBER                   4
+#define TLS_CT_ECDSA_SIGN               64
+#define TLS_CT_RSA_FIXED_ECDH           65
+#define TLS_CT_ECDSA_FIXED_ECDH         66
+#define TLS_CT_NUMBER                   7
 
 #define TLS1_FINISH_MAC_LENGTH          12
 
@@ -193,3 +403,5 @@ extern "C" {
 #endif
 #endif
 
+
+